feat(server): 用户管理与变更历史接口；修复 result_revisions.parent_id 从未写入
This commit is contained in:
AskaEth committed
1 parent
f3813171d3
commit
72462792ec
39 files changed
+10001
-28
No files matched your search
@@ -0,0 +1,241 @@
|
||||
package httpapi
|
||||
|
||||
import (
|
||||
"context"
|
||||
"database/sql"
|
||||
"errors"
|
||||
"net/http"
|
||||
"strings"
|
||||
|
||||
"git.yeij.top/AskaEth/Scoreboard/server/internal/auth"
|
||||
)
|
||||
|
||||
// ---------- 用户管理（仅 admin，见 devdocs/08 第 2 节） ----------
|
||||
|
||||
func (s *server) listUsersHandler(w http.ResponseWriter, r *http.Request) (any, error) {
|
||||
return s.listUsers(r.Context())
|
||||
}
|
||||
|
||||
func (s *server) createUserHandler(w http.ResponseWriter, r *http.Request) (any, error) {
|
||||
var in createUserInput
|
||||
if err := decodeJSON(r, &in); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
created, err := s.createUser(r.Context(), in)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
s.audit(r.Context(), "user.create", "user", created.ID, nil, created)
|
||||
return created, nil
|
||||
}
|
||||
|
||||
func (s *server) updateUserHandler(w http.ResponseWriter, r *http.Request) (any, error) {
|
||||
id, err := pathID(r, "id")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
var in updateUserInput
|
||||
if err := decodeJSON(r, &in); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
before, err := s.getUser(r.Context(), id)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
updated, err := s.updateUser(r.Context(), id, in, middlewareUserID(r))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
s.audit(r.Context(), "user.update", "user", id, before, updated)
|
||||
return updated, nil
|
||||
}
|
||||
|
||||
func (s *server) resetUserPasswordHandler(w http.ResponseWriter, r *http.Request) (any, error) {
|
||||
id, err := pathID(r, "id")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
var in resetUserPasswordInput
|
||||
if err := decodeJSON(r, &in); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
result, err := s.resetUserPassword(r.Context(), id, in)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
s.audit(r.Context(), "user.reset_password", "user", id, nil, map[string]any{
|
||||
"username": result.Username,
|
||||
"generated": result.Generated,
|
||||
})
|
||||
return result, nil
|
||||
}
|
||||
|
||||
const userColumns = `id, username, display_name, role, active, must_change_password, last_login_at`
|
||||
|
||||
func scanUser(row interface{ Scan(...any) error }) (userListItemDTO, error) {
|
||||
var (
|
||||
u userListItemDTO
|
||||
lastLogin sql.NullString
|
||||
)
|
||||
if err := row.Scan(&u.ID, &u.Username, &u.DisplayName, &u.Role, &u.Active, &u.MustChangePassword, &lastLogin); err != nil {
|
||||
return u, err
|
||||
}
|
||||
u.LastLoginAt = strPtr(lastLogin)
|
||||
return u, nil
|
||||
}
|
||||
|
||||
func (s *server) listUsers(ctx context.Context) ([]userListItemDTO, error) {
|
||||
rows, err := s.sys.QueryContext(ctx, `SELECT `+userColumns+` FROM users ORDER BY id`)
|
||||
if err != nil {
|
||||
return nil, internal(err)
|
||||
}
|
||||
defer func() { _ = rows.Close() }()
|
||||
|
||||
items := make([]userListItemDTO, 0)
|
||||
for rows.Next() {
|
||||
u, err := scanUser(rows)
|
||||
if err != nil {
|
||||
return nil, internal(err)
|
||||
}
|
||||
items = append(items, u)
|
||||
}
|
||||
if err := rows.Err(); err != nil {
|
||||
return nil, internal(err)
|
||||
}
|
||||
return items, nil
|
||||
}
|
||||
|
||||
func (s *server) getUser(ctx context.Context, id int64) (userListItemDTO, error) {
|
||||
u, err := scanUser(s.sys.QueryRowContext(ctx, `SELECT `+userColumns+` FROM users WHERE id = ?`, id))
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
return u, notFound("用户不存在")
|
||||
}
|
||||
if err != nil {
|
||||
return u, internal(err)
|
||||
}
|
||||
return u, nil
|
||||
}
|
||||
|
||||
// userRole 只接受落库的两种角色；guest 是「未登录」，不能建也不能改出来。
|
||||
func userRole(raw string) (string, error) {
|
||||
switch strings.ToLower(strings.TrimSpace(raw)) {
|
||||
case auth.RoleRecorder.String():
|
||||
return auth.RoleRecorder.String(), nil
|
||||
case auth.RoleAdmin.String():
|
||||
return auth.RoleAdmin.String(), nil
|
||||
default:
|
||||
return "", badRequest("role 只能是 recorder 或 admin", raw)
|
||||
}
|
||||
}
|
||||
|
||||
func (s *server) createUser(ctx context.Context, in createUserInput) (userListItemDTO, error) {
|
||||
username := strings.TrimSpace(in.Username)
|
||||
if username == "" {
|
||||
return userListItemDTO{}, badRequest("username 必填", nil)
|
||||
}
|
||||
role, err := userRole(in.Role)
|
||||
if err != nil {
|
||||
return userListItemDTO{}, err
|
||||
}
|
||||
if len(in.Password) < 8 {
|
||||
return userListItemDTO{}, badRequest("password 至少 8 位", nil)
|
||||
}
|
||||
displayName := strings.TrimSpace(in.DisplayName)
|
||||
if displayName == "" {
|
||||
displayName = username
|
||||
}
|
||||
|
||||
// 先占位插入再交给认证服务写哈希，避免在 httpapi 里复制 bcrypt 成本配置。
|
||||
res, err := s.sys.ExecContext(ctx,
|
||||
`INSERT INTO users (username, password_hash, display_name, role, active, must_change_password)
|
||||
VALUES (?, '!', ?, ?, 1, 1)`, username, displayName, role)
|
||||
if isUniqueViolation(err) {
|
||||
return userListItemDTO{}, conflict("用户名已存在")
|
||||
}
|
||||
if err != nil {
|
||||
return userListItemDTO{}, internal(err)
|
||||
}
|
||||
id, err := lastInsertID(res)
|
||||
if err != nil {
|
||||
return userListItemDTO{}, internal(err)
|
||||
}
|
||||
if err := s.auth.SetPassword(ctx, username, in.Password, true); err != nil {
|
||||
// 占位行没有可用哈希，改密失败就删掉，避免留下登不进去的僵尸用户。
|
||||
_, _ = s.sys.ExecContext(ctx, `DELETE FROM users WHERE id = ?`, id)
|
||||
return userListItemDTO{}, internal(err)
|
||||
}
|
||||
return s.getUser(ctx, id)
|
||||
}
|
||||
|
||||
func (s *server) updateUser(ctx context.Context, id int64, in updateUserInput, actorID int64) (userListItemDTO, error) {
|
||||
before, err := s.getUser(ctx, id)
|
||||
if err != nil {
|
||||
return before, err
|
||||
}
|
||||
|
||||
role := before.Role
|
||||
if in.Role != nil {
|
||||
role, err = userRole(*in.Role)
|
||||
if err != nil {
|
||||
return before, err
|
||||
}
|
||||
}
|
||||
displayName := before.DisplayName
|
||||
if in.DisplayName != nil {
|
||||
displayName = strings.TrimSpace(*in.DisplayName)
|
||||
if displayName == "" {
|
||||
return before, badRequest("displayName 不能为空", nil)
|
||||
}
|
||||
}
|
||||
active := before.Active
|
||||
if in.Active != nil {
|
||||
active = *in.Active
|
||||
}
|
||||
|
||||
// 管理员把自己降级或停用会当场失去管理入口，无法再改回来，直接拒绝。
|
||||
if id == actorID && (role != auth.RoleAdmin.String() || !active) {
|
||||
return before, badRequest("不能把自己降级或停用", nil)
|
||||
}
|
||||
|
||||
if _, err := s.sys.ExecContext(ctx,
|
||||
`UPDATE users SET display_name = ?, role = ?, active = ?, updated_at = datetime('now') WHERE id = ?`,
|
||||
displayName, role, active, id); err != nil {
|
||||
return before, internal(err)
|
||||
}
|
||||
if !active {
|
||||
// 停用必须连带踢掉已登录会话，否则旧 Cookie 还能继续写。
|
||||
if err := s.auth.RevokeUserSessions(ctx, id); err != nil {
|
||||
return before, internal(err)
|
||||
}
|
||||
}
|
||||
return s.getUser(ctx, id)
|
||||
}
|
||||
|
||||
func (s *server) resetUserPassword(ctx context.Context, id int64, in resetUserPasswordInput) (resetPasswordResultDTO, error) {
|
||||
u, err := s.getUser(ctx, id)
|
||||
if err != nil {
|
||||
return resetPasswordResultDTO{}, err
|
||||
}
|
||||
password := in.Password
|
||||
generated := false
|
||||
if password == "" {
|
||||
password, err = auth.RandomPassword(16)
|
||||
if err != nil {
|
||||
return resetPasswordResultDTO{}, internal(err)
|
||||
}
|
||||
generated = true
|
||||
} else if len(password) < 8 {
|
||||
return resetPasswordResultDTO{}, badRequest("password 至少 8 位", nil)
|
||||
}
|
||||
// SetPassword 会作废该用户全部会话，被重置的人必须重新登录。
|
||||
if err := s.auth.SetPassword(ctx, u.Username, password, true); err != nil {
|
||||
return resetPasswordResultDTO{}, internal(err)
|
||||
}
|
||||
return resetPasswordResultDTO{
|
||||
ID: u.ID,
|
||||
Username: u.Username,
|
||||
Password: password,
|
||||
Generated: generated,
|
||||
MustChangePassword: true,
|
||||
}, nil
|
||||
}
|
||||
Reference in new issue
Block a user