midway-fatcms 0.0.1-beta.6 → 0.0.1-beta.60

package/src/controller/manage/UserAccountManageApi.ts

@@ -1,88 +1,94 @@
-import { Controller, Inject, Post } from '@midwayjs/core';
-import { Context } from '@midwayjs/koa';
-import { KeysOfSimpleSQL, KeysOfValidators } from '../../libs/crud-pro/models/keys';
-import { BaseApiController } from '../base/BaseApiController';
-import { createUniqueId } from '../../libs/utils/functions';
-import { checkPermission } from '../../middleware/permission.middleware';
-import { SystemFuncCode } from '../../models/SystemPerm';
-import { CommonException, Exceptions } from '../../libs/crud-pro/exceptions';
-import { SystemTables } from '../../models/SystemTables';
-
-const accountNameBlacklist = new Set(['sa', 'root', 'admin', 'superadmin', 'administrator', 'sys', 'sysop', 'schedule_user']);
-function checkAccountCreateBlacklist(value: string) {
-  if (!value) {
-    return;
-  }
-  if (accountNameBlacklist.has(value)) {
-    throw new CommonException(Exceptions.VALIDATE_EXCEPTION, '用户名或昵称不能使用具有管理员歧义的词语');
-  }
-}
-
-const LOGIN_NAME_VALIDATE =  [KeysOfValidators.STRING, KeysOfValidators.NAME, 'length:6,50', checkAccountCreateBlacklist]
-
-@Controller('/ns/api/manage/userAccount', { middleware: [checkPermission(SystemFuncCode.UserAccountMangeRead)] })
-export class UserAccountManageApi extends BaseApiController {
-  @Inject()
-  ctx: Context;
-
-  @Post('/getUserAccountList')
-  async getUserAccountList() {
-    return this.executeSysSimpleSQL(SystemTables.sys_user_account, KeysOfSimpleSQL.SIMPLE_QUERY_PAGE, {
-      columns: '!pwd_md5,!pwd_salt',
-    });
-  }
-
-  @Post('/getUserAccountOne')
-  async getUserAccountOne() {
-    return this.executeSysSimpleSQL(SystemTables.sys_user_account, KeysOfSimpleSQL.SIMPLE_QUERY_ONE, {
-      columns: '!pwd_md5,!pwd_salt',
-    });
-  }
-
-  @Post('/updateUserAccount', { middleware: [checkPermission(SystemFuncCode.UserAccountMangeWrite)] })
-  async updateUserAccount() {
-    return this.executeSysSimpleSQL(SystemTables.sys_user_account, KeysOfSimpleSQL.SIMPLE_UPDATE, {
-      validateCfg: {
-        'condition.id': [KeysOfValidators.REQUIRED, KeysOfValidators.INTEGER],
-        'data.login_name': LOGIN_NAME_VALIDATE,
-        'data.nick_name': [KeysOfValidators.STRING, 'length:3,20', checkAccountCreateBlacklist],
-      },
-      allowCfg: {
-        data: ['login_name', 'nick_name', 'avatar', 'status'],
-      },
-    });
-  }
-
-  @Post('/createUserAccount', { middleware: [checkPermission(SystemFuncCode.UserAccountMangeWrite)] })
-  async createUserAccount() {
-    const body = this.ctx.request.body as any;
-    body.data.account_id = createUniqueId();
-
-    return this.executeSysSimpleSQL(SystemTables.sys_user_account, KeysOfSimpleSQL.SIMPLE_INSERT, {
-      validateCfg: {
-        'data.login_name': LOGIN_NAME_VALIDATE,
-        'data.nick_name': [KeysOfValidators.REQUIRED, KeysOfValidators.STRING, 'length:3,20', checkAccountCreateBlacklist],
-        'data.avatar': [KeysOfValidators.REQUIRED, KeysOfValidators.STRING],
-      },
-    });
-  }
-
-  @Post('/deleteUserAccount', { middleware: [checkPermission(SystemFuncCode.UserAccountMangeWrite)] })
-  async deleteUserAccount() {
-    return this.executeSysSimpleSQL(SystemTables.sys_user_account, KeysOfSimpleSQL.SIMPLE_DELETE, {
-      validateCfg: {
-        'condition.id': [KeysOfValidators.REQUIRED, KeysOfValidators.INTEGER],
-      },
-    });
-  }
-
-  /**
-   * 重置密码
-   */
-  @Post('/chgUserPassword', { middleware: [checkPermission(SystemFuncCode.UserAccountMangeWrite)] })
-  async chgUserPassword() {
-    const body = this.ctx.request.body as any;
-    const { loginName, unsaltedPwd } = body;
-    return this.userAccountService.chgUserPassword(loginName, unsaltedPwd);
-  }
-}
+import { Controller, Inject, Post } from '@midwayjs/core';
+import { Context } from '@midwayjs/koa';
+import { KeysOfSimpleSQL, KeysOfValidators } from '../../libs/crud-pro/models/keys';
+import { BaseApiController } from '../base/BaseApiController';
+import { createUniqueId } from '../../libs/utils/functions';
+import { checkPermission } from '../../middleware/permission.middleware';
+import { SystemFuncCode } from '../../models/SystemPerm';
+import { CommonException, Exceptions } from '../../libs/crud-pro/exceptions';
+import { SystemTables } from '../../models/SystemTables';
+import { GLOBAL_STATIC_CONFIG } from '@/libs/global-config/global-config';
+
+const accountNameBlacklist = new Set(['sa', 'root', 'admin', 'superadmin', 'administrator', 'sys', 'sysop', 'schedule_user']);
+function checkAccountCreateBlacklist(value: string) {
+  if (!value) {
+    return;
+  }
+  if (accountNameBlacklist.has(value)) {
+    throw new CommonException(Exceptions.VALIDATE_EXCEPTION, '用户名或昵称不能使用具有管理员歧义的词语');
+  }
+}
+
+const LOGIN_NAME_VALIDATE = [KeysOfValidators.STRING, KeysOfValidators.NAME, 'length:5,50', checkAccountCreateBlacklist];
+
+@Controller('/ns/api/manage/userAccount', { middleware: [checkPermission(SystemFuncCode.UserAccountMangeRead)] })
+export class UserAccountManageApi extends BaseApiController {
+  @Inject()
+  protected ctx: Context;
+
+  @Post('/getUserAccountList')
+  async getUserAccountList() {
+    return this.executeSysSimpleSQL(SystemTables.sys_user_account, KeysOfSimpleSQL.SIMPLE_QUERY_PAGE, {
+      columns: '!pwd_md5,!pwd_salt',
+    });
+  }
+
+  @Post('/getUserAccountOne')
+  async getUserAccountOne() {
+    return this.executeSysSimpleSQL(SystemTables.sys_user_account, KeysOfSimpleSQL.SIMPLE_QUERY_ONE, {
+      columns: '!pwd_md5,!pwd_salt',
+    });
+  }
+
+  @Post('/updateUserAccount', { middleware: [checkPermission(SystemFuncCode.UserAccountMangeWrite)] })
+  async updateUserAccount() {
+    return this.executeSysSimpleSQL(SystemTables.sys_user_account, KeysOfSimpleSQL.SIMPLE_UPDATE, {
+      validateCfg: {
+        'condition.id': [KeysOfValidators.REQUIRED, KeysOfValidators.NUMERIC],
+        'data.login_name': LOGIN_NAME_VALIDATE,
+        'data.nick_name': [KeysOfValidators.STRING, 'length:2,20', checkAccountCreateBlacklist],
+      },
+      allowCfg: {
+        data: ['login_name', 'nick_name', 'avatar', 'status', 'modified_at', 'created_at'],
+      },
+    });
+  }
+
+  @Post('/createUserAccount', { middleware: [checkPermission(SystemFuncCode.UserAccountMangeWrite)] })
+  async createUserAccount() {
+    const body = this.ctx.request.body as any;
+    body.data.account_id = createUniqueId();
+
+    const { generateUserAccountId } = GLOBAL_STATIC_CONFIG.getConfig();
+    if (typeof generateUserAccountId === 'function') {
+      body.data.account_id = await generateUserAccountId(body.data);
+    }
+
+    return this.executeSysSimpleSQL(SystemTables.sys_user_account, KeysOfSimpleSQL.SIMPLE_INSERT, {
+      validateCfg: {
+        'data.login_name': LOGIN_NAME_VALIDATE,
+        'data.nick_name': [KeysOfValidators.REQUIRED, KeysOfValidators.STRING, 'length:2,20', checkAccountCreateBlacklist],
+        'data.avatar': [KeysOfValidators.REQUIRED, KeysOfValidators.STRING],
+      },
+    });
+  }
+
+  @Post('/deleteUserAccount', { middleware: [checkPermission(SystemFuncCode.UserAccountMangeWrite)] })
+  async deleteUserAccount() {
+    return this.executeSysSimpleSQL(SystemTables.sys_user_account, KeysOfSimpleSQL.SIMPLE_DELETE, {
+      validateCfg: {
+        'condition.id': [KeysOfValidators.REQUIRED, KeysOfValidators.NUMERIC],
+      },
+    });
+  }
+
+  /**
+   * 重置密码
+   */
+  @Post('/chgUserPassword', { middleware: [checkPermission(SystemFuncCode.UserAccountMangeWrite)] })
+  async chgUserPassword() {
+    const body = this.ctx.request.body as any;
+    const { loginName, unsaltedPwd } = body;
+    return this.userAccountService.chgUserPassword(loginName, unsaltedPwd);
+  }
+}

package/src/controller/manage/WorkbenchMangeApi.ts

@@ -1,72 +1,72 @@
-import { Controller, Inject, Post } from '@midwayjs/core';
-import { Context } from '@midwayjs/koa';
-import { KeysOfSimpleSQL, KeysOfValidators } from '../../libs/crud-pro/models/keys';
-import { BaseApiController } from '../base/BaseApiController';
-import { checkPermission } from '../../middleware/permission.middleware';
-import { SystemFuncCode } from '../../models/SystemPerm';
-import { SystemTables } from '../../models/SystemTables';
-import { WorkbenchService } from '../../service/WorkbenchService';
-
-@Controller('/ns/api/manage/workbench', { middleware: [checkPermission(SystemFuncCode.WorkbenchMangeRead)] })
-export class WorkbenchMangeApi extends BaseApiController {
-  @Inject()
-  protected ctx: Context;
-
-  @Inject()
-  private workbenchService: WorkbenchService;
-
-  @Post('/getWorkbenchList')
-  async getWorkbenchList() {
-    return this.executeSysSimpleSQL(SystemTables.sys_workbench, KeysOfSimpleSQL.SIMPLE_QUERY_PAGE);
-  }
-
-  @Post('/getWorkbenchOne')
-  async getWorkbenchOne() {
-    return this.executeSysSimpleSQL(SystemTables.sys_workbench, KeysOfSimpleSQL.SIMPLE_QUERY_ONE);
-  }
-
-  @Post('/createWorkbench', { middleware: [checkPermission(SystemFuncCode.WorkbenchMangeWrite)] })
-  async createWorkbench() {
-    // 清除运行时缓存
-    this.workbenchService.clearCache();
-
-    const body = this.ctx.request.body as any;
-    const dataObj: any = body.data || {};
-
-    dataObj.html_content = dataObj.html_content || "<html>hello</html>";
-
-    return this.executeSysSimpleSQL(SystemTables.sys_workbench, KeysOfSimpleSQL.SIMPLE_INSERT, {
-      validateCfg: {
-        'data.workbench_code': [KeysOfValidators.REQUIRED, KeysOfValidators.STRING],
-        'data.workbench_name': [KeysOfValidators.REQUIRED, KeysOfValidators.STRING],
-        'data.workbench_domain': [KeysOfValidators.REQUIRED, KeysOfValidators.STRING],
-      },
-    });
-  }
-
-  @Post('/updateWorkbench', { middleware: [checkPermission(SystemFuncCode.WorkbenchMangeWrite)] })
-  async updateWorkbench() {
-    // 清除运行时缓存
-    this.workbenchService.clearCache();
-
-    return this.executeSysSimpleSQL(SystemTables.sys_workbench, KeysOfSimpleSQL.SIMPLE_UPDATE, {
-      validateCfg: {
-        'condition.id': [KeysOfValidators.REQUIRED, KeysOfValidators.INTEGER],
-        'condition.workbench_code': [KeysOfValidators.REQUIRED, KeysOfValidators.STRING],
-      },
-    });
-  }
-
-  @Post('/deleteWorkbench', { middleware: [checkPermission(SystemFuncCode.WorkbenchMangeWrite)] })
-  async deleteWorkbench() {
-    // 清除运行时缓存
-    this.workbenchService.clearCache();
-
-    return this.executeSysSimpleSQL(SystemTables.sys_workbench, KeysOfSimpleSQL.SIMPLE_DELETE, {
-      validateCfg: {
-        'condition.id': [KeysOfValidators.REQUIRED, KeysOfValidators.INTEGER],
-        'condition.workbench_code': [KeysOfValidators.REQUIRED, KeysOfValidators.STRING],
-      },
-    });
-  }
-}
+import { Controller, Inject, Post } from '@midwayjs/core';
+import { Context } from '@midwayjs/koa';
+import { KeysOfSimpleSQL, KeysOfValidators } from '@/libs/crud-pro/models/keys';
+import { BaseApiController } from '../base/BaseApiController';
+import { checkPermission } from '@/middleware/permission.middleware';
+import { SystemFuncCode } from '@/models/SystemPerm';
+import { SystemTables } from '@/models/SystemTables';
+import { WorkbenchService } from '@/service/WorkbenchService';
+
+@Controller('/ns/api/manage/workbench', { middleware: [checkPermission(SystemFuncCode.WorkbenchMangeRead)] })
+export class WorkbenchMangeApi extends BaseApiController {
+  @Inject()
+  protected ctx: Context;
+
+  @Inject()
+  private workbenchService: WorkbenchService;
+
+  @Post('/getWorkbenchList')
+  async getWorkbenchList() {
+    return this.executeSysSimpleSQL(SystemTables.sys_workbench, KeysOfSimpleSQL.SIMPLE_QUERY_PAGE);
+  }
+
+  @Post('/getWorkbenchOne')
+  async getWorkbenchOne() {
+    return this.executeSysSimpleSQL(SystemTables.sys_workbench, KeysOfSimpleSQL.SIMPLE_QUERY_ONE);
+  }
+
+  @Post('/createWorkbench', { middleware: [checkPermission(SystemFuncCode.WorkbenchMangeWrite)] })
+  async createWorkbench() {
+    // 清除运行时缓存
+    this.workbenchService.clearCache();
+
+    const body = this.ctx.request.body as any;
+    const dataObj: any = body.data || {};
+
+    dataObj.html_content = dataObj.html_content || '<html>hello</html>';
+
+    return this.executeSysSimpleSQL(SystemTables.sys_workbench, KeysOfSimpleSQL.SIMPLE_INSERT, {
+      validateCfg: {
+        'data.workbench_code': [KeysOfValidators.REQUIRED, KeysOfValidators.STRING],
+        'data.workbench_name': [KeysOfValidators.REQUIRED, KeysOfValidators.STRING],
+        'data.workbench_domain': [KeysOfValidators.REQUIRED, KeysOfValidators.STRING],
+      },
+    });
+  }
+
+  @Post('/updateWorkbench', { middleware: [checkPermission(SystemFuncCode.WorkbenchMangeWrite)] })
+  async updateWorkbench() {
+    // 清除运行时缓存
+    this.workbenchService.clearCache();
+
+    return this.executeSysSimpleSQL(SystemTables.sys_workbench, KeysOfSimpleSQL.SIMPLE_UPDATE, {
+      validateCfg: {
+        'condition.id': [KeysOfValidators.REQUIRED, KeysOfValidators.NUMERIC],
+        'condition.workbench_code': [KeysOfValidators.REQUIRED, KeysOfValidators.STRING],
+      },
+    });
+  }
+
+  @Post('/deleteWorkbench', { middleware: [checkPermission(SystemFuncCode.WorkbenchMangeWrite)] })
+  async deleteWorkbench() {
+    // 清除运行时缓存
+    this.workbenchService.clearCache();
+
+    return this.executeSysSimpleSQL(SystemTables.sys_workbench, KeysOfSimpleSQL.SIMPLE_DELETE, {
+      validateCfg: {
+        'condition.id': [KeysOfValidators.REQUIRED, KeysOfValidators.NUMERIC],
+        'condition.workbench_code': [KeysOfValidators.REQUIRED, KeysOfValidators.STRING],
+      },
+    });
+  }
+}

package/src/controller/myinfo/AuthController.ts

@@ -1,174 +1,108 @@
-import { Controller, Inject, Post } from '@midwayjs/core';
-import { Context } from '@midwayjs/koa';
-import axios from 'axios';
-import { BaseApiController } from '../base/BaseApiController';
-import { AuthService } from '../../service/AuthService';
-import {IConsumerUserInfo, ISessionInfo, SESSION_ID_KEY, sessionCookieCfg} from '../../models/userSession';
-import { CommonResult } from '../../libs/utils/common-dto';
-import { checkLogin } from '../../middleware/permission.middleware';
-import { assertCsrfToken } from "../../libs/utils/fatcms-request";
-import {WorkbenchService} from "../../service/WorkbenchService";
-import {CommonException} from "../../libs/crud-pro/exceptions";
-
-/**
- * 支持使用明文密码和Hash后密码登录。
- * 1. 明文密码登录，所需字段：loginName， plainPwd，
- * 2. Hash后密码登录，所需字段：loginName， unsaltedPwd
- */
-@Controller('/ns/api/auth')
-export class AuthController extends BaseApiController {
-  @Inject()
-  protected ctx: Context;
-
-  @Inject()
-  private authService: AuthService;
-
-
-  @Inject()
-  private workbenchService: WorkbenchService;
-
-  /**
-   * 登录
-   */
-  @Post('/login')
-  async login(): Promise<CommonResult> {
-    await assertCsrfToken(this.ctx);
-
-    // 先删除之前的SessionId
-    const sessionId = this.ctx.cookies.get(SESSION_ID_KEY, sessionCookieCfg);
-    await this.authService.removeUserSession(sessionId);
-
-    // eslint-disable-next-line prefer-const
-    let { loginName, unsaltedPwd, plainPwd } = this.ctx.request.body as any;
-    if (!unsaltedPwd && plainPwd) {
-      unsaltedPwd = this.authService.toUnsaltedPwd(plainPwd, loginName); // 使用明文密码登录时，转换成unsaltedPwd
-    }
-
-    const checkRes = await this.authService.checkLoginPassword(loginName, unsaltedPwd);
-    if (!checkRes.success) {
-      return checkRes;
-    }
-
-    const workbench = await this.workbenchService.getCurrentHostWorkbenchInfo();
-    if (!workbench) {
-      throw new CommonException('WORKBENCH_IS_NOT_FOUND', '站点未找到');
-    }
-
-
-    const userSessionInfo = await this.authService.createUserSession(loginName, workbench.workbench_code);
-
-    this.ctx.cookies.set(SESSION_ID_KEY, userSessionInfo.sessionId, sessionCookieCfg);
-
-    return CommonResult.successMsg('登录成功', userSessionInfo);
-  }
-
-
-  /**
-   * 使用https://medstatistic.com/账号登录
-   */
-  @Post('/loginByMedStatistic')
-  async loginByMedStatistic(): Promise<CommonResult> {
-
-    const { medStatisticToken } = this.ctx.request.body as any;
-    if (!medStatisticToken) {
-      return CommonResult.errorRes("medStatisticToken is null")
-    }
-
-    const workbench = await this.workbenchService.getCurrentHostWorkbenchInfo();
-    if (!workbench) {
-      throw new CommonException('WORKBENCH_IS_NOT_FOUND', '站点未找到');
-    }
-
-    // 先删除之前的cookie
-    const sessionId = this.ctx.cookies.get(SESSION_ID_KEY, sessionCookieCfg);
-    await this.authService.removeUserSession(sessionId);
-
-
-    let userInfoRes: any = null;
-    try {
-      userInfoRes = await axios.get("https://console.medstatistic.com/api/user/index?lang=zh-cn", {
-        headers: {
-          host: "console.medstatistic.com",
-          origin: "https://console.medstatistic.com",
-          token: medStatisticToken
-        },
-        responseType: 'json'
-      });
-
-    } catch (e) {
-      return CommonResult.errorRes(e?.message || '');
-    }
-
-    const userInfo = userInfoRes?.data?.data;
-
-    if (!userInfo || !userInfo.id) {
-      return CommonResult.errorRes("USER_NOT_EXIST")
-    }
-
-    const consumerUserInfo: IConsumerUserInfo = {
-      workbenchCode: workbench.workbench_code,
-      accountType: 'medstatistic',
-      accountId: userInfo.id,
-      nickName: userInfo.nickname,
-      loginName: `${userInfo.id}_${userInfo.username}`,
-      avatar: userInfo.avatar,
-    };
-
-    const userSessionInfo = await this.authService.createUserSessionForConsumer(consumerUserInfo);
-
-    this.ctx.cookies.set(SESSION_ID_KEY, userSessionInfo.sessionId, sessionCookieCfg);
-
-    return CommonResult.successMsg('登录成功', userSessionInfo);
-  }
-
-
-
-  /**
-   * 退出
-   */
-  @Post('/logout')
-  async logout(): Promise<CommonResult> {
-    const sessionId = this.ctx.cookies.get(SESSION_ID_KEY, sessionCookieCfg);
-    await this.authService.removeUserSession(sessionId);
-    this.ctx.cookies.set(SESSION_ID_KEY, '', sessionCookieCfg);
-    return CommonResult.successMsg('退出成功');
-  }
-
-
-  /**
-   * 避免Session过期，前端需要定时调用此接口刷新
-   */
-  @Post('/refreshSession', { middleware: [checkLogin()] })
-  async refreshSession(): Promise<CommonResult> {
-    const sessionInfo:ISessionInfo = this.ctx.userSession.getSessionInfo();
-    const newSessionInfo: ISessionInfo = await this.authService.refreshSession(sessionInfo);
-    this.ctx.cookies.set(SESSION_ID_KEY, newSessionInfo.sessionId, sessionCookieCfg);
-    return CommonResult.successRes(newSessionInfo);
-  }
-
-
-  /**
-   * 修改我自己的密码
-   */
-  @Post('/changeMyPassword', { middleware: [checkLogin()] })
-  async changeMyPassword(): Promise<CommonResult> {
-    const { unsaltedPwd } = this.ctx.request.body as any;
-    const loginName = this.ctx.userSession.getSessionInfo().loginName;
-
-    if (loginName === 'devopsviewer') {
-      return CommonResult.errorRes("开放体验账号不支持修改密码")
-    }
-
-    return this.userAccountService.chgUserPassword(loginName, unsaltedPwd);
-  }
-
-  /**
-   * 校验权限接口，给前端用的。用于界面按钮级权限控制
-   */
-  @Post('/batchCheckPermission', { middleware: [checkLogin()] })
-  async batchCheckPermission(): Promise<CommonResult> {
-    const { permissionCodeList, roleCodeList } = (this.ctx.request.body || {}) as any;
-    const res = this.ctx.userSession.batchCheckPermission({ permissionCodeList, roleCodeList });
-    return CommonResult.successRes(res);
-  }
-}
+import { Controller, Inject, Post } from '@midwayjs/core';
+import { Context } from '@midwayjs/koa';
+import { BaseApiController } from '../base/BaseApiController';
+import { AuthService } from '@/service/AuthService';
+import { ISessionInfo, SESSION_ID_KEY, sessionCookieCfg } from '@/models/userSession';
+import { CommonResult } from '@/libs/utils/common-dto';
+import { checkLogin } from '@/middleware/permission.middleware';
+import { assertCsrfToken } from '@/libs/utils/fatcms-request';
+import { WorkbenchService } from '@/service/WorkbenchService';
+import { CommonException } from '@/libs/crud-pro/exceptions';
+
+/**
+ * 支持使用明文密码和Hash后密码登录。
+ * 1. 明文密码登录，所需字段：loginName， plainPwd，
+ * 2. Hash后密码登录，所需字段：loginName， unsaltedPwd
+ */
+@Controller('/ns/api/auth')
+export class AuthController extends BaseApiController {
+  @Inject()
+  protected ctx: Context;
+
+  @Inject()
+  private authService: AuthService;
+
+  @Inject()
+  private workbenchService: WorkbenchService;
+
+  /**
+   * 登录
+   */
+  @Post('/login')
+  async login(): Promise<CommonResult> {
+    await assertCsrfToken(this.ctx);
+
+    // 先删除之前的SessionId
+    const sessionId = this.ctx.cookies.get(SESSION_ID_KEY, sessionCookieCfg);
+    await this.authService.removeUserSession(sessionId);
+
+    // eslint-disable-next-line prefer-const
+    let { loginName, unsaltedPwd, plainPwd } = this.ctx.request.body as any;
+    if (!unsaltedPwd && plainPwd) {
+      unsaltedPwd = this.authService.toUnsaltedPwd(plainPwd, loginName); // 使用明文密码登录时，转换成unsaltedPwd
+    }
+
+    const checkRes = await this.authService.checkLoginPassword(loginName, unsaltedPwd);
+    if (!checkRes.success) {
+      return checkRes;
+    }
+
+    const workbench = await this.workbenchService.getCurrentHostWorkbenchInfo();
+    if (!workbench) {
+      throw new CommonException('WORKBENCH_IS_NOT_FOUND', '站点未找到');
+    }
+
+    const userSessionInfo = await this.authService.createUserSession(loginName, workbench.workbench_code);
+
+    this.ctx.cookies.set(SESSION_ID_KEY, userSessionInfo.sessionId, sessionCookieCfg);
+
+    return CommonResult.successMsg('登录成功', userSessionInfo);
+  }
+
+  /**
+   * 退出
+   */
+  @Post('/logout')
+  async logout(): Promise<CommonResult> {
+    const sessionId = this.ctx.cookies.get(SESSION_ID_KEY, sessionCookieCfg);
+    await this.authService.removeUserSession(sessionId);
+    this.ctx.cookies.set(SESSION_ID_KEY, '', sessionCookieCfg);
+    return CommonResult.successMsg('退出成功');
+  }
+
+  /**
+   * 避免Session过期，前端需要定时调用此接口刷新
+   */
+  @Post('/refreshSession', { middleware: [checkLogin()] })
+  async refreshSession(): Promise<CommonResult> {
+    const sessionInfo: ISessionInfo = this.ctx.userSession.getSessionInfo();
+    const newSessionInfo: ISessionInfo = await this.authService.refreshSession(sessionInfo);
+    this.ctx.cookies.set(SESSION_ID_KEY, newSessionInfo.sessionId, sessionCookieCfg);
+    return CommonResult.successRes(newSessionInfo);
+  }
+
+  /**
+   * 修改我自己的密码
+   */
+  @Post('/changeMyPassword', { middleware: [checkLogin()] })
+  async changeMyPassword(): Promise<CommonResult> {
+    const { unsaltedPwd } = this.ctx.request.body as any;
+    const loginName = this.ctx.userSession.getSessionInfo().loginName;
+
+    if (loginName === 'devopsviewer') {
+      return CommonResult.errorRes('开放体验账号不支持修改密码');
+    }
+
+    return this.userAccountService.chgUserPassword(loginName, unsaltedPwd);
+  }
+
+  /**
+   * 校验权限接口，给前端用的。用于界面按钮级权限控制
+   */
+  @Post('/batchCheckPermission', { middleware: [checkLogin()] })
+  async batchCheckPermission(): Promise<CommonResult> {
+    const { permissionCodeList, roleCodeList } = (this.ctx.request.body || {}) as any;
+    const res = this.ctx.userSession.batchCheckPermission({ permissionCodeList, roleCodeList });
+    return CommonResult.successRes(res);
+  }
+}