增加权限系统

2026-05-27 05:41:59 +08:00
parent a04327fd05
commit 1458fc279c
29 changed files with 2276 additions and 46 deletions
@@ -0,0 +1,234 @@
+package adminmgr
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"hfb_sys/backend/internal/model"
+	"hfb_sys/backend/internal/modules/adminrole"
+
+	"github.com/redis/go-redis/v9"
+	"golang.org/x/crypto/bcrypt"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+)
+
+type Repository struct {
+	db    *gorm.DB
+	redis *redis.Client
+}
+
+func NewRepository(db *gorm.DB, redis *redis.Client) *Repository {
+	return &Repository{db: db, redis: redis}
+}
+
+func (r *Repository) List(page, pageSize int) (*PaginatedResult, error) {
+	var total int64
+	if err := r.db.Model(&model.AdminUser{}).Count(&total).Error; err != nil {
+		return nil, err
+	}
+	offset := (page - 1) * pageSize
+	var admins []model.AdminUser
+	if err := r.db.Order("id DESC").Offset(offset).Limit(pageSize).Find(&admins).Error; err != nil {
+		return nil, err
+	}
+	items := make([]AdminUserDTO, 0, len(admins))
+	for _, admin := range admins {
+		roles, _ := r.getAdminRoles(admin.ID)
+		items = append(items, AdminUserDTO{
+			ID:          admin.ID,
+			Username:    admin.Username,
+			Nickname:    admin.Nickname,
+			Status:      admin.Status,
+			Roles:       roles,
+			LastLoginAt: admin.LastLoginAt,
+			CreatedAt:   admin.CreatedAt,
+			UpdatedAt:   admin.UpdatedAt,
+		})
+	}
+	return &PaginatedResult{Items: items, Total: total, Page: page, PageSize: pageSize}, nil
+}
+
+func (r *Repository) FindByID(id uint64) (*AdminUserDTO, error) {
+	var admin model.AdminUser
+	if err := r.db.First(&admin, id).Error; err != nil {
+		return nil, err
+	}
+	roles, _ := r.getAdminRoles(admin.ID)
+	dto := AdminUserDTO{
+		ID:          admin.ID,
+		Username:    admin.Username,
+		Nickname:    admin.Nickname,
+		Status:      admin.Status,
+		Roles:       roles,
+		LastLoginAt: admin.LastLoginAt,
+		CreatedAt:   admin.CreatedAt,
+		UpdatedAt:   admin.UpdatedAt,
+	}
+	return &dto, nil
+}
+
+func (r *Repository) Create(req CreateAdminRequest) (*AdminUserDTO, error) {
+	hash, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
+	if err != nil {
+		return nil, err
+	}
+	admin := model.AdminUser{
+		Username:     req.Username,
+		PasswordHash: string(hash),
+		Nickname:     req.Nickname,
+		Status:       "active",
+	}
+	if err := r.db.Create(&admin).Error; err != nil {
+		return nil, err
+	}
+	return r.FindByID(admin.ID)
+}
+
+func (r *Repository) Update(id uint64, req UpdateAdminRequest) (*AdminUserDTO, error) {
+	var admin model.AdminUser
+	if err := r.db.First(&admin, id).Error; err != nil {
+		return nil, err
+	}
+	if req.Nickname != "" {
+		admin.Nickname = req.Nickname
+	}
+	if req.Status != "" {
+		admin.Status = req.Status
+	}
+	if err := r.db.Save(&admin).Error; err != nil {
+		return nil, err
+	}
+	return r.FindByID(id)
+}
+
+func (r *Repository) Delete(id uint64, currentAdminID uint64) error {
+	if id == currentAdminID {
+		return ErrCannotDeleteSelf
+	}
+	var admin model.AdminUser
+	if err := r.db.First(&admin, id).Error; err != nil {
+		return err
+	}
+	// 检查是否是最后一个 super_admin
+	isLastSuper, err := r.isLastSuperAdmin(id)
+	if err != nil {
+		return err
+	}
+	if isLastSuper {
+		return ErrLastSuperAdmin
+	}
+	return r.db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("admin_user_id = ?", id).Delete(&model.AdminUserRole{}).Error; err != nil {
+			return err
+		}
+		if err := tx.Delete(&model.AdminUser{}, id).Error; err != nil {
+			return err
+		}
+		r.invalidatePermCache(id)
+		return nil
+	})
+}
+
+func (r *Repository) AssignRoles(adminID uint64, roleIDs []uint64) error {
+	var admin model.AdminUser
+	if err := r.db.First(&admin, adminID).Error; err != nil {
+		return err
+	}
+	err := r.db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("admin_user_id = ?", adminID).Delete(&model.AdminUserRole{}).Error; err != nil {
+			return err
+		}
+		for _, rid := range roleIDs {
+			aur := model.AdminUserRole{AdminID: adminID, RoleID: rid}
+			if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(&aur).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return err
+	}
+	r.invalidatePermCache(adminID)
+	return nil
+}
+
+func (r *Repository) ChangePassword(id uint64, oldPwd, newPwd string) error {
+	var admin model.AdminUser
+	if err := r.db.First(&admin, id).Error; err != nil {
+		return err
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(admin.PasswordHash), []byte(oldPwd)); err != nil {
+		return ErrWrongPassword
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(newPwd), bcrypt.DefaultCost)
+	if err != nil {
+		return err
+	}
+	return r.db.Model(&admin).Update("password_hash", string(hash)).Error
+}
+
+func (r *Repository) GetPermissionCodes(adminID uint64) ([]string, error) {
+	var codes []string
+	err := r.db.Table("admin_user_roles aur").
+		Select("DISTINCT p.code").
+		Joins("JOIN role_permissions rp ON rp.role_id = aur.role_id").
+		Joins("JOIN permissions p ON p.id = rp.permission_id").
+		Where("aur.admin_user_id = ?", adminID).
+		Pluck("code", &codes).Error
+	return codes, err
+}
+
+func (r *Repository) getAdminRoles(adminID uint64) ([]adminrole.RoleDTO, error) {
+	var roles []model.Role
+	err := r.db.Table("roles").
+		Joins("JOIN admin_user_roles aur ON aur.role_id = roles.id").
+		Where("aur.admin_user_id = ?", adminID).
+		Find(&roles).Error
+	if err != nil {
+		return nil, err
+	}
+	result := make([]adminrole.RoleDTO, 0, len(roles))
+	for _, role := range roles {
+		result = append(result, adminrole.RoleDTO{
+			ID: role.ID, Code: role.Code, Name: role.Name, Description: role.Description,
+		})
+	}
+	return result, nil
+}
+
+func (r *Repository) isLastSuperAdmin(adminID uint64) (bool, error) {
+	var superRole model.Role
+	if err := r.db.Where("code = ?", "super_admin").First(&superRole).Error; err != nil {
+		return false, nil // 没有 super_admin 角色，不限制
+	}
+	var count int64
+	err := r.db.Model(&model.AdminUserRole{}).
+		Where("role_id = ? AND admin_user_id != ?", superRole.ID, adminID).
+		Count(&count).Error
+	return count == 0, err
+}
+
+func (r *Repository) invalidatePermCache(adminID uint64) {
+	if r.redis == nil {
+		return
+	}
+	ctx := context.Background()
+	r.redis.Del(ctx, permCacheKey(adminID))
+}
+
+func permCacheKey(adminID uint64) string {
+	return fmt.Sprintf("admin:perms:%d", adminID)
+}
+
+var (
+	ErrCannotDeleteSelf = errors.New("cannot delete self")
+	ErrLastSuperAdmin   = errors.New("cannot delete the last super admin")
+	ErrWrongPassword    = errors.New("wrong password")
+)
+
+func IsNotFound(err error) bool {
+	return errors.Is(err, gorm.ErrRecordNotFound)
+}