@allbluecn/admin-app 0.3.2 → 0.3.4

package/src/server/serverFns/user/list.ts

@@ -17,7 +17,8 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
+import { requireAdmin } from '@/server/auth-helpers'
 
 const listInput = z.object({
   page: z.number().default(1),
@@ -30,11 +31,13 @@ const listInput = z.object({
 export const listUsersFn = createServerFn({ method: 'GET' })
   .validator(listInput)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    await requireAdmin()
     const { page, pageSize, search, role, status } = data
     const where: any = {}
     if (search) {
       where.OR = [
-        { name: { contains: search, mode: 'insensitive' } },
+        { username: { contains: search, mode: 'insensitive' } },
         { email: { contains: search, mode: 'insensitive' } },
       ]
     }
@@ -46,8 +49,20 @@ export const listUsersFn = createServerFn({ method: 'GET' })
         skip: (page - 1) * pageSize,
         take: pageSize,
         orderBy: { createdAt: 'desc' },
-        include: {
-          _count: { select: { prds: true, anyhubMarketApps: true, reviews: true } },
+        // SEC-01 联动：select 显式列出 UI 所需列，绝不返回 password / aiApiKey 等凭据字段
+        select: {
+          id: true,
+          email: true,
+          username: true,
+          role: true,
+          status: true,
+          avatarConfig: true,
+          bgShape: true,
+          bgColor: true,
+          createdAt: true,
+          updatedAt: true,
+          lastLoginAt: true,
+          _count: { select: { designs: true, anyhubMarketApps: true, reviews: true } },
         },
       }),
       prisma.user.count({ where }),

package/src/server/serverFns/user/reset-password.ts

@@ -17,12 +17,20 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import bcrypt from 'bcryptjs'
+import { requireAdmin } from '@/server/auth-helpers'
 
 export const resetUserPasswordFn = createServerFn({ method: 'POST' })
   .validator(z.object({ userId: z.string(), newPassword: z.string().min(8) }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    await requireAdmin()
     const hashedPassword = await bcrypt.hash(data.newPassword, 12)
-    return prisma.user.update({ where: { id: data.userId }, data: { password: hashedPassword } })
+    return prisma.user.update({
+      where: { id: data.userId },
+      data: { password: hashedPassword },
+      // 不回显 password 哈希
+      select: { id: true, email: true, username: true, role: true, status: true },
+    })
   })

package/src/server/serverFns/user/update-role.ts

@@ -17,10 +17,18 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
+import { requireAdmin } from '@/server/auth-helpers'
 
 export const updateUserRoleFn = createServerFn({ method: 'POST' })
   .validator(z.object({ userId: z.string(), role: z.enum(['USER', 'ADMIN', 'SUPER_ADMIN']) }))
   .handler(async ({ data }) => {
-    return prisma.user.update({ where: { id: data.userId }, data: { role: data.role } })
+    const prisma = await getPrisma()
+    await requireAdmin()
+    return prisma.user.update({
+      where: { id: data.userId },
+      data: { role: data.role },
+      // 不回显 password 哈希
+      select: { id: true, email: true, username: true, role: true, status: true },
+    })
   })

package/src/server/serverFns/user/update-status.ts

@@ -17,10 +17,18 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
+import { requireAdmin } from '@/server/auth-helpers'
 
 export const updateUserStatusFn = createServerFn({ method: 'POST' })
   .validator(z.object({ userId: z.string(), status: z.enum(['ACTIVE', 'INACTIVE', 'BANNED']) }))
   .handler(async ({ data }) => {
-    return prisma.user.update({ where: { id: data.userId }, data: { status: data.status } })
+    const prisma = await getPrisma()
+    await requireAdmin()
+    return prisma.user.update({
+      where: { id: data.userId },
+      data: { status: data.status },
+      // 不回显 password 哈希
+      select: { id: true, email: true, username: true, role: true, status: true },
+    })
   })

package/src/styles/globals.css

@@ -3,6 +3,10 @@
 
 @import "tailwindcss";
 
+/* 共享 UI 包源码类名扫描（Tailwind v4 自动探测不覆盖 workspace 包，
+   缺失则 @allbluecn/ui 内组件的全部工具类不生成） */
+@source "../../../../packages/ui/src/**/*.{ts,tsx}";
+
 @import "tw-animate-css";
 
 @import "shadcn/tailwind.css";

package/src/components/ui/input.tsx

@@ -1,19 +0,0 @@
-import * as React from "react"
-import { Input as InputPrimitive } from "@base-ui/react/input"
-import { cn } from "cn"
-
-function Input({ className, type, ...props }: React.ComponentProps<"input">) {
-  return (
-    <InputPrimitive
-      type={type}
-      data-slot="input"
-      className={cn(
-        "h-9 w-full min-w-0 rounded-md border border-input bg-transparent px-2.5 py-1 text-base shadow-xs transition-[color,box-shadow] outline-none file:inline-flex file:h-7 file:border-0 file:bg-transparent file:text-sm file:font-medium file:text-foreground placeholder:text-muted-foreground focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 md:text-sm dark:bg-input/30 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40",
-        className
-      )}
-      {...props}
-    />
-  )
-}
-
-export { Input }