feat: 完善 RBAC 权限体系与权限管理页面
This commit is contained in:
@@ -1,7 +1,10 @@
|
||||
import { Injectable, Logger, NotFoundException } from '@nestjs/common';
|
||||
import { Injectable, Logger, Optional } from '@nestjs/common';
|
||||
import type { UpdateProfileDto } from './dto/rbac.dto';
|
||||
import { RbacSeedService } from './rbac-seed.service';
|
||||
import { RbacUserService } from './rbac-user.service';
|
||||
import { getChinaDateParts } from './rbac-presets';
|
||||
import { InjectRepository } from '@nestjs/typeorm';
|
||||
import { Repository, In } from 'typeorm';
|
||||
import * as bcrypt from 'bcryptjs';
|
||||
import {
|
||||
Permission,
|
||||
Role,
|
||||
@@ -11,263 +14,9 @@ import {
|
||||
ClassTeacher,
|
||||
ClassSchedule,
|
||||
Student,
|
||||
AttendanceSession,
|
||||
} from '../entities';
|
||||
|
||||
const PRESET_PERMISSIONS: Array<{ code: string; name: string; group: string }> = [
|
||||
{ code: 'dashboard:view', name: '查看数据面板', group: 'dashboard' },
|
||||
{ code: 'notification:view', name: '查看通知', group: 'notification' },
|
||||
{ code: 'student:view', name: '查看学生管理', group: 'student' },
|
||||
{ code: 'student:basic-view', name: '查看学生基础信息', group: 'student-scope' },
|
||||
{ code: 'teacher-workspace:view', name: '查看教师工作台', group: 'teacher-workspace' },
|
||||
{ code: 'teacher:view', name: '查看教师', group: 'teacher' },
|
||||
{ code: 'teacher:edit', name: '编辑教师', group: 'teacher' },
|
||||
{ code: 'student:create', name: '新增学生', group: 'student' },
|
||||
{ code: 'student:edit', name: '编辑学生', group: 'student' },
|
||||
{ code: 'student:delete', name: '归档学生', group: 'student' },
|
||||
{ code: 'student:import', name: '导入学生', group: 'student' },
|
||||
{ code: 'student:export', name: '导出学生', group: 'student' },
|
||||
{ code: 'exam:view', name: '查看和录入考试成绩', group: 'exam' },
|
||||
{ code: 'room:view', name: '查看宿舍', group: 'room' },
|
||||
{ code: 'room:inspect', name: '宿舍查寝', group: 'room' },
|
||||
{ code: 'room:create', name: '新增宿舍', group: 'room' },
|
||||
{ code: 'room:edit', name: '编辑宿舍', group: 'room' },
|
||||
{ code: 'room:delete', name: '归档宿舍', group: 'room' },
|
||||
{ code: 'occupancy:view', name: '查看入住', group: 'occupancy' },
|
||||
{ code: 'occupancy:checkin', name: '办理入住', group: 'occupancy' },
|
||||
{ code: 'occupancy:checkout', name: '办理退宿', group: 'occupancy' },
|
||||
{ code: 'occupancy:transfer', name: '调换宿舍', group: 'occupancy' },
|
||||
{ code: 'occupancy:delete', name: '归档入住记录', group: 'occupancy' },
|
||||
{ code: 'expense:view', name: '查看费用', group: 'expense' },
|
||||
{ code: 'expense:create', name: '录入费用', group: 'expense' },
|
||||
{ code: 'expense:edit', name: '编辑费用', group: 'expense' },
|
||||
{ code: 'expense:delete', name: '归档费用', group: 'expense' },
|
||||
{ code: 'bill:view', name: '查看账单', group: 'bill' },
|
||||
{ code: 'bill:generate', name: '生成账单', group: 'bill' },
|
||||
{ code: 'bill:confirm', name: '确认账单', group: 'bill' },
|
||||
{ code: 'bill:delete', name: '归档账单', group: 'bill' },
|
||||
{ code: 'bill:export-excel', name: '导出 Excel', group: 'bill' },
|
||||
{ code: 'bill:export-pdf', name: '导出 PDF', group: 'bill' },
|
||||
{ code: 'deposit:view', name: '查看押金', group: 'deposit' },
|
||||
{ code: 'deposit:create', name: '新增押金', group: 'deposit' },
|
||||
{ code: 'deposit:edit', name: '编辑押金', group: 'deposit' },
|
||||
{ code: 'deposit:delete', name: '归档押金', group: 'deposit' },
|
||||
{ code: 'deposit:refund', name: '直接退还押金', group: 'deposit' },
|
||||
{ code: 'wallet:view', name: '查看学生余额', group: 'wallet' },
|
||||
{ code: 'wallet:edit', name: '充值和调账', group: 'wallet' },
|
||||
{ code: 'classroom:view', name: '查看教室', group: 'classroom' },
|
||||
{ code: 'classroom:create', name: '新增教室', group: 'classroom' },
|
||||
{ code: 'classroom:edit', name: '编辑教室', group: 'classroom' },
|
||||
{ code: 'classroom:delete', name: '归档教室', group: 'classroom' },
|
||||
{ code: 'organization:view', name: '查看机构', group: 'organization' },
|
||||
{ code: 'organization:create', name: '新增机构', group: 'organization' },
|
||||
{ code: 'organization:edit', name: '编辑机构', group: 'organization' },
|
||||
{ code: 'organization:delete', name: '归档机构', group: 'organization' },
|
||||
{ code: 'rental:view', name: '查看租赁订单', group: 'rental' },
|
||||
{ code: 'rental:create', name: '新增租赁订单', group: 'rental' },
|
||||
{ code: 'rental:edit', name: '编辑租赁订单', group: 'rental' },
|
||||
{ code: 'rental:delete', name: '归档租赁订单', group: 'rental' },
|
||||
{ code: 'log:view', name: '查看操作日志', group: 'log' },
|
||||
{ code: 'log:create', name: '写入操作日志', group: 'log' },
|
||||
{ code: 'user:view', name: '查看用户', group: 'user' },
|
||||
{ code: 'user:create', name: '创建用户', group: 'user' },
|
||||
{ code: 'user:edit', name: '编辑用户', group: 'user' },
|
||||
{ code: 'user:reset-password', name: '重置密码', group: 'user' },
|
||||
{ code: 'role:view', name: '查看角色', group: 'role' },
|
||||
{ code: 'role:create', name: '创建角色', group: 'role' },
|
||||
{ code: 'role:edit', name: '编辑角色', group: 'role' },
|
||||
{ code: 'role:delete', name: '停用角色', group: 'role' },
|
||||
{ code: 'class:view', name: '查看班级', group: 'class' },
|
||||
{ code: 'class:create', name: '创建班级', group: 'class' },
|
||||
{ code: 'class:edit', name: '编辑班级', group: 'class' },
|
||||
{ code: 'class:delete', name: '归档班级', group: 'class' },
|
||||
{ code: 'schedule:view', name: '查看排课', group: 'schedule' },
|
||||
{ code: 'schedule:create', name: '创建排课', group: 'schedule' },
|
||||
{ code: 'schedule:edit', name: '编辑排课', group: 'schedule' },
|
||||
{ code: 'schedule:delete', name: '停用排课', group: 'schedule' },
|
||||
{ code: 'attendance:view', name: '查看考勤', group: 'attendance' },
|
||||
{ code: 'attendance:create', name: '新增考勤', group: 'attendance' },
|
||||
{ code: 'attendance:edit', name: '编辑全部考勤', group: 'attendance' },
|
||||
{ code: 'attendance:self-edit', name: '编辑任教班级考勤', group: 'attendance-scope' },
|
||||
{ code: 'attendance:export', name: '导出考勤', group: 'attendance' },
|
||||
{ code: 'sync:trigger', name: '触发数据同步', group: 'sync' },
|
||||
{ code: 'sync:read', name: '查看同步状态', group: 'sync' },
|
||||
{ code: 'integration:trigger', name: '触发集成', group: 'integration' },
|
||||
{ code: 'integration:read', name: '查看集成状态', group: 'integration' },
|
||||
{ code: 'ai:config:read', name: '查看 AI 配置', group: 'ai' },
|
||||
{ code: 'ai:config:write', name: '修改 AI 配置', group: 'ai' },
|
||||
{ code: 'ai:config:test', name: '测试 AI 连接', group: 'ai' },
|
||||
{ code: 'ai:chat:use', name: '使用 AI 助手', group: 'ai-chat' },
|
||||
];
|
||||
|
||||
const DEPRECATED_PERMISSION_CODES = [
|
||||
'profile:view',
|
||||
'attendance:generate',
|
||||
'learning:create',
|
||||
'learning:edit',
|
||||
'learning:delete',
|
||||
'exam:create',
|
||||
'exam:edit',
|
||||
'exam:delete',
|
||||
'department:view',
|
||||
'department:edit',
|
||||
'department:delete',
|
||||
// Legacy permission codes from older admin UI / seed data.
|
||||
'student:add',
|
||||
'student:update',
|
||||
'room:add',
|
||||
'room:update',
|
||||
'occupancy:add',
|
||||
'occupancy:update',
|
||||
'attendance:add',
|
||||
'attendance:update',
|
||||
'attendance:delete',
|
||||
'attendance:batch',
|
||||
'bill:export',
|
||||
'deposit:collect',
|
||||
'expense:add',
|
||||
'expense:update',
|
||||
'class:add',
|
||||
'class:update',
|
||||
'schedule:add',
|
||||
'schedule:update',
|
||||
'classroom:add',
|
||||
'classroom:update',
|
||||
'rental:add',
|
||||
'rental:update',
|
||||
'role:add',
|
||||
'role:update',
|
||||
'user:add',
|
||||
'user:update',
|
||||
'archive:view',
|
||||
'archive:import',
|
||||
'archive:export',
|
||||
'report:generate',
|
||||
] as const;
|
||||
|
||||
const DEPRECATED_PERMISSION_CODE_SET = new Set<string>(DEPRECATED_PERMISSION_CODES);
|
||||
|
||||
function getChinaDateParts(date = new Date()): { date: string; weekDay: number } {
|
||||
const parts = Object.fromEntries(
|
||||
new Intl.DateTimeFormat('en-CA', {
|
||||
timeZone: 'Asia/Shanghai',
|
||||
year: 'numeric',
|
||||
month: '2-digit',
|
||||
day: '2-digit',
|
||||
weekday: 'short',
|
||||
})
|
||||
.formatToParts(date)
|
||||
.filter((part) => part.type !== 'literal')
|
||||
.map((part) => [part.type, part.value]),
|
||||
);
|
||||
const weekDays: Record<string, number> = { Mon: 1, Tue: 2, Wed: 3, Thu: 4, Fri: 5, Sat: 6, Sun: 7 };
|
||||
return {
|
||||
date: `${parts.year}-${parts.month}-${parts.day}`,
|
||||
weekDay: weekDays[parts.weekday],
|
||||
};
|
||||
}
|
||||
|
||||
export const PRESET_ROLES: Array<{
|
||||
name: string;
|
||||
code: string;
|
||||
description: string;
|
||||
isSystem: boolean;
|
||||
permissionGroups: string[];
|
||||
extraPermissions?: string[];
|
||||
legacyNames?: string[];
|
||||
legacyCodes?: string[];
|
||||
}> = [
|
||||
{
|
||||
name: '超级管理员',
|
||||
code: 'super_admin',
|
||||
description: '系统初始化、应急维护和全局权限处理',
|
||||
isSystem: true,
|
||||
permissionGroups: [],
|
||||
legacyNames: ['超管', 'super_admin'],
|
||||
},
|
||||
{
|
||||
name: '任课老师',
|
||||
code: 'teacher',
|
||||
description: '查看自己的排课、今日课程和任教班级考勤',
|
||||
isSystem: true,
|
||||
permissionGroups: ['notification'],
|
||||
extraPermissions: [
|
||||
'teacher-workspace:view',
|
||||
'schedule:view',
|
||||
'attendance:view',
|
||||
'attendance:create',
|
||||
'attendance:self-edit',
|
||||
],
|
||||
legacyNames: ['老师'],
|
||||
},
|
||||
{
|
||||
name: '教务管理员',
|
||||
code: 'academic',
|
||||
description: '管理学生、班级、教师、全局排课和历史考勤',
|
||||
isSystem: true,
|
||||
permissionGroups: [
|
||||
'student',
|
||||
'exam',
|
||||
'class',
|
||||
'schedule',
|
||||
'attendance',
|
||||
'classroom',
|
||||
'dashboard',
|
||||
'notification',
|
||||
],
|
||||
extraPermissions: [
|
||||
'teacher-workspace:view',
|
||||
'teacher:view',
|
||||
'teacher:edit',
|
||||
'sync:read',
|
||||
'sync:trigger',
|
||||
],
|
||||
legacyNames: ['教务'],
|
||||
},
|
||||
{
|
||||
name: '住宿运营管理员',
|
||||
code: 'accommodation_operations',
|
||||
description: '管理宿舍、入住、住宿费用、账单、押金和退宿结算',
|
||||
isSystem: true,
|
||||
permissionGroups: [
|
||||
'room',
|
||||
'occupancy',
|
||||
'expense',
|
||||
'bill',
|
||||
'deposit',
|
||||
'wallet',
|
||||
'dashboard',
|
||||
'notification',
|
||||
],
|
||||
extraPermissions: ['student:basic-view'],
|
||||
legacyNames: ['宿管老师', '宿管', '财务'],
|
||||
legacyCodes: ['dormitory_supervisor', 'dorm_manager', 'finance'],
|
||||
},
|
||||
{
|
||||
name: '教室运营管理员',
|
||||
code: 'classroom_operations',
|
||||
description: '管理教室、教室排期、外部机构和租赁订单',
|
||||
isSystem: true,
|
||||
permissionGroups: ['classroom', 'rental', 'organization', 'notification'],
|
||||
legacyNames: ['机构负责人'],
|
||||
legacyCodes: ['institution_head'],
|
||||
},
|
||||
{
|
||||
name: '系统管理员',
|
||||
code: 'system_admin',
|
||||
description: '管理账号、角色、日志、同步和系统配置',
|
||||
isSystem: true,
|
||||
permissionGroups: [
|
||||
'user',
|
||||
'role',
|
||||
'log',
|
||||
'integration',
|
||||
'sync',
|
||||
'ai',
|
||||
'notification',
|
||||
],
|
||||
},
|
||||
];
|
||||
|
||||
@Injectable()
|
||||
export class RbacService {
|
||||
private readonly logger = new Logger(RbacService.name);
|
||||
@@ -281,179 +30,34 @@ export class RbacService {
|
||||
@InjectRepository(ClassTeacher) private classTeacherRepo: Repository<ClassTeacher>,
|
||||
@InjectRepository(ClassSchedule) private classScheduleRepo: Repository<ClassSchedule>,
|
||||
@InjectRepository(Student) private studentRepo: Repository<Student>,
|
||||
@InjectRepository(AttendanceSession)
|
||||
private attendanceSessionRepo: Repository<AttendanceSession>,
|
||||
@Optional() private seedService?: RbacSeedService,
|
||||
@Optional() private userService?: RbacUserService,
|
||||
) {}
|
||||
|
||||
private async findLegacyPresetRole(preset: (typeof PRESET_ROLES)[number]): Promise<Role | null> {
|
||||
for (const code of preset.legacyCodes ?? []) {
|
||||
const role = await this.roleRepo.findOne({ where: { code } });
|
||||
if (role) return role;
|
||||
private get seedOps(): RbacSeedService {
|
||||
if (!this.seedService) {
|
||||
this.seedService = new RbacSeedService(this.permRepo, this.roleRepo, this.userRepo);
|
||||
}
|
||||
for (const name of preset.legacyNames ?? []) {
|
||||
const role = await this.roleRepo.findOne({ where: { name } });
|
||||
if (role) return role;
|
||||
}
|
||||
return null;
|
||||
return this.seedService;
|
||||
}
|
||||
|
||||
async seedData(): Promise<void> {
|
||||
const restoredLegacyUsers = await this.userRepo.update({ isActive: false }, { isActive: true });
|
||||
if (restoredLegacyUsers.affected) {
|
||||
this.logger.log(
|
||||
`已恢复 ${restoredLegacyUsers.affected} 个旧版禁用账号，账号状态现统一由归档管理`,
|
||||
private get userOps(): RbacUserService {
|
||||
if (!this.userService) {
|
||||
this.userService = new RbacUserService(
|
||||
this.permRepo,
|
||||
this.roleRepo,
|
||||
this.userRepo,
|
||||
this.classRepo,
|
||||
this.classStudentRepo,
|
||||
this.classTeacherRepo,
|
||||
this.classScheduleRepo,
|
||||
this.studentRepo,
|
||||
this.attendanceSessionRepo,
|
||||
);
|
||||
}
|
||||
|
||||
// Step 1: 幂等插入所有权限点（先查后插，兼容 SQLite/MySQL）
|
||||
for (const p of PRESET_PERMISSIONS) {
|
||||
const exists = await this.permRepo.findOne({ where: { code: p.code } });
|
||||
if (!exists) {
|
||||
await this.permRepo.save(this.permRepo.create(p));
|
||||
}
|
||||
}
|
||||
const deprecatedUserDeletePermission = await this.permRepo.findOne({
|
||||
where: { code: 'user:delete' },
|
||||
});
|
||||
const allPerms = (await this.permRepo.find()).filter(
|
||||
(permission) =>
|
||||
permission.code !== 'user:delete' && !DEPRECATED_PERMISSION_CODE_SET.has(permission.code),
|
||||
);
|
||||
|
||||
// Step 2: 幂等插入预置角色
|
||||
for (const r of PRESET_ROLES) {
|
||||
const exists =
|
||||
(await this.roleRepo.findOne({ where: { code: r.code } })) ||
|
||||
(await this.roleRepo.findOne({ where: { name: r.name } })) ||
|
||||
(await this.findLegacyPresetRole(r));
|
||||
if (!exists) {
|
||||
await this.roleRepo.save(
|
||||
this.roleRepo.create({
|
||||
name: r.name,
|
||||
code: r.code,
|
||||
description: r.description,
|
||||
isSystem: r.isSystem,
|
||||
}),
|
||||
);
|
||||
}
|
||||
}
|
||||
const allRoles = await this.roleRepo.find({ relations: ['permissions', 'users'] });
|
||||
|
||||
if (deprecatedUserDeletePermission) {
|
||||
for (const role of allRoles) {
|
||||
const permissions = role.permissions ?? [];
|
||||
if (permissions.some((permission) => permission.id === deprecatedUserDeletePermission.id)) {
|
||||
role.permissions = permissions.filter(
|
||||
(permission) => permission.id !== deprecatedUserDeletePermission.id,
|
||||
);
|
||||
await this.roleRepo.save(role);
|
||||
}
|
||||
}
|
||||
await this.permRepo.remove(deprecatedUserDeletePermission);
|
||||
}
|
||||
|
||||
const deprecatedPermissions = await this.permRepo.find({
|
||||
where: { code: In([...DEPRECATED_PERMISSION_CODES]) },
|
||||
});
|
||||
if (deprecatedPermissions.length > 0) {
|
||||
const deprecatedIds = new Set(deprecatedPermissions.map((permission) => permission.id));
|
||||
for (const role of allRoles) {
|
||||
const permissions = role.permissions ?? [];
|
||||
if (permissions.some((permission) => deprecatedIds.has(permission.id))) {
|
||||
role.permissions = permissions.filter((permission) => !deprecatedIds.has(permission.id));
|
||||
await this.roleRepo.save(role);
|
||||
}
|
||||
}
|
||||
await this.permRepo.remove(deprecatedPermissions);
|
||||
this.logger.log(`已清理废弃权限点: ${deprecatedPermissions.map((p) => p.code).join(', ')}`);
|
||||
}
|
||||
|
||||
// Step 3: 合并旧角色并构建新的职责权限矩阵
|
||||
for (const preset of PRESET_ROLES) {
|
||||
const matchesPreset = (role: Role) =>
|
||||
role.name === preset.name ||
|
||||
role.code === preset.code ||
|
||||
preset.legacyNames?.includes(role.name) ||
|
||||
preset.legacyCodes?.includes(role.code);
|
||||
const candidates = allRoles.filter(matchesPreset);
|
||||
const role = candidates.find((candidate) => candidate.code === preset.code) ?? candidates[0];
|
||||
if (!role) continue;
|
||||
|
||||
const duplicateRoles = candidates.filter((candidate) => candidate.id !== role.id);
|
||||
if (duplicateRoles.length > 0) {
|
||||
for (const duplicate of duplicateRoles) {
|
||||
for (const relatedUser of duplicate.users ?? []) {
|
||||
const user = await this.userRepo.findOne({
|
||||
where: { id: relatedUser.id },
|
||||
relations: ['roles'],
|
||||
});
|
||||
if (!user) continue;
|
||||
const remainingRoles = (user.roles ?? []).filter(
|
||||
(assignedRole) => assignedRole.id !== duplicate.id && assignedRole.id !== role.id,
|
||||
);
|
||||
user.roles = [...remainingRoles, role];
|
||||
await this.userRepo.save(user);
|
||||
}
|
||||
await this.roleRepo.remove(duplicate);
|
||||
}
|
||||
}
|
||||
|
||||
if (
|
||||
role.code !== preset.code ||
|
||||
role.name !== preset.name ||
|
||||
role.description !== preset.description
|
||||
) {
|
||||
role.code = preset.code;
|
||||
role.name = preset.name;
|
||||
role.description = preset.description;
|
||||
role.isSystem = preset.isSystem;
|
||||
role.status = 1;
|
||||
await this.roleRepo.save(role);
|
||||
}
|
||||
|
||||
let perms: Permission[];
|
||||
if (preset.permissionGroups.length === 0) {
|
||||
// 超管：全部权限
|
||||
perms = allPerms;
|
||||
} else {
|
||||
// 按 group 匹配 + 额外权限（如老师的 student:view）
|
||||
const byGroup = allPerms.filter((p) => preset.permissionGroups.includes(p.group));
|
||||
const byExtra = preset.extraPermissions
|
||||
? allPerms.filter((p) => preset.extraPermissions!.includes(p.code))
|
||||
: [];
|
||||
perms = [...byGroup, ...byExtra].filter(
|
||||
(p, i, arr) => arr.findIndex((x) => x.id === p.id) === i,
|
||||
);
|
||||
}
|
||||
|
||||
// 系统预置角色必须严格遵循职责矩阵；额外授权请创建自定义角色叠加。
|
||||
const currentIds = role.permissions.map((permission) => permission.id).sort((a, b) => a - b);
|
||||
const targetIds = perms.map((permission) => permission.id).sort((a, b) => a - b);
|
||||
if (currentIds.join(',') !== targetIds.join(',')) {
|
||||
role.permissions = perms;
|
||||
await this.roleRepo.save(role);
|
||||
}
|
||||
}
|
||||
|
||||
// Step 4: 初始化 admin 用户
|
||||
const count = await this.userRepo.count();
|
||||
if (count === 0) {
|
||||
const adminPassword = process.env.ADMIN_PASSWORD || 'admin123';
|
||||
const hash = await bcrypt.hash(adminPassword, 10);
|
||||
const adminUser = this.userRepo.create({
|
||||
username: 'admin',
|
||||
passwordHash: hash,
|
||||
name: '管理员',
|
||||
});
|
||||
const superAdminRole = allRoles.find((r) => r.code === 'super_admin');
|
||||
if (superAdminRole) {
|
||||
adminUser.roles = [superAdminRole];
|
||||
}
|
||||
await this.userRepo.save(adminUser);
|
||||
this.logger.log(
|
||||
`已创建默认管理员: admin / ${adminPassword === 'admin123' ? 'admin123 (请尽快修改!)' : '******'}`,
|
||||
);
|
||||
}
|
||||
|
||||
this.logger.log(`种子数据初始化完成: ${allPerms.length} 权限点, ${allRoles.length} 角色`);
|
||||
return this.userService;
|
||||
}
|
||||
|
||||
async findAllRoles(): Promise<Role[]> {
|
||||
@@ -467,28 +71,6 @@ export class RbacService {
|
||||
return this.roleRepo.findOneOrFail({ where: { id }, relations: ['permissions'] });
|
||||
}
|
||||
|
||||
private async resolvePermissions(permissionIds: number[]): Promise<Permission[]> {
|
||||
const uniqueIds = [...new Set(permissionIds)];
|
||||
const permissions = uniqueIds.length > 0 ? await this.permRepo.findByIds(uniqueIds) : [];
|
||||
if (permissions.length !== uniqueIds.length) {
|
||||
const foundIds = new Set(permissions.map((permission) => permission.id));
|
||||
const missingIds = uniqueIds.filter((id) => !foundIds.has(id));
|
||||
throw new Error(`权限不存在: ${missingIds.join(',')}`);
|
||||
}
|
||||
return permissions;
|
||||
}
|
||||
|
||||
private async resolveRoles(roleIds: number[]): Promise<Role[]> {
|
||||
const uniqueIds = [...new Set(roleIds)];
|
||||
const roles = uniqueIds.length > 0 ? await this.roleRepo.findByIds(uniqueIds) : [];
|
||||
if (roles.length !== uniqueIds.length) {
|
||||
const foundIds = new Set(roles.map((role) => role.id));
|
||||
const missingIds = uniqueIds.filter((id) => !foundIds.has(id));
|
||||
throw new Error(`角色不存在: ${missingIds.join(',')}`);
|
||||
}
|
||||
return roles;
|
||||
}
|
||||
|
||||
async createRole(dto: {
|
||||
name: string;
|
||||
description?: string;
|
||||
@@ -496,7 +78,7 @@ export class RbacService {
|
||||
}): Promise<Role> {
|
||||
const role = this.roleRepo.create({ name: dto.name, description: dto.description });
|
||||
if (dto.permissionIds && dto.permissionIds.length > 0) {
|
||||
role.permissions = await this.resolvePermissions(dto.permissionIds);
|
||||
role.permissions = await this.userOps.resolvePermissions(dto.permissionIds);
|
||||
}
|
||||
return this.roleRepo.save(role);
|
||||
}
|
||||
@@ -513,7 +95,7 @@ export class RbacService {
|
||||
if (dto.description !== undefined) role.description = dto.description;
|
||||
if (dto.permissionIds !== undefined) {
|
||||
role.permissions =
|
||||
dto.permissionIds.length > 0 ? await this.resolvePermissions(dto.permissionIds) : [];
|
||||
dto.permissionIds.length > 0 ? await this.userOps.resolvePermissions(dto.permissionIds) : [];
|
||||
}
|
||||
return this.roleRepo.save(role);
|
||||
}
|
||||
@@ -557,139 +139,6 @@ export class RbacService {
|
||||
return Array.from(codes);
|
||||
}
|
||||
|
||||
// ---- 用户管理 ----
|
||||
|
||||
async findAllUsers(isArchived = false) {
|
||||
const users = await this.userRepo.find({
|
||||
where: { isArchived },
|
||||
relations: ['roles'],
|
||||
order: { createdAt: 'DESC' },
|
||||
});
|
||||
const userIds = users.map((u) => u.id);
|
||||
const students = await this.studentRepo.find({
|
||||
where: { userId: In(userIds) },
|
||||
select: ['userId', 'status'],
|
||||
});
|
||||
const statusMap = new Map(students.map((s) => [s.userId, s.status]));
|
||||
return users.map((u) => ({
|
||||
id: u.id,
|
||||
username: u.username,
|
||||
name: u.name,
|
||||
isArchived: u.isArchived,
|
||||
studentStatus: statusMap.get(u.id) || null,
|
||||
lastLoginAt: u.lastLoginAt,
|
||||
createdAt: u.createdAt,
|
||||
updatedAt: u.updatedAt,
|
||||
roles: u.roles?.map((r) => ({ id: r.id, code: r.code, name: r.name })) || [],
|
||||
profile: u.profile || {},
|
||||
}));
|
||||
}
|
||||
|
||||
async createUser(dto: { username: string; password: string; name: string; roleIds?: number[] }) {
|
||||
const exists = await this.userRepo.findOne({ where: { username: dto.username } });
|
||||
if (exists) throw new Error('用户名已存在');
|
||||
const hash = await bcrypt.hash(dto.password, 10);
|
||||
const user = this.userRepo.create({
|
||||
username: dto.username,
|
||||
passwordHash: hash,
|
||||
name: dto.name,
|
||||
});
|
||||
if (dto.roleIds && dto.roleIds.length > 0) {
|
||||
user.roles = await this.resolveRoles(dto.roleIds);
|
||||
}
|
||||
await this.userRepo.save(user);
|
||||
return { message: '用户创建成功' };
|
||||
}
|
||||
|
||||
async updateUser(
|
||||
id: number,
|
||||
dto: { username?: string; name?: string; roleIds?: number[] },
|
||||
) {
|
||||
const user = await this.userRepo.findOne({ where: { id }, relations: ['roles'] });
|
||||
if (!user) throw new Error('用户不存在');
|
||||
if (dto.username !== undefined && dto.username !== user.username) {
|
||||
const exists = await this.userRepo.findOne({ where: { username: dto.username } });
|
||||
if (exists) throw new Error('用户名已存在');
|
||||
user.username = dto.username;
|
||||
}
|
||||
if (dto.name !== undefined) user.name = dto.name;
|
||||
if (dto.roleIds !== undefined) {
|
||||
user.roles = dto.roleIds.length > 0 ? await this.resolveRoles(dto.roleIds) : [];
|
||||
}
|
||||
await this.userRepo.save(user);
|
||||
return { message: '更新成功' };
|
||||
}
|
||||
|
||||
async resetPassword(id: number, newPassword: string) {
|
||||
const user = await this.userRepo.findOne({ where: { id } });
|
||||
if (!user) throw new Error('用户不存在');
|
||||
user.passwordHash = await bcrypt.hash(newPassword, 10);
|
||||
await this.userRepo.save(user);
|
||||
return { message: '密码已重置' };
|
||||
}
|
||||
|
||||
async archiveUser(id: number) {
|
||||
const user = await this.userRepo.findOne({ where: { id } });
|
||||
if (!user) throw new Error('用户不存在');
|
||||
if (user.username === 'admin') throw new Error('不能归档默认管理员');
|
||||
await this.userRepo.update(id, { isArchived: true });
|
||||
return { message: '用户已归档' };
|
||||
}
|
||||
|
||||
async restoreUser(id: number) {
|
||||
const user = await this.userRepo.findOne({ where: { id } });
|
||||
if (!user) throw new Error('用户不存在');
|
||||
await this.userRepo.update(id, { isArchived: false, isActive: true });
|
||||
return { message: '用户已恢复' };
|
||||
}
|
||||
|
||||
async markAsStaff(userId: number) {
|
||||
const student = await this.studentRepo.findOne({ where: { userId } });
|
||||
if (!student) throw new Error('该用户没有学员记录');
|
||||
await this.studentRepo.update(student.id, { status: 'staff' });
|
||||
this.logger.log(`User ${userId} Student ${student.id} marked as staff`);
|
||||
return { message: '已标记为教职工' };
|
||||
}
|
||||
|
||||
async markAsStudent(userId: number) {
|
||||
const student = await this.studentRepo.findOne({ where: { userId } });
|
||||
if (!student) throw new Error('该用户没有学员记录');
|
||||
await this.studentRepo.update(student.id, { status: 'active' });
|
||||
this.logger.log(`User ${userId} Student ${student.id} restored to student`);
|
||||
return { message: '已恢复为学员' };
|
||||
}
|
||||
|
||||
// ---- 用户资料 ----
|
||||
|
||||
async getUserProfile(id: number) {
|
||||
const user = await this.userRepo.findOne({ where: { id } });
|
||||
if (!user) throw new Error('用户不存在');
|
||||
return {
|
||||
id: user.id,
|
||||
username: user.username,
|
||||
name: user.name,
|
||||
profile: user.profile || {},
|
||||
};
|
||||
}
|
||||
|
||||
async updateUserProfile(
|
||||
id: number,
|
||||
dto: { subjects?: string[]; joinedAt?: string; qualifications?: string },
|
||||
) {
|
||||
const user = await this.userRepo.findOne({ where: { id } });
|
||||
if (!user) throw new Error('用户不存在');
|
||||
const current = user.profile || {};
|
||||
user.profile = {
|
||||
subjects: dto.subjects !== undefined ? dto.subjects : current.subjects,
|
||||
joinedAt: dto.joinedAt !== undefined ? dto.joinedAt : current.joinedAt,
|
||||
qualifications:
|
||||
dto.qualifications !== undefined ? dto.qualifications : current.qualifications,
|
||||
};
|
||||
await this.userRepo.save(user);
|
||||
return { message: '资料已更新', profile: user.profile };
|
||||
}
|
||||
|
||||
// ---- 教师工作台 ----
|
||||
|
||||
async getTeacherWorkspace(userId: number) {
|
||||
// Find all classes where this user is a teacher
|
||||
@@ -704,7 +153,6 @@ export class RbacService {
|
||||
return { assignedClasses: [], todaySchedules: [], myStudents: [] };
|
||||
}
|
||||
|
||||
// Get assigned classes
|
||||
const assignedClasses = teacherAssignments.map((t) => ({
|
||||
classId: t.classId,
|
||||
className: t.class?.name || '',
|
||||
@@ -716,7 +164,6 @@ export class RbacService {
|
||||
// Get today's China business date and day of week (1=Monday, 7=Sunday)
|
||||
const { date: todayStr, weekDay: adjustedWeekDay } = getChinaDateParts();
|
||||
|
||||
// Get today's schedules for assigned classes
|
||||
const todaySchedules = await this.classScheduleRepo
|
||||
.createQueryBuilder('cs')
|
||||
.where('cs.classId IN (:...classIds)', { classIds })
|
||||
@@ -727,7 +174,6 @@ export class RbacService {
|
||||
.orderBy('cs.startTime', 'ASC')
|
||||
.getMany();
|
||||
|
||||
// Get students in assigned classes
|
||||
const classStudents = await this.classStudentRepo.find({
|
||||
where: { classId: In(classIds), status: 'active' },
|
||||
relations: ['student', 'class'],
|
||||
@@ -758,71 +204,60 @@ export class RbacService {
|
||||
myStudents,
|
||||
};
|
||||
}
|
||||
async seedData(): Promise<void> {
|
||||
return this.seedOps.seedData();
|
||||
}
|
||||
|
||||
async findAllUsers(isArchived = false) {
|
||||
return this.userOps.findAllUsers(isArchived);
|
||||
}
|
||||
|
||||
async createUser(dto: { username: string; password: string; name: string; roleIds?: number[] }) {
|
||||
return this.userOps.createUser(dto);
|
||||
}
|
||||
|
||||
async updateUser(id: number, dto: { username?: string; name?: string; roleIds?: number[] }) {
|
||||
return this.userOps.updateUser(id, dto);
|
||||
}
|
||||
|
||||
async resetPassword(id: number, newPassword: string) {
|
||||
return this.userOps.resetPassword(id, newPassword);
|
||||
}
|
||||
|
||||
async archiveUser(id: number) {
|
||||
return this.userOps.archiveUser(id);
|
||||
}
|
||||
|
||||
async restoreUser(id: number) {
|
||||
return this.userOps.restoreUser(id);
|
||||
}
|
||||
|
||||
async purgeUser(id: number, currentUserId: number) {
|
||||
return this.userOps.purgeUser(id, currentUserId);
|
||||
}
|
||||
|
||||
async markAsStaff(userId: number) {
|
||||
return this.userOps.markAsStaff(userId);
|
||||
}
|
||||
|
||||
async markAsStudent(userId: number) {
|
||||
return this.userOps.markAsStudent(userId);
|
||||
}
|
||||
|
||||
async getUserProfile(id: number) {
|
||||
return this.userOps.getUserProfile(id);
|
||||
}
|
||||
|
||||
async updateUserProfile(id: number, dto: UpdateProfileDto) {
|
||||
return this.userOps.updateUserProfile(id, dto);
|
||||
}
|
||||
|
||||
async getTeachers(query?: { search?: string; page?: number; pageSize?: number }) {
|
||||
const page = query?.page || 1;
|
||||
const pageSize = query?.pageSize || 20;
|
||||
const teacherRoleCodes = ['teacher'];
|
||||
const teacherRoleNames = ['任课老师', '老师'];
|
||||
|
||||
const qb = this.userRepo
|
||||
.createQueryBuilder('u')
|
||||
.leftJoinAndSelect('u.roles', 'role')
|
||||
.where('(role.code IN (:...roleCodes) OR role.name IN (:...roleNames))', {
|
||||
roleCodes: teacherRoleCodes,
|
||||
roleNames: teacherRoleNames,
|
||||
})
|
||||
.andWhere('u.isArchived = :isArchived', { isArchived: false });
|
||||
|
||||
if (query?.search) {
|
||||
qb.andWhere('(u.name LIKE :s OR u.username LIKE :s)', { s: `%${query.search}%` });
|
||||
}
|
||||
|
||||
const total = await qb.getCount();
|
||||
const users = await qb
|
||||
.orderBy('u.name', 'ASC')
|
||||
.skip((page - 1) * pageSize)
|
||||
.take(pageSize)
|
||||
.getMany();
|
||||
|
||||
const userIds = users.map((user) => user.id);
|
||||
const assignments =
|
||||
userIds.length > 0
|
||||
? await this.classTeacherRepo.find({ where: { userId: In(userIds) }, relations: ['class'] })
|
||||
: [];
|
||||
const assignmentsByUser = new Map<number, ClassTeacher[]>();
|
||||
for (const assignment of assignments) {
|
||||
const list = assignmentsByUser.get(assignment.userId) || [];
|
||||
list.push(assignment);
|
||||
assignmentsByUser.set(assignment.userId, list);
|
||||
}
|
||||
|
||||
const list = users.map((u) => ({
|
||||
id: u.id,
|
||||
username: u.username,
|
||||
name: u.name,
|
||||
profile: u.profile,
|
||||
lastLoginAt: u.lastLoginAt,
|
||||
roles: u.roles || [],
|
||||
classAssignments: (assignmentsByUser.get(u.id) || []).map((assignment) => ({
|
||||
id: assignment.id,
|
||||
classId: assignment.classId,
|
||||
roleType: assignment.roleType,
|
||||
subject: assignment.subject,
|
||||
className: assignment.class?.name || null,
|
||||
})),
|
||||
}));
|
||||
|
||||
return { list, total };
|
||||
return this.userOps.getTeachers(query);
|
||||
}
|
||||
|
||||
async updateTeacherProfile(
|
||||
id: number,
|
||||
profile: { subjects?: string[]; joinedAt?: string; qualifications?: string },
|
||||
) {
|
||||
const user = await this.userRepo.findOne({ where: { id } });
|
||||
if (!user) throw new NotFoundException('用户不存在');
|
||||
user.profile = { ...user.profile, ...profile };
|
||||
return this.userRepo.save(user);
|
||||
async updateTeacherProfile(id: number, dto: UpdateProfileDto) {
|
||||
return this.userOps.updateTeacherProfile(id, dto);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user