@ian2018cs/agenthub 0.1.45 → 0.1.47

package/server/database/db.js

@@ -247,6 +247,43 @@ const runMigrations = () => {
       )
     `);
 
+    // Migration: Add super_admin role (recreate users table with updated CHECK constraint)
+    const hasAnyUser = db.prepare('SELECT COUNT(*) as count FROM users').get().count > 0;
+    const hasSuperAdmin = db.prepare("SELECT COUNT(*) as count FROM users WHERE role = 'super_admin'").get().count > 0;
+
+    if (hasAnyUser && !hasSuperAdmin) {
+      console.log('Running migration: Adding super_admin role and promoting first admin');
+      db.exec('PRAGMA foreign_keys = OFF');
+      db.transaction(() => {
+        db.exec(`CREATE TABLE users_new (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          username TEXT UNIQUE,
+          password_hash TEXT,
+          email TEXT UNIQUE,
+          uuid TEXT,
+          role TEXT DEFAULT 'user' CHECK(role IN ('admin', 'user', 'super_admin')),
+          status TEXT DEFAULT 'active' CHECK(status IN ('active', 'disabled')),
+          created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+          last_login DATETIME,
+          is_active BOOLEAN DEFAULT 1,
+          git_name TEXT,
+          git_email TEXT,
+          has_completed_onboarding BOOLEAN DEFAULT 0,
+          total_limit_usd REAL DEFAULT NULL,
+          daily_limit_usd REAL DEFAULT NULL
+        )`);
+        db.exec('INSERT INTO users_new SELECT id,username,password_hash,email,uuid,role,status,created_at,last_login,is_active,git_name,git_email,has_completed_onboarding,total_limit_usd,daily_limit_usd FROM users');
+        db.exec('DROP TABLE users');
+        db.exec('ALTER TABLE users_new RENAME TO users');
+        db.exec("UPDATE users SET role='super_admin' WHERE id=(SELECT MIN(id) FROM users WHERE role='admin')");
+      })();
+      db.exec('PRAGMA foreign_keys = ON');
+      db.exec('CREATE UNIQUE INDEX IF NOT EXISTS idx_users_uuid ON users(uuid)');
+      db.exec('CREATE INDEX IF NOT EXISTS idx_users_role ON users(role)');
+      db.exec('CREATE INDEX IF NOT EXISTS idx_users_status ON users(status)');
+      db.exec('CREATE UNIQUE INDEX IF NOT EXISTS idx_users_email ON users(email)');
+    }
+
     // 聊天图片持久化关联表
     db.exec(`
       CREATE TABLE IF NOT EXISTS message_images (
@@ -438,6 +475,15 @@ const userDb = {
     }
   },
 
+  // Update user role
+  updateUserRole: (userId, role) => {
+    try {
+      db.prepare('UPDATE users SET role = ? WHERE id = ?').run(role, userId);
+    } catch (err) {
+      throw err;
+    }
+  },
+
   // Update user status
   updateUserStatus: (userId, status) => {
     try {
@@ -795,13 +841,13 @@ const usageDb = {
     try {
       return db.prepare(`
         SELECT
-          user_uuid,
-          SUM(total_cost_usd) as total_cost,
-          SUM(request_count) as total_requests,
-          SUM(session_count) as total_sessions,
-          MAX(date) as last_active
-        FROM usage_daily_summary
-        GROUP BY user_uuid
+          uds.user_uuid,
+          SUM(uds.total_cost_usd) as total_cost,
+          SUM(uds.request_count) as total_requests,
+          (SELECT COUNT(DISTINCT ur.session_id) FROM usage_records ur WHERE ur.user_uuid = uds.user_uuid AND ur.session_id IS NOT NULL) as total_sessions,
+          MAX(uds.date) as last_active
+        FROM usage_daily_summary uds
+        GROUP BY uds.user_uuid
         ORDER BY total_cost DESC
       `).all();
     } catch (err) {
@@ -839,10 +885,10 @@ const usageDb = {
           SUM(total_input_tokens) as total_input_tokens,
           SUM(total_output_tokens) as total_output_tokens,
           SUM(request_count) as total_requests,
-          SUM(session_count) as total_sessions
+          (SELECT COUNT(DISTINCT session_id) FROM usage_records WHERE user_uuid = ? AND session_id IS NOT NULL) as total_sessions
         FROM usage_daily_summary
         WHERE user_uuid = ?
-      `).get(userUuid);
+      `).get(userUuid, userUuid);
     } catch (err) {
       throw err;
     }
@@ -859,6 +905,7 @@ const usageDb = {
           COUNT(*) as requests
         FROM usage_records
         WHERE user_uuid = ? AND created_at >= ? AND created_at <= ?
+          AND COALESCE(raw_model, model) != '<synthetic>'
         GROUP BY COALESCE(raw_model, model)
         ORDER BY cost DESC
       `).all(userUuid, startDate + 'T00:00:00', endDate + 'T23:59:59');
@@ -874,11 +921,11 @@ const usageDb = {
         SELECT
           SUM(total_cost_usd) as total_cost,
           SUM(request_count) as total_requests,
-          SUM(session_count) as total_sessions,
+          (SELECT COUNT(DISTINCT session_id) FROM usage_records WHERE date(created_at) >= ? AND date(created_at) <= ? AND session_id IS NOT NULL) as total_sessions,
           COUNT(DISTINCT user_uuid) as active_users
         FROM usage_daily_summary
         WHERE date >= ? AND date <= ?
-      `).get(startDate, endDate);
+      `).get(startDate, endDate, startDate, endDate);
 
       const dailyTrend = db.prepare(`
         SELECT
@@ -899,6 +946,7 @@ const usageDb = {
           COUNT(*) as requests
         FROM usage_records
         WHERE created_at >= ? AND created_at <= ?
+          AND COALESCE(raw_model, model) != '<synthetic>'
         GROUP BY COALESCE(raw_model, model)
         ORDER BY cost DESC
       `).all(startDate + 'T00:00:00', endDate + 'T23:59:59');

package/server/database/init.sql

@@ -11,7 +11,7 @@ CREATE TABLE IF NOT EXISTS users (
     password_hash TEXT,
     email TEXT UNIQUE,
     uuid TEXT,
-    role TEXT DEFAULT 'user' CHECK(role IN ('admin', 'user')),
+    role TEXT DEFAULT 'user' CHECK(role IN ('admin', 'user', 'super_admin')),
     status TEXT DEFAULT 'active' CHECK(status IN ('active', 'disabled')),
     created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
     last_login DATETIME,

package/server/routes/admin.js

@@ -7,14 +7,22 @@ import { deleteUserDirectories, initUserDirectories } from '../services/user-dir
 
 const router = express.Router();
 
-// Admin middleware
+// Admin middleware - allows both admin and super_admin
 const requireAdmin = (req, res, next) => {
-  if (req.user.role !== 'admin') {
+  if (req.user.role !== 'admin' && req.user.role !== 'super_admin') {
     return res.status(403).json({ error: 'Admin access required' });
   }
   next();
 };
 
+// Super admin only middleware
+const requireSuperAdmin = (req, res, next) => {
+  if (req.user.role !== 'super_admin') {
+    return res.status(403).json({ error: 'Super admin access required' });
+  }
+  next();
+};
+
 // Apply auth and admin middleware to all routes
 router.use(authenticateToken);
 router.use(requireAdmin);
@@ -108,6 +116,11 @@ router.patch('/users/:id', (req, res) => {
       return res.status(404).json({ error: 'User not found' });
     }
 
+    // admin cannot operate on other admin/super_admin users
+    if (req.user.role === 'admin' && ['admin', 'super_admin'].includes(user.role)) {
+      return res.status(403).json({ error: '无权操作管理员账户' });
+    }
+
     userDb.updateUserStatus(id, status);
     res.json({ success: true, message: `User status updated to ${status}` });
   } catch (error) {
@@ -131,6 +144,11 @@ router.delete('/users/:id', async (req, res) => {
       return res.status(404).json({ error: 'User not found' });
     }
 
+    // admin cannot delete other admin/super_admin users
+    if (req.user.role === 'admin' && ['admin', 'super_admin'].includes(user.role)) {
+      return res.status(403).json({ error: '无权删除管理员账户' });
+    }
+
     // Delete user directories
     if (user.uuid) {
       await deleteUserDirectories(user.uuid);
@@ -167,6 +185,11 @@ router.patch('/users/:id/password', async (req, res) => {
       return res.status(404).json({ error: '用户不存在' });
     }
 
+    // admin cannot reset password of other admin/super_admin users
+    if (req.user.role === 'admin' && ['admin', 'super_admin'].includes(user.role)) {
+      return res.status(403).json({ error: '无权重置管理员密码' });
+    }
+
     // Can only reset password for password-login users
     if (!user.password_hash) {
       return res.status(400).json({ error: '该用户使用邮箱验证码登录，无法重置密码' });
@@ -186,6 +209,37 @@ router.patch('/users/:id/password', async (req, res) => {
   }
 });
 
+// Update user role (super_admin only)
+router.patch('/users/:id/role', requireSuperAdmin, (req, res) => {
+  try {
+    const { id } = req.params;
+    const { role } = req.body;
+
+    if (!['admin', 'user'].includes(role)) {
+      return res.status(400).json({ error: '只能设置为 admin 或 user' });
+    }
+
+    if (parseInt(id) === req.user.id) {
+      return res.status(400).json({ error: '不能修改自己的角色' });
+    }
+
+    const user = userDb.getUserById(id);
+    if (!user) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+
+    if (user.role === 'super_admin') {
+      return res.status(403).json({ error: '不能修改超级管理员的角色' });
+    }
+
+    userDb.updateUserRole(id, role);
+    res.json({ success: true, message: '用户角色已更新' });
+  } catch (error) {
+    console.error('Error updating user role:', error);
+    res.status(500).json({ error: '更新用户角色失败' });
+  }
+});
+
 // ==================== User Spending Limits ====================
 
 // Get user spending limits
@@ -227,9 +281,17 @@ router.patch('/users/:id/limits', (req, res) => {
       }
     }
 
-    // Prevent modifying own limits
-    if (parseInt(id) === req.user.id) {
-      return res.status(400).json({ error: '不能修改自己的额度限制' });
+    const isSelf = parseInt(id) === req.user.id;
+
+    // admin can only set limits for themselves or for user-role accounts
+    if (req.user.role === 'admin' && !isSelf) {
+      const targetUser = userDb.getUserById(id);
+      if (!targetUser) {
+        return res.status(404).json({ error: 'User not found' });
+      }
+      if (['admin', 'super_admin'].includes(targetUser.role)) {
+        return res.status(403).json({ error: '无权修改管理员账户的限额' });
+      }
     }
 
     const user = userDb.getUserById(id);

package/server/routes/auth.js

@@ -111,13 +111,13 @@ router.post('/verify-code', async (req, res) => {
     // If user doesn't exist, create new user (registration)
     if (!user) {
       const userCount = userDb.getUserCount();
-      const role = userCount === 0 ? 'admin' : 'user';
+      const role = userCount === 0 ? 'super_admin' : 'user';
       const uuid = uuidv4();
 
       user = userDb.createUserWithEmail(email, uuid, role);
 
-      // Apply default total limit for non-admin users
-      if (role !== 'admin') {
+      // Apply default total limit for regular users only
+      if (role === 'user') {
         const defaultTotalLimit = settingsDb.get('default_total_limit_usd');
         if (defaultTotalLimit !== null) {
           userDb.updateUserLimits(user.id, parseFloat(defaultTotalLimit), null);
@@ -276,6 +276,7 @@ router.patch('/change-password', authenticateToken, async (req, res) => {
 // Get current user's spending limit status
 router.get('/limit-status', authenticateToken, (req, res) => {
   try {
+    if (req.user.role === 'super_admin') return res.json({ allowed: true });
     const status = usageDb.checkUserLimits(req.user.uuid);
     res.json(status);
   } catch (error) {

package/server/routes/usage.js

@@ -7,7 +7,7 @@ const router = express.Router();
 
 // Admin middleware
 const requireAdmin = (req, res, next) => {
-  if (req.user.role !== 'admin') {
+  if (req.user.role !== 'admin' && req.user.role !== 'super_admin') {
     return res.status(403).json({ error: 'Admin access required' });
   }
   next();

package/server/services/feishu/sdk-bridge.js

@@ -16,7 +16,7 @@
  */
 
 import { queryClaudeSDK } from '../../claude-sdk.js';
-import { usageDb } from '../../database/db.js';
+import { usageDb, userDb } from '../../database/db.js';
 import { feishuDb } from './feishu-db.js';
 import fs from 'fs/promises';
 import path from 'path';
@@ -413,14 +413,17 @@ async function runQuery({
   larkClient,
   pendingApprovals,
 }) {
-  // 限额检查
-  const limitStatus = usageDb.checkUserLimits(userUuid);
-  if (!limitStatus.allowed) {
-    const reason = limitStatus.reason === 'daily_limit_exceeded'
-      ? `每日用量已达上限 ($${limitStatus.limit.toFixed(2)})`
-      : `总用量已达上限 ($${limitStatus.limit.toFixed(2)})`;
-    await larkClient.sendText(chatId, `⚠️ ${reason}，请联系管理员。`);
-    return;
+  // 限额检查（super_admin 豁免）
+  const feishuUser = userDb.getUserByUuid(userUuid);
+  if (feishuUser?.role !== 'super_admin') {
+    const limitStatus = usageDb.checkUserLimits(userUuid);
+    if (!limitStatus.allowed) {
+      const reason = limitStatus.reason === 'daily_limit_exceeded'
+        ? `每日用量已达上限 ($${limitStatus.limit.toFixed(2)})`
+        : `总用量已达上限 ($${limitStatus.limit.toFixed(2)})`;
+      await larkClient.sendText(chatId, `⚠️ ${reason}，请联系管理员。`);
+      return;
+    }
   }
 
   const { claude_session_id, cwd, permission_mode } = state || {};