forked from wangziqi/gongxue-base
feat: add tenant class student scopes
This commit is contained in:
Codex
12
README.md
12
README.md
@@ -6,13 +6,13 @@
|
||||
|
||||
## 当前状态
|
||||
|
||||
更新时间：2026-06-28
|
||||
更新时间：2026-06-29
|
||||
|
||||
目前已经完成并在本地验证通过的内容：
|
||||
|
||||
- Supabase/PostgreSQL 多租户数据库 schema、RLS、索引、触发器。
|
||||
- `apps/api` 独立业务 API，后续供 H5、Taro 小程序、管理后台统一调用；已支持 Supabase Auth JWT 和迁移期 `tk_` session 双入口。
|
||||
- 租户后台能力：品牌、域名、公开设置、支付账户、登录配置、私密密钥掩码、活动内容、激活码、优惠券、成员权限、自定义角色模板、审计日志。
|
||||
- 租户后台能力：品牌、域名、公开设置、支付账户、登录配置、私密密钥掩码、活动内容、激活码、优惠券、成员权限、自定义角色模板、班级/教师/学生范围权限、审计日志。
|
||||
- 租户内容能力：可配置题库入口、任意深度分类树、考试意向标记、题目集合、顺序/随机/全真模拟蓝图、题目录入/更新、视频绑定、分数线、单词、知识手册、资料资源台账、题目/单词/知识手册 JSON 批量导入。
|
||||
- 学生端能力：题库入口、分类树、题目集合、顺序/随机/模考 session 组卷快照、答题、错题本、收藏夹、背单词进度、个人中心、分数线、题目视频、订单、权益、激活码兑换、资料下载。
|
||||
- 平台后台能力：租户管理、SaaS 套餐、订阅、账单、服务费收款、用量记录。
|
||||
@@ -22,7 +22,7 @@
|
||||
|
||||
还没有达到生产交付的部分：
|
||||
|
||||
- Supabase Auth/JWT 已可联调；生产前还要做真实云端 Auth/JWKS 回归、RLS 深测和自定义角色权限细化。
|
||||
- Supabase Auth/JWT、租户角色模板、班级/教师/学生范围权限已可联调；生产前还要做真实云端 Auth/JWKS 回归和 RLS 深测。
|
||||
- 真实短信、微信登录、QQ 登录、微信支付、支付宝等 provider adapter 还没接完。
|
||||
- OSS/COS/Supabase Storage 上传下载签名 provider 已接入；上传后校验、PDF 预览、防盗链和视频水印还没完成。
|
||||
- Excel/CSV 导入、分数线/视频批量导入和异步 worker 还没完成。
|
||||
@@ -138,7 +138,7 @@ apps/api/src/features/
|
||||
referral/ 销售/代理客资追踪、CRM 队列
|
||||
scoreline/ 分数线
|
||||
tenant/ 租户解析
|
||||
tenant-admin/ 租户后台配置、成员权限、活动和审计
|
||||
tenant-admin/ 租户后台配置、成员权限、班级学生、活动和审计
|
||||
tenant-content/ 租户内容导航、题库维护、资源管理、批量导入
|
||||
video/ 题目视频讲解
|
||||
```
|
||||
@@ -174,8 +174,8 @@ npm run check:refactor
|
||||
|
||||
优先继续补：
|
||||
|
||||
1. 真实云端 Auth/JWKS 回归、RLS 深测、班级/教师/学生范围权限。
|
||||
1. 真实云端 Auth/JWKS 回归、RLS 深测和生产环境配置验收。
|
||||
2. Taro 前端 scaffold，让 H5 和小程序共用同一套 API。
|
||||
3. 对象存储上传后校验、PDF 预览、防盗链和视频水印。
|
||||
4. Excel/CSV 以及分数线、视频批量导入；把现有 JSON 导入升级为可排队异步执行。
|
||||
5. 微信网页/QQ 登录、退款对账、CRM worker、公共题库授权和租户采纳。
|
||||
5. 学生批量导入/批量分班、微信网页/QQ 登录、退款对账、CRM worker、公共题库授权和租户采纳。
|
||||
|
||||
@@ -14,7 +14,7 @@ const ROLE_PERMISSION_DEFAULTS: Record<string, string[]> = {
|
||||
tenant_owner: ['*'],
|
||||
tenant_admin: ['*'],
|
||||
tenant_operator: ['content:*', 'marketing:*', 'codes:read', 'coupons:read', 'referral:read', 'crm:read'],
|
||||
teacher: ['content:*'],
|
||||
teacher: ['content:*', 'classes:read', 'students:read'],
|
||||
sales: ['codes:*', 'coupons:*', 'referral:*'],
|
||||
agent: ['codes:read', 'coupons:read', 'referral:self'],
|
||||
student: [],
|
||||
@@ -102,6 +102,10 @@ export function tenantPermissionCatalog() {
|
||||
{ key: 'referral:write', label: '客资归属管理' },
|
||||
{ key: 'crm:read', label: 'CRM 队列查看' },
|
||||
{ key: 'crm:write', label: 'CRM 入队和重试' },
|
||||
{ key: 'classes:read', label: '班级查看' },
|
||||
{ key: 'classes:write', label: '班级管理' },
|
||||
{ key: 'students:read', label: '学生查看' },
|
||||
{ key: 'students:write', label: '学生管理' },
|
||||
{ key: 'members:read', label: '成员查看' },
|
||||
{ key: 'members:write', label: '成员管理' },
|
||||
{ key: 'roles:read', label: '角色模板查看' },
|
||||
|
||||
724
apps/api/src/features/tenant-admin/classes.ts
Normal file
724
apps/api/src/features/tenant-admin/classes.ts
Normal file
@@ -0,0 +1,724 @@
|
||||
import type pg from 'pg';
|
||||
import { HttpError, type RequestContext } from '../../core/http.js';
|
||||
import { intParam, readJsonBody, requiredString, stringParam } from '../../core/request.js';
|
||||
import { query, transaction } from '../../core/db.js';
|
||||
import {
|
||||
hasTenantPermission,
|
||||
requireTenantAdmin,
|
||||
requireTenantPermission,
|
||||
type TenantAdminAuth,
|
||||
} from './auth.js';
|
||||
|
||||
type JsonBody = Record<string, unknown>;
|
||||
|
||||
const CLASS_STATUSES = ['active', 'disabled', 'archived'];
|
||||
const CLASS_MEMBER_TYPES = ['student', 'teacher', 'assistant', 'head_teacher'];
|
||||
const CLASS_MEMBER_STATUSES = ['active', 'disabled', 'removed'];
|
||||
const STUDENT_MEMBER_STATUSES = ['active', 'invited', 'disabled'];
|
||||
|
||||
function nullableString(value: unknown) {
|
||||
return typeof value === 'string' && value.trim() ? value.trim() : null;
|
||||
}
|
||||
|
||||
function objectValue(value: unknown): Record<string, unknown> {
|
||||
return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {};
|
||||
}
|
||||
|
||||
function jsonBodyValue(value: unknown) {
|
||||
return JSON.stringify(objectValue(value));
|
||||
}
|
||||
|
||||
function intValue(value: unknown, fallback: number) {
|
||||
const numberValue = Number(value ?? fallback);
|
||||
return Number.isFinite(numberValue) ? Math.trunc(numberValue) : fallback;
|
||||
}
|
||||
|
||||
function optionalChoice(value: unknown, allowed: string[], fallback: string) {
|
||||
const candidate = nullableString(value) || fallback;
|
||||
if (!allowed.includes(candidate)) {
|
||||
throw new HttpError(400, `Invalid value: ${candidate}`, 'INVALID_FIELD_VALUE');
|
||||
}
|
||||
return candidate;
|
||||
}
|
||||
|
||||
function uuidArrayValue(value: unknown) {
|
||||
if (!Array.isArray(value)) return [];
|
||||
return value
|
||||
.map(item => (typeof item === 'string' ? item.trim() : ''))
|
||||
.filter(item => /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(item));
|
||||
}
|
||||
|
||||
function classCodeValue(value: unknown) {
|
||||
const code = nullableString(value);
|
||||
if (!code) return null;
|
||||
if (!/^[a-z0-9][a-z0-9_-]{1,63}$/i.test(code)) {
|
||||
throw new HttpError(400, 'Invalid class code', 'INVALID_CLASS_CODE');
|
||||
}
|
||||
return code;
|
||||
}
|
||||
|
||||
function canReadAllClassScope(auth: TenantAdminAuth) {
|
||||
return (
|
||||
auth.role === 'tenant_owner' ||
|
||||
auth.role === 'tenant_admin' ||
|
||||
hasTenantPermission(auth, 'classes:write') ||
|
||||
hasTenantPermission(auth, 'students:write') ||
|
||||
hasTenantPermission(auth, 'members:read')
|
||||
);
|
||||
}
|
||||
|
||||
function canSeeStudentPhone(auth: TenantAdminAuth) {
|
||||
return auth.fieldPermissions?.['student.phone'] !== false;
|
||||
}
|
||||
|
||||
function maskStudentFields<T extends Record<string, unknown>>(auth: TenantAdminAuth, item: T): T {
|
||||
if (canSeeStudentPhone(auth)) return item;
|
||||
return {
|
||||
...item,
|
||||
phone: null,
|
||||
};
|
||||
}
|
||||
|
||||
async function recordAudit(
|
||||
client: pg.PoolClient,
|
||||
auth: TenantAdminAuth,
|
||||
action: string,
|
||||
targetType: string,
|
||||
targetId: string | null,
|
||||
details: Record<string, unknown> = {},
|
||||
) {
|
||||
await client.query(
|
||||
`
|
||||
insert into public.audit_logs (tenant_id, actor_user_id, action, target_type, target_id, details)
|
||||
values ($1, $2, $3, $4, $5, $6::jsonb)
|
||||
`,
|
||||
[auth.tenantId, auth.userId, action, targetType, targetId, JSON.stringify(details)],
|
||||
);
|
||||
}
|
||||
|
||||
async function scopedClassIds(auth: TenantAdminAuth) {
|
||||
if (canReadAllClassScope(auth)) return null;
|
||||
|
||||
const explicit = uuidArrayValue(auth.dataScope?.classIds);
|
||||
const rows = await query<{ id: string }>(
|
||||
`
|
||||
select distinct class_id as id
|
||||
from public.tenant_class_members
|
||||
where tenant_id = $1
|
||||
and user_id = $2
|
||||
and status = 'active'
|
||||
and member_type in ('teacher', 'assistant', 'head_teacher')
|
||||
`,
|
||||
[auth.tenantId, auth.userId],
|
||||
);
|
||||
|
||||
return Array.from(new Set([...explicit, ...rows.map(item => item.id)]));
|
||||
}
|
||||
|
||||
async function ensureReadableClass(auth: TenantAdminAuth, classId: string) {
|
||||
const allowedClassIds = await scopedClassIds(auth);
|
||||
if (allowedClassIds && !allowedClassIds.includes(classId)) {
|
||||
throw new HttpError(403, 'Class is outside the current data scope', 'CLASS_SCOPE_REQUIRED');
|
||||
}
|
||||
|
||||
const rows = await query<{ id: string }>(
|
||||
'select id from public.tenant_classes where tenant_id = $1 and id = $2 limit 1',
|
||||
[auth.tenantId, classId],
|
||||
);
|
||||
if (!rows[0]) throw new HttpError(404, 'Class not found', 'CLASS_NOT_FOUND');
|
||||
}
|
||||
|
||||
async function ensureTenantReference(
|
||||
client: pg.PoolClient,
|
||||
tableName: 'regions' | 'schools' | 'majors',
|
||||
tenantId: string,
|
||||
id: string | null,
|
||||
errorCode: string,
|
||||
) {
|
||||
if (!id) return;
|
||||
const result = await client.query<{ id: string }>(
|
||||
`select id from public.${tableName} where tenant_id = $1 and id = $2 limit 1`,
|
||||
[tenantId, id],
|
||||
);
|
||||
if (!result.rows[0]) throw new HttpError(400, `${tableName} id is not in this tenant`, errorCode);
|
||||
}
|
||||
|
||||
async function ensureTenantClass(client: pg.PoolClient, tenantId: string, classId: string) {
|
||||
const result = await client.query<{ id: string }>(
|
||||
'select id from public.tenant_classes where tenant_id = $1 and id = $2 limit 1',
|
||||
[tenantId, classId],
|
||||
);
|
||||
if (!result.rows[0]) throw new HttpError(404, 'Class not found', 'CLASS_NOT_FOUND');
|
||||
}
|
||||
|
||||
async function resolveOrCreateUser(client: pg.PoolClient, body: JsonBody, fallbackPrimaryRole: string) {
|
||||
const userId = nullableString(body.userId);
|
||||
if (userId) {
|
||||
const existing = await client.query<{ id: string }>(
|
||||
'select id from public.platform_users where id = $1 limit 1',
|
||||
[userId],
|
||||
);
|
||||
if (!existing.rows[0]) throw new HttpError(404, 'User not found', 'USER_NOT_FOUND');
|
||||
await client.query(
|
||||
`
|
||||
update public.platform_users
|
||||
set username = coalesce($2, username),
|
||||
email = coalesce($3::citext, email),
|
||||
phone = coalesce($4, phone),
|
||||
name = coalesce($5, name),
|
||||
avatar_url = coalesce($6, avatar_url),
|
||||
primary_role = coalesce($7, primary_role),
|
||||
updated_at = now()
|
||||
where id = $1
|
||||
`,
|
||||
[
|
||||
userId,
|
||||
nullableString(body.username),
|
||||
nullableString(body.email),
|
||||
nullableString(body.phone),
|
||||
nullableString(body.name),
|
||||
nullableString(body.avatarUrl),
|
||||
nullableString(body.primaryRole),
|
||||
],
|
||||
);
|
||||
return userId;
|
||||
}
|
||||
|
||||
const phone = nullableString(body.phone);
|
||||
const email = nullableString(body.email);
|
||||
const username = nullableString(body.username);
|
||||
const name = nullableString(body.name);
|
||||
if (!phone && !email && !username && !name) {
|
||||
throw new HttpError(400, 'userId, phone, email, username, or name is required', 'USER_REQUIRED');
|
||||
}
|
||||
|
||||
const found = await client.query<{ id: string }>(
|
||||
`
|
||||
select id
|
||||
from public.platform_users
|
||||
where ($1::text is not null and phone = $1)
|
||||
or ($2::citext is not null and email = $2::citext)
|
||||
or ($3::text is not null and username = $3)
|
||||
order by created_at asc
|
||||
limit 1
|
||||
`,
|
||||
[phone, email, username],
|
||||
);
|
||||
if (found.rows[0]) return found.rows[0].id;
|
||||
|
||||
const created = await client.query<{ id: string }>(
|
||||
`
|
||||
insert into public.platform_users (username, email, phone, name, avatar_url, primary_role, raw_profile)
|
||||
values ($1, $2::citext, $3, $4, $5, $6, '{"source":"tenant-admin"}'::jsonb)
|
||||
returning id
|
||||
`,
|
||||
[
|
||||
username || phone || email,
|
||||
email,
|
||||
phone,
|
||||
name || username || phone || email,
|
||||
nullableString(body.avatarUrl),
|
||||
fallbackPrimaryRole,
|
||||
],
|
||||
);
|
||||
return created.rows[0].id;
|
||||
}
|
||||
|
||||
async function ensureTenantMembership(
|
||||
client: pg.PoolClient,
|
||||
tenantId: string,
|
||||
userId: string,
|
||||
role: string,
|
||||
status = 'active',
|
||||
) {
|
||||
await client.query(
|
||||
`
|
||||
insert into public.tenant_memberships (tenant_id, user_id, role, status)
|
||||
values ($1, $2, $3, $4)
|
||||
on conflict (tenant_id, user_id, role)
|
||||
do update set status = excluded.status,
|
||||
updated_at = now()
|
||||
`,
|
||||
[tenantId, userId, role, status],
|
||||
);
|
||||
}
|
||||
|
||||
function membershipRoleForClassMember(memberType: string) {
|
||||
return memberType === 'student' ? 'student' : 'teacher';
|
||||
}
|
||||
|
||||
export async function tenantClassesRoute(ctx: RequestContext) {
|
||||
const auth = await requireTenantAdmin(ctx);
|
||||
requireTenantPermission(auth, 'classes:read');
|
||||
const limit = intParam(ctx, 'limit', 100, 500);
|
||||
const status = stringParam(ctx, 'status');
|
||||
const regionId = stringParam(ctx, 'regionId');
|
||||
const keyword = stringParam(ctx, 'keyword');
|
||||
const scopedIds = await scopedClassIds(auth);
|
||||
|
||||
const params: unknown[] = [auth.tenantId];
|
||||
const filters = ['tc.tenant_id = $1'];
|
||||
if (status) {
|
||||
if (!CLASS_STATUSES.includes(status)) throw new HttpError(400, `Invalid class status: ${status}`, 'INVALID_CLASS_STATUS');
|
||||
params.push(status);
|
||||
filters.push(`tc.status = $${params.length}`);
|
||||
} else {
|
||||
filters.push(`tc.status <> 'archived'`);
|
||||
}
|
||||
if (regionId) {
|
||||
params.push(regionId);
|
||||
filters.push(`tc.region_id = $${params.length}::uuid`);
|
||||
}
|
||||
if (keyword) {
|
||||
params.push(`%${keyword}%`);
|
||||
filters.push(`(tc.name ilike $${params.length} or tc.code ilike $${params.length})`);
|
||||
}
|
||||
if (scopedIds) {
|
||||
params.push(scopedIds);
|
||||
filters.push(`tc.id = any($${params.length}::uuid[])`);
|
||||
}
|
||||
params.push(limit);
|
||||
|
||||
const items = await query(
|
||||
`
|
||||
select tc.id, tc.region_id as "regionId", r.name as "regionName",
|
||||
tc.legacy_id as "legacyId", tc.code, tc.name, tc.description,
|
||||
tc.status, tc.sort_order as "sortOrder", tc.metadata,
|
||||
tc.created_by as "createdBy", tc.updated_by as "updatedBy",
|
||||
tc.created_at as "createdAt", tc.updated_at as "updatedAt",
|
||||
coalesce(count(tcm.id) filter (where tcm.status = 'active' and tcm.member_type = 'student'), 0)::int as "studentCount",
|
||||
coalesce(count(tcm.id) filter (where tcm.status = 'active' and tcm.member_type in ('teacher', 'assistant', 'head_teacher')), 0)::int as "teacherCount"
|
||||
from public.tenant_classes tc
|
||||
left join public.regions r on r.id = tc.region_id and r.tenant_id = tc.tenant_id
|
||||
left join public.tenant_class_members tcm on tcm.tenant_id = tc.tenant_id and tcm.class_id = tc.id
|
||||
where ${filters.join(' and ')}
|
||||
group by tc.id, r.name
|
||||
order by tc.sort_order asc, tc.created_at desc
|
||||
limit $${params.length}
|
||||
`,
|
||||
params,
|
||||
);
|
||||
return { items, scoped: scopedIds !== null };
|
||||
}
|
||||
|
||||
export async function upsertTenantClassRoute(ctx: RequestContext) {
|
||||
const auth = await requireTenantAdmin(ctx);
|
||||
requireTenantPermission(auth, 'classes:write');
|
||||
const body = await readJsonBody(ctx);
|
||||
const item = await transaction(async client => {
|
||||
const regionId = nullableString(body.regionId);
|
||||
await ensureTenantReference(client, 'regions', auth.tenantId, regionId, 'REGION_NOT_FOUND');
|
||||
|
||||
const result = await client.query(
|
||||
`
|
||||
insert into public.tenant_classes (
|
||||
id, tenant_id, region_id, legacy_id, code, name, description,
|
||||
status, sort_order, metadata, created_by, updated_by
|
||||
)
|
||||
values (
|
||||
coalesce($2::uuid, gen_random_uuid()), $1, $3::uuid, $4, $5, $6, $7,
|
||||
$8, $9, $10::jsonb, $11, $11
|
||||
)
|
||||
on conflict (id)
|
||||
do update set region_id = excluded.region_id,
|
||||
legacy_id = coalesce(excluded.legacy_id, public.tenant_classes.legacy_id),
|
||||
code = excluded.code,
|
||||
name = excluded.name,
|
||||
description = excluded.description,
|
||||
status = excluded.status,
|
||||
sort_order = excluded.sort_order,
|
||||
metadata = excluded.metadata,
|
||||
updated_by = excluded.updated_by,
|
||||
updated_at = now()
|
||||
where public.tenant_classes.tenant_id = excluded.tenant_id
|
||||
returning id, region_id as "regionId", legacy_id as "legacyId", code, name,
|
||||
description, status, sort_order as "sortOrder", metadata,
|
||||
created_by as "createdBy", updated_by as "updatedBy",
|
||||
created_at as "createdAt", updated_at as "updatedAt"
|
||||
`,
|
||||
[
|
||||
auth.tenantId,
|
||||
nullableString(body.id),
|
||||
regionId,
|
||||
nullableString(body.legacyId),
|
||||
classCodeValue(body.code),
|
||||
requiredString(body, 'name'),
|
||||
nullableString(body.description),
|
||||
optionalChoice(body.status, CLASS_STATUSES, 'active'),
|
||||
intValue(body.sortOrder, 0),
|
||||
jsonBodyValue(body.metadata),
|
||||
auth.userId,
|
||||
],
|
||||
);
|
||||
if (!result.rows[0]) throw new HttpError(404, 'Class not found for this tenant', 'CLASS_NOT_FOUND');
|
||||
await recordAudit(client, auth, 'tenant.class.upserted', 'tenant_classes', result.rows[0].id, {
|
||||
code: result.rows[0].code,
|
||||
name: result.rows[0].name,
|
||||
});
|
||||
return result.rows[0];
|
||||
});
|
||||
return { item };
|
||||
}
|
||||
|
||||
export async function disableTenantClassRoute(ctx: RequestContext) {
|
||||
const auth = await requireTenantAdmin(ctx);
|
||||
requireTenantPermission(auth, 'classes:write');
|
||||
const body = await readJsonBody(ctx);
|
||||
const classId = requiredString(body, 'classId');
|
||||
const item = await transaction(async client => {
|
||||
const result = await client.query(
|
||||
`
|
||||
update public.tenant_classes
|
||||
set status = 'disabled',
|
||||
updated_by = $3,
|
||||
updated_at = now()
|
||||
where tenant_id = $1 and id = $2
|
||||
returning id, code, name, status, updated_at as "updatedAt"
|
||||
`,
|
||||
[auth.tenantId, classId, auth.userId],
|
||||
);
|
||||
if (!result.rows[0]) throw new HttpError(404, 'Class not found', 'CLASS_NOT_FOUND');
|
||||
await recordAudit(client, auth, 'tenant.class.disabled', 'tenant_classes', classId);
|
||||
return result.rows[0];
|
||||
});
|
||||
return { item };
|
||||
}
|
||||
|
||||
export async function tenantClassMembersRoute(ctx: RequestContext) {
|
||||
const auth = await requireTenantAdmin(ctx);
|
||||
requireTenantPermission(auth, 'classes:read');
|
||||
const classId = stringParam(ctx, 'classId');
|
||||
if (!classId) throw new HttpError(400, 'classId is required', 'CLASS_ID_REQUIRED');
|
||||
await ensureReadableClass(auth, classId);
|
||||
const memberType = stringParam(ctx, 'memberType');
|
||||
const status = stringParam(ctx, 'status') || 'active';
|
||||
if (memberType && !CLASS_MEMBER_TYPES.includes(memberType)) {
|
||||
throw new HttpError(400, `Invalid member type: ${memberType}`, 'INVALID_CLASS_MEMBER_TYPE');
|
||||
}
|
||||
if (!CLASS_MEMBER_STATUSES.includes(status)) {
|
||||
throw new HttpError(400, `Invalid class member status: ${status}`, 'INVALID_CLASS_MEMBER_STATUS');
|
||||
}
|
||||
const params: unknown[] = [auth.tenantId, classId, status];
|
||||
const filters = ['tcm.tenant_id = $1', 'tcm.class_id = $2::uuid', 'tcm.status = $3'];
|
||||
if (memberType) {
|
||||
params.push(memberType);
|
||||
filters.push(`tcm.member_type = $${params.length}`);
|
||||
}
|
||||
|
||||
const items = await query<Record<string, unknown>>(
|
||||
`
|
||||
select tcm.id, tcm.class_id as "classId", tcm.user_id as "userId",
|
||||
tcm.member_type as "memberType", tcm.status, tcm.joined_at as "joinedAt",
|
||||
tcm.left_at as "leftAt", tcm.metadata, tcm.created_at as "createdAt",
|
||||
tcm.updated_at as "updatedAt",
|
||||
u.username, u.email::text as email, u.phone, u.name,
|
||||
u.avatar_url as "avatarUrl", u.primary_role as "primaryRole",
|
||||
sp.region_id as "regionId", sp.selected_school_id as "selectedSchoolId",
|
||||
sp.selected_major_id as "selectedMajorId"
|
||||
from public.tenant_class_members tcm
|
||||
join public.platform_users u on u.id = tcm.user_id
|
||||
left join public.student_profiles sp on sp.tenant_id = tcm.tenant_id and sp.user_id = tcm.user_id
|
||||
where ${filters.join(' and ')}
|
||||
order by case tcm.member_type
|
||||
when 'head_teacher' then 1
|
||||
when 'teacher' then 2
|
||||
when 'assistant' then 3
|
||||
else 9
|
||||
end, tcm.joined_at asc
|
||||
`,
|
||||
params,
|
||||
);
|
||||
|
||||
return { items: items.map(item => maskStudentFields(auth, item)) };
|
||||
}
|
||||
|
||||
export async function upsertTenantClassMemberRoute(ctx: RequestContext) {
|
||||
const auth = await requireTenantAdmin(ctx);
|
||||
requireTenantPermission(auth, 'classes:write');
|
||||
const body = await readJsonBody(ctx);
|
||||
const classId = requiredString(body, 'classId');
|
||||
const memberType = optionalChoice(body.memberType, CLASS_MEMBER_TYPES, 'student');
|
||||
const status = optionalChoice(body.status, CLASS_MEMBER_STATUSES, 'active');
|
||||
|
||||
const item = await transaction(async client => {
|
||||
await ensureTenantClass(client, auth.tenantId, classId);
|
||||
const userId = await resolveOrCreateUser(client, body, membershipRoleForClassMember(memberType));
|
||||
await ensureTenantMembership(client, auth.tenantId, userId, membershipRoleForClassMember(memberType), 'active');
|
||||
if (memberType === 'student') {
|
||||
await client.query(
|
||||
`
|
||||
insert into public.student_profiles (tenant_id, user_id, stats, progress)
|
||||
values ($1, $2, '{}'::jsonb, '{}'::jsonb)
|
||||
on conflict (tenant_id, user_id) do nothing
|
||||
`,
|
||||
[auth.tenantId, userId],
|
||||
);
|
||||
}
|
||||
|
||||
const result = await client.query(
|
||||
`
|
||||
insert into public.tenant_class_members (
|
||||
tenant_id, class_id, user_id, member_type, status, left_at,
|
||||
metadata, created_by, updated_by
|
||||
)
|
||||
values ($1, $2, $3, $4, $5, case when $5 in ('disabled', 'removed') then now() else null end, $6::jsonb, $7, $7)
|
||||
on conflict (tenant_id, class_id, user_id, member_type)
|
||||
do update set status = excluded.status,
|
||||
left_at = excluded.left_at,
|
||||
metadata = excluded.metadata,
|
||||
updated_by = excluded.updated_by,
|
||||
updated_at = now()
|
||||
returning id, class_id as "classId", user_id as "userId",
|
||||
member_type as "memberType", status, joined_at as "joinedAt",
|
||||
left_at as "leftAt", metadata, created_at as "createdAt", updated_at as "updatedAt"
|
||||
`,
|
||||
[auth.tenantId, classId, userId, memberType, status, jsonBodyValue(body.metadata), auth.userId],
|
||||
);
|
||||
|
||||
await recordAudit(client, auth, 'tenant.class_member.upserted', 'tenant_class_members', result.rows[0].id, {
|
||||
classId,
|
||||
userId,
|
||||
memberType,
|
||||
status,
|
||||
});
|
||||
return result.rows[0];
|
||||
});
|
||||
|
||||
return { item };
|
||||
}
|
||||
|
||||
export async function removeTenantClassMemberRoute(ctx: RequestContext) {
|
||||
const auth = await requireTenantAdmin(ctx);
|
||||
requireTenantPermission(auth, 'classes:write');
|
||||
const body = await readJsonBody(ctx);
|
||||
const classMemberId = requiredString(body, 'classMemberId');
|
||||
|
||||
const item = await transaction(async client => {
|
||||
const result = await client.query(
|
||||
`
|
||||
update public.tenant_class_members
|
||||
set status = 'removed',
|
||||
left_at = now(),
|
||||
updated_by = $3,
|
||||
updated_at = now()
|
||||
where tenant_id = $1 and id = $2
|
||||
returning id, class_id as "classId", user_id as "userId",
|
||||
member_type as "memberType", status, left_at as "leftAt",
|
||||
updated_at as "updatedAt"
|
||||
`,
|
||||
[auth.tenantId, classMemberId, auth.userId],
|
||||
);
|
||||
if (!result.rows[0]) throw new HttpError(404, 'Class member not found', 'CLASS_MEMBER_NOT_FOUND');
|
||||
await recordAudit(client, auth, 'tenant.class_member.removed', 'tenant_class_members', classMemberId, {
|
||||
classId: result.rows[0].classId,
|
||||
userId: result.rows[0].userId,
|
||||
});
|
||||
return result.rows[0];
|
||||
});
|
||||
|
||||
return { item };
|
||||
}
|
||||
|
||||
export async function tenantStudentsRoute(ctx: RequestContext) {
|
||||
const auth = await requireTenantAdmin(ctx);
|
||||
requireTenantPermission(auth, 'students:read');
|
||||
const limit = intParam(ctx, 'limit', 100, 500);
|
||||
const keyword = stringParam(ctx, 'keyword');
|
||||
const status = stringParam(ctx, 'status') || 'active';
|
||||
const regionId = stringParam(ctx, 'regionId');
|
||||
const classId = stringParam(ctx, 'classId');
|
||||
const scopedIds = await scopedClassIds(auth);
|
||||
if (classId) await ensureReadableClass(auth, classId);
|
||||
if (!STUDENT_MEMBER_STATUSES.includes(status)) {
|
||||
throw new HttpError(400, `Invalid student status: ${status}`, 'INVALID_STUDENT_STATUS');
|
||||
}
|
||||
|
||||
const params: unknown[] = [auth.tenantId, status];
|
||||
let classAggScopeSql = '';
|
||||
if (scopedIds) {
|
||||
params.push(scopedIds);
|
||||
classAggScopeSql = `and tcm.class_id = any($${params.length}::uuid[])`;
|
||||
}
|
||||
const filters = ['tm.tenant_id = $1', `tm.role = 'student'`, 'tm.status = $2'];
|
||||
if (keyword) {
|
||||
params.push(`%${keyword}%`);
|
||||
filters.push(`(u.username ilike $${params.length} or u.name ilike $${params.length} or u.phone ilike $${params.length} or u.email::text ilike $${params.length})`);
|
||||
}
|
||||
if (regionId) {
|
||||
params.push(regionId);
|
||||
filters.push(`sp.region_id = $${params.length}::uuid`);
|
||||
}
|
||||
if (classId) {
|
||||
params.push(classId);
|
||||
filters.push(`exists (
|
||||
select 1 from public.tenant_class_members scoped_cm
|
||||
where scoped_cm.tenant_id = tm.tenant_id
|
||||
and scoped_cm.user_id = tm.user_id
|
||||
and scoped_cm.class_id = $${params.length}::uuid
|
||||
and scoped_cm.member_type = 'student'
|
||||
and scoped_cm.status = 'active'
|
||||
)`);
|
||||
}
|
||||
if (scopedIds) {
|
||||
params.push(scopedIds);
|
||||
filters.push(`exists (
|
||||
select 1 from public.tenant_class_members scoped_cm
|
||||
where scoped_cm.tenant_id = tm.tenant_id
|
||||
and scoped_cm.user_id = tm.user_id
|
||||
and scoped_cm.class_id = any($${params.length}::uuid[])
|
||||
and scoped_cm.member_type = 'student'
|
||||
and scoped_cm.status = 'active'
|
||||
)`);
|
||||
}
|
||||
params.push(limit);
|
||||
|
||||
const items = await query<Record<string, unknown>>(
|
||||
`
|
||||
with class_agg as (
|
||||
select tcm.tenant_id, tcm.user_id,
|
||||
jsonb_agg(
|
||||
jsonb_build_object(
|
||||
'classId', tc.id,
|
||||
'className', tc.name,
|
||||
'classCode', tc.code,
|
||||
'memberType', tcm.member_type,
|
||||
'joinedAt', tcm.joined_at
|
||||
)
|
||||
order by tc.sort_order asc, tc.created_at desc
|
||||
) filter (where tcm.status = 'active') as classes
|
||||
from public.tenant_class_members tcm
|
||||
join public.tenant_classes tc on tc.tenant_id = tcm.tenant_id and tc.id = tcm.class_id
|
||||
where tcm.tenant_id = $1 and tcm.member_type = 'student'
|
||||
${classAggScopeSql}
|
||||
group by tcm.tenant_id, tcm.user_id
|
||||
)
|
||||
select tm.id as "membershipId", tm.user_id as "userId", tm.status,
|
||||
tm.created_at as "memberCreatedAt", tm.updated_at as "memberUpdatedAt",
|
||||
u.username, u.email::text as email, u.phone, u.name,
|
||||
u.avatar_url as "avatarUrl", u.primary_role as "primaryRole",
|
||||
u.last_seen_at as "lastSeenAt",
|
||||
sp.id as "profileId", sp.region_id as "regionId", r.name as "regionName",
|
||||
sp.selected_school_id as "selectedSchoolId", s.name as "selectedSchoolName",
|
||||
sp.selected_major_id as "selectedMajorId", m.name as "selectedMajorName",
|
||||
sp.questions_answered_today as "questionsAnsweredToday",
|
||||
sp.mastered_words_count as "masteredWordsCount",
|
||||
sp.last_check_in_date as "lastCheckInDate",
|
||||
sp.stats, sp.progress, sp.module_selections as "moduleSelections",
|
||||
coalesce(ca.classes, '[]'::jsonb) as classes
|
||||
from public.tenant_memberships tm
|
||||
join public.platform_users u on u.id = tm.user_id
|
||||
left join public.student_profiles sp on sp.tenant_id = tm.tenant_id and sp.user_id = tm.user_id
|
||||
left join public.regions r on r.tenant_id = tm.tenant_id and r.id = sp.region_id
|
||||
left join public.schools s on s.tenant_id = tm.tenant_id and s.id = sp.selected_school_id
|
||||
left join public.majors m on m.tenant_id = tm.tenant_id and m.id = sp.selected_major_id
|
||||
left join class_agg ca on ca.tenant_id = tm.tenant_id and ca.user_id = tm.user_id
|
||||
where ${filters.join(' and ')}
|
||||
order by tm.created_at desc
|
||||
limit $${params.length}
|
||||
`,
|
||||
params,
|
||||
);
|
||||
|
||||
return { items: items.map(item => maskStudentFields(auth, item)), scoped: scopedIds !== null };
|
||||
}
|
||||
|
||||
export async function upsertTenantStudentRoute(ctx: RequestContext) {
|
||||
const auth = await requireTenantAdmin(ctx);
|
||||
requireTenantPermission(auth, 'students:write');
|
||||
const body = await readJsonBody(ctx);
|
||||
const status = optionalChoice(body.status, STUDENT_MEMBER_STATUSES, 'active');
|
||||
|
||||
const item = await transaction(async client => {
|
||||
const userId = await resolveOrCreateUser(client, body, 'student');
|
||||
const regionId = nullableString(body.regionId);
|
||||
const selectedSchoolId = nullableString(body.selectedSchoolId);
|
||||
const selectedMajorId = nullableString(body.selectedMajorId);
|
||||
await ensureTenantReference(client, 'regions', auth.tenantId, regionId, 'REGION_NOT_FOUND');
|
||||
await ensureTenantReference(client, 'schools', auth.tenantId, selectedSchoolId, 'SCHOOL_NOT_FOUND');
|
||||
await ensureTenantReference(client, 'majors', auth.tenantId, selectedMajorId, 'MAJOR_NOT_FOUND');
|
||||
|
||||
await ensureTenantMembership(client, auth.tenantId, userId, 'student', status);
|
||||
const profile = await client.query(
|
||||
`
|
||||
insert into public.student_profiles (
|
||||
tenant_id, user_id, region_id, selected_school_id, selected_major_id,
|
||||
stats, progress, module_selections
|
||||
)
|
||||
values ($1, $2, $3::uuid, $4::uuid, $5::uuid, $6::jsonb, $7::jsonb, $8::jsonb)
|
||||
on conflict (tenant_id, user_id)
|
||||
do update set region_id = coalesce(excluded.region_id, public.student_profiles.region_id),
|
||||
selected_school_id = coalesce(excluded.selected_school_id, public.student_profiles.selected_school_id),
|
||||
selected_major_id = coalesce(excluded.selected_major_id, public.student_profiles.selected_major_id),
|
||||
stats = case when $6::jsonb = '{}'::jsonb then public.student_profiles.stats else excluded.stats end,
|
||||
progress = case when $7::jsonb = '{}'::jsonb then public.student_profiles.progress else excluded.progress end,
|
||||
module_selections = case when $8::jsonb = '{}'::jsonb then public.student_profiles.module_selections else excluded.module_selections end,
|
||||
updated_at = now()
|
||||
returning id as "profileId", tenant_id as "tenantId", user_id as "userId",
|
||||
region_id as "regionId", selected_school_id as "selectedSchoolId",
|
||||
selected_major_id as "selectedMajorId", stats, progress,
|
||||
module_selections as "moduleSelections", updated_at as "updatedAt"
|
||||
`,
|
||||
[
|
||||
auth.tenantId,
|
||||
userId,
|
||||
regionId,
|
||||
selectedSchoolId,
|
||||
selectedMajorId,
|
||||
jsonBodyValue(body.stats),
|
||||
jsonBodyValue(body.progress),
|
||||
jsonBodyValue(body.moduleSelections),
|
||||
],
|
||||
);
|
||||
|
||||
await recordAudit(client, auth, 'tenant.student.upserted', 'student_profiles', profile.rows[0].profileId, {
|
||||
userId,
|
||||
status,
|
||||
regionId,
|
||||
selectedSchoolId,
|
||||
selectedMajorId,
|
||||
});
|
||||
return profile.rows[0];
|
||||
});
|
||||
|
||||
return { item };
|
||||
}
|
||||
|
||||
export async function tenantTeachersRoute(ctx: RequestContext) {
|
||||
const auth = await requireTenantAdmin(ctx);
|
||||
requireTenantPermission(auth, 'classes:read');
|
||||
const limit = intParam(ctx, 'limit', 100, 500);
|
||||
const keyword = stringParam(ctx, 'keyword');
|
||||
const params: unknown[] = [auth.tenantId];
|
||||
const filters = ['tm.tenant_id = $1', `tm.role = 'teacher'`, `tm.status = 'active'`];
|
||||
if (keyword) {
|
||||
params.push(`%${keyword}%`);
|
||||
filters.push(`(u.username ilike $${params.length} or u.name ilike $${params.length} or u.phone ilike $${params.length})`);
|
||||
}
|
||||
if (!canReadAllClassScope(auth)) {
|
||||
params.push(auth.userId);
|
||||
filters.push(`tm.user_id = $${params.length}::uuid`);
|
||||
}
|
||||
params.push(limit);
|
||||
|
||||
const items = await query<Record<string, unknown>>(
|
||||
`
|
||||
select tm.id as "membershipId", tm.user_id as "userId", tm.status,
|
||||
u.username, u.email::text as email, u.phone, u.name,
|
||||
u.avatar_url as "avatarUrl", u.last_seen_at as "lastSeenAt",
|
||||
coalesce(count(tcm.id) filter (where tcm.status = 'active'), 0)::int as "classCount"
|
||||
from public.tenant_memberships tm
|
||||
join public.platform_users u on u.id = tm.user_id
|
||||
left join public.tenant_class_members tcm
|
||||
on tcm.tenant_id = tm.tenant_id
|
||||
and tcm.user_id = tm.user_id
|
||||
and tcm.member_type in ('teacher', 'assistant', 'head_teacher')
|
||||
where ${filters.join(' and ')}
|
||||
group by tm.id, u.id
|
||||
order by tm.created_at desc
|
||||
limit $${params.length}
|
||||
`,
|
||||
params,
|
||||
);
|
||||
|
||||
return { items };
|
||||
}
|
||||
@@ -1,4 +1,15 @@
|
||||
import type { RouteDefinition } from '../../core/router.js';
|
||||
import {
|
||||
disableTenantClassRoute,
|
||||
removeTenantClassMemberRoute,
|
||||
tenantClassesRoute,
|
||||
tenantClassMembersRoute,
|
||||
tenantStudentsRoute,
|
||||
tenantTeachersRoute,
|
||||
upsertTenantClassMemberRoute,
|
||||
upsertTenantClassRoute,
|
||||
upsertTenantStudentRoute,
|
||||
} from './classes.js';
|
||||
import {
|
||||
activationCodesRoute,
|
||||
announcementsAdminRoute,
|
||||
@@ -39,6 +50,15 @@ export const tenantAdminRoutes: RouteDefinition[] = [
|
||||
['GET', '/api/tenant-admin/role-templates', tenantRoleTemplatesRoute],
|
||||
['PUT', '/api/tenant-admin/role-templates', upsertTenantRoleTemplateRoute],
|
||||
['POST', '/api/tenant-admin/role-templates/disable', disableTenantRoleTemplateRoute],
|
||||
['GET', '/api/tenant-admin/classes', tenantClassesRoute],
|
||||
['PUT', '/api/tenant-admin/classes', upsertTenantClassRoute],
|
||||
['POST', '/api/tenant-admin/classes/disable', disableTenantClassRoute],
|
||||
['GET', '/api/tenant-admin/classes/members', tenantClassMembersRoute],
|
||||
['PUT', '/api/tenant-admin/classes/members', upsertTenantClassMemberRoute],
|
||||
['POST', '/api/tenant-admin/classes/members/remove', removeTenantClassMemberRoute],
|
||||
['GET', '/api/tenant-admin/students', tenantStudentsRoute],
|
||||
['PUT', '/api/tenant-admin/students', upsertTenantStudentRoute],
|
||||
['GET', '/api/tenant-admin/teachers', tenantTeachersRoute],
|
||||
['GET', '/api/tenant-admin/overview', tenantOverviewRoute],
|
||||
['PUT', '/api/tenant-admin/branding', updateTenantBrandingRoute],
|
||||
['PUT', '/api/tenant-admin/settings', updateTenantSettingsRoute],
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# 后端当前能力盘点
|
||||
|
||||
更新时间：2026-06-28
|
||||
更新时间：2026-06-29
|
||||
|
||||
当前后端已经完成商用 SaaS 题库系统的主干骨架：PostgreSQL 多租户 schema、Node.js 业务 API、PocketBase 数据导入工具、本地 seed、API 集成测试和对象存储签名 provider。
|
||||
|
||||
@@ -42,7 +42,8 @@
|
||||
| 微信网页/QQ OAuth | 待补齐 | 目前仍是 placeholder，需要 code 换 token、回调域名、账号合并和审计 |
|
||||
| 平台管理员鉴权 | 可联调 | 已支持平台管理员 Supabase JWT；`x-platform-admin-key` 仅作本地/迁移期兼容且可通过配置禁用 |
|
||||
| 租户角色权限 | 可联调 | `tenant_memberships.role + permissions + role_template_id`，接口有权限点校验 |
|
||||
| 自定义角色模板 | 可联调 | `tenant_role_templates` + `/api/tenant-admin/role-templates`，支持权限、菜单、模块、字段、数据范围配置；前端 UI 和班级/学生范围继续补 |
|
||||
| 自定义角色模板 | 可联调 | `tenant_role_templates` + `/api/tenant-admin/role-templates`，支持权限、菜单、模块、字段、数据范围配置；前端 UI 继续补 |
|
||||
| 班级/教师/学生范围权限 | 可联调 | `tenant_classes`、`tenant_class_members` + `/api/tenant-admin/classes`、`classes/members`、`students`、`teachers`；教师默认只看自己负责班级，字段权限可脱敏学生手机号 |
|
||||
|
||||
## 学生端题库主链路
|
||||
|
||||
@@ -114,6 +115,7 @@
|
||||
| 活动、Banner、FAQ、公告 | 可联调 | `/api/tenant-admin/banners`、`faqs`、`announcements` |
|
||||
| 激活码批次/生成/列表 | 可联调 | `/api/tenant-admin/code-batches`、`activation-codes` |
|
||||
| 成员/角色权限/审计 | 可联调 | `/api/tenant-admin/members`、`permissions`、`role-templates`、`audit-logs` |
|
||||
| 班级/学生/教师管理 | 可联调 | `/api/tenant-admin/classes`、`classes/members`、`students`、`teachers`，支持班级范围权限和审计 |
|
||||
| 平台租户/套餐/订阅/账单/用量 | 可联调 | `/api/platform-admin/*` |
|
||||
| 数据看板聚合接口 | 待补齐 | 表基础已有，缺完整 dashboard API |
|
||||
|
||||
|
||||
@@ -14,11 +14,12 @@
|
||||
- `commerce`：订单、支付确认、激活码兑换、权益查询。
|
||||
- `referral`：销售/代理邀请码、首绑客资保护、销售统计、团队关系、CRM 队列。
|
||||
- `platform-admin`：平台方租户管理、SaaS 套餐、订阅、账单、服务费收款、使用量。
|
||||
- `tenant-admin`：租户资料、品牌、公开设置、域名、支付账户、登录 provider、私密密钥掩码、活动内容、激活码批次、优惠券、成员管理、角色模板、权限矩阵、审计查询。
|
||||
- `tenant-admin`：租户资料、品牌、公开设置、域名、支付账户、登录 provider、私密密钥掩码、活动内容、激活码批次、优惠券、成员管理、角色模板、班级/学生/教师范围权限、权限矩阵、审计查询。
|
||||
- `tenant-content`：租户后台内容入口、任意深度分类树、考试意向标记、题目集合、练习蓝图、题目、视频、分数线、单词、知识手册、资料资源、题目/单词/知识手册 JSON 导入维护。
|
||||
- `tenant`：域名/租户解析。
|
||||
- 鉴权上下文已支持 Supabase Auth JWT 和迁移期 `tk_` session 双入口，JWT 通过 `auth.users.id -> platform_users.auth_user_id -> tenant_memberships` 映射业务用户和租户；平台管理员 JWT 已可访问平台后台。
|
||||
- 租户自定义角色模板已落库：`tenant_role_templates` 支持权限、菜单、模块、字段和数据范围配置，成员可通过 `role_template_id` 绑定模板。
|
||||
- 班级与学生范围权限已落库：`tenant_classes`、`tenant_class_members` 支持教师/班主任/助教/学生分组，教师按负责班级查看学生，字段权限可脱敏学生手机号。
|
||||
- `learning` 已接入商用访问控制：免费用户每日题量、SVIP 范围、SVIP-only 内容、答题 session 快照保护由后端强制执行。
|
||||
- `src/services/supabaseApi.ts` 已加入新 API 客户端方法，供旧 Web 逐步替换和后续 Taro 复用。
|
||||
- 已新增 `npm run db:smoke-seed`，用于 `supabase:reset` 后恢复最小烟测数据。
|
||||
@@ -135,6 +136,18 @@ GET /api/crm/config
|
||||
PUT /api/crm/config
|
||||
GET /api/crm/queue
|
||||
GET /api/tenant-admin/permissions
|
||||
GET /api/tenant-admin/role-templates
|
||||
PUT /api/tenant-admin/role-templates
|
||||
POST /api/tenant-admin/role-templates/disable
|
||||
GET /api/tenant-admin/classes
|
||||
PUT /api/tenant-admin/classes
|
||||
POST /api/tenant-admin/classes/disable
|
||||
GET /api/tenant-admin/classes/members
|
||||
PUT /api/tenant-admin/classes/members
|
||||
POST /api/tenant-admin/classes/members/remove
|
||||
GET /api/tenant-admin/students
|
||||
PUT /api/tenant-admin/students
|
||||
GET /api/tenant-admin/teachers
|
||||
GET /api/tenant-admin/overview
|
||||
PUT /api/tenant-admin/branding
|
||||
PUT /api/tenant-admin/settings
|
||||
@@ -177,7 +190,8 @@ GET /api/tenant-admin/audit-logs
|
||||
- 激活码兑换和支付成功都走同一套 `grantSvipEntitlement` 权益开通逻辑。
|
||||
- 租户支付账户、短信、OAuth 登录配置接口只保存公开配置；密钥进入 `app_private.tenant_secrets` 或生产 KMS/Vault，API 只返回 `secretRef` 和掩码状态。
|
||||
- `tenant-admin` 采用角色默认权限 + `tenant_memberships.permissions` 覆盖的权限矩阵。成员可进入后台，但每个接口会校验具体权限点；学生和跨租户成员会被拒绝。
|
||||
- 当前默认角色：`tenant_owner`/`tenant_admin` 全权限，`tenant_operator` 可维护内容和活动，`teacher` 可维护内容，`sales` 可维护激活码和优惠券，`agent` 只读部分兑换码/优惠券。
|
||||
- 当前默认角色：`tenant_owner`/`tenant_admin` 全权限，`tenant_operator` 可维护内容和活动，`teacher` 可维护内容并按班级范围查看学生，`sales` 可维护激活码和优惠券，`agent` 只读部分兑换码/优惠券。
|
||||
- 班级学生 API 会按 `tenant_memberships.role_template_id -> tenant_role_templates.data_scope`、成员显式权限和 `tenant_class_members` 共同确定可见范围；非全局权限教师只能查看自己负责班级的学生。
|
||||
- 销售/代理客资采用首绑保护：普通扫码/分享事件不会覆盖已有归属，只有具备 `referral:write` 的租户成员可手动强制补绑。
|
||||
- CRM 当前完成配置、密钥入私密表、客资入队和队列查询；真实 webhook 发送、重试、签名在后续 `apps/worker` 中实现。
|
||||
- 内容资源当前完成台账、租户后台维护、学生端 SVIP 下载权限，以及 `local_dev`、阿里云 OSS、腾讯 COS、Supabase Storage 的上传/下载签名 provider。真实对象存在性校验、PDF 预览渲染、防盗链、水印和大文件上传后 worker 校验仍需继续补。
|
||||
|
||||
@@ -144,7 +144,7 @@ provider event id 幂等
|
||||
| tenant_owner | `*` |
|
||||
| tenant_admin | `*` |
|
||||
| tenant_operator | 内容、营销、兑换码/优惠券只读、客资/CRM 只读 |
|
||||
| teacher | 内容维护 |
|
||||
| teacher | 内容维护、班级查看、学生查看 |
|
||||
| sales | 兑换码、优惠券、客资 |
|
||||
| agent | 兑换码/优惠券只读、本人的客资 |
|
||||
| student | 无后台权限 |
|
||||
@@ -156,11 +156,14 @@ provider event id 幂等
|
||||
- 模板可保存 `menuPermissions`、`modulePermissions`、`fieldPermissions`、`dataScope`，供 Taro/管理台做菜单、模块、字段可见性和数据范围 UI。
|
||||
- 模板含 `*`、`tenant_owner`、`tenant_admin` 等管理员级能力时，只有租户 owner 可创建或授予；普通租户管理员不能自造全权限模板。
|
||||
- 角色模板创建、更新、禁用都会写入 `audit_logs`。
|
||||
- `tenant_classes` 和 `tenant_class_members` 提供班级、班主任、教师、助教、学生分组边界。
|
||||
- 教师如无 `classes:write`、`students:write`、`members:read` 等全局管理权限，只能查看自己在 `tenant_class_members` 中负责的班级及这些班级下的学生；也可由角色模板 `dataScope.classIds` 显式限定。
|
||||
- 学生手机号等敏感字段可由 `fieldPermissions` 控制，后端会对不可见字段返回 `null`，前端不得绕过其它接口补取。
|
||||
|
||||
后续要补：
|
||||
|
||||
- 前端角色模板配置 UI。
|
||||
- 班级/教师/学生范围权限。
|
||||
- 更细的数据范围 UI，例如地区、题库、销售团队、本人客资、班级学生组合规则。
|
||||
|
||||
## 上线前安全验收清单
|
||||
|
||||
@@ -170,6 +173,7 @@ provider event id 幂等
|
||||
- 跨租户学生读取题目/订单/资料返回拒绝。
|
||||
- 销售只能查看自己权限范围内客资。
|
||||
- 代理不能查看其他代理客资。
|
||||
- 教师只能查看自己负责班级的学生，不能查看其它班级或跨租户学生。
|
||||
- 教师不能修改租户商户密钥。
|
||||
- 学生不能访问租户后台接口。
|
||||
- 未开通权益不能下载 SVIP 资料或播放会员视频。
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# 后续开发 TODO
|
||||
|
||||
更新时间：2026-06-22
|
||||
更新时间：2026-06-29
|
||||
|
||||
## 当前后端基线
|
||||
|
||||
@@ -17,6 +17,7 @@
|
||||
- 模考报告与学习统计：`practice_session_reports/practice_session_report_sections` 支持交卷、评分、题型/小节统计、错题解析汇总和历史查询；`/api/learning/stats`、`trend`、`practice-sessions/history`、`wrong-questions/review-plan` 可支撑个人中心和学习报告基础页。
|
||||
- 练习访问控制：`practice_daily_usage/practice_access_events` 支持免费每日额度、SVIP 范围校验、SVIP-only 内容拦截和答题 session 快照保护。
|
||||
- 内容导入：题目、单词、知识手册 JSON 预览、校验、导入、幂等、审计。
|
||||
- 租户组织范围：班级、班级成员、教师/班主任/助教/学生分组，教师按负责班级查看学生，字段权限可脱敏学生手机号。
|
||||
- 本地验证：`npm run check:refactor` 已通过。
|
||||
|
||||
当前更适合进入前端联调前阅读的总览文档：
|
||||
@@ -30,7 +31,7 @@
|
||||
1. 生产鉴权
|
||||
- 已支持 Supabase Auth JWT 和迁移期 `tk_` session 双入口；JWT 通过 `auth.users.id -> platform_users.auth_user_id -> tenant_memberships` 映射业务身份。
|
||||
- 已覆盖学生、租户管理员、平台管理员、错租户、坏签名、禁用 legacy header 的 API 集成测试。
|
||||
- 已补自定义角色模板、菜单/模块/字段级配置 API；继续补真实云端 Auth/JWKS 回归、RLS 深测和班级/学生范围权限。
|
||||
- 已补自定义角色模板、菜单/模块/字段级配置 API、班级/学生范围权限；继续补真实云端 Auth/JWKS 回归和 RLS 深测。
|
||||
- 前端联调时禁止继续使用 `x-user-id`；`x-tenant-id` 只作为租户上下文，不能作为身份依据。
|
||||
|
||||
2. 对象存储
|
||||
@@ -88,7 +89,11 @@
|
||||
- 套餐销量、运营动态、24h 活跃度、激活码使用情况。
|
||||
- 销售/代理转化、分佣结算、客资跟进效果。
|
||||
|
||||
8. AI 择校推荐
|
||||
8. 学生运营管理
|
||||
- 已完成学生列表、学生资料维护、班级分组和教师范围可见。
|
||||
- 继续补学生批量导入、禁用/恢复、批量分班、批量 CRM 推送、学习督导任务和家校/班主任备注。
|
||||
|
||||
9. AI 择校推荐
|
||||
- 地区考试数据上下文。
|
||||
- 学生输入 schema。
|
||||
- AI 返回 JSON schema。
|
||||
@@ -98,8 +103,9 @@
|
||||
|
||||
1. 自定义角色
|
||||
- 已完成租户内角色模板、菜单可见、模块可见、字段级权限和权限变更审计基础 API。
|
||||
- 已完成班级/教师/学生范围权限 API，教师只能查看自己负责班级的学生。
|
||||
- 继续补租户后台可视化配置 UI。
|
||||
- 继续补班级/教师/学生范围权限。
|
||||
- 继续补更细的数据范围 UI，例如地区、题库、销售团队、本人客资、班级学生组合规则。
|
||||
|
||||
2. 主题系统
|
||||
- 平台默认三套主题。
|
||||
|
||||
@@ -171,6 +171,10 @@ tenant:<tenantId>:theme
|
||||
| 激活码兑换 | `POST /api/commerce/activation-codes/redeem` |
|
||||
| 个人中心 | `GET/PATCH /api/profile/me` |
|
||||
| 销售分享 | `/api/referral/resolve`、`track-event`、`bind` |
|
||||
| 租户班级 | `GET/PUT /api/tenant-admin/classes`、`POST /api/tenant-admin/classes/disable` |
|
||||
| 班级成员 | `GET/PUT /api/tenant-admin/classes/members`、`POST /api/tenant-admin/classes/members/remove` |
|
||||
| 租户学生 | `GET/PUT /api/tenant-admin/students` |
|
||||
| 租户教师 | `GET /api/tenant-admin/teachers` |
|
||||
|
||||
## 练习访问控制契约
|
||||
|
||||
@@ -438,6 +442,8 @@ content_entries
|
||||
- 小程序分享路径必须带 tenantCode 和 referral code。
|
||||
- 用户首绑归属由后端保护，前端不要提供“换绑销售”入口。
|
||||
- 管理后台菜单按 `GET /api/tenant-admin/permissions` 返回的 `current.permissions`、`current.templatePermissions`、`current.menuPermissions`、`current.modulePermissions` 渲染；接口权限仍以后端校验为准。
|
||||
- 教师、班主任、助教类账号进入租户后台时，学生列表以 `GET /api/tenant-admin/students` 返回的 `scoped` 和 `items` 为准；前端不要自行用本地班级 ID 放大查询范围。
|
||||
- 学生手机号、订单金额、客资归属等敏感字段按 `fieldPermissions` 控制显示；字段被后端返回为 `null` 时前端展示脱敏占位，不要从其它接口补取。
|
||||
- H5 自定义域名下要注意缓存隔离，不能把 A 租户主题缓存用到 B 租户。
|
||||
|
||||
## 登录对接
|
||||
@@ -602,6 +608,7 @@ GET /api/commerce/entitlements
|
||||
- 品牌/主题/域名/公开设置
|
||||
- 支付账户/登录 provider/密钥引用
|
||||
- 用户与成员权限
|
||||
- 班级/教师/学生：`/api/tenant-admin/classes`、`classes/members`、`students`、`teachers`
|
||||
- 角色模板：`GET/PUT /api/tenant-admin/role-templates`、`POST /api/tenant-admin/role-templates/disable`
|
||||
- 内容入口/分类树/题目集合/练习蓝图
|
||||
- 题目/单词/知识手册/分数线/视频维护
|
||||
@@ -609,7 +616,7 @@ GET /api/commerce/entitlements
|
||||
- Banner/FAQ/公告/激活码/优惠券
|
||||
- 销售/代理/CRM 队列
|
||||
|
||||
租户后台不应在前端自行决定权限；隐藏菜单只是体验优化，接口仍会校验权限。角色模板用于让租户配置“运营、教师、销售、代理”等自定义后台体验，成员绑定模板后，前端按模板的菜单/模块/字段权限渲染，后端按 permission keys 执行真正的访问控制。
|
||||
租户后台不应在前端自行决定权限；隐藏菜单只是体验优化，接口仍会校验权限。角色模板用于让租户配置“运营、教师、销售、代理”等自定义后台体验，成员绑定模板后，前端按模板的菜单/模块/字段权限渲染，后端按 permission keys 执行真正的访问控制。班级/学生范围权限由后端根据角色、模板 `dataScope.classIds` 和 `tenant_class_members` 计算，教师默认只能看到自己负责班级。
|
||||
|
||||
## 联调顺序
|
||||
|
||||
|
||||
@@ -13,6 +13,8 @@ const TENANT_ADMIN_USER_ID = process.env.TENANT_ADMIN_USER_ID || '00000000-0000-
|
||||
const TENANT_OPERATOR_USER_ID = '00000000-0000-0000-0000-000000000103';
|
||||
const TENANT_SALES_USER_ID = '00000000-0000-0000-0000-000000000104';
|
||||
const TENANT_AGENT_USER_ID = '00000000-0000-0000-0000-000000000105';
|
||||
const TENANT_TEACHER_USER_ID = '00000000-0000-0000-0000-000000000106';
|
||||
const SECOND_STUDENT_USER_ID = '00000000-0000-0000-0000-000000000107';
|
||||
const AUTH_USER_ID = '00000000-0000-0000-0000-00000000a101';
|
||||
const AUTH_TENANT_ADMIN_USER_ID = '00000000-0000-0000-0000-00000000a102';
|
||||
const AUTH_PLATFORM_ADMIN_USER_ID = '00000000-0000-0000-0000-00000000a999';
|
||||
@@ -40,6 +42,8 @@ const ids = {
|
||||
video: '00000000-0000-0000-0000-000000000821',
|
||||
quotaVideo: '00000000-0000-0000-0000-000000000824',
|
||||
scorelineSchool: '00000000-0000-0000-0000-000000000831',
|
||||
tenantClass: '00000000-0000-0000-0000-000000000851',
|
||||
tenantClassOther: '00000000-0000-0000-0000-000000000852',
|
||||
};
|
||||
|
||||
const paymentFixture = (() => {
|
||||
@@ -2556,6 +2560,208 @@ async function testTenantMemberPermissionsAndAudit() {
|
||||
assert.equal(partnerAuditDenied.code, 'TENANT_ADMIN_REQUIRED', 'tenant audit logs must be tenant isolated');
|
||||
}
|
||||
|
||||
async function testTenantClassStudentScopes() {
|
||||
const permissionMatrix = await request('/api/tenant-admin/permissions', {
|
||||
userId: TENANT_ADMIN_USER_ID,
|
||||
});
|
||||
assert.ok(permissionMatrix.permissions?.some(item => item.key === 'classes:write'), 'permission matrix should expose class write permission');
|
||||
assert.ok(permissionMatrix.permissions?.some(item => item.key === 'students:read'), 'permission matrix should expose student read permission');
|
||||
|
||||
const createdClass = await request('/api/tenant-admin/classes', {
|
||||
userId: TENANT_ADMIN_USER_ID,
|
||||
method: 'PUT',
|
||||
body: {
|
||||
id: ids.tenantClass,
|
||||
regionId: ids.region,
|
||||
code: 'integration-main',
|
||||
name: '集成测试主班级',
|
||||
description: '教师和学生范围权限测试',
|
||||
sortOrder: 1,
|
||||
metadata: { stage: 'integration' },
|
||||
},
|
||||
});
|
||||
assert.equal(createdClass.item?.id, ids.tenantClass, 'tenant admin should upsert class');
|
||||
|
||||
const otherClass = await request('/api/tenant-admin/classes', {
|
||||
userId: TENANT_ADMIN_USER_ID,
|
||||
method: 'PUT',
|
||||
body: {
|
||||
id: ids.tenantClassOther,
|
||||
regionId: ids.region,
|
||||
code: 'integration-other',
|
||||
name: '集成测试其他班级',
|
||||
sortOrder: 2,
|
||||
},
|
||||
});
|
||||
assert.equal(otherClass.item?.id, ids.tenantClassOther, 'tenant admin should upsert another class');
|
||||
|
||||
const teacherTemplate = await request('/api/tenant-admin/role-templates', {
|
||||
userId: TENANT_ADMIN_USER_ID,
|
||||
method: 'PUT',
|
||||
body: {
|
||||
code: 'teacher-class-scope',
|
||||
name: '教师班级范围模板',
|
||||
baseRole: 'teacher',
|
||||
permissions: {
|
||||
'classes:read': true,
|
||||
'students:read': true,
|
||||
},
|
||||
menuPermissions: {
|
||||
teachers: true,
|
||||
students: true,
|
||||
},
|
||||
fieldPermissions: {
|
||||
'student.phone': false,
|
||||
},
|
||||
dataScope: {
|
||||
mode: 'classes',
|
||||
},
|
||||
},
|
||||
});
|
||||
assert.equal(teacherTemplate.item?.code, 'teacher-class-scope', 'tenant admin should create teacher scope template');
|
||||
|
||||
const teacher = await request('/api/tenant-admin/members', {
|
||||
userId: TENANT_ADMIN_USER_ID,
|
||||
method: 'PUT',
|
||||
body: {
|
||||
userId: TENANT_TEACHER_USER_ID,
|
||||
username: 'integration_teacher',
|
||||
phone: '13800000015',
|
||||
name: 'Integration Teacher',
|
||||
role: 'teacher',
|
||||
roleTemplateId: teacherTemplate.item.id,
|
||||
status: 'active',
|
||||
permissions: {},
|
||||
},
|
||||
});
|
||||
assert.equal(teacher.item?.role, 'teacher', 'tenant admin should create teacher member');
|
||||
|
||||
const student = await request('/api/tenant-admin/students', {
|
||||
userId: TENANT_ADMIN_USER_ID,
|
||||
method: 'PUT',
|
||||
body: {
|
||||
userId: USER_ID,
|
||||
username: 'smoke_student',
|
||||
phone: '13800000000',
|
||||
name: 'Smoke Student',
|
||||
regionId: ids.region,
|
||||
status: 'active',
|
||||
},
|
||||
});
|
||||
assert.equal(student.item?.userId, USER_ID, 'tenant admin should upsert student profile');
|
||||
|
||||
const secondStudent = await request('/api/tenant-admin/students', {
|
||||
userId: TENANT_ADMIN_USER_ID,
|
||||
method: 'PUT',
|
||||
body: {
|
||||
userId: SECOND_STUDENT_USER_ID,
|
||||
username: 'integration_second_student',
|
||||
phone: '13800000016',
|
||||
name: 'Integration Second Student',
|
||||
regionId: ids.region,
|
||||
status: 'active',
|
||||
},
|
||||
});
|
||||
assert.equal(secondStudent.item?.userId, SECOND_STUDENT_USER_ID, 'tenant admin should upsert another student');
|
||||
|
||||
const teacherAssignment = await request('/api/tenant-admin/classes/members', {
|
||||
userId: TENANT_ADMIN_USER_ID,
|
||||
method: 'PUT',
|
||||
body: {
|
||||
classId: ids.tenantClass,
|
||||
userId: TENANT_TEACHER_USER_ID,
|
||||
memberType: 'teacher',
|
||||
status: 'active',
|
||||
},
|
||||
});
|
||||
assert.equal(teacherAssignment.item?.memberType, 'teacher', 'tenant admin should assign teacher to class');
|
||||
|
||||
const studentAssignment = await request('/api/tenant-admin/classes/members', {
|
||||
userId: TENANT_ADMIN_USER_ID,
|
||||
method: 'PUT',
|
||||
body: {
|
||||
classId: ids.tenantClass,
|
||||
userId: USER_ID,
|
||||
memberType: 'student',
|
||||
status: 'active',
|
||||
},
|
||||
});
|
||||
assert.equal(studentAssignment.item?.memberType, 'student', 'tenant admin should assign student to class');
|
||||
|
||||
const otherStudentAssignment = await request('/api/tenant-admin/classes/members', {
|
||||
userId: TENANT_ADMIN_USER_ID,
|
||||
method: 'PUT',
|
||||
body: {
|
||||
classId: ids.tenantClassOther,
|
||||
userId: SECOND_STUDENT_USER_ID,
|
||||
memberType: 'student',
|
||||
status: 'active',
|
||||
},
|
||||
});
|
||||
assert.equal(otherStudentAssignment.item?.classId, ids.tenantClassOther, 'tenant admin should assign second student to another class');
|
||||
|
||||
const adminClasses = await request('/api/tenant-admin/classes', {
|
||||
userId: TENANT_ADMIN_USER_ID,
|
||||
});
|
||||
assert.ok(adminClasses.items?.some(item => item.id === ids.tenantClass && item.studentCount >= 1), 'admin should see main class student count');
|
||||
assert.ok(adminClasses.items?.some(item => item.id === ids.tenantClassOther), 'admin should see other class');
|
||||
|
||||
const teacherClasses = await request('/api/tenant-admin/classes', {
|
||||
userId: TENANT_TEACHER_USER_ID,
|
||||
});
|
||||
assert.equal(teacherClasses.scoped, true, 'teacher class list should be scoped');
|
||||
assert.ok(teacherClasses.items?.some(item => item.id === ids.tenantClass), 'teacher should see assigned class');
|
||||
assert.ok(!teacherClasses.items?.some(item => item.id === ids.tenantClassOther), 'teacher should not see unassigned class');
|
||||
|
||||
const teacherStudents = await request('/api/tenant-admin/students', {
|
||||
userId: TENANT_TEACHER_USER_ID,
|
||||
});
|
||||
assert.equal(teacherStudents.scoped, true, 'teacher student list should be scoped');
|
||||
assert.ok(teacherStudents.items?.some(item => item.userId === USER_ID), 'teacher should see student in assigned class');
|
||||
assert.ok(!teacherStudents.items?.some(item => item.userId === SECOND_STUDENT_USER_ID), 'teacher should not see student in unassigned class');
|
||||
const visibleStudent = teacherStudents.items?.find(item => item.userId === USER_ID);
|
||||
assert.equal(visibleStudent?.phone, null, 'teacher role template should mask student phone');
|
||||
|
||||
const teacherOtherClassDenied = await request('/api/tenant-admin/classes/members', {
|
||||
userId: TENANT_TEACHER_USER_ID,
|
||||
query: { classId: ids.tenantClassOther },
|
||||
expectStatus: 403,
|
||||
});
|
||||
assert.equal(teacherOtherClassDenied.code, 'CLASS_SCOPE_REQUIRED', 'teacher should not read another class members');
|
||||
|
||||
const adminStudents = await request('/api/tenant-admin/students', {
|
||||
userId: TENANT_ADMIN_USER_ID,
|
||||
query: { classId: ids.tenantClassOther },
|
||||
});
|
||||
assert.ok(adminStudents.items?.some(item => item.userId === SECOND_STUDENT_USER_ID), 'tenant admin should filter students by class');
|
||||
|
||||
const studentDenied = await request('/api/tenant-admin/students', {
|
||||
userId: USER_ID,
|
||||
expectStatus: 403,
|
||||
});
|
||||
assert.equal(studentDenied.code, 'TENANT_ADMIN_REQUIRED', 'student should not access tenant admin student list');
|
||||
|
||||
const partnerClassDenied = await request('/api/tenant-admin/classes/members', {
|
||||
tenantId: PARTNER_TENANT_ID,
|
||||
userId: TENANT_ADMIN_USER_ID,
|
||||
method: 'PUT',
|
||||
body: {
|
||||
classId: ids.tenantClass,
|
||||
userId: USER_ID,
|
||||
memberType: 'student',
|
||||
},
|
||||
expectStatus: 403,
|
||||
});
|
||||
assert.equal(partnerClassDenied.code, 'TENANT_ADMIN_REQUIRED', 'tenant admin must not assign another tenant class');
|
||||
|
||||
const auditLogs = await request('/api/tenant-admin/audit-logs', {
|
||||
userId: TENANT_ADMIN_USER_ID,
|
||||
query: { action: 'tenant.class', limit: 50 },
|
||||
});
|
||||
assert.ok(auditLogs.items?.some(item => item.action === 'tenant.class.upserted'), 'audit logs should include class upsert');
|
||||
assert.ok(auditLogs.items?.some(item => item.action === 'tenant.class_member.upserted'), 'audit logs should include class member upsert');
|
||||
}
|
||||
|
||||
async function testReferralAndCrmGrowth() {
|
||||
const salesMember = await request('/api/tenant-admin/members', {
|
||||
userId: TENANT_ADMIN_USER_ID,
|
||||
@@ -2751,6 +2957,7 @@ async function main() {
|
||||
await check('tenant content assets and imports', testTenantContentAssetsAndImports);
|
||||
await check('tenant admin operations', testTenantAdminOps);
|
||||
await check('tenant member permissions and audit', testTenantMemberPermissionsAndAudit);
|
||||
await check('tenant class and student scopes', testTenantClassStudentScopes);
|
||||
await check('referral and CRM growth', testReferralAndCrmGrowth);
|
||||
|
||||
console.log('API integration tests complete.');
|
||||
|
||||
@@ -15,6 +15,8 @@ const ids = {
|
||||
tenantOperatorUser: '00000000-0000-0000-0000-000000000103',
|
||||
tenantSalesUser: '00000000-0000-0000-0000-000000000104',
|
||||
tenantAgentUser: '00000000-0000-0000-0000-000000000105',
|
||||
tenantTeacherUser: '00000000-0000-0000-0000-000000000106',
|
||||
secondStudentUser: '00000000-0000-0000-0000-000000000107',
|
||||
region: '00000000-0000-0000-0000-000000000301',
|
||||
subject: '00000000-0000-0000-0000-000000000501',
|
||||
category: '00000000-0000-0000-0000-000000000601',
|
||||
@@ -50,6 +52,8 @@ const ids = {
|
||||
scorelineField: '00000000-0000-0000-0000-000000000833',
|
||||
scorelineRecord: '00000000-0000-0000-0000-000000000834',
|
||||
recentPractice: '00000000-0000-0000-0000-000000000841',
|
||||
tenantClass: '00000000-0000-0000-0000-000000000851',
|
||||
tenantClassOther: '00000000-0000-0000-0000-000000000852',
|
||||
partnerTenant: '00000000-0000-0000-0000-000000000901',
|
||||
partnerSubscription: '00000000-0000-0000-0000-000000000902',
|
||||
partnerInvoice: '00000000-0000-0000-0000-000000000903',
|
||||
@@ -208,11 +212,11 @@ async function main() {
|
||||
delete from public.referral_team_edges
|
||||
where tenant_id = $1
|
||||
and (
|
||||
member_user_id in ($2::uuid, $3::uuid, $4::uuid)
|
||||
or leader_user_id in ($2::uuid, $3::uuid, $4::uuid)
|
||||
member_user_id in ($2::uuid, $3::uuid, $4::uuid, $5::uuid)
|
||||
or leader_user_id in ($2::uuid, $3::uuid, $4::uuid, $5::uuid)
|
||||
)
|
||||
`,
|
||||
[tenantId, ids.tenantOperatorUser, ids.tenantSalesUser, ids.tenantAgentUser],
|
||||
[tenantId, ids.tenantOperatorUser, ids.tenantSalesUser, ids.tenantAgentUser, ids.tenantTeacherUser],
|
||||
);
|
||||
|
||||
await client.query(
|
||||
@@ -269,7 +273,9 @@ async function main() {
|
||||
values
|
||||
($1, $2, 'smoke_tenant_operator', '13800000003', 'Smoke Tenant Operator', 'tenant_operator', '{"source":"smoke-seed"}'::jsonb),
|
||||
($3, null, 'smoke_tenant_sales', '13800000004', 'Smoke Tenant Sales', 'sales', '{"source":"smoke-seed"}'::jsonb),
|
||||
($4, null, 'smoke_tenant_agent', '13800000005', 'Smoke Tenant Agent', 'agent', '{"source":"smoke-seed"}'::jsonb)
|
||||
($4, null, 'smoke_tenant_agent', '13800000005', 'Smoke Tenant Agent', 'agent', '{"source":"smoke-seed"}'::jsonb),
|
||||
($5, null, 'smoke_teacher', '13800000015', 'Smoke Teacher', 'teacher', '{"source":"smoke-seed"}'::jsonb),
|
||||
($6, null, 'smoke_second_student', '13800000016', 'Smoke Second Student', 'student', '{"source":"smoke-seed"}'::jsonb)
|
||||
on conflict (id)
|
||||
do update set username = excluded.username,
|
||||
auth_user_id = excluded.auth_user_id,
|
||||
@@ -278,7 +284,14 @@ async function main() {
|
||||
primary_role = excluded.primary_role,
|
||||
updated_at = now()
|
||||
`,
|
||||
[ids.tenantOperatorUser, ids.authTenantOperatorUser, ids.tenantSalesUser, ids.tenantAgentUser],
|
||||
[
|
||||
ids.tenantOperatorUser,
|
||||
ids.authTenantOperatorUser,
|
||||
ids.tenantSalesUser,
|
||||
ids.tenantAgentUser,
|
||||
ids.tenantTeacherUser,
|
||||
ids.secondStudentUser,
|
||||
],
|
||||
);
|
||||
|
||||
await client.query(
|
||||
@@ -335,13 +348,15 @@ async function main() {
|
||||
insert into public.tenant_memberships (tenant_id, user_id, role, status, permissions)
|
||||
values
|
||||
($1, $2, 'tenant_operator', 'active', '{"marketing:read":true}'::jsonb),
|
||||
($1, $3, 'platform_admin', 'active', '{"*":true}'::jsonb)
|
||||
($1, $3, 'platform_admin', 'active', '{"*":true}'::jsonb),
|
||||
($1, $4, 'teacher', 'active', '{"classes:read":true,"students:read":true}'::jsonb),
|
||||
($1, $5, 'student', 'active', '{}'::jsonb)
|
||||
on conflict (tenant_id, user_id, role)
|
||||
do update set status = 'active',
|
||||
permissions = excluded.permissions,
|
||||
updated_at = now()
|
||||
`,
|
||||
[tenantId, ids.tenantOperatorUser, ids.platformAdminUser],
|
||||
[tenantId, ids.tenantOperatorUser, ids.platformAdminUser, ids.tenantTeacherUser, ids.secondStudentUser],
|
||||
);
|
||||
|
||||
await client.query(
|
||||
@@ -353,6 +368,15 @@ async function main() {
|
||||
[tenantId, ids.user],
|
||||
);
|
||||
|
||||
await client.query(
|
||||
`
|
||||
insert into public.student_profiles (tenant_id, user_id, stats, progress)
|
||||
values ($1, $2, '{"totalAnswered":0,"correctCount":0,"wrongCount":0,"studyDays":1}'::jsonb, '{}'::jsonb)
|
||||
on conflict (tenant_id, user_id) do nothing
|
||||
`,
|
||||
[tenantId, ids.secondStudentUser],
|
||||
);
|
||||
|
||||
await client.query(
|
||||
`
|
||||
insert into public.regions (id, tenant_id, legacy_id, name, code, sort_order, is_active)
|
||||
@@ -1028,6 +1052,55 @@ async function main() {
|
||||
[ids.recentPractice, tenantId, ids.user],
|
||||
);
|
||||
|
||||
await client.query(
|
||||
`
|
||||
insert into public.tenant_classes (
|
||||
id, tenant_id, region_id, legacy_id, code, name, description,
|
||||
status, sort_order, metadata, created_by, updated_by
|
||||
)
|
||||
values
|
||||
($1, $3, $4, 'smoke-class-main', 'smoke-main', '烟测主班级', '用于教师学生范围权限测试', 'active', 1, '{"source":"smoke-seed"}'::jsonb, $5, $5),
|
||||
($2, $3, $4, 'smoke-class-other', 'smoke-other', '烟测其他班级', '用于验证非负责班级不可见', 'active', 2, '{"source":"smoke-seed"}'::jsonb, $5, $5)
|
||||
on conflict (id)
|
||||
do update set region_id = excluded.region_id,
|
||||
code = excluded.code,
|
||||
name = excluded.name,
|
||||
description = excluded.description,
|
||||
status = excluded.status,
|
||||
sort_order = excluded.sort_order,
|
||||
metadata = excluded.metadata,
|
||||
updated_by = excluded.updated_by,
|
||||
updated_at = now()
|
||||
`,
|
||||
[ids.tenantClass, ids.tenantClassOther, tenantId, ids.region, ids.tenantAdminUser],
|
||||
);
|
||||
|
||||
await client.query(
|
||||
`
|
||||
insert into public.tenant_class_members (
|
||||
tenant_id, class_id, user_id, member_type, status, metadata, created_by, updated_by
|
||||
)
|
||||
values
|
||||
($1, $2, $4, 'teacher', 'active', '{"source":"smoke-seed"}'::jsonb, $6, $6),
|
||||
($1, $2, $5, 'student', 'active', '{"source":"smoke-seed"}'::jsonb, $6, $6),
|
||||
($1, $3, $7, 'student', 'active', '{"source":"smoke-seed"}'::jsonb, $6, $6)
|
||||
on conflict (tenant_id, class_id, user_id, member_type)
|
||||
do update set status = excluded.status,
|
||||
metadata = excluded.metadata,
|
||||
updated_by = excluded.updated_by,
|
||||
updated_at = now()
|
||||
`,
|
||||
[
|
||||
tenantId,
|
||||
ids.tenantClass,
|
||||
ids.tenantClassOther,
|
||||
ids.tenantTeacherUser,
|
||||
ids.user,
|
||||
ids.tenantAdminUser,
|
||||
ids.secondStudentUser,
|
||||
],
|
||||
);
|
||||
|
||||
await client.query(
|
||||
`
|
||||
insert into public.tenants (id, slug, name, legal_name, status, mode, billing_status, metadata)
|
||||
|
||||
86
supabase/migrations/202606290002_tenant_classes.sql
Normal file
86
supabase/migrations/202606290002_tenant_classes.sql
Normal file
@@ -0,0 +1,86 @@
|
||||
create table if not exists public.tenant_classes (
|
||||
id uuid primary key default gen_random_uuid(),
|
||||
tenant_id uuid not null references public.tenants(id) on delete cascade,
|
||||
region_id uuid references public.regions(id) on delete set null,
|
||||
legacy_id text,
|
||||
code text,
|
||||
name text not null,
|
||||
description text,
|
||||
status text not null default 'active' check (status in ('active', 'disabled', 'archived')),
|
||||
sort_order integer not null default 0,
|
||||
metadata jsonb not null default '{}'::jsonb,
|
||||
created_by uuid references public.platform_users(id) on delete set null,
|
||||
updated_by uuid references public.platform_users(id) on delete set null,
|
||||
created_at timestamptz not null default now(),
|
||||
updated_at timestamptz not null default now(),
|
||||
unique (tenant_id, id),
|
||||
unique (tenant_id, legacy_id)
|
||||
);
|
||||
|
||||
comment on table public.tenant_classes is
|
||||
'Tenant-scoped class/cohort records used for teacher, head-teacher, assistant and student data scopes.';
|
||||
|
||||
create unique index if not exists idx_tenant_classes_code_unique
|
||||
on public.tenant_classes(tenant_id, lower(code))
|
||||
where code is not null and code <> '';
|
||||
|
||||
create index if not exists idx_tenant_classes_tenant_status
|
||||
on public.tenant_classes(tenant_id, status, sort_order, created_at desc);
|
||||
|
||||
create index if not exists idx_tenant_classes_region
|
||||
on public.tenant_classes(tenant_id, region_id)
|
||||
where region_id is not null;
|
||||
|
||||
create table if not exists public.tenant_class_members (
|
||||
id uuid primary key default gen_random_uuid(),
|
||||
tenant_id uuid not null references public.tenants(id) on delete cascade,
|
||||
class_id uuid not null,
|
||||
user_id uuid not null references public.platform_users(id) on delete cascade,
|
||||
member_type text not null check (member_type in ('student', 'teacher', 'assistant', 'head_teacher')),
|
||||
status text not null default 'active' check (status in ('active', 'disabled', 'removed')),
|
||||
joined_at timestamptz not null default now(),
|
||||
left_at timestamptz,
|
||||
metadata jsonb not null default '{}'::jsonb,
|
||||
created_by uuid references public.platform_users(id) on delete set null,
|
||||
updated_by uuid references public.platform_users(id) on delete set null,
|
||||
created_at timestamptz not null default now(),
|
||||
updated_at timestamptz not null default now(),
|
||||
unique (tenant_id, class_id, user_id, member_type),
|
||||
foreign key (tenant_id, class_id) references public.tenant_classes(tenant_id, id) on delete cascade
|
||||
);
|
||||
|
||||
comment on table public.tenant_class_members is
|
||||
'Class membership assignments. Students can belong to multiple classes; teachers gain scoped visibility through active class memberships.';
|
||||
|
||||
create index if not exists idx_class_members_tenant_class
|
||||
on public.tenant_class_members(tenant_id, class_id, status, member_type);
|
||||
|
||||
create index if not exists idx_class_members_tenant_user
|
||||
on public.tenant_class_members(tenant_id, user_id, status, member_type);
|
||||
|
||||
alter table public.tenant_classes enable row level security;
|
||||
alter table public.tenant_class_members enable row level security;
|
||||
|
||||
drop policy if exists tenant_isolation on public.tenant_classes;
|
||||
create policy tenant_isolation on public.tenant_classes
|
||||
for all
|
||||
using (tenant_id = app.current_tenant_id() or app.is_platform_admin())
|
||||
with check (tenant_id = app.current_tenant_id() or app.is_platform_admin());
|
||||
|
||||
drop policy if exists tenant_isolation on public.tenant_class_members;
|
||||
create policy tenant_isolation on public.tenant_class_members
|
||||
for all
|
||||
using (tenant_id = app.current_tenant_id() or app.is_platform_admin())
|
||||
with check (tenant_id = app.current_tenant_id() or app.is_platform_admin());
|
||||
|
||||
drop trigger if exists set_updated_at on public.tenant_classes;
|
||||
create trigger set_updated_at
|
||||
before update on public.tenant_classes
|
||||
for each row
|
||||
execute function app.touch_updated_at();
|
||||
|
||||
drop trigger if exists set_updated_at on public.tenant_class_members;
|
||||
create trigger set_updated_at
|
||||
before update on public.tenant_class_members
|
||||
for each row
|
||||
execute function app.touch_updated_at();
|
||||
Reference in New Issue
Block a user