kefu_cloud/server/internal/handler/auth.go

package handler

import (
	"net/http"
	"time"

	"github.com/gin-gonic/gin"
	"golang.org/x/crypto/bcrypt"
	"kefu-cloud/server/internal/middleware"
	"kefu-cloud/server/internal/model"
)

type AuthHandler struct{}

func NewAuthHandler() *AuthHandler { return &AuthHandler{} }

type LoginReq struct {
	Username string `json:"username" binding:"required"`
	Password string `json:"password" binding:"required"`
}

func (h *AuthHandler) Login(c *gin.Context) {
	var req LoginReq
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": "参数错误"})
		return
	}

	var user model.User
	if err := model.DB.Where("username = ?", req.Username).First(&user).Error; err != nil {
		c.JSON(http.StatusUnauthorized, gin.H{"code": 401, "message": "用户名或密码错误"})
		return
	}

	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.Password)); err != nil {
		c.JSON(http.StatusUnauthorized, gin.H{"code": 401, "message": "用户名或密码错误"})
		return
	}

	if status, message := middleware.ValidateUserAccess(user.ID, user.TenantID, user.Role); status != 0 {
		c.JSON(status, gin.H{"code": status, "message": message})
		return
	}

	// 登录后默认置为在线（可被坐席自行改忙碌/离线）
	now := time.Now()
	_ = model.DB.Model(&user).Updates(map[string]interface{}{
		"status":         "online",
		"last_online_at": now,
	}).Error
	user.Status = "online"

	token, err := middleware.GenerateToken(user.ID, user.TenantID, user.Role)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "生成token失败"})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"code":    0,
		"message": "登录成功",
		"data": gin.H{
			"token":     token,
			"user_id":   user.ID,
			"tenant_id": user.TenantID,
			"nickname":  user.Nickname,
			"role":      user.Role,
			"status":    user.Status,
		},
	})
}

// Refresh 以当前登录身份签发新令牌（用于前端定时续期，避免长挂机后令牌过期掉线）。
// 以数据库中的真实角色/租户为准，防止携带过期角色的令牌被无限续期。
func (h *AuthHandler) Refresh(c *gin.Context) {
	userID := middleware.GetUserID(c)
	var user model.User
	if err := model.DB.Select("id", "tenant_id", "role", "status").First(&user, userID).Error; err != nil {
		c.JSON(http.StatusUnauthorized, gin.H{"code": 401, "message": "账号状态已变化，请重新登录"})
		return
	}
	if status, message := middleware.ValidateUserAccess(user.ID, user.TenantID, user.Role); status != 0 {
		c.JSON(status, gin.H{"code": status, "message": message})
		return
	}
	token, err := middleware.GenerateToken(user.ID, user.TenantID, user.Role)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "生成token失败"})
		return
	}
	middleware.JSON(c, gin.H{"token": token})
}

// Me 当前登录用户信息。
func (h *AuthHandler) Me(c *gin.Context) {
	var user model.User
	if err := model.DB.Select("id", "tenant_id", "nickname", "role", "status", "username").
		First(&user, middleware.GetUserID(c)).Error; err != nil {
		c.JSON(http.StatusNotFound, gin.H{"code": 404, "message": "用户不存在"})
		return
	}
	middleware.JSON(c, gin.H{
		"user_id":   user.ID,
		"tenant_id": user.TenantID,
		"nickname":  user.Nickname,
		"role":      user.Role,
		"status":    user.Status,
		"username":  user.Username,
	})
}

// MePermissions 当前登录用户的权限码列表（供前端按钮控制）。
func (h *AuthHandler) MePermissions(c *gin.Context) {
	perms := middleware.GetPermissions(c)
	codes := make([]string, 0, len(perms))
	for k := range perms {
		codes = append(codes, k)
	}
	middleware.JSON(c, gin.H{
		"role":        middleware.GetRole(c),
		"permissions": codes,
	})
}

type UpdatePresenceReq struct {
	Status string `json:"status" binding:"required"`
}

// UpdatePresence 坐席自行切换在线状态（online / busy / offline）。
func (h *AuthHandler) UpdatePresence(c *gin.Context) {
	var req UpdatePresenceReq
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": "参数错误"})
		return
	}
	status := req.Status
	if status != "online" && status != "busy" && status != "offline" {
		c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": "状态仅支持 online / busy / offline"})
		return
	}

	userID := middleware.GetUserID(c)
	var user model.User
	if err := model.DB.First(&user, userID).Error; err != nil {
		c.JSON(http.StatusNotFound, gin.H{"code": 404, "message": "用户不存在"})
		return
	}
	if user.Status == "disabled" {
		c.JSON(http.StatusForbidden, gin.H{"code": 403, "message": "账号已停用"})
		return
	}

	updates := map[string]interface{}{"status": status}
	if status == "online" {
		updates["last_online_at"] = time.Now()
	}
	if err := model.DB.Model(&user).Updates(updates).Error; err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "更新状态失败"})
		return
	}
	user.Status = status
	middleware.JSON(c, gin.H{
		"user_id": user.ID,
		"status":  user.Status,
	})
}