zhang1106
73cbe4ac1b
1. 新增操作日志记录功能，记录关键操作 2. 实现危险操作确认对话框，防止误删 3. 添加业务和库房管理模块 4. 支持设备标记为空闲状态 5. 完善API文档和健康检查 6. 优化前端删除操作的确认流程 7. 添加Swagger API文档支持 8. 实现设备与业务的关联功能 9. 改进设备模型，添加空闲相关字段 10. 优化用户、角色管理操作日志
662 lines
17 KiB
JavaScript
662 lines
17 KiB
JavaScript
const express = require('express');
|
||
const bcrypt = require('bcryptjs');
|
||
const path = require('path');
|
||
const fs = require('fs');
|
||
const User = require('../models/User');
|
||
const Role = require('../models/Role');
|
||
const UserRole = require('../models/UserRole');
|
||
const { authMiddleware } = require('../middleware/auth');
|
||
const { SALT_ROUNDS, PASSWORD_MIN_LENGTH, FILE_UPLOAD, PAGINATION } = require('../config');
|
||
const { logUserOperation } = require('../utils/operationLogger');
|
||
|
||
const router = express.Router();
|
||
|
||
const generateId = () => {
|
||
return 'user_' + Date.now().toString(36) + Math.random().toString(36).substr(2, 9);
|
||
};
|
||
|
||
const getWhereClause = (query) => {
|
||
const where = {};
|
||
|
||
if (query.username) {
|
||
where.username = { [Op.like]: `%${query.username}%` };
|
||
}
|
||
|
||
if (query.status) {
|
||
where.status = query.status;
|
||
}
|
||
|
||
if (query.realName) {
|
||
where.realName = { [Op.like]: `%${query.realName}%` };
|
||
}
|
||
|
||
return where;
|
||
};
|
||
|
||
const getUserRoleIds = async (userId) => {
|
||
const userRoles = await UserRole.findAll({
|
||
where: { UserId: userId },
|
||
attributes: ['RoleId']
|
||
});
|
||
return userRoles.map(ur => ur.RoleId);
|
||
};
|
||
|
||
const { Op } = require('sequelize');
|
||
|
||
router.get('/', authMiddleware, async (req, res) => {
|
||
try {
|
||
const { page = 1, pageSize = PAGINATION.DEFAULT_PAGE_SIZE, username, status, realName } = req.query;
|
||
const offset = (parseInt(page) - 1) * parseInt(pageSize);
|
||
const limit = Math.min(parseInt(pageSize), PAGINATION.MAX_PAGE_SIZE);
|
||
|
||
const where = getWhereClause({ username, status, realName });
|
||
|
||
const { count, rows: users } = await User.findAndCountAll({
|
||
where,
|
||
attributes: { exclude: ['password'] },
|
||
limit,
|
||
offset,
|
||
order: [['createdAt', 'DESC']]
|
||
});
|
||
|
||
if (users.length > 0) {
|
||
const userIds = users.map(u => u.userId);
|
||
const allUserRoles = await UserRole.findAll({
|
||
include: [{
|
||
model: Role,
|
||
where: { status: 'active' },
|
||
attributes: ['roleId', 'roleName', 'roleCode']
|
||
}],
|
||
where: {
|
||
UserId: { [Op.in]: userIds }
|
||
}
|
||
});
|
||
|
||
const userRolesMap = {};
|
||
allUserRoles.forEach(ur => {
|
||
if (!userRolesMap[ur.UserId]) {
|
||
userRolesMap[ur.UserId] = [];
|
||
}
|
||
userRolesMap[ur.UserId].push({
|
||
roleId: ur.Role.roleId,
|
||
roleName: ur.Role.roleName,
|
||
roleCode: ur.Role.roleCode
|
||
});
|
||
});
|
||
|
||
users.forEach(user => {
|
||
user.dataValues.roles = userRolesMap[user.userId] || [];
|
||
});
|
||
} else {
|
||
users.forEach(user => {
|
||
user.dataValues.roles = [];
|
||
});
|
||
}
|
||
|
||
res.json({
|
||
success: true,
|
||
data: {
|
||
total: count,
|
||
page: parseInt(page),
|
||
pageSize: parseInt(pageSize),
|
||
users
|
||
}
|
||
});
|
||
} catch (error) {
|
||
console.error('获取用户列表错误:', error);
|
||
res.status(500).json({
|
||
success: false,
|
||
message: '获取用户列表失败'
|
||
});
|
||
}
|
||
});
|
||
|
||
router.get('/all', authMiddleware, async (req, res) => {
|
||
try {
|
||
const users = await User.findAll({
|
||
where: { status: 'active' },
|
||
attributes: ['userId', 'username', 'realName', 'email'],
|
||
order: [['realName', 'ASC']]
|
||
});
|
||
|
||
res.json({
|
||
success: true,
|
||
data: users
|
||
});
|
||
} catch (error) {
|
||
console.error('获取所有用户错误:', error);
|
||
res.status(500).json({
|
||
success: false,
|
||
message: '获取用户列表失败'
|
||
});
|
||
}
|
||
});
|
||
|
||
router.get('/:userId', authMiddleware, async (req, res) => {
|
||
try {
|
||
const user = await User.findByPk(req.params.userId, {
|
||
attributes: { exclude: ['password'] }
|
||
});
|
||
|
||
if (!user) {
|
||
return res.status(404).json({
|
||
success: false,
|
||
message: '用户不存在'
|
||
});
|
||
}
|
||
|
||
const userRoles = await UserRole.findAll({
|
||
include: [{
|
||
model: Role,
|
||
where: { status: 'active' }
|
||
}],
|
||
where: { UserId: user.userId }
|
||
});
|
||
|
||
user.dataValues.roles = userRoles.map(ur => ({
|
||
roleId: ur.Role.roleId,
|
||
roleName: ur.Role.roleName,
|
||
roleCode: ur.Role.roleCode
|
||
}));
|
||
|
||
res.json({
|
||
success: true,
|
||
data: user
|
||
});
|
||
} catch (error) {
|
||
console.error('获取用户详情错误:', error);
|
||
res.status(500).json({
|
||
success: false,
|
||
message: '获取用户详情失败'
|
||
});
|
||
}
|
||
});
|
||
|
||
router.post('/', authMiddleware, async (req, res) => {
|
||
try {
|
||
const { username, password, email, phone, realName, roleIds, status, remark } = req.body;
|
||
|
||
if (!username || !password) {
|
||
return res.status(400).json({
|
||
success: false,
|
||
message: '用户名和密码不能为空'
|
||
});
|
||
}
|
||
|
||
const existingUser = await User.findOne({ where: { username } });
|
||
if (existingUser) {
|
||
return res.status(400).json({
|
||
success: false,
|
||
message: '用户名已存在'
|
||
});
|
||
}
|
||
|
||
const hashedPassword = await bcrypt.hash(password, SALT_ROUNDS);
|
||
|
||
const user = await User.create({
|
||
userId: generateId(),
|
||
username,
|
||
password: hashedPassword,
|
||
email,
|
||
phone,
|
||
realName: realName || username,
|
||
status: status || 'active',
|
||
remark
|
||
});
|
||
|
||
if (roleIds && roleIds.length > 0) {
|
||
for (const roleId of roleIds) {
|
||
await UserRole.create({
|
||
UserId: user.userId,
|
||
RoleId: roleId
|
||
});
|
||
}
|
||
}
|
||
|
||
const roleNames = roleIds && roleIds.length > 0
|
||
? (await Role.findAll({ where: { roleId: { [Op.in]: roleIds } } })).map(r => r.roleName).join('、')
|
||
: '未分配角色';
|
||
|
||
await logUserOperation('create', `创建用户【${username}】（姓名：${realName || '未填写'}，邮箱：${email || '未填写'}，角色：${roleNames}）`, {
|
||
targetId: user.userId,
|
||
targetName: username,
|
||
afterState: {
|
||
username: user.username,
|
||
email: user.email,
|
||
realName: user.realName,
|
||
status: user.status
|
||
},
|
||
req,
|
||
metadata: { roleIds, roleNames }
|
||
});
|
||
|
||
res.status(201).json({
|
||
success: true,
|
||
message: '创建成功',
|
||
data: {
|
||
userId: user.userId,
|
||
username: user.username,
|
||
email: user.email,
|
||
realName: user.realName,
|
||
status: user.status
|
||
}
|
||
});
|
||
} catch (error) {
|
||
console.error('创建用户错误:', error);
|
||
res.status(500).json({
|
||
success: false,
|
||
message: '创建用户失败'
|
||
});
|
||
}
|
||
});
|
||
|
||
router.put('/:userId', authMiddleware, async (req, res) => {
|
||
try {
|
||
const { username, email, phone, realName, roleIds, status, remark, newPassword } = req.body;
|
||
const user = await User.findByPk(req.params.userId);
|
||
|
||
if (!user) {
|
||
return res.status(404).json({
|
||
success: false,
|
||
message: '用户不存在'
|
||
});
|
||
}
|
||
|
||
const beforeState = {
|
||
username: user.username,
|
||
email: user.email,
|
||
phone: user.phone,
|
||
realName: user.realName,
|
||
status: user.status,
|
||
remark: user.remark
|
||
};
|
||
|
||
const oldRoleIds = roleIds !== undefined ? null : await getUserRoleIds(user.userId);
|
||
|
||
if (username !== undefined && username !== user.username) {
|
||
const existingUser = await User.findOne({
|
||
where: { username, userId: { [Op.ne]: user.userId } }
|
||
});
|
||
if (existingUser) {
|
||
return res.status(400).json({
|
||
success: false,
|
||
message: '用户名已存在'
|
||
});
|
||
}
|
||
user.username = username;
|
||
}
|
||
|
||
if (email !== undefined) user.email = email;
|
||
if (phone !== undefined) user.phone = phone;
|
||
if (realName !== undefined) user.realName = realName;
|
||
if (status !== undefined) user.status = status;
|
||
if (remark !== undefined) user.remark = remark;
|
||
|
||
if (newPassword && newPassword.length >= PASSWORD_MIN_LENGTH) {
|
||
user.password = await bcrypt.hash(newPassword, SALT_ROUNDS);
|
||
}
|
||
|
||
await user.save();
|
||
|
||
let permissionChanged = false;
|
||
let oldRoleNames = [];
|
||
let newRoleNames = [];
|
||
|
||
if (roleIds !== undefined) {
|
||
const oldRoles = await Role.findAll({ where: { roleId: { [Op.in]: oldRoleIds || [] } } });
|
||
oldRoleNames = oldRoles.map(r => r.roleName);
|
||
|
||
await UserRole.destroy({ where: { UserId: user.userId } });
|
||
|
||
for (const roleId of roleIds) {
|
||
await UserRole.create({
|
||
UserId: user.userId,
|
||
RoleId: roleId
|
||
});
|
||
}
|
||
|
||
const newRoles = await Role.findAll({ where: { roleId: { [Op.in]: roleIds } } });
|
||
newRoleNames = newRoles.map(r => r.roleName);
|
||
permissionChanged = true;
|
||
}
|
||
|
||
const updatedUser = await User.findByPk(req.params.userId, {
|
||
attributes: { exclude: ['password'] }
|
||
});
|
||
|
||
if (permissionChanged) {
|
||
const roleChangeDesc = `变更用户【${updatedUser.username}】的角色：${oldRoleNames.join('、') || '无'} → ${newRoleNames.join('、') || '无'}`;
|
||
await logUserOperation('permission_change', roleChangeDesc, {
|
||
targetId: updatedUser.userId,
|
||
targetName: updatedUser.username,
|
||
beforeState: { ...beforeState, roleIds: oldRoleIds, roleNames: oldRoleNames },
|
||
afterState: { ...beforeState, roleIds, roleNames: newRoleNames },
|
||
req,
|
||
metadata: { oldRoleIds, newRoleIds: roleIds, oldRoleNames, newRoleNames }
|
||
});
|
||
} else {
|
||
const afterState = {
|
||
username: updatedUser.username,
|
||
email: updatedUser.email,
|
||
phone: updatedUser.phone,
|
||
realName: updatedUser.realName,
|
||
status: updatedUser.status,
|
||
remark: updatedUser.remark
|
||
};
|
||
|
||
const changedFields = {};
|
||
for (const key of Object.keys(beforeState)) {
|
||
if (JSON.stringify(beforeState[key]) !== JSON.stringify(afterState[key])) {
|
||
changedFields[key] = { from: beforeState[key], to: afterState[key] };
|
||
}
|
||
}
|
||
|
||
const changeDetails = Object.entries(changedFields).map(([field, values]) => {
|
||
const fieldNames = {
|
||
username: '用户名', email: '邮箱', phone: '电话', realName: '姓名',
|
||
status: '状态', remark: '备注'
|
||
};
|
||
const displayName = fieldNames[field] || field;
|
||
return `${displayName}: ${values.from ?? '空'} → ${values.to ?? '空'}`;
|
||
}).join('；');
|
||
|
||
const updateDesc = changeDetails
|
||
? `更新用户【${updatedUser.username}】：${changeDetails}`
|
||
: `更新用户【${updatedUser.username}】`;
|
||
|
||
await logUserOperation('update', updateDesc, {
|
||
targetId: updatedUser.userId,
|
||
targetName: updatedUser.username,
|
||
beforeState,
|
||
afterState,
|
||
req,
|
||
metadata: { changedFields }
|
||
});
|
||
}
|
||
|
||
res.json({
|
||
success: true,
|
||
message: '更新成功',
|
||
data: updatedUser
|
||
});
|
||
} catch (error) {
|
||
console.error('更新用户错误:', error);
|
||
res.status(500).json({
|
||
success: false,
|
||
message: '更新用户失败'
|
||
});
|
||
}
|
||
});
|
||
|
||
router.put('/:userId/password', authMiddleware, async (req, res) => {
|
||
try {
|
||
const { newPassword } = req.body;
|
||
const user = await User.findByPk(req.params.userId);
|
||
|
||
if (!user) {
|
||
return res.status(404).json({
|
||
success: false,
|
||
message: '用户不存在'
|
||
});
|
||
}
|
||
|
||
if (!newPassword || newPassword.length < PASSWORD_MIN_LENGTH) {
|
||
return res.status(400).json({
|
||
success: false,
|
||
message: `密码长度不能少于${PASSWORD_MIN_LENGTH}个字符`
|
||
});
|
||
}
|
||
|
||
user.password = await bcrypt.hash(newPassword, SALT_ROUNDS);
|
||
await user.save();
|
||
|
||
res.json({
|
||
success: true,
|
||
message: '密码重置成功'
|
||
});
|
||
} catch (error) {
|
||
console.error('重置密码错误:', error);
|
||
res.status(500).json({
|
||
success: false,
|
||
message: '重置密码失败'
|
||
});
|
||
}
|
||
});
|
||
|
||
router.delete('/:userId', authMiddleware, async (req, res) => {
|
||
try {
|
||
const user = await User.findByPk(req.params.userId);
|
||
|
||
if (!user) {
|
||
return res.status(404).json({
|
||
success: false,
|
||
message: '用户不存在'
|
||
});
|
||
}
|
||
|
||
if (user.userId === req.user.userId) {
|
||
return res.status(400).json({
|
||
success: false,
|
||
message: '不能删除当前登录用户'
|
||
});
|
||
}
|
||
|
||
const userName = user.username;
|
||
const userRealName = user.realName;
|
||
const userEmail = user.email;
|
||
const beforeState = {
|
||
username: user.username,
|
||
email: user.email,
|
||
realName: user.realName,
|
||
status: user.status
|
||
};
|
||
|
||
await UserRole.destroy({ where: { UserId: user.userId } });
|
||
await user.destroy();
|
||
|
||
await logUserOperation('delete', `删除用户【${userName}】（姓名：${userRealName || '未填写'}，邮箱：${userEmail || '未填写'}）`, {
|
||
targetId: req.params.userId,
|
||
targetName: userName,
|
||
beforeState,
|
||
req,
|
||
metadata: { deletedUsername: userName, realName: userRealName, email: userEmail }
|
||
});
|
||
|
||
res.json({
|
||
success: true,
|
||
message: '删除成功'
|
||
});
|
||
} catch (error) {
|
||
console.error('删除用户错误:', error);
|
||
res.status(500).json({
|
||
success: false,
|
||
message: '删除用户失败'
|
||
});
|
||
}
|
||
});
|
||
|
||
router.post('/:userId/avatar', authMiddleware, async (req, res) => {
|
||
try {
|
||
const user = await User.findByPk(req.params.userId);
|
||
|
||
if (!user) {
|
||
return res.status(404).json({
|
||
success: false,
|
||
message: '用户不存在'
|
||
});
|
||
}
|
||
|
||
if (!req.files || !req.files.avatar) {
|
||
return res.status(400).json({
|
||
success: false,
|
||
message: '请选择要上传的头像文件'
|
||
});
|
||
}
|
||
|
||
const avatarFile = req.files.avatar;
|
||
const allowedTypes = ['image/jpeg', 'image/png', 'image/gif', 'image/webp'];
|
||
|
||
if (!allowedTypes.includes(avatarFile.mimetype)) {
|
||
return res.status(400).json({
|
||
success: false,
|
||
message: '只支持 JPG、PNG、GIF 和 WebP 格式的图片'
|
||
});
|
||
}
|
||
|
||
if (avatarFile.size > FILE_UPLOAD.MAX_AVATAR_SIZE) {
|
||
return res.status(400).json({
|
||
success: false,
|
||
message: `图片大小不能超过 ${FILE_UPLOAD.MAX_AVATAR_SIZE / 1024 / 1024}MB`
|
||
});
|
||
}
|
||
|
||
const uploadDir = path.join(__dirname, '..', 'uploads', 'avatars');
|
||
if (!fs.existsSync(uploadDir)) {
|
||
fs.mkdirSync(uploadDir, { recursive: true });
|
||
}
|
||
|
||
const ext = path.extname(avatarFile.name) || '.jpg';
|
||
const filename = `avatar_${user.userId}_${Date.now()}${ext}`;
|
||
const filepath = path.join(uploadDir, filename);
|
||
|
||
await avatarFile.mv(filepath);
|
||
|
||
if (user.avatar && user.avatar.startsWith('/uploads/avatars/')) {
|
||
const oldFile = path.join(__dirname, '..', user.avatar);
|
||
if (fs.existsSync(oldFile)) {
|
||
fs.unlinkSync(oldFile);
|
||
}
|
||
}
|
||
|
||
const avatarUrl = `/uploads/avatars/${filename}`;
|
||
user.avatar = avatarUrl;
|
||
await user.save();
|
||
|
||
res.json({
|
||
success: true,
|
||
message: '头像上传成功',
|
||
data: { avatar: avatarUrl }
|
||
});
|
||
} catch (error) {
|
||
console.error('上传头像错误:', error);
|
||
res.status(500).json({
|
||
success: false,
|
||
message: '上传头像失败'
|
||
});
|
||
}
|
||
});
|
||
|
||
router.delete('/:userId/avatar', authMiddleware, async (req, res) => {
|
||
try {
|
||
const user = await User.findByPk(req.params.userId);
|
||
|
||
if (!user) {
|
||
return res.status(404).json({
|
||
success: false,
|
||
message: '用户不存在'
|
||
});
|
||
}
|
||
|
||
if (user.avatar && user.avatar.startsWith('/uploads/avatars/')) {
|
||
const oldFile = path.join(__dirname, '..', user.avatar);
|
||
if (fs.existsSync(oldFile)) {
|
||
fs.unlinkSync(oldFile);
|
||
}
|
||
}
|
||
|
||
user.avatar = null;
|
||
await user.save();
|
||
|
||
res.json({
|
||
success: true,
|
||
message: '头像删除成功'
|
||
});
|
||
} catch (error) {
|
||
console.error('删除头像错误:', error);
|
||
res.status(500).json({
|
||
success: false,
|
||
message: '删除头像失败'
|
||
});
|
||
}
|
||
});
|
||
|
||
router.put('/:userId/approve', authMiddleware, async (req, res) => {
|
||
try {
|
||
const user = await User.findByPk(req.params.userId);
|
||
|
||
if (!user) {
|
||
return res.status(404).json({
|
||
success: false,
|
||
message: '用户不存在'
|
||
});
|
||
}
|
||
|
||
if (user.status !== 'pending') {
|
||
return res.status(400).json({
|
||
success: false,
|
||
message: '该用户不在待审核状态'
|
||
});
|
||
}
|
||
|
||
user.status = 'active';
|
||
await user.save();
|
||
|
||
res.json({
|
||
success: true,
|
||
message: '用户审核通过',
|
||
data: {
|
||
userId: user.userId,
|
||
username: user.username,
|
||
status: user.status
|
||
}
|
||
});
|
||
} catch (error) {
|
||
console.error('审核用户错误:', error);
|
||
res.status(500).json({
|
||
success: false,
|
||
message: '审核用户失败'
|
||
});
|
||
}
|
||
});
|
||
|
||
router.put('/:userId/reject', authMiddleware, async (req, res) => {
|
||
try {
|
||
const user = await User.findByPk(req.params.userId);
|
||
|
||
if (!user) {
|
||
return res.status(404).json({
|
||
success: false,
|
||
message: '用户不存在'
|
||
});
|
||
}
|
||
|
||
if (user.status !== 'pending') {
|
||
return res.status(400).json({
|
||
success: false,
|
||
message: '该用户不在待审核状态'
|
||
});
|
||
}
|
||
|
||
user.status = 'inactive';
|
||
await user.save();
|
||
|
||
res.json({
|
||
success: true,
|
||
message: '已拒绝该用户的注册申请',
|
||
data: {
|
||
userId: user.userId,
|
||
username: user.username,
|
||
status: user.status
|
||
}
|
||
});
|
||
} catch (error) {
|
||
console.error('拒绝用户错误:', error);
|
||
res.status(500).json({
|
||
success: false,
|
||
message: '操作失败'
|
||
});
|
||
}
|
||
});
|
||
|
||
module.exports = router;
|