node-resource-utils 0.0.0-stage → 1.1.8

package/resources/src/auth.ts

@@ -0,0 +1,215 @@
+import NextAuth, { type DefaultSession } from 'next-auth';
+import Credentials from 'next-auth/providers/credentials';
+import bcrypt from 'bcryptjs';
+import { prisma } from '@/lib/prisma';
+
+/**
+ * 认证 + 权限装载。
+ *
+ * 设计取舍：
+ *   - JWT 会话（非数据库会话）：内网单机、无横向扩容需求，JWT 省一次库往返，
+ *     刷新页面也不掉登录态。
+ *   - 权限集合（permCodes）在登录时一次算好塞进 JWT —— 之后每次判权限不用再查库。
+ *     代价是改权限要重新登录才生效；演示/比赛场景完全够用。
+ *   - 密码一律 bcrypt 比对，绝不存明文。
+ */
+
+export type SessionUser = {
+  id: string;
+  username: string;
+  name: string;
+  isSuper: boolean;
+  permCodes: string[];
+  roleCodes: string[];
+  deptId?: string | null;
+  /** 数据范围档位（见 lib/rbac.ts 的 DATA_SCOPE）：1 全部 2 本部门及下级 3 本部门 4 仅本人 */
+  dataScope?: number;
+  /** 本人部门 + 全部下级部门 id，登录时算好；deptScope 用它拼 { deptId: { in: [...] } } */
+  deptIds?: string[];
+  /** true = 管理员重置过密码，必须先修改密码才能进入后台 */
+  mustChangePassword?: boolean;
+} & DefaultSession['user'];
+
+declare module 'next-auth' {
+  interface Session {
+    user: SessionUser;
+  }
+}
+
+declare module '@auth/core/jwt' {
+  interface JWT {
+    uid?: string;
+    username?: string;
+    isSuper?: boolean;
+    permCodes?: string[];
+    roleCodes?: string[];
+    deptId?: string | null;
+    dataScope?: number;
+    deptIds?: string[];
+    mustChangePassword?: boolean;
+  }
+}
+
+/** 部门子树：本人部门 + 全部下级。部门表很小，登录时全量拉一次足够。 */
+async function loadDeptSubtree(rootId: string): Promise<string[]> {
+  const all = await prisma.department.findMany({ select: { id: true, parentId: true } });
+  const children = new Map<string, string[]>();
+  for (const d of all) {
+    if (!d.parentId) continue;
+    const arr = children.get(d.parentId);
+    if (arr) arr.push(d.id);
+    else children.set(d.parentId, [d.id]);
+  }
+  const out: string[] = [];
+  const seen = new Set<string>();
+  const queue = [rootId];
+  while (queue.length) {
+    const id = queue.shift()!;
+    if (seen.has(id)) continue;
+    seen.add(id);
+    out.push(id);
+    for (const child of children.get(id) ?? []) queue.push(child);
+  }
+  return out;
+}
+
+/** 取用户全部权限标识；超管返回 ['*'] 表示放行一切 */
+async function loadUserAuth(userId: string) {
+  const user = await prisma.user.findUnique({
+    where: { id: userId },
+    include: {
+      roles: {
+        include: {
+          role: { include: { menus: { include: { menu: true } } } },
+        },
+      },
+    },
+  });
+  if (!user) return null;
+
+  const activeRoles = user.roles.filter((r) => r.role.status === 1);
+  const roleCodes = activeRoles.map((r) => r.role.code);
+  const deptIds = user.deptId ? await loadDeptSubtree(user.deptId) : [];
+  if (user.isSuper === 1) {
+    // 超管恒为「全部数据」，不必关心角色怎么配
+    return { roleCodes, permCodes: ['*'], dataScope: 1, deptIds };
+  }
+
+  const set = new Set<string>();
+  for (const ur of activeRoles) {
+    for (const rm of ur.role.menus) {
+      if (rm.menu.status !== 1) continue;
+      if (rm.menu.permCode) set.add(rm.menu.permCode);
+      if (rm.menu.path) set.add(`menu:${rm.menu.path}`);
+    }
+  }
+
+  // 多角色取最宽的一档：1 全部 < 2 本部门及下级 < 3 本部门 < 4 仅本人
+  const scopes = activeRoles.map((r) => r.role.dataScope).filter((n) => n >= 1 && n <= 4);
+  const dataScope = scopes.length ? Math.min(...scopes) : 2;
+
+  return { roleCodes, permCodes: [...set], dataScope, deptIds };
+}
+
+export const { handlers, auth, signIn, signOut } = NextAuth({
+  trustHost: true,
+  secret: process.env.AUTH_SECRET || 'biz-stack-dev-secret-please-change-me-32ch',
+  session: { strategy: 'jwt', maxAge: 60 * 60 * 8 },
+  pages: { signIn: '/login' },
+  providers: [
+    Credentials({
+      name: '账号密码',
+      credentials: {
+        username: { label: '用户名', type: 'text' },
+        password: { label: '密码', type: 'password' },
+      },
+      async authorize(raw) {
+        const username = String(raw?.username ?? '').trim();
+        const password = String(raw?.password ?? '');
+        if (!username || !password) return null;
+
+        const user = await prisma.user.findFirst({ where: { username, deletedAt: null } });
+        if (!user || user.status !== 1) return null;
+        if (!(await bcrypt.compare(password, user.password))) return null;
+
+        const authInfo = await loadUserAuth(user.id);
+        await prisma.user
+          .update({ where: { id: user.id }, data: { lastLogin: new Date() } })
+          .catch(() => {});
+
+        return {
+          id: user.id,
+          name: user.name,
+          email: user.email ?? undefined,
+          username: user.username,
+          isSuper: user.isSuper === 1,
+          deptId: user.deptId,
+          permCodes: authInfo?.permCodes ?? [],
+          roleCodes: authInfo?.roleCodes ?? [],
+          dataScope: authInfo?.dataScope ?? 2,
+          deptIds: authInfo?.deptIds ?? [],
+          mustChangePassword: user.mustChangePassword === 1,
+        } as never;
+      },
+    }),
+  ],
+  callbacks: {
+    async jwt({ token, user }) {
+      if (user) {
+        const u = user as unknown as {
+          id: string;
+          username?: string;
+          isSuper?: boolean;
+          permCodes?: string[];
+          roleCodes?: string[];
+          deptId?: string | null;
+          dataScope?: number;
+          deptIds?: string[];
+          mustChangePassword?: boolean;
+        };
+        token.uid = u.id;
+        token.username = u.username;
+        token.isSuper = u.isSuper;
+        token.permCodes = u.permCodes;
+        token.roleCodes = u.roleCodes;
+        token.deptId = u.deptId ?? null;
+        token.dataScope = u.dataScope ?? 2;
+        token.deptIds = u.deptIds ?? [];
+        token.mustChangePassword = Boolean(u.mustChangePassword);
+      }
+      return token;
+    },
+    async session({ session, token }) {
+      session.user = {
+        ...session.user,
+        id: String(token.uid ?? ''),
+        username: String(token.username ?? ''),
+        name: String(session.user?.name ?? token.username ?? ''),
+        isSuper: Boolean(token.isSuper),
+        permCodes: (token.permCodes as string[]) ?? [],
+        roleCodes: (token.roleCodes as string[]) ?? [],
+        deptId: (token.deptId as string | null) ?? null,
+        dataScope: (token.dataScope as number) ?? 2,
+        deptIds: (token.deptIds as string[]) ?? [],
+        mustChangePassword: Boolean(token.mustChangePassword),
+      };
+      return session;
+    },
+  },
+});
+
+/** 服务端取当前会话；未登录返回 null */
+export async function currentUser(): Promise<SessionUser | null> {
+  const session = await auth();
+  return (session?.user as SessionUser) ?? null;
+}
+
+/** 服务端强制登录，未登录抛 BizError（withRoute 会转成 401） */
+export async function requireUser(): Promise<SessionUser> {
+  const u = await currentUser();
+  if (!u?.id) {
+    const { BizError, CODE } = await import('@/lib/api');
+    throw new BizError('未登录或登录已过期，请重新登录', CODE.UNAUTHORIZED, 401);
+  }
+  return u;
+}