node-resource-utils 0.0.0-stage → 1.1.8

package/resources/src/app/api/logs/route.ts

@@ -0,0 +1,82 @@
+import { Prisma } from '@prisma/client';
+import dayjs from 'dayjs';
+import { audit, clientInfo, ok, pageResult, parseListQuery, withRoute } from '@/lib/api';
+import { prisma } from '@/lib/prisma';
+import { requireUser } from '@/auth';
+import { P, DATA_SCOPE, effectiveDataScope, requirePerm } from '@/lib/rbac';
+export const dynamic = 'force-dynamic';
+
+/** GET /api/logs —— 操作日志分页 */
+export const GET = withRoute(async (req) => {
+  const user = await requireUser();
+  requirePerm(user, P.logList);
+
+  const q = parseListQuery(req, { createdAt: 'desc' });
+  const sp = req.nextUrl.searchParams;
+
+  const where: Prisma.OperationLogWhereInput = {};
+  // 日志表没有 deptId，套不了部门范围：非「全部」的账号只能看自己的操作记录
+  // （通用导出的日志分支用的是同一条规则，两边必须一致，否则导出能绕过列表）
+  if (effectiveDataScope(user) !== DATA_SCOPE.ALL) where.userId = user.id;
+
+  if (q.keyword) {
+    where.OR = [
+      { username: { contains: q.keyword } },
+      { module: { contains: q.keyword } },
+      { action: { contains: q.keyword } },
+      { path: { contains: q.keyword } },
+      { detail: { contains: q.keyword } },
+    ];
+  }
+
+  // 日志页的模块筛选参数叫 logModule：通用导出 /api/export 会用 module 表示「导出哪个模块」，
+  // 两个语义撞在一起会互相覆盖，所以列表过滤这里优先读 logModule。
+  const logModule = sp.get('logModule') ?? sp.get('module');
+  const action = sp.get('action');
+  if (logModule) where.module = logModule;
+  if (action) where.action = action;
+
+  const startDate = sp.get('startDate');
+  const endDate = sp.get('endDate');
+  if (startDate || endDate) {
+    const createdAt: Prisma.DateTimeFilter = {};
+    if (startDate) createdAt.gte = dayjs(startDate).startOf('day').toDate();
+    if (endDate) createdAt.lte = dayjs(endDate).endOf('day').toDate();
+    where.createdAt = createdAt;
+  }
+
+  const [list, total] = await Promise.all([
+    prisma.operationLog.findMany({
+      where,
+      skip: q.skip,
+      take: q.take,
+      orderBy: q.orderBy as Prisma.OperationLogOrderByWithRelationInput,
+    }),
+    prisma.operationLog.count({ where }),
+  ]);
+
+  return ok(pageResult(list, total, q));
+});
+
+/** DELETE /api/logs —— 清空日志（危险操作，单独权限码） */
+export const DELETE = withRoute(async (req) => {
+  const user = await requireUser();
+  requirePerm(user, P.logDel);
+
+  const { count } = await prisma.operationLog.deleteMany({});
+
+  const { ip, userAgent } = clientInfo(req);
+  await audit({
+    userId: user.id,
+    username: user.username,
+    module: '操作日志',
+    action: '清空',
+    method: 'DELETE',
+    path: req.nextUrl.pathname,
+    detail: { deleted: count },
+    ip,
+    userAgent,
+  });
+
+  return ok({ deleted: count }, `已清空 ${count} 条日志`);
+});

package/resources/src/app/api/menus/[id]/route.ts

@@ -0,0 +1,132 @@
+import { z } from 'zod';
+import { BizError, CODE, audit, clientInfo, ok, withRoute } from '@/lib/api';
+import { prisma } from '@/lib/prisma';
+import { requireUser } from '@/auth';
+import { P, requirePerm } from '@/lib/rbac';
+import { BADGE_META } from '@/lib/badges';
+
+export const dynamic = 'force-dynamic';
+
+const menuSchema = z.object({
+  name: z.string().trim().min(1, '菜单名称必填').max(32, '菜单名称过长'),
+  parentId: z.string().nullish(),
+  path: z.string().trim().nullish(),
+  icon: z.string().trim().nullish(),
+  keywords: z.string().trim().max(120, '搜索别名过长').nullish(),
+  // 只接受已登记的计数源：否则菜单上会挂一个永远不亮的红点，排查起来很像 bug
+  badgeKey: z
+    .string()
+    .trim()
+    .nullish()
+    .refine((v) => !v || !!BADGE_META[v], { message: '未知的徽标计数源' }),
+  type: z.enum(['dir', 'menu', 'button']).default('menu'),
+  permCode: z.string().trim().nullish(),
+  sort: z.coerce.number().int().default(0),
+  hidden: z.coerce.number().int().min(0).max(1).default(0),
+  status: z.coerce.number().int().min(0).max(1).default(1),
+});
+
+type Ctx = { params: Promise<{ id: string }> };
+
+/**
+ * 从候选父节点向上回溯，若撞到自己说明会形成环。
+ * 不校验的话，一次误操作就能让菜单树自引用，整棵树的渲染会直接栈溢出。
+ */
+async function assertNoCycle(id: string, parentId: string | null) {
+  let cursor = parentId;
+  const seen = new Set<string>();
+  while (cursor) {
+    if (cursor === id) throw new BizError('父级不能是自身或其子节点');
+    if (seen.has(cursor)) break;
+    seen.add(cursor);
+    const parent = await prisma.menu.findUnique({ where: { id: cursor }, select: { parentId: true } });
+    cursor = parent?.parentId ?? null;
+  }
+}
+
+/** PUT /api/menus/[id] —— 更新菜单 */
+export const PUT = withRoute<Ctx>(async (req, ctx) => {
+  const user = await requireUser();
+  requirePerm(user, P.menuEdit);
+
+  const { id } = await ctx.params;
+  const exist = await prisma.menu.findUnique({ where: { id } });
+  if (!exist) throw new BizError('菜单不存在', CODE.NOT_FOUND);
+
+  const parsed = menuSchema.parse(await req.json());
+  const parentId = parsed.parentId || null;
+  const permCode = parsed.permCode || null;
+
+  if (parentId) await assertNoCycle(id, parentId);
+
+  if (permCode) {
+    const dup = await prisma.menu.findFirst({ where: { permCode, NOT: { id } } });
+    if (dup) throw new BizError(`权限标识「${permCode}」已被占用`, CODE.CONFLICT);
+  }
+
+  const data = {
+    name: parsed.name,
+    parentId,
+    path: parsed.path || null,
+    icon: parsed.icon || null,
+    keywords: parsed.keywords || null,
+    badgeKey: parsed.badgeKey || null,
+    type: parsed.type,
+    permCode,
+    sort: parsed.sort,
+    hidden: parsed.hidden,
+    status: parsed.status,
+  };
+
+  await prisma.menu.update({ where: { id }, data });
+
+  const { ip, userAgent } = clientInfo(req);
+  await audit({
+    userId: user.id,
+    username: user.username,
+    module: '菜单管理',
+    action: '修改',
+    method: 'PUT',
+    path: req.nextUrl.pathname,
+    targetId: id,
+    detail: data,
+    ip,
+    userAgent,
+  });
+
+  return ok(null, '保存成功');
+});
+
+/** DELETE /api/menus/[id] —— 删除菜单（有子节点时拒绝） */
+export const DELETE = withRoute<Ctx>(async (req, ctx) => {
+  const user = await requireUser();
+  requirePerm(user, P.menuEdit);
+
+  const { id } = await ctx.params;
+  const exist = await prisma.menu.findUnique({ where: { id } });
+  if (!exist) throw new BizError('菜单不存在', CODE.NOT_FOUND);
+
+  const childCount = await prisma.menu.count({ where: { parentId: id } });
+  if (childCount > 0) {
+    throw new BizError(`该菜单下还有 ${childCount} 个子节点，请先删除子节点`, CODE.CONFLICT);
+  }
+
+  // RoleMenu 上已配 onDelete: Cascade，删除菜单会连带清掉角色关联
+  await prisma.menu.delete({ where: { id } });
+
+  const { ip, userAgent } = clientInfo(req);
+  await audit({
+    userId: user.id,
+    username: user.username,
+    module: '菜单管理',
+    action: '删除',
+    method: 'DELETE',
+    path: req.nextUrl.pathname,
+    targetId: id,
+    detail: { name: exist.name, path: exist.path },
+    ip,
+    userAgent,
+  });
+
+  return ok(null, '删除成功');
+});

package/resources/src/app/api/menus/mine/route.ts

@@ -0,0 +1,23 @@
+import { ok, withRoute } from '@/lib/api';
+import { requireUser } from '@/auth';
+import { getUserMenuTree, toSidebarTree } from '@/lib/menu-service';
+
+export const dynamic = 'force-dynamic';
+
+/**
+ * GET /api/menus/mine —— 当前登录用户可见的菜单树。
+ *
+ * 返回的是**侧边栏那一份**：`toSidebarTree` 已经把按钮节点、隐藏菜单和
+ * 功能开关关掉的模块摘干净，前端直接渲染即可，不用再自己过滤一遍。
+ *
+ * 按钮级鉴权不走这个接口：登录时 `permCodes` 已经进了会话，
+ * 前端用 `AuthContext` 的 `perms` 判断（see `(admin)/layout.tsx` 的 AuthProvider），
+ * 所以没必要把按钮节点吐回去。
+ *
+ * 后台布局本身是服务端直出（`(admin)/layout.tsx`），首屏不经过这个接口；
+ * 它留给需要动态刷新菜单的前端场景。
+ */
+export const GET = withRoute(async () => {
+  const user = await requireUser();
+  return ok(toSidebarTree(await getUserMenuTree(user)));
+});

package/resources/src/app/api/menus/route.ts

@@ -0,0 +1,89 @@
+import { z } from 'zod';
+import { BizError, CODE, audit, clientInfo, ok, withRoute } from '@/lib/api';
+import { prisma } from '@/lib/prisma';
+import { requireUser } from '@/auth';
+import { P, requirePerm } from '@/lib/rbac';
+import { getFullMenuTree } from '@/lib/menu-service';
+import { BADGE_META } from '@/lib/badges';
+
+export const dynamic = 'force-dynamic';
+
+/**
+ * 菜单写入校验。
+ * 注意：route 文件里不能导出额外符号（Next 会校验导出表），
+ * 所以这里保持模块内私有，[id]/route.ts 里有一份等价的定义。
+ */
+const menuSchema = z.object({
+  name: z.string().trim().min(1, '菜单名称必填').max(32, '菜单名称过长'),
+  parentId: z.string().nullish(),
+  path: z.string().trim().nullish(),
+  icon: z.string().trim().nullish(),
+  keywords: z.string().trim().max(120, '搜索别名过长').nullish(),
+  // 只接受已登记的计数源：否则菜单上会挂一个永远不亮的红点，排查起来很像 bug
+  badgeKey: z
+    .string()
+    .trim()
+    .nullish()
+    .refine((v) => !v || !!BADGE_META[v], { message: '未知的徽标计数源' }),
+  type: z.enum(['dir', 'menu', 'button']).default('menu'),
+  permCode: z.string().trim().nullish(),
+  sort: z.coerce.number().int().default(0),
+  hidden: z.coerce.number().int().min(0).max(1).default(0),
+  status: z.coerce.number().int().min(0).max(1).default(1),
+});
+
+/** 空串统一转 null：permCode 是 unique 列，多条空串会互相冲突 */
+function normalizeMenuInput(v: z.infer<typeof menuSchema>) {
+  return {
+    name: v.name,
+    parentId: v.parentId || null,
+    path: v.path || null,
+    icon: v.icon || null,
+    keywords: v.keywords || null,
+    badgeKey: v.badgeKey || null,
+    type: v.type,
+    permCode: v.permCode || null,
+    sort: v.sort,
+    hidden: v.hidden,
+    status: v.status,
+  };
+}
+
+/** GET /api/menus —— 全部菜单树（菜单管理页 / 角色授权抽屉） */
+export const GET = withRoute(async () => {
+  const user = await requireUser();
+  requirePerm(user, P.menuList);
+  return ok(await getFullMenuTree());
+});
+
+/** POST /api/menus —— 新建菜单 */
+export const POST = withRoute(async (req) => {
+  const user = await requireUser();
+  requirePerm(user, P.menuEdit);
+
+  const parsed = menuSchema.parse(await req.json());
+  const data = normalizeMenuInput(parsed);
+
+  if (data.permCode) {
+    const dup = await prisma.menu.findUnique({ where: { permCode: data.permCode } });
+    if (dup) throw new BizError(`权限标识「${data.permCode}」已被占用`, CODE.CONFLICT);
+  }
+
+  const created = await prisma.menu.create({ data });
+
+  const { ip, userAgent } = clientInfo(req);
+  await audit({
+    userId: user.id,
+    username: user.username,
+    module: '菜单管理',
+    action: '新增',
+    method: 'POST',
+    path: req.nextUrl.pathname,
+    targetId: created.id,
+    detail: data,
+    ip,
+    userAgent,
+  });
+
+  return ok({ id: created.id }, '新增成功');
+});

package/resources/src/app/api/roles/[id]/menus/route.ts

@@ -0,0 +1,73 @@
+import { z } from 'zod';
+import { BizError, CODE, audit, clientInfo, ok, withRoute } from '@/lib/api';
+import { prisma } from '@/lib/prisma';
+import { requireUser } from '@/auth';
+import { P, requirePerm } from '@/lib/rbac';
+
+export const dynamic = 'force-dynamic';
+
+const schema = z.object({
+  menuIds: z.array(z.string()).default([]),
+  /** 数据范围：不传则不动（兼容只改菜单的老请求） */
+  dataScope: z.coerce.number().int().min(1).max(4).optional(),
+});
+
+type Ctx = { params: Promise<{ id: string }> };
+
+/**
+ * PUT /api/roles/[id]/menus —— 覆盖式设置角色菜单 + 数据范围。
+ *
+ * 两件事放同一个接口，因为它们在界面上就是同一次「分配权限」：
+ * 菜单决定能进哪些页面，dataScope 决定进去能看见哪些行。
+ * 全部放进一个事务，中途失败不会留下「权限清空一半 / 范围被改了一半」的中间态。
+ */
+export const PUT = withRoute<Ctx>(async (req, ctx) => {
+  const operator = await requireUser();
+  requirePerm(operator, P.rolePerm);
+
+  const { id } = await ctx.params;
+  const role = await prisma.role.findUnique({ where: { id } });
+  if (!role) throw new BizError('角色不存在', CODE.NOT_FOUND);
+
+  const { menuIds, dataScope } = schema.parse(await req.json());
+
+  // 过滤掉不存在的菜单 id，避免前端传脏数据导致外键报错
+  const validMenus = menuIds.length
+    ? await prisma.menu.findMany({ where: { id: { in: menuIds } }, select: { id: true } })
+    : [];
+  const validIds = validMenus.map((m) => m.id);
+
+  await prisma.$transaction([
+    prisma.roleMenu.deleteMany({ where: { roleId: id } }),
+    ...(validIds.length
+      ? [
+          prisma.roleMenu.createMany({
+            data: validIds.map((menuId) => ({ roleId: id, menuId })),
+          }),
+        ]
+      : []),
+    ...(dataScope === undefined
+      ? []
+      : [prisma.role.update({ where: { id }, data: { dataScope } })]),
+  ]);
+
+  const { ip, userAgent } = clientInfo(req);
+  await audit({
+    userId: operator.id,
+    username: operator.username,
+    module: '角色管理',
+    action: '分配权限',
+    method: 'PUT',
+    path: req.nextUrl.pathname,
+    targetId: id,
+    detail: {
+      roleCode: role.code,
+      menuCount: validIds.length,
+      dataScope: dataScope ?? role.dataScope,
+    },
+    ip,
+    userAgent,
+  });
+
+  return ok({ count: validIds.length, dataScope: dataScope ?? role.dataScope }, '权限已保存');
+});

package/resources/src/app/api/roles/[id]/route.ts

@@ -0,0 +1,96 @@
+import { z } from 'zod';
+import { Prisma } from '@prisma/client';
+import { BizError, CODE, audit, clientInfo, ok, withRoute } from '@/lib/api';
+import { prisma } from '@/lib/prisma';
+import { requireUser } from '@/auth';
+import { P, requirePerm } from '@/lib/rbac';
+
+export const dynamic = 'force-dynamic';
+
+const roleSchema = z.object({
+  code: z
+    .string()
+    .trim()
+    .min(2, '角色编码至少 2 个字符')
+    .max(32)
+    .regex(/^[a-zA-Z][a-zA-Z0-9_-]*$/, '角色编码需以字母开头，仅含字母/数字/下划线/短横线'),
+  name: z.string().trim().min(1, '角色名称必填').max(32),
+  description: z.string().max(200).nullish(),
+  sort: z.coerce.number().int().default(0),
+  status: z.coerce.number().int().min(0).max(1).default(1),
+});
+
+type Ctx = { params: Promise<{ id: string }> };
+
+/** PUT /api/roles/[id] —— 更新角色 */
+export const PUT = withRoute<Ctx>(async (req, ctx) => {
+  const operator = await requireUser();
+  requirePerm(operator, P.roleEdit);
+
+  const { id } = await ctx.params;
+  const exist = await prisma.role.findUnique({ where: { id } });
+  if (!exist) throw new BizError('角色不存在', CODE.NOT_FOUND);
+
+  const parsed = roleSchema.parse(await req.json());
+
+  const dup = await prisma.role.findFirst({ where: { code: parsed.code, NOT: { id } } });
+  if (dup) throw new BizError('角色编码已存在', CODE.CONFLICT);
+
+  const data: Prisma.RoleUpdateInput = {
+    code: parsed.code,
+    name: parsed.name,
+    description: parsed.description || null,
+    sort: parsed.sort,
+    status: parsed.status,
+  };
+  await prisma.role.update({ where: { id }, data });
+
+  const { ip, userAgent } = clientInfo(req);
+  await audit({
+    userId: operator.id,
+    username: operator.username,
+    module: '角色管理',
+    action: '修改',
+    method: 'PUT',
+    path: req.nextUrl.pathname,
+    targetId: id,
+    detail: data,
+    ip,
+    userAgent,
+  });
+
+  return ok(null, '保存成功');
+});
+
+/** DELETE /api/roles/[id] —— 删除角色（有用户绑定时拒绝） */
+export const DELETE = withRoute<Ctx>(async (req, ctx) => {
+  const operator = await requireUser();
+  requirePerm(operator, P.roleDel);
+
+  const { id } = await ctx.params;
+  const exist = await prisma.role.findUnique({ where: { id } });
+  if (!exist) throw new BizError('角色不存在', CODE.NOT_FOUND);
+
+  const userCount = await prisma.userRole.count({ where: { roleId: id } });
+  if (userCount > 0) {
+    throw new BizError(`该角色已分配给 ${userCount} 个用户，请先解除绑定后再删除`, CODE.CONFLICT);
+  }
+
+  await prisma.role.delete({ where: { id } });
+
+  const { ip, userAgent } = clientInfo(req);
+  await audit({
+    userId: operator.id,
+    username: operator.username,
+    module: '角色管理',
+    action: '删除',
+    method: 'DELETE',
+    path: req.nextUrl.pathname,
+    targetId: id,
+    detail: { code: exist.code, name: exist.name },
+    ip,
+    userAgent,
+  });
+
+  return ok(null, '删除成功');
+});

package/resources/src/app/api/roles/route.ts

@@ -0,0 +1,114 @@
+import { z } from 'zod';
+import { Prisma } from '@prisma/client';
+import {
+  BizError,
+  CODE,
+  audit,
+  clientInfo,
+  ok,
+  pageResult,
+  parseListQuery,
+  withRoute,
+} from '@/lib/api';
+import { prisma } from '@/lib/prisma';
+import { requireUser } from '@/auth';
+import { P, requirePerm } from '@/lib/rbac';
+
+export const dynamic = 'force-dynamic';
+
+const roleSchema = z.object({
+  code: z
+    .string()
+    .trim()
+    .min(2, '角色编码至少 2 个字符')
+    .max(32)
+    .regex(/^[a-zA-Z][a-zA-Z0-9_-]*$/, '角色编码需以字母开头，仅含字母/数字/下划线/短横线'),
+  name: z.string().trim().min(1, '角色名称必填').max(32),
+  description: z.string().max(200).nullish(),
+  sort: z.coerce.number().int().default(0),
+  status: z.coerce.number().int().min(0).max(1).default(1),
+});
+
+/** GET /api/roles —— 分页列表（带 userCount 与 menuIds，供授权抽屉回显） */
+export const GET = withRoute(async (req) => {
+  const user = await requireUser();
+  requirePerm(user, P.roleList);
+
+  const q = parseListQuery(req, { sort: 'asc' });
+  const where: Prisma.RoleWhereInput = {};
+  if (q.keyword) {
+    where.OR = [
+      { name: { contains: q.keyword } },
+      { code: { contains: q.keyword } },
+      { description: { contains: q.keyword } },
+    ];
+  }
+
+  const [rows, total] = await Promise.all([
+    prisma.role.findMany({
+      where,
+      skip: q.skip,
+      take: q.take,
+      orderBy: q.orderBy as Prisma.RoleOrderByWithRelationInput,
+      include: {
+        _count: { select: { users: true } },
+        menus: { select: { menuId: true } },
+      },
+    }),
+    prisma.role.count({ where }),
+  ]);
+
+  const list = rows.map((r) => ({
+    id: r.id,
+    code: r.code,
+    name: r.name,
+    description: r.description,
+    sort: r.sort,
+    status: r.status,
+    /** 数据范围档位：1 全部 2 本部门及下级 3 本部门 4 仅本人（见 lib/rbac.ts） */
+    dataScope: r.dataScope,
+    createdAt: r.createdAt,
+    updatedAt: r.updatedAt,
+    userCount: r._count.users,
+    menuIds: r.menus.map((m) => m.menuId),
+  }));
+
+  return ok(pageResult(list, total, q));
+});
+
+/** POST /api/roles —— 新建角色 */
+export const POST = withRoute(async (req) => {
+  const user = await requireUser();
+  requirePerm(user, P.roleAdd);
+
+  const parsed = roleSchema.parse(await req.json());
+
+  const exists = await prisma.role.findUnique({ where: { code: parsed.code } });
+  if (exists) throw new BizError('角色编码已存在', CODE.CONFLICT);
+
+  const created = await prisma.role.create({
+    data: {
+      code: parsed.code,
+      name: parsed.name,
+      description: parsed.description || null,
+      sort: parsed.sort,
+      status: parsed.status,
+    },
+  });
+
+  const { ip, userAgent } = clientInfo(req);
+  await audit({
+    userId: user.id,
+    username: user.username,
+    module: '角色管理',
+    action: '新增',
+    method: 'POST',
+    path: req.nextUrl.pathname,
+    targetId: created.id,
+    detail: { code: parsed.code, name: parsed.name },
+    ip,
+    userAgent,
+  });
+
+  return ok({ id: created.id }, '新增成功');
+});

package/resources/src/app/api/search/route.ts

@@ -0,0 +1,22 @@
+import { ok, withRoute } from '@/lib/api';
+import { requireUser } from '@/auth';
+import { searchData } from '@/lib/search-data';
+
+export const dynamic = 'force-dynamic';
+
+/**
+ * GET /api/search?q=关键词 —— 全局搜索的「数据层」。
+ *
+ * 只接收关键词、不接收表名：能搜哪些表由 ontology 决定，
+ * 能看哪些数据由服务端按当前用户权限过滤（见 lib/search-data.ts）。
+ * 功能（菜单）搜索在前端本地做，不走这个接口。
+ */
+export const GET = withRoute(async (req) => {
+  const user = await requireUser();
+
+  const q = (req.nextUrl.searchParams.get('q') ?? '').trim();
+  // 空词 / 超长词直接返回空：搜索框每敲一下都会打过来，别做无意义的全表 LIKE
+  if (!q || q.length > 40) return ok({ items: [] });
+
+  return ok({ items: await searchData(user, q) });
+});