feat: 完善 RBAC 权限体系与权限管理页面

apps/server/src/rbac/rbac.controller.ts

@@ -23,7 +23,7 @@ import {
 import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
 import { RequirePermission } from '../auth/decorators/permission.decorator';
 import { OperationLogsService } from '../operation-logs/operation-logs.service';
-import { extractRequestInfo } from '../common/request-utils';
+import { logAudit } from '../common/with-audit-log';
 
 @UseGuards(JwtAuthGuard)
 @Controller('rbac')
@@ -33,8 +33,6 @@ export class RbacController {
     private logService: OperationLogsService,
   ) {}
 
-  // ==================== 角色管理 ====================
-
   @Get('roles')
   @RequirePermission('role:view')
   findAllRoles() {
@@ -50,16 +48,9 @@ export class RbacController {
   @Post('roles')
   @RequirePermission('role:create')
   async createRole(@Body() dto: CreateRoleDto, @Request() req: any) {
-    const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.rbacService.createRole(dto);
-    await this.logService.log({
-      userId: req.user?.id,
-      username: req.user?.username,
-      module: 'RBAC',
-      action: '创建角色',
-      detail: `角色: ${dto.name}`,
-      ipAddress,
-      userAgent,
+    await logAudit(this.logService, req, {
+      module: 'RBAC', action: '创建角色', detail: `角色: ${dto.name}`,
     });
     return result;
   }
@@ -67,19 +58,10 @@ export class RbacController {
   @Put('roles/:id')
   @RequirePermission('role:edit')
   async updateRole(@Param('id') id: string, @Body() dto: UpdateRoleDto, @Request() req: any) {
-    const { ipAddress, userAgent } = extractRequestInfo(req);
     try {
       const result = await this.rbacService.updateRole(+id, dto);
-      await this.logService.log({
-        userId: req.user?.id,
-        username: req.user?.username,
-        module: 'RBAC',
-        action: '编辑角色',
-        targetId: +id,
-        targetType: 'role',
-        detail: JSON.stringify(dto),
-        ipAddress,
-        userAgent,
+      await logAudit(this.logService, req, {
+        module: 'RBAC', action: '编辑角色', targetId: +id, targetType: 'role', detail: JSON.stringify(dto),
       });
       return result;
     } catch (e: any) {
@@ -90,18 +72,10 @@ export class RbacController {
   @Delete('roles/:id')
   @RequirePermission('role:delete')
   async deleteRole(@Param('id') id: string, @Request() req: any) {
-    const { ipAddress, userAgent } = extractRequestInfo(req);
     try {
       const result = await this.rbacService.deleteRole(+id);
-      await this.logService.log({
-        userId: req.user?.id,
-        username: req.user?.username,
-        module: 'RBAC',
-        action: '停用角色',
-        targetId: +id,
-        targetType: 'role',
-        ipAddress,
-        userAgent,
+      await logAudit(this.logService, req, {
+        module: 'RBAC', action: '停用角色', targetId: +id, targetType: 'role',
       });
       return result;
     } catch (e: any) {
@@ -109,8 +83,6 @@ export class RbacController {
     }
   }
 
-  // ==================== 权限管理 ====================
-
   @Get('permissions')
   @RequirePermission('role:view')
   findAllPermissions() {
@@ -123,8 +95,6 @@ export class RbacController {
     return this.rbacService.getPermissionTree();
   }
 
-  // ==================== 用户管理 ====================
-
   @Get('users')
   @RequirePermission('user:view', 'teacher:view')
   getUsers(@Query('isArchived') isArchived?: string) {
@@ -135,17 +105,10 @@ export class RbacController {
   @Post('users')
   @RequirePermission('user:create')
   async createUser(@Body() dto: CreateUserDto, @Request() req: any) {
-    const { ipAddress, userAgent } = extractRequestInfo(req);
     try {
       const result = await this.rbacService.createUser(dto);
-      await this.logService.log({
-        userId: req.user?.id,
-        username: req.user?.username,
-        module: '账号',
-        action: '创建账号',
-        detail: `用户名: ${dto.username}`,
-        ipAddress,
-        userAgent,
+      await logAudit(this.logService, req, {
+        module: '账号', action: '创建账号', detail: `用户名: ${dto.username}`,
       });
       return result;
     } catch (e: any) {
@@ -156,19 +119,10 @@ export class RbacController {
   @Put('users/:id')
   @RequirePermission('user:edit')
   async updateUser(@Param('id') id: string, @Body() dto: UpdateUserDto, @Request() req: any) {
-    const { ipAddress, userAgent } = extractRequestInfo(req);
     try {
       const result = await this.rbacService.updateUser(+id, dto);
-      await this.logService.log({
-        userId: req.user?.id,
-        username: req.user?.username,
-        module: '账号',
-        action: '更新账号',
-        targetId: +id,
-        targetType: 'user',
-        detail: JSON.stringify(dto),
-        ipAddress,
-        userAgent,
+      await logAudit(this.logService, req, {
+        module: '账号', action: '更新账号', targetId: +id, targetType: 'user', detail: JSON.stringify(dto),
       });
       return result;
     } catch (e: any) {
@@ -179,18 +133,10 @@ export class RbacController {
   @Put('users/:id/password')
   @RequirePermission('user:reset-password')
   async resetPassword(@Param('id') id: string, @Body() dto: ResetPasswordDto, @Request() req: any) {
-    const { ipAddress, userAgent } = extractRequestInfo(req);
     try {
       const result = await this.rbacService.resetPassword(+id, dto.password);
-      await this.logService.log({
-        userId: req.user?.id,
-        username: req.user?.username,
-        module: '账号',
-        action: '重置密码',
-        targetId: +id,
-        targetType: 'user',
-        ipAddress,
-        userAgent,
+      await logAudit(this.logService, req, {
+        module: '账号', action: '重置密码', targetId: +id, targetType: 'user',
       });
       return result;
     } catch (e: any) {
@@ -220,6 +166,21 @@ export class RbacController {
     }
   }
 
+  @Delete('users/:id/permanent')
+  @RequirePermission('user:purge')
+  async purgeUser(@Param('id') id: string, @Request() req: any) {
+    try {
+      const result = await this.rbacService.purgeUser(+id, req.user?.id);
+      await logAudit(this.logService, req, {
+        module: '账号', action: '永久删除用户', targetId: +id, targetType: 'user', detail: '物理删除，不可恢复',
+      });
+      return result;
+    } catch (e: unknown) {
+      const err = e as { message?: string };
+      throw new BadRequestException(err?.message);
+    }
+  }
+
   @Put('users/:id/mark-staff')
   @RequirePermission('user:edit')
   async markAsStaff(@Param('id') id: string) {
@@ -242,8 +203,6 @@ export class RbacController {
     }
   }
 
-  // ---- 用户资料 ----
-
   @Get('users/:id/profile')
   @RequirePermission('user:view')
   getUserProfile(@Param('id') id: string) {
@@ -257,18 +216,10 @@ export class RbacController {
     @Body() dto: UpdateProfileDto,
     @Request() req: any,
   ) {
-    const { ipAddress, userAgent } = extractRequestInfo(req);
     try {
       const result = await this.rbacService.updateUserProfile(+id, dto);
-      await this.logService.log({
-        userId: req.user?.id,
-        username: req.user?.username,
-        module: '账号',
-        action: '更新资料',
-        targetId: +id,
-        targetType: 'user',
-        ipAddress,
-        userAgent,
+      await logAudit(this.logService, req, {
+        module: '账号', action: '更新资料', targetId: +id, targetType: 'user',
       });
       return result;
     } catch (e: any) {
@@ -276,16 +227,12 @@ export class RbacController {
     }
   }
 
-  // ---- 教师工作台 ----
-
   @Get('teacher-workspace')
   @RequirePermission('teacher-workspace:view')
   async getTeacherWorkspace(@Request() req: any) {
     return this.rbacService.getTeacherWorkspace(req.user?.id);
   }
 
-  // ---- 教师管理 ----
-
   @Get('teachers')
   @RequirePermission('teacher:view')
   async getTeachers(
@@ -307,18 +254,9 @@ export class RbacController {
     @Body() profile: UpdateProfileDto,
     @Request() req: { user?: { id: number; username: string } },
   ) {
-    const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.rbacService.updateTeacherProfile(+id, profile);
-    await this.logService.log({
-      userId: req.user?.id,
-      username: req.user?.username,
-      module: '教师管理',
-      action: '编辑档案',
-      targetId: +id,
-      targetType: 'user',
-      detail: '更新教师档案',
-      ipAddress,
-      userAgent,
+    await logAudit(this.logService, req, {
+      module: '教师管理', action: '编辑档案', targetId: +id, targetType: 'user', detail: '更新教师档案',
     });
     return result;
   }