第 5 阶段：纠纷、通知与后台-2

backend/internal/modules/adminauth/dto.go

@@ -0,0 +1,25 @@
+package adminauth
+
+import (
+	"time"
+
+	"hfb_sys/backend/internal/modules/auth"
+)
+
+type AdminDTO struct {
+	ID          uint64     `json:"id"`
+	Username    string     `json:"username"`
+	Nickname    string     `json:"nickname"`
+	Status      string     `json:"status"`
+	LastLoginAt *time.Time `json:"last_login_at"`
+}
+
+type LoginRequest struct {
+	Username string `json:"username" binding:"required"`
+	Password string `json:"password" binding:"required"`
+}
+
+type LoginResult struct {
+	Admin  AdminDTO       `json:"admin"`
+	Tokens auth.TokenPair `json:"tokens"`
+}

backend/internal/modules/adminauth/handler.go

@@ -0,0 +1,70 @@
+package adminauth
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+
+	"hfb_sys/backend/internal/middleware"
+	"hfb_sys/backend/pkg/response"
+
+	"github.com/gin-gonic/gin"
+)
+
+type Handler struct {
+	service *Service
+}
+
+func NewHandler(service *Service) *Handler {
+	return &Handler{service: service}
+}
+
+func (h *Handler) Login(c *gin.Context) {
+	var req LoginRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "用户名和密码不能为空")
+		return
+	}
+	result, err := h.service.Login(strings.TrimSpace(req.Username), req.Password)
+	if err != nil {
+		writeAdminAuthError(c, err)
+		return
+	}
+	response.OK(c, result)
+}
+
+func (h *Handler) Me(c *gin.Context) {
+	value, ok := c.Get(middleware.ContextAdminID)
+	if !ok {
+		response.Unauthorized(c, "缺少管理员上下文")
+		return
+	}
+	adminID, ok := value.(uint64)
+	if !ok {
+		response.Unauthorized(c, "管理员上下文无效")
+		return
+	}
+	admin, err := h.service.Me(adminID)
+	if err != nil {
+		writeAdminAuthError(c, err)
+		return
+	}
+	response.OK(c, admin)
+}
+
+func (h *Handler) Logout(c *gin.Context) {
+	response.OK(c, gin.H{"logged_out": true})
+}
+
+func writeAdminAuthError(c *gin.Context, err error) {
+	switch {
+	case errors.Is(err, ErrDependencyUnavailable):
+		response.ServiceUnavailable(c, "数据库未连接")
+	case errors.Is(err, ErrInvalidCredential):
+		response.BadRequest(c, "用户名或密码错误")
+	case errors.Is(err, ErrAdminDisabled):
+		response.Error(c, http.StatusForbidden, "admin_disabled", "管理员已禁用")
+	default:
+		response.Error(c, http.StatusInternalServerError, "internal_error", "后台认证服务暂时不可用")
+	}
+}

backend/internal/modules/adminauth/repository.go

@@ -0,0 +1,98 @@
+package adminauth
+
+import (
+	"errors"
+	"time"
+
+	"hfb_sys/backend/internal/model"
+	"hfb_sys/backend/internal/modules/auth"
+
+	"golang.org/x/crypto/bcrypt"
+	"gorm.io/gorm"
+)
+
+const (
+	defaultAdminUsername = "admin"
+	defaultAdminPassword = "admin123456"
+)
+
+type Repository struct {
+	db  *gorm.DB
+	jwt *auth.JWTManager
+}
+
+func NewRepository(db *gorm.DB, jwt *auth.JWTManager) *Repository {
+	return &Repository{db: db, jwt: jwt}
+}
+
+func (r *Repository) Login(username string, password string) (LoginResult, error) {
+	if err := r.ensureDefaultAdmin(); err != nil {
+		return LoginResult{}, err
+	}
+	var admin model.AdminUser
+	if err := r.db.Where("username = ?", username).First(&admin).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return LoginResult{}, ErrInvalidCredential
+		}
+		return LoginResult{}, err
+	}
+	if admin.Status != "active" {
+		return LoginResult{}, ErrAdminDisabled
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(admin.PasswordHash), []byte(password)); err != nil {
+		return LoginResult{}, ErrInvalidCredential
+	}
+	now := time.Now()
+	admin.LastLoginAt = &now
+	if err := r.db.Save(&admin).Error; err != nil {
+		return LoginResult{}, err
+	}
+	tokens, err := r.jwt.GenerateSubjectPair(admin.ID, admin.Username, "admin")
+	if err != nil {
+		return LoginResult{}, err
+	}
+	return LoginResult{Admin: toDTO(admin), Tokens: tokens}, nil
+}
+
+func (r *Repository) FindByID(id uint64) (*AdminDTO, error) {
+	var admin model.AdminUser
+	if err := r.db.First(&admin, id).Error; err != nil {
+		return nil, err
+	}
+	if admin.Status != "active" {
+		return nil, ErrAdminDisabled
+	}
+	dto := toDTO(admin)
+	return &dto, nil
+}
+
+func (r *Repository) ensureDefaultAdmin() error {
+	var count int64
+	if err := r.db.Model(&model.AdminUser{}).Count(&count).Error; err != nil {
+		return err
+	}
+	if count > 0 {
+		return nil
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(defaultAdminPassword), bcrypt.DefaultCost)
+	if err != nil {
+		return err
+	}
+	admin := model.AdminUser{
+		Username:     defaultAdminUsername,
+		PasswordHash: string(hash),
+		Nickname:     "超级管理员",
+		Status:       "active",
+	}
+	return r.db.Create(&admin).Error
+}
+
+func toDTO(admin model.AdminUser) AdminDTO {
+	return AdminDTO{
+		ID:          admin.ID,
+		Username:    admin.Username,
+		Nickname:    admin.Nickname,
+		Status:      admin.Status,
+		LastLoginAt: admin.LastLoginAt,
+	}
+}

backend/internal/modules/adminauth/service.go

@@ -0,0 +1,34 @@
+package adminauth
+
+import "errors"
+
+var (
+	ErrDependencyUnavailable = errors.New("dependency unavailable")
+	ErrInvalidCredential     = errors.New("invalid credential")
+	ErrAdminDisabled         = errors.New("admin disabled")
+)
+
+type Service struct {
+	repo *Repository
+}
+
+func NewService(repo *Repository) *Service {
+	return &Service{repo: repo}
+}
+
+func (s *Service) Login(username string, password string) (LoginResult, error) {
+	if s.repo == nil {
+		return LoginResult{}, ErrDependencyUnavailable
+	}
+	if username == "" || password == "" {
+		return LoginResult{}, ErrInvalidCredential
+	}
+	return s.repo.Login(username, password)
+}
+
+func (s *Service) Me(adminID uint64) (*AdminDTO, error) {
+	if s.repo == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	return s.repo.FindByID(adminID)
+}