@allbluecn/admin-app 0.3.1 → 0.3.3

package/src/server/serverFns/user/list.ts

@@ -17,7 +17,8 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
+import { requireAdmin } from '@/server/auth-helpers'
 
 const listInput = z.object({
   page: z.number().default(1),
@@ -30,11 +31,13 @@ const listInput = z.object({
 export const listUsersFn = createServerFn({ method: 'GET' })
   .validator(listInput)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    await requireAdmin()
     const { page, pageSize, search, role, status } = data
     const where: any = {}
     if (search) {
       where.OR = [
-        { name: { contains: search, mode: 'insensitive' } },
+        { username: { contains: search, mode: 'insensitive' } },
         { email: { contains: search, mode: 'insensitive' } },
       ]
     }
@@ -46,8 +49,20 @@ export const listUsersFn = createServerFn({ method: 'GET' })
         skip: (page - 1) * pageSize,
         take: pageSize,
         orderBy: { createdAt: 'desc' },
-        include: {
-          _count: { select: { prds: true, anyhubMarketApps: true, reviews: true } },
+        // SEC-01 联动：select 显式列出 UI 所需列，绝不返回 password / aiApiKey 等凭据字段
+        select: {
+          id: true,
+          email: true,
+          username: true,
+          role: true,
+          status: true,
+          avatarConfig: true,
+          bgShape: true,
+          bgColor: true,
+          createdAt: true,
+          updatedAt: true,
+          lastLoginAt: true,
+          _count: { select: { designs: true, anyhubMarketApps: true, reviews: true } },
         },
       }),
       prisma.user.count({ where }),

package/src/server/serverFns/user/reset-password.ts

@@ -17,12 +17,20 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import bcrypt from 'bcryptjs'
+import { requireAdmin } from '@/server/auth-helpers'
 
 export const resetUserPasswordFn = createServerFn({ method: 'POST' })
   .validator(z.object({ userId: z.string(), newPassword: z.string().min(8) }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    await requireAdmin()
     const hashedPassword = await bcrypt.hash(data.newPassword, 12)
-    return prisma.user.update({ where: { id: data.userId }, data: { password: hashedPassword } })
+    return prisma.user.update({
+      where: { id: data.userId },
+      data: { password: hashedPassword },
+      // 不回显 password 哈希
+      select: { id: true, email: true, username: true, role: true, status: true },
+    })
   })

package/src/server/serverFns/user/update-role.ts

@@ -17,10 +17,18 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
+import { requireAdmin } from '@/server/auth-helpers'
 
 export const updateUserRoleFn = createServerFn({ method: 'POST' })
   .validator(z.object({ userId: z.string(), role: z.enum(['USER', 'ADMIN', 'SUPER_ADMIN']) }))
   .handler(async ({ data }) => {
-    return prisma.user.update({ where: { id: data.userId }, data: { role: data.role } })
+    const prisma = await getPrisma()
+    await requireAdmin()
+    return prisma.user.update({
+      where: { id: data.userId },
+      data: { role: data.role },
+      // 不回显 password 哈希
+      select: { id: true, email: true, username: true, role: true, status: true },
+    })
   })

package/src/server/serverFns/user/update-status.ts

@@ -17,10 +17,18 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
+import { requireAdmin } from '@/server/auth-helpers'
 
 export const updateUserStatusFn = createServerFn({ method: 'POST' })
   .validator(z.object({ userId: z.string(), status: z.enum(['ACTIVE', 'INACTIVE', 'BANNED']) }))
   .handler(async ({ data }) => {
-    return prisma.user.update({ where: { id: data.userId }, data: { status: data.status } })
+    const prisma = await getPrisma()
+    await requireAdmin()
+    return prisma.user.update({
+      where: { id: data.userId },
+      data: { status: data.status },
+      // 不回显 password 哈希
+      select: { id: true, email: true, username: true, role: true, status: true },
+    })
   })

package/src/styles/globals.css

@@ -3,6 +3,10 @@
 
 @import "tailwindcss";
 
+/* 共享 UI 包源码类名扫描（Tailwind v4 自动探测不覆盖 workspace 包，
+   缺失则 @allbluecn/ui 内组件的全部工具类不生成） */
+@source "../../../../packages/ui/src/**/*.{ts,tsx}";
+
 @import "tw-animate-css";
 
 @import "shadcn/tailwind.css";

package/src/components/data-table/data-table-pagination.tsx

@@ -1,112 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-// AllBlue - 理想之海
-// Copyright (C) 2026 AllBlue Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-import {
-  Pagination,
-  PaginationContent,
-  PaginationEllipsis,
-  PaginationItem,
-  PaginationLink,
-  PaginationNext,
-  PaginationPrevious,
-} from "@/components/ui/pagination";
-import { m } from '@/paraglide/messages.js'
-interface DataTablePaginationProps {
-  page: number;
-  totalPages: number;
-  total: number;
-  onPageChange: (page: number) => void;
-}
-
-function getPageNumbers(current: number, total: number): (number | "ellipsis")[] {
-  if (total <= 5) {
-    return Array.from({ length: total }, (_, i) => i + 1);
-  }
-
-  const pages: (number | "ellipsis")[] = [1];
-
-  if (current > 3) {
-    pages.push("ellipsis");
-  }
-
-  const start = Math.max(2, current - 1);
-  const end = Math.min(total - 1, current + 1);
-
-  for (let i = start; i <= end; i++) {
-    pages.push(i);
-  }
-
-  if (current < total - 2) {
-    pages.push("ellipsis");
-  }
-
-  pages.push(total);
-
-  return pages;
-}
-
-export function DataTablePagination({
-  page,
-  totalPages,
-  total,
-  onPageChange,
-}: DataTablePaginationProps) {
-  const pages = getPageNumbers(page, totalPages);
-
-  return (
-    <div className="flex items-center justify-between gap-4 px-2 py-4">
-      <div className="text-sm text-muted-foreground whitespace-nowrap shrink-0">
-        {m.common_pagination_total({ total, page, totalPages })}
-      </div>
-      <Pagination className="justify-end">
-        <PaginationContent>
-          <PaginationItem>
-            <PaginationPrevious
-              text={m.common_pagination_prev()}
-              onClick={() => page > 1 && onPageChange(page - 1)}
-              className={page <= 1 ? "pointer-events-none opacity-50" : "cursor-pointer"}
-            />
-          </PaginationItem>
-          {pages.map((p, i) =>
-            p === "ellipsis" ? (
-              <PaginationItem key={`ellipsis-${i}`}>
-                <PaginationEllipsis />
-              </PaginationItem>
-            ) : (
-              <PaginationItem key={p}>
-                <PaginationLink
-                  isActive={p === page}
-                  onClick={() => onPageChange(p)}
-                  className="cursor-pointer"
-                >
-                  {p}
-                </PaginationLink>
-              </PaginationItem>
-            )
-          )}
-          <PaginationItem>
-            <PaginationNext
-              text={m.common_pagination_next()}
-              onClick={() => page < totalPages && onPageChange(page + 1)}
-              className={page >= totalPages ? "pointer-events-none opacity-50" : "cursor-pointer"}
-            />
-          </PaginationItem>
-        </PaginationContent>
-      </Pagination>
-    </div>
-  );
-}

package/src/components/data-table/data-table.tsx

@@ -1,218 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-// AllBlue - 理想之海
-// Copyright (C) 2026 AllBlue Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-import type { CSSProperties } from 'react'
-import { useRef } from 'react'
-import {
-  type ColumnDef,
-  type RowData,
-  columnVisibilityFeature,
-  flexRender,
-  tableFeatures,
-  useTable,
-} from '@tanstack/react-table'
-import { useVirtualizer } from '@tanstack/react-virtual'
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from '@/components/ui/table'
-import { VIRTUALIZE_THRESHOLD } from '@allbluecn/kernel'
-
-export const dataTableFeatures = tableFeatures({
-  columnVisibilityFeature,
-})
-
-export type AdminColumnDef<
-  TData extends RowData,
-  TValue = unknown,
-> = ColumnDef<typeof dataTableFeatures, TData, TValue> & {
-  meta?: { style?: CSSProperties }
-}
-
-export interface DataTableProps<TData extends RowData> {
-  columns: AdminColumnDef<TData>[];
-  data: TData[];
-  onRowClick?: (row: TData) => void;
-  actions?: React.ReactNode;
-}
-
-const ROW_HEIGHT = 48
-
-function ColGroup({ columns }: { columns: AdminColumnDef<any>[] }) {
-  return (
-    <colgroup>
-      {columns.map((col, i) => {
-        const style = (col.meta as { style?: CSSProperties } | undefined)?.style
-        const width = style?.width
-        return width != null ? <col key={i} style={{ width }} /> : null
-      })}
-    </colgroup>
-  )
-}
-
-export function DataTable<TData extends RowData>({
-  columns,
-  data,
-  onRowClick,
-  actions,
-}: DataTableProps<TData>) {
-  const table = useTable({
-    features: dataTableFeatures,
-    data,
-    columns,
-  });
-
-  const { rows } = table.getRowModel();
-  const parentRef = useRef<HTMLDivElement>(null);
-
-  const shouldVirtualize = rows.length > VIRTUALIZE_THRESHOLD;
-
-  const rowVirtualizer = useVirtualizer({
-    count: shouldVirtualize ? rows.length : 0,
-    getScrollElement: () => parentRef.current,
-    estimateSize: () => ROW_HEIGHT,
-    overscan: 10,
-    enabled: shouldVirtualize,
-  });
-
-  const virtualRows = shouldVirtualize ? rowVirtualizer.getVirtualItems() : [];
-  const totalHeight = shouldVirtualize ? rowVirtualizer.getTotalSize() : 0;
-  const paddingTop = virtualRows.length > 0 ? virtualRows[0].start : 0;
-  const paddingBottom =
-    virtualRows.length > 0
-      ? totalHeight - virtualRows[virtualRows.length - 1].end
-      : 0;
-
-  const headerGroups = table.getHeaderGroups();
-
-  const renderRows = () => {
-    if (!shouldVirtualize) {
-      return rows.map((row) => (
-        <TableRow
-          key={row.id}
-          className={onRowClick ? 'cursor-pointer' : undefined}
-          onClick={() => onRowClick?.(row.original)}
-        >
-          {row.getVisibleCells().map((cell) => {
-            const style = (cell.column.columnDef.meta as
-              | { style?: CSSProperties }
-              | undefined)?.style
-            const alignClass =
-              style?.textAlign === 'right' ? 'text-right' : undefined
-            return (
-              <TableCell
-                key={cell.id}
-                className={alignClass}
-                style={{ width: style?.width }}
-              >
-                {flexRender(cell.column.columnDef.cell, cell.getContext())}
-              </TableCell>
-            )
-          })}
-        </TableRow>
-      ))
-    }
-
-    return (
-      <>
-        {paddingTop > 0 && <tr style={{ height: paddingTop }} />}
-        {virtualRows.map((virtualRow) => {
-          const row = rows[virtualRow.index]
-          return (
-            <TableRow
-              key={row.id}
-              style={{
-                position: 'absolute',
-                transform: `translateY(${virtualRow.start}px)`,
-                height: ROW_HEIGHT,
-              }}
-              className={onRowClick ? 'cursor-pointer' : undefined}
-              onClick={() => onRowClick?.(row.original)}
-            >
-              {row.getVisibleCells().map((cell) => {
-                const style = (cell.column.columnDef.meta as
-                  | { style?: CSSProperties }
-                  | undefined)?.style
-                const alignClass =
-                  style?.textAlign === 'right' ? 'text-right' : undefined
-                return (
-                  <TableCell
-                    key={cell.id}
-                    className={alignClass}
-                    style={{ width: style?.width }}
-                  >
-                    {flexRender(cell.column.columnDef.cell, cell.getContext())}
-                  </TableCell>
-                )
-              })}
-            </TableRow>
-          )
-        })}
-        {paddingBottom > 0 && <tr style={{ height: paddingBottom }} />}
-      </>
-    );
-  };
-
-  return (
-    <div className="rounded-md border flex flex-col min-h-0 flex-1 overflow-x-hidden">
-      <div className="shrink-0">
-        <Table className="table-fixed">
-          <ColGroup columns={columns} />
-          <TableHeader>
-            {headerGroups.map((headerGroup) => (
-              <TableRow key={headerGroup.id}>
-                {headerGroup.headers.map((header) => {
-                  const style = (
-                    header.column.columnDef.meta as
-                      | { style?: CSSProperties }
-                      | undefined
-                  )?.style
-                  const alignClass =
-                    style?.textAlign === 'right' ? 'text-right' : undefined
-                  return (
-                    <TableHead
-                      key={header.id}
-                      className={alignClass}
-                      style={{ width: style?.width }}
-                    >
-                      {header.isPlaceholder
-                        ? null
-                        : flexRender(header.column.columnDef.header, header.getContext())}
-                    </TableHead>
-                  )
-                })}
-              </TableRow>
-            ))}
-          </TableHeader>
-        </Table>
-      </div>
-      <div ref={parentRef} className="overflow-y-auto flex-1 min-h-0">
-        <div style={{ position: "relative", height: shouldVirtualize ? totalHeight : undefined }}>
-          <Table className="table-fixed">
-            <ColGroup columns={columns} />
-            <TableBody>{renderRows()}</TableBody>
-          </Table>
-        </div>
-      </div>
-      {actions && <div className="shrink-0 border-t">{actions}</div>}
-    </div>
-  );
-}

package/src/components/data-table/table-detail-layout.tsx

@@ -1,98 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-// AllBlue - 理想之海
-// Copyright (C) 2026 AllBlue Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-import { useNavigate } from "@tanstack/react-router";
-import { m } from '@/paraglide/messages.js'
-import { Button } from "@/components/ui/button";
-import { Skeleton } from "@/components/ui/skeleton";
-import { ArrowLeftIcon } from "lucide-react";
-
-interface TableDetailLayoutProps {
-  backHref: string;
-  backLabel?: string;
-  title: string;
-  subtitle?: string;
-  avatar?: React.ReactNode;
-  badges?: React.ReactNode;
-  actions?: React.ReactNode;
-  loading?: boolean;
-  children: React.ReactNode;
-}
-
-export function TableDetailLayout({
-  backHref,
-  backLabel,
-  title,
-  subtitle,
-  avatar,
-  badges,
-  actions,
-  loading,
-  children,
-}: TableDetailLayoutProps) {
-  const navigate = useNavigate();
-  const resolvedBackLabel = backLabel ?? m.common_common_backToList()
-
-  if (loading) {
-    return (
-      <div className="p-6 space-y-6">
-        <Skeleton className="h-8 w-24" />
-        <div className="flex items-center gap-4">
-          <Skeleton className="h-12 w-12 rounded-full" />
-          <div className="space-y-2">
-            <Skeleton className="h-6 w-40" />
-            <Skeleton className="h-4 w-60" />
-          </div>
-        </div>
-        <Skeleton className="h-64 w-full" />
-      </div>
-    );
-  }
-
-  return (
-    <div>
-      <div className="sticky top-0 z-10 bg-background border-b px-6 py-2.5">
-        <Button
-          variant="ghost"
-          size="sm"
-          onClick={() => navigate({ to: backHref })}
-          className="gap-1.5 text-muted-foreground hover:text-foreground"
-        >
-          <ArrowLeftIcon className="h-4 w-4" />
-          {resolvedBackLabel}
-        </Button>
-      </div>
-      <div className="p-6 pt-4 space-y-6">
-        <div className="flex items-start justify-between">
-          <div className="flex items-center gap-4">
-            {avatar}
-            <div>
-              <div className="flex items-center gap-2">
-                <h1 className="text-2xl font-bold">{title}</h1>
-                {badges}
-              </div>
-              {subtitle && <p className="text-muted-foreground mt-1">{subtitle}</p>}
-            </div>
-          </div>
-          {actions && <div className="flex gap-2">{actions}</div>}
-        </div>
-
-        {children}
-      </div>
-    </div>
-  );
-}