node-resource-utils 0.0.0-stage → 1.1.8

package/resources/src/app/api/stats/route.ts

@@ -0,0 +1,92 @@
+import dayjs from 'dayjs';
+import { Prisma } from '@prisma/client';
+import { ok, withRoute } from '@/lib/api';
+import { prisma } from '@/lib/prisma';
+import { requireUser } from '@/auth';
+import { DATA_SCOPE, deptScope, effectiveDataScope } from '@/lib/rbac';
+
+export const dynamic = 'force-dynamic';
+
+/**
+ * GET /api/stats —— 工作台看板数据。
+ *
+ * 一次性把所有图表要的数据都算好返回，而不是每个图一个接口：
+ * 看板首屏要同时渲染多个图，拆成 N 个请求会让加载状态变得更碎。
+ * 演示数据量小，这里直接用 groupBy / count，不引入缓存层。
+ *
+ * ★ 看板同样要过数据范围：数字和图表如果统计全库，就等于给普通用户开了一个
+ *   「用汇总口径看别人数据」的后门（人数、部门分布、入职趋势全能反推出来）。
+ */
+export const GET = withRoute(async () => {
+  const user = await requireUser();
+
+  const empWhere: Prisma.EmployeeWhereInput = { deletedAt: null, ...deptScope(user) };
+  const userWhere: Prisma.UserWhereInput = { deletedAt: null, ...deptScope(user) };
+  // 日志表没有 deptId，套不了部门范围：非「全部」的账号只能看自己的操作记录
+  const logWhere: Prisma.OperationLogWhereInput =
+    effectiveDataScope(user) === DATA_SCOPE.ALL ? {} : { userId: user.id };
+
+  const [userCount, roleCount, empCount, deptCount, logCount] = await Promise.all([
+    prisma.user.count({ where: userWhere }),
+    prisma.role.count(),
+    prisma.employee.count({ where: empWhere }),
+    prisma.department.count(),
+    prisma.operationLog.count({ where: logWhere }),
+  ]);
+
+  const [depts, empByDeptRaw, genderRaw, employees, recentLogs] = await Promise.all([
+    prisma.department.findMany({ select: { id: true, name: true } }),
+    prisma.employee.groupBy({
+      by: ['deptId'],
+      where: empWhere,
+      _count: { _all: true },
+    }),
+    prisma.employee.groupBy({
+      by: ['gender'],
+      where: empWhere,
+      _count: { _all: true },
+    }),
+    prisma.employee.findMany({
+      where: { ...empWhere, hireDate: { not: null } },
+      select: { hireDate: true },
+    }),
+    prisma.operationLog.findMany({ where: logWhere, orderBy: { createdAt: 'desc' }, take: 8 }),
+  ]);
+
+  const deptName = new Map(depts.map((d) => [d.id, d.name]));
+  const empByDept = empByDeptRaw
+    .map((r) => ({
+      name: r.deptId ? deptName.get(r.deptId) ?? '未知部门' : '未分配',
+      value: r._count._all,
+    }))
+    .sort((a, b) => b.value - a.value);
+
+  const genderRatio = genderRaw.map((r) => ({
+    name: r.gender === 'female' ? '女' : '男',
+    value: r._count._all,
+  }));
+
+  // 入职趋势按「月份」聚合：种子数据的入职日期跨越数年，
+  // 按天聚合会得到一条几乎全空的折线，看不出任何规律。
+  const trend = new Map<string, number>();
+  for (const e of employees) {
+    if (!e.hireDate) continue;
+    const key = dayjs(e.hireDate).format('YYYY-MM');
+    trend.set(key, (trend.get(key) ?? 0) + 1);
+  }
+  const empTrend = [...trend.entries()]
+    .sort((a, b) => a[0].localeCompare(b[0]))
+    .map(([date, count]) => ({ date, count }));
+
+  return ok({
+    userCount,
+    roleCount,
+    empCount,
+    deptCount,
+    logCount,
+    empByDept,
+    empTrend,
+    genderRatio,
+    recentLogs,
+  });
+});

package/resources/src/app/api/upload/route.ts

@@ -0,0 +1,38 @@
+import { BizError, audit, clientInfo, ok, withRoute } from '@/lib/api';
+import { requireUser } from '@/auth';
+import { saveUpload } from '@/lib/upload';
+
+export const dynamic = 'force-dynamic';
+
+function isFile(v: unknown): v is File {
+  return typeof v === 'object' && v !== null && typeof (v as File).arrayBuffer === 'function';
+}
+
+/** POST /api/upload —— 通用文件上传，返回可访问 URL */
+export const POST = withRoute(async (req) => {
+  const user = await requireUser();
+
+  const form = await req.formData();
+  const file = form.get('file');
+  if (!isFile(file)) throw new BizError('未收到文件（表单字段名应为 file）');
+  if (file.size === 0) throw new BizError('文件内容为空');
+  if (file.size > 50 * 1024 * 1024) throw new BizError('单个文件不能超过 50MB');
+
+  const saved = await saveUpload(file, '', user.id);
+
+  const { ip, userAgent } = clientInfo(req);
+  await audit({
+    userId: user.id,
+    username: user.username,
+    module: '文件管理',
+    action: '上传',
+    method: 'POST',
+    path: req.nextUrl.pathname,
+    targetId: saved.name,
+    detail: { original: file.name, size: saved.size },
+    ip,
+    userAgent,
+  });
+
+  return ok({ name: saved.name, url: saved.url, size: saved.size });
+});

package/resources/src/app/api/users/[id]/password/route.ts

@@ -0,0 +1,55 @@
+import { z } from 'zod';
+import bcrypt from 'bcryptjs';
+import { BizError, CODE, audit, clientInfo, ok, withRoute } from '@/lib/api';
+import { prisma } from '@/lib/prisma';
+import { requireUser } from '@/auth';
+import { P, deptScope, requirePerm } from '@/lib/rbac';
+import { zField } from '@/lib/zodField';
+
+export const dynamic = 'force-dynamic';
+
+const schema = z.object({
+  password: zField('password', { label: '新密码' }),
+});
+
+type Ctx = { params: Promise<{ id: string }> };
+
+/** PUT /api/users/[id]/password —— 管理员重置密码 */
+export const PUT = withRoute<Ctx>(async (req, ctx) => {
+  const operator = await requireUser();
+  requirePerm(operator, P.userReset);
+
+  const { id } = await ctx.params;
+  // 重置密码也过数据范围：部门管理员不该能重置别的部门账号的密码
+  const target = await prisma.user.findFirst({
+    where: { id, deletedAt: null, ...deptScope(operator) },
+  });
+  if (!target) throw new BizError('用户不存在', CODE.NOT_FOUND);
+
+  const parsed = schema.parse(await req.json());
+  await prisma.user.update({
+    where: { id },
+    data: {
+      password: await bcrypt.hash(parsed.password, 10),
+      // 管理员知道明文，用户下一次登录必须自己改成新密码
+      mustChangePassword: 1,
+    },
+  });
+
+  const { ip, userAgent } = clientInfo(req);
+  await audit({
+    userId: operator.id,
+    username: operator.username,
+    module: '用户管理',
+    action: '重置密码',
+    method: 'PUT',
+    path: req.nextUrl.pathname,
+    targetId: id,
+    // 明文密码绝不落日志，只记「谁重置了谁的密码」以及「要求下次登录改密」
+    detail: { username: target.username, mustChangePassword: true },
+    ip,
+    userAgent,
+  });
+
+  return ok(null, '密码已重置');
+});

package/resources/src/app/api/users/[id]/route.ts

@@ -0,0 +1,145 @@
+import { z } from 'zod';
+import { Prisma } from '@prisma/client';
+import bcrypt from 'bcryptjs';
+import { BizError, CODE, audit, clientInfo, ok, withRoute } from '@/lib/api';
+import { prisma } from '@/lib/prisma';
+import { requireUser } from '@/auth';
+import { P, deptScope, requirePerm } from '@/lib/rbac';
+import { zField, zNullableField } from '@/lib/zodField';
+
+export const dynamic = 'force-dynamic';
+
+const userSelect = {
+  id: true,
+  username: true,
+  name: true,
+  email: true,
+  phone: true,
+  avatar: true,
+  deptId: true,
+  status: true,
+  isSuper: true,
+  securityQuestion: true,
+  mustChangePassword: true,
+  lastLogin: true,
+  remark: true,
+  createdAt: true,
+  updatedAt: true,
+  dept: { select: { id: true, name: true } },
+  roles: { select: { role: { select: { id: true, code: true, name: true } } } },
+} satisfies Prisma.UserSelect;
+
+const updateSchema = z.object({
+  // 编辑时不改密码：允许不传、空串或 null；传了实际值才走格式校验
+  password: zNullableField('password', { label: '密码' }),
+  // 编辑时姓名可以不改，但一旦传了就不能是空串
+  name: zField('name', { label: '姓名' }).optional(),
+  email: zNullableField('email', { label: '邮箱' }),
+  phone: zNullableField('phone', { label: '手机号' }),
+  deptId: z.string().nullish(),
+  status: z.coerce.number().int().min(0).max(1).optional(),
+  remark: z.string().max(200).nullish(),
+  roleIds: z.array(z.string()).optional(),
+});
+
+type Ctx = { params: Promise<{ id: string }> };
+
+/** GET /api/users/[id] —— 详情 */
+export const GET = withRoute<Ctx>(async (_req, ctx) => {
+  const user = await requireUser();
+  requirePerm(user, P.userList);
+
+  const { id } = await ctx.params;
+  const found = await prisma.user.findFirst({
+    // 详情同样过数据范围，避免「知道 id 就能读到范围外的账号」
+    where: { id, deletedAt: null, ...deptScope(user) },
+    select: userSelect,
+  });
+  if (!found) throw new BizError('用户不存在', CODE.NOT_FOUND);
+
+  return ok({ ...found, roles: found.roles.map((r) => r.role) });
+});
+
+/** PUT /api/users/[id] —— 更新（可选择性改密） */
+export const PUT = withRoute<Ctx>(async (req, ctx) => {
+  const operator = await requireUser();
+  requirePerm(operator, P.userEdit);
+
+  const { id } = await ctx.params;
+  const exist = await prisma.user.findFirst({
+    where: { id, deletedAt: null, ...deptScope(operator) },
+  });
+  if (!exist) throw new BizError('用户不存在', CODE.NOT_FOUND);
+
+  const parsed = updateSchema.parse(await req.json());
+
+  // Unchecked 变体：既能直接写外键 deptId，又能用嵌套操作整体替换角色
+  const data: Prisma.UserUncheckedUpdateInput = {};
+  if (parsed.name !== undefined) data.name = parsed.name;
+  if (parsed.email !== undefined) data.email = parsed.email || null;
+  if (parsed.phone !== undefined) data.phone = parsed.phone || null;
+  if (parsed.deptId !== undefined) data.deptId = parsed.deptId || null;
+  if (parsed.status !== undefined) data.status = parsed.status;
+  if (parsed.remark !== undefined) data.remark = parsed.remark || null;
+  if (parsed.password) {
+    data.password = await bcrypt.hash(parsed.password, 10);
+    // 管理员直接改密与「重置密码」同义：用户下次登录必须先自己改
+    data.mustChangePassword = 1;
+  }
+  if (parsed.roleIds) {
+    // 覆盖式：先清空再写入，前端只关心「最终绑定了哪些角色」
+    data.roles = { deleteMany: {}, create: parsed.roleIds.map((roleId) => ({ roleId })) };
+  }
+
+  await prisma.user.update({ where: { id }, data });
+
+  const { ip, userAgent } = clientInfo(req);
+  await audit({
+    userId: operator.id,
+    username: operator.username,
+    module: '用户管理',
+    action: '修改',
+    method: 'PUT',
+    path: req.nextUrl.pathname,
+    targetId: id,
+    detail: { ...parsed, password: parsed.password ? '***' : undefined },
+    ip,
+    userAgent,
+  });
+
+  return ok(null, '保存成功');
+});
+
+/** DELETE /api/users/[id] —— 软删除 */
+export const DELETE = withRoute<Ctx>(async (req, ctx) => {
+  const operator = await requireUser();
+  requirePerm(operator, P.userDel);
+
+  const { id } = await ctx.params;
+  if (id === operator.id) throw new BizError('不能删除当前登录账号');
+
+  const target = await prisma.user.findFirst({
+    where: { id, deletedAt: null, ...deptScope(operator) },
+  });
+  if (!target) throw new BizError('用户不存在', CODE.NOT_FOUND);
+  if (target.isSuper === 1) throw new BizError('超级管理员账号不允许删除');
+
+  // 软删：保留行以便审计追溯，同时释放 username 之外的业务引用
+  await prisma.user.update({ where: { id }, data: { deletedAt: new Date() } });
+
+  const { ip, userAgent } = clientInfo(req);
+  await audit({
+    userId: operator.id,
+    username: operator.username,
+    module: '用户管理',
+    action: '删除',
+    method: 'DELETE',
+    path: req.nextUrl.pathname,
+    targetId: id,
+    detail: { username: target.username, name: target.name },
+    ip,
+    userAgent,
+  });
+
+  return ok(null, '删除成功');
+});

package/resources/src/app/api/users/route.ts

@@ -0,0 +1,153 @@
+import { z } from 'zod';
+import { Prisma } from '@prisma/client';
+import bcrypt from 'bcryptjs';
+import {
+  BizError,
+  CODE,
+  audit,
+  clientInfo,
+  ok,
+  pageResult,
+  parseListQuery,
+  withRoute,
+} from '@/lib/api';
+import { prisma } from '@/lib/prisma';
+import { requireUser } from '@/auth';
+import { P, deptScope, requirePerm } from '@/lib/rbac';
+import { zField, zNullableField } from '@/lib/zodField';
+
+export const dynamic = 'force-dynamic';
+
+/** 列表/详情都不允许把密码哈希带出去，统一用这个 select */
+const userSelect = {
+  id: true,
+  username: true,
+  name: true,
+  email: true,
+  phone: true,
+  avatar: true,
+  deptId: true,
+  status: true,
+  isSuper: true,
+  securityQuestion: true,
+  mustChangePassword: true,
+  lastLogin: true,
+  remark: true,
+  createdAt: true,
+  updatedAt: true,
+  dept: { select: { id: true, name: true } },
+  roles: { select: { role: { select: { id: true, code: true, name: true } } } },
+} satisfies Prisma.UserSelect;
+
+const createSchema = z.object({
+  username: zField('username', { label: '用户名' }),
+  password: zField('password', { label: '密码' }),
+  name: zField('name', { label: '姓名' }),
+  email: zNullableField('email', { label: '邮箱' }),
+  phone: zNullableField('phone', { label: '手机号' }),
+  deptId: z.string().nullish(),
+  status: z.coerce.number().int().min(0).max(1).default(1),
+  remark: z.string().max(200).nullish(),
+  roleIds: z.array(z.string()).default([]),
+  // 密保用于用户忘记密码时自助找回；答案只存 bcrypt 哈希
+  securityQuestion: z.string().trim().max(100, '密保问题过长').optional().or(z.literal('')),
+  securityAnswer: z.string().trim().max(100, '密保答案过长').optional().or(z.literal('')),
+});
+
+/** GET /api/users —— 分页列表 */
+export const GET = withRoute(async (req) => {
+  const user = await requireUser();
+  requirePerm(user, P.userList);
+
+  const q = parseListQuery(req, { createdAt: 'desc' });
+  const sp = req.nextUrl.searchParams;
+  const status = sp.get('status');
+  const deptId = sp.get('deptId');
+
+  const where: Prisma.UserWhereInput = { deletedAt: null };
+
+  if (q.keyword) {
+    where.OR = [
+      { username: { contains: q.keyword } },
+      { name: { contains: q.keyword } },
+      { phone: { contains: q.keyword } },
+      { email: { contains: q.keyword } },
+    ];
+  }
+  if (status === '0' || status === '1') where.status = Number(status);
+  if (deptId) where.deptId = deptId;
+
+  // 数据范围：超管看全部，其余只看本部门。放在最后合并，保证「越权筛选」筛不出别人的数据。
+  Object.assign(where, deptScope(user));
+
+  const [rows, total] = await Promise.all([
+    prisma.user.findMany({
+      where,
+      skip: q.skip,
+      take: q.take,
+      orderBy: q.orderBy as Prisma.UserOrderByWithRelationInput,
+      select: userSelect,
+    }),
+    prisma.user.count({ where }),
+  ]);
+
+  const list = rows.map((u) => ({ ...u, roles: u.roles.map((r) => r.role) }));
+  return ok(pageResult(list, total, q));
+});
+
+/** POST /api/users —— 新建用户 */
+export const POST = withRoute(async (req) => {
+  const user = await requireUser();
+  requirePerm(user, P.userAdd);
+
+  const parsed = createSchema.parse(await req.json());
+
+  // 唯一约束是「全局」的（软删的账号仍占用用户名），所以这里不能带 deletedAt 条件
+  const exists = await prisma.user.findUnique({ where: { username: parsed.username } });
+  if (exists) throw new BizError('用户名已存在', CODE.CONFLICT);
+
+  const question = parsed.securityQuestion?.trim() || '';
+  const answer = parsed.securityAnswer?.trim() || '';
+  if (Boolean(question) !== Boolean(answer)) {
+    throw new BizError('密保问题和答案需要同时填写', CODE.BAD_REQUEST);
+  }
+
+  const password = await bcrypt.hash(parsed.password, 10);
+
+  const created = await prisma.user.create({
+    data: {
+      username: parsed.username,
+      password,
+      name: parsed.name,
+      email: parsed.email || null,
+      phone: parsed.phone || null,
+      deptId: parsed.deptId || null,
+      status: parsed.status,
+      remark: parsed.remark || null,
+      securityQuestion: question || null,
+      securityAnswerHash: answer ? await bcrypt.hash(answer, 10) : null,
+      roles: { create: parsed.roleIds.map((roleId) => ({ roleId })) },
+    },
+  });
+
+  const { ip, userAgent } = clientInfo(req);
+  await audit({
+    userId: user.id,
+    username: user.username,
+    module: '用户管理',
+    action: '新增',
+    method: 'POST',
+    path: req.nextUrl.pathname,
+    targetId: created.id,
+    detail: {
+      username: parsed.username,
+      name: parsed.name,
+      roleIds: parsed.roleIds,
+      securityQuestion: question || undefined,
+    },
+    ip,
+    userAgent,
+  });
+
+  return ok({ id: created.id }, '新增成功');
+});

package/resources/src/app/api/visits/route.ts

@@ -0,0 +1,48 @@
+import { z } from 'zod';
+import { auth, requireUser } from '@/auth';
+import { clientInfo, ok, withRoute } from '@/lib/api';
+import { isVisitorId, normalizeVisitPath } from '@/lib/visits';
+import { getVisitStats, trackVisit } from '@/lib/visit-stats';
+
+export const dynamic = 'force-dynamic';
+
+/**
+ * 访问统计接口。
+ *
+ * POST /api/visits { visitorId, path? }
+ *   path 有值 = 一次页面浏览；没有 = 心跳（只刷新在线状态）。
+ *   刻意**不要求登录**：埋点挂在根布局上，登录页 / 帮助文档也要统计；
+ *   已登录时顺手把 userId 记下来，方便以后按账号口径分析。
+ *
+ * GET /api/visits
+ *   → { online, today, total }。只有登录用户能看（顶栏组件本来就是登录后才有），
+ *   游客拿不到全站访问量，避免把运营数据暴露在公网。
+ */
+
+const trackSchema = z.object({
+  visitorId: z.string().trim().refine(isVisitorId, 'visitorId 格式不合法'),
+  path: z.string().trim().max(500).optional(),
+});
+
+export const POST = withRoute(async (req) => {
+  const body = await req.json().catch(() => ({}));
+  const { visitorId, path } = trackSchema.parse(body);
+  const { ip, userAgent } = clientInfo(req);
+  const session = await auth();
+
+  const recorded = await trackVisit({
+    visitorId,
+    userId: session?.user?.id ?? null,
+    // 非法路径按心跳处理：统计接口不因为一条脏数据报错，业务页面更不该被打断
+    path: normalizeVisitPath(path),
+    ip,
+    userAgent,
+  });
+
+  return ok({ recorded });
+});
+
+export const GET = withRoute(async () => {
+  await requireUser();
+  return ok(await getVisitStats());
+});