增加权限系统

2026-05-27 05:41:59 +08:00
parent a04327fd05
commit 1458fc279c
29 changed files with 2276 additions and 46 deletions
@@ -0,0 +1,45 @@
+package adminmgr
+
+import (
+	"time"
+
+	"hfb_sys/backend/internal/modules/adminrole"
+)
+
+type AdminUserDTO struct {
+	ID          uint64                `json:"id"`
+	Username    string                `json:"username"`
+	Nickname    string                `json:"nickname"`
+	Status      string                `json:"status"`
+	Roles       []adminrole.RoleDTO   `json:"roles"`
+	LastLoginAt *time.Time            `json:"last_login_at"`
+	CreatedAt   time.Time             `json:"created_at"`
+	UpdatedAt   time.Time             `json:"updated_at"`
+}
+
+type PaginatedResult struct {
+	Items    []AdminUserDTO `json:"items"`
+	Total    int64          `json:"total"`
+	Page     int            `json:"page"`
+	PageSize int            `json:"page_size"`
+}
+
+type CreateAdminRequest struct {
+	Username string `json:"username" binding:"required"`
+	Password string `json:"password" binding:"required"`
+	Nickname string `json:"nickname"`
+}
+
+type UpdateAdminRequest struct {
+	Nickname string `json:"nickname"`
+	Status   string `json:"status"`
+}
+
+type AssignRolesRequest struct {
+	RoleIDs []uint64 `json:"role_ids"`
+}
+
+type ChangePasswordRequest struct {
+	OldPassword string `json:"old_password" binding:"required"`
+	NewPassword string `json:"new_password" binding:"required"`
+}
@@ -0,0 +1,149 @@
+package adminmgr
+
+import (
+	"errors"
+	"net/http"
+	"strconv"
+
+	"hfb_sys/backend/internal/middleware"
+	"hfb_sys/backend/pkg/response"
+
+	"github.com/gin-gonic/gin"
+)
+
+type Handler struct {
+	service *Service
+}
+
+func NewHandler(service *Service) *Handler {
+	return &Handler{service: service}
+}
+
+func (h *Handler) List(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	pageSize, _ := strconv.Atoi(c.DefaultQuery("page_size", "20"))
+	result, err := h.service.List(page, pageSize)
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, result)
+}
+
+func (h *Handler) FindByID(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	item, err := h.service.FindByID(id)
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, item)
+}
+
+func (h *Handler) Create(c *gin.Context) {
+	var req CreateAdminRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "用户名和密码不能为空")
+		return
+	}
+	item, err := h.service.Create(req)
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	response.Created(c, item)
+}
+
+func (h *Handler) Update(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var req UpdateAdminRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "请求格式不正确")
+		return
+	}
+	item, err := h.service.Update(id, req)
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, item)
+}
+
+func (h *Handler) Delete(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	currentAdminID, _ := c.Get(middleware.ContextAdminID)
+	if err := h.service.Delete(id, currentAdminID.(uint64)); err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, gin.H{"deleted": true})
+}
+
+func (h *Handler) AssignRoles(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var req AssignRolesRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "请求格式不正确")
+		return
+	}
+	if err := h.service.AssignRoles(id, req); err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, gin.H{"updated": true})
+}
+
+func (h *Handler) ChangePassword(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var req ChangePasswordRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "密码不能为空")
+		return
+	}
+	if err := h.service.ChangePassword(id, req); err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, gin.H{"updated": true})
+}
+
+func parseID(c *gin.Context) (uint64, bool) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		response.BadRequest(c, "ID 不正确")
+		return 0, false
+	}
+	return id, true
+}
+
+func writeError(c *gin.Context, err error) {
+	switch {
+	case errors.Is(err, ErrDependencyUnavailable):
+		response.ServiceUnavailable(c, "数据库未连接")
+	case errors.Is(err, ErrCannotDeleteSelf):
+		response.BadRequest(c, "不能删除自己的账号")
+	case errors.Is(err, ErrLastSuperAdmin):
+		response.BadRequest(c, "不能删除最后一个超级管理员")
+	case errors.Is(err, ErrWrongPassword):
+		response.BadRequest(c, "原密码错误")
+	case IsNotFound(err):
+		response.Error(c, http.StatusNotFound, "not_found", "管理员不存在")
+	default:
+		response.Error(c, http.StatusInternalServerError, "internal_error", "管理员管理服务暂时不可用")
+	}
+}
@@ -0,0 +1,234 @@
+package adminmgr
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"hfb_sys/backend/internal/model"
+	"hfb_sys/backend/internal/modules/adminrole"
+
+	"github.com/redis/go-redis/v9"
+	"golang.org/x/crypto/bcrypt"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+)
+
+type Repository struct {
+	db    *gorm.DB
+	redis *redis.Client
+}
+
+func NewRepository(db *gorm.DB, redis *redis.Client) *Repository {
+	return &Repository{db: db, redis: redis}
+}
+
+func (r *Repository) List(page, pageSize int) (*PaginatedResult, error) {
+	var total int64
+	if err := r.db.Model(&model.AdminUser{}).Count(&total).Error; err != nil {
+		return nil, err
+	}
+	offset := (page - 1) * pageSize
+	var admins []model.AdminUser
+	if err := r.db.Order("id DESC").Offset(offset).Limit(pageSize).Find(&admins).Error; err != nil {
+		return nil, err
+	}
+	items := make([]AdminUserDTO, 0, len(admins))
+	for _, admin := range admins {
+		roles, _ := r.getAdminRoles(admin.ID)
+		items = append(items, AdminUserDTO{
+			ID:          admin.ID,
+			Username:    admin.Username,
+			Nickname:    admin.Nickname,
+			Status:      admin.Status,
+			Roles:       roles,
+			LastLoginAt: admin.LastLoginAt,
+			CreatedAt:   admin.CreatedAt,
+			UpdatedAt:   admin.UpdatedAt,
+		})
+	}
+	return &PaginatedResult{Items: items, Total: total, Page: page, PageSize: pageSize}, nil
+}
+
+func (r *Repository) FindByID(id uint64) (*AdminUserDTO, error) {
+	var admin model.AdminUser
+	if err := r.db.First(&admin, id).Error; err != nil {
+		return nil, err
+	}
+	roles, _ := r.getAdminRoles(admin.ID)
+	dto := AdminUserDTO{
+		ID:          admin.ID,
+		Username:    admin.Username,
+		Nickname:    admin.Nickname,
+		Status:      admin.Status,
+		Roles:       roles,
+		LastLoginAt: admin.LastLoginAt,
+		CreatedAt:   admin.CreatedAt,
+		UpdatedAt:   admin.UpdatedAt,
+	}
+	return &dto, nil
+}
+
+func (r *Repository) Create(req CreateAdminRequest) (*AdminUserDTO, error) {
+	hash, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
+	if err != nil {
+		return nil, err
+	}
+	admin := model.AdminUser{
+		Username:     req.Username,
+		PasswordHash: string(hash),
+		Nickname:     req.Nickname,
+		Status:       "active",
+	}
+	if err := r.db.Create(&admin).Error; err != nil {
+		return nil, err
+	}
+	return r.FindByID(admin.ID)
+}
+
+func (r *Repository) Update(id uint64, req UpdateAdminRequest) (*AdminUserDTO, error) {
+	var admin model.AdminUser
+	if err := r.db.First(&admin, id).Error; err != nil {
+		return nil, err
+	}
+	if req.Nickname != "" {
+		admin.Nickname = req.Nickname
+	}
+	if req.Status != "" {
+		admin.Status = req.Status
+	}
+	if err := r.db.Save(&admin).Error; err != nil {
+		return nil, err
+	}
+	return r.FindByID(id)
+}
+
+func (r *Repository) Delete(id uint64, currentAdminID uint64) error {
+	if id == currentAdminID {
+		return ErrCannotDeleteSelf
+	}
+	var admin model.AdminUser
+	if err := r.db.First(&admin, id).Error; err != nil {
+		return err
+	}
+	// 检查是否是最后一个 super_admin
+	isLastSuper, err := r.isLastSuperAdmin(id)
+	if err != nil {
+		return err
+	}
+	if isLastSuper {
+		return ErrLastSuperAdmin
+	}
+	return r.db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("admin_user_id = ?", id).Delete(&model.AdminUserRole{}).Error; err != nil {
+			return err
+		}
+		if err := tx.Delete(&model.AdminUser{}, id).Error; err != nil {
+			return err
+		}
+		r.invalidatePermCache(id)
+		return nil
+	})
+}
+
+func (r *Repository) AssignRoles(adminID uint64, roleIDs []uint64) error {
+	var admin model.AdminUser
+	if err := r.db.First(&admin, adminID).Error; err != nil {
+		return err
+	}
+	err := r.db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("admin_user_id = ?", adminID).Delete(&model.AdminUserRole{}).Error; err != nil {
+			return err
+		}
+		for _, rid := range roleIDs {
+			aur := model.AdminUserRole{AdminID: adminID, RoleID: rid}
+			if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(&aur).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return err
+	}
+	r.invalidatePermCache(adminID)
+	return nil
+}
+
+func (r *Repository) ChangePassword(id uint64, oldPwd, newPwd string) error {
+	var admin model.AdminUser
+	if err := r.db.First(&admin, id).Error; err != nil {
+		return err
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(admin.PasswordHash), []byte(oldPwd)); err != nil {
+		return ErrWrongPassword
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(newPwd), bcrypt.DefaultCost)
+	if err != nil {
+		return err
+	}
+	return r.db.Model(&admin).Update("password_hash", string(hash)).Error
+}
+
+func (r *Repository) GetPermissionCodes(adminID uint64) ([]string, error) {
+	var codes []string
+	err := r.db.Table("admin_user_roles aur").
+		Select("DISTINCT p.code").
+		Joins("JOIN role_permissions rp ON rp.role_id = aur.role_id").
+		Joins("JOIN permissions p ON p.id = rp.permission_id").
+		Where("aur.admin_user_id = ?", adminID).
+		Pluck("code", &codes).Error
+	return codes, err
+}
+
+func (r *Repository) getAdminRoles(adminID uint64) ([]adminrole.RoleDTO, error) {
+	var roles []model.Role
+	err := r.db.Table("roles").
+		Joins("JOIN admin_user_roles aur ON aur.role_id = roles.id").
+		Where("aur.admin_user_id = ?", adminID).
+		Find(&roles).Error
+	if err != nil {
+		return nil, err
+	}
+	result := make([]adminrole.RoleDTO, 0, len(roles))
+	for _, role := range roles {
+		result = append(result, adminrole.RoleDTO{
+			ID: role.ID, Code: role.Code, Name: role.Name, Description: role.Description,
+		})
+	}
+	return result, nil
+}
+
+func (r *Repository) isLastSuperAdmin(adminID uint64) (bool, error) {
+	var superRole model.Role
+	if err := r.db.Where("code = ?", "super_admin").First(&superRole).Error; err != nil {
+		return false, nil // 没有 super_admin 角色，不限制
+	}
+	var count int64
+	err := r.db.Model(&model.AdminUserRole{}).
+		Where("role_id = ? AND admin_user_id != ?", superRole.ID, adminID).
+		Count(&count).Error
+	return count == 0, err
+}
+
+func (r *Repository) invalidatePermCache(adminID uint64) {
+	if r.redis == nil {
+		return
+	}
+	ctx := context.Background()
+	r.redis.Del(ctx, permCacheKey(adminID))
+}
+
+func permCacheKey(adminID uint64) string {
+	return fmt.Sprintf("admin:perms:%d", adminID)
+}
+
+var (
+	ErrCannotDeleteSelf = errors.New("cannot delete self")
+	ErrLastSuperAdmin   = errors.New("cannot delete the last super admin")
+	ErrWrongPassword    = errors.New("wrong password")
+)
+
+func IsNotFound(err error) bool {
+	return errors.Is(err, gorm.ErrRecordNotFound)
+}
@@ -0,0 +1,74 @@
+package adminmgr
+
+import "errors"
+
+var ErrDependencyUnavailable = errors.New("dependency unavailable")
+
+type Service struct {
+	repo *Repository
+}
+
+func NewService(repo *Repository) *Service {
+	return &Service{repo: repo}
+}
+
+func (s *Service) List(page, pageSize int) (*PaginatedResult, error) {
+	if s.repo == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	if page < 1 {
+		page = 1
+	}
+	if pageSize < 1 || pageSize > 100 {
+		pageSize = 20
+	}
+	return s.repo.List(page, pageSize)
+}
+
+func (s *Service) FindByID(id uint64) (*AdminUserDTO, error) {
+	if s.repo == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	return s.repo.FindByID(id)
+}
+
+func (s *Service) Create(req CreateAdminRequest) (*AdminUserDTO, error) {
+	if s.repo == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	if len(req.Password) < 6 {
+		return nil, errors.New("password too short")
+	}
+	return s.repo.Create(req)
+}
+
+func (s *Service) Update(id uint64, req UpdateAdminRequest) (*AdminUserDTO, error) {
+	if s.repo == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	return s.repo.Update(id, req)
+}
+
+func (s *Service) Delete(id uint64, currentAdminID uint64) error {
+	if s.repo == nil {
+		return ErrDependencyUnavailable
+	}
+	return s.repo.Delete(id, currentAdminID)
+}
+
+func (s *Service) AssignRoles(adminID uint64, req AssignRolesRequest) error {
+	if s.repo == nil {
+		return ErrDependencyUnavailable
+	}
+	return s.repo.AssignRoles(adminID, req.RoleIDs)
+}
+
+func (s *Service) ChangePassword(id uint64, req ChangePasswordRequest) error {
+	if s.repo == nil {
+		return ErrDependencyUnavailable
+	}
+	if len(req.NewPassword) < 6 {
+		return errors.New("new password too short")
+	}
+	return s.repo.ChangePassword(id, req.OldPassword, req.NewPassword)
+}