fix permissions and teacher attendance workflows

apps/server/src/students/students.controller.ts

@@ -17,6 +17,7 @@ import {
 import { InjectRepository } from '@nestjs/typeorm';
 import { Repository } from 'typeorm';
 import { Tenant } from '../entities/tenant.entity';
+import { ClassTeacher } from '../entities/class-teacher.entity';
 import { FileInterceptor } from '@nestjs/platform-express';
 import type { Response } from 'express';
 import { StudentsService } from './students.service';
@@ -30,33 +31,59 @@ import * as ExcelJS from 'exceljs';
 @UseGuards(JwtAuthGuard)
 @Controller('students')
 export class StudentsController {
-
   constructor(
     private service: StudentsService,
     private logService: OperationLogsService,
     @InjectRepository(Tenant) private tenantRepo: Repository<Tenant>,
   ) {}
 
+  private canManageAllStudents(user: { isSuperAdmin?: boolean; permissions?: string[] }): boolean {
+    return (
+      user.isSuperAdmin === true ||
+      user.permissions?.includes('student:edit') === true ||
+      user.permissions?.includes('class:edit') === true
+    );
+  }
+
   @Get()
   @RequirePermission('student:view')
-  findAll(
-    @Query('name') name?: string,
-    @Query('status') status?: string,
-    @Query('includeArchived') includeArchived?: string,
-    @Query('tenantId') tenantId?: string,
+  async findAll(
+    @Query('name') name: string | undefined,
+    @Query('status') status: string | undefined,
+    @Query('includeArchived') includeArchived: string | undefined,
+    @Query('tenantId') tenantId: string | undefined,
+    @Request() req: { user: { id: number; isSuperAdmin?: boolean; permissions?: string[] } },
   ) {
-    return this.service.findAll({
-      name,
-      status,
-      includeArchived: includeArchived === 'true',
-      tenantId: tenantId ? +tenantId : undefined,
-    });
+    const classIds = await this.service.getAccessibleClassIds(
+      req.user.id,
+      this.canManageAllStudents(req.user),
+    );
+    return this.service.findAll(
+      {
+        name,
+        status,
+        includeArchived: includeArchived === 'true',
+        tenantId: tenantId ? +tenantId : undefined,
+      },
+      classIds,
+    );
   }
 
   @Get('export')
   @RequirePermission('student:export')
-  async exportExcel(@Query('includeArchived') includeArchived?: string, @Res() res?: Response, @Request() req?: any) {
-    const students = await this.service.findAll({ includeArchived: includeArchived === 'true' });
+  async exportExcel(
+    @Query('includeArchived') includeArchived?: string,
+    @Res() res?: Response,
+    @Request() req?: any,
+  ) {
+    const classIds = await this.service.getAccessibleClassIds(
+      req.user.id,
+      this.canManageAllStudents(req.user),
+    );
+    const students = await this.service.findAll(
+      { includeArchived: includeArchived === 'true' },
+      classIds,
+    );
     const workbook = new ExcelJS.Workbook();
     const ws = workbook.addWorksheet('学生名单');
     ws.columns = [
@@ -303,6 +330,60 @@ export class StudentsController {
     return result;
   }
 
+  @Post('import-match')
+  @RequirePermission('student:import')
+  @UseInterceptors(FileInterceptor('file'))
+  async matchImport(@UploadedFile() file: Express.Multer.File, @Request() req: any) {
+    const { ipAddress, userAgent } = extractRequestInfo(req);
+    const workbook = new ExcelJS.Workbook();
+    await workbook.xlsx.load(file.buffer as unknown as ArrayBuffer);
+    const ws = workbook.worksheets[0];
+    const rows: {
+      name: string;
+      phone?: string;
+      idNumber?: string;
+      gender?: string;
+      ethnicity?: string;
+      emergencyContact?: string;
+      emergencyPhone?: string;
+      organization?: string;
+      supervisor?: string;
+      tenantId?: number;
+    }[] = [];
+    ws.eachRow((row, idx) => {
+      if (idx === 1) return;
+      rows.push({
+        name: String(row.getCell(1).value || ''),
+        phone: String(row.getCell(2).value || ''),
+        idNumber: String(row.getCell(3).value || ''),
+        gender: String(row.getCell(4).value || '').trim() || undefined,
+        ethnicity: String(row.getCell(5).value || '').trim() || undefined,
+        emergencyContact: String(row.getCell(6).value || '').trim() || undefined,
+        emergencyPhone: String(row.getCell(7).value || '').trim() || undefined,
+        organization: String(row.getCell(8).value || '').trim() || undefined,
+        supervisor: String(row.getCell(9).value || '').trim() || undefined,
+      });
+    });
+    // Resolve tenant names to IDs
+    for (const row of rows) {
+      if (row.organization) {
+        const tenant = await this.tenantRepo.findOne({ where: { name: row.organization } });
+        if (tenant) row.tenantId = tenant.id;
+      }
+    }
+    const result = await this.service.matchImport(rows);
+    await this.logService.log({
+      userId: req.user?.id,
+      username: req.user?.username,
+      module: '学生管理',
+      action: '匹配导入学生',
+      detail: result.message,
+      ipAddress,
+      userAgent,
+    });
+    return result;
+  }
+
   @Get(':id/compare-classes')
   @RequirePermission('student:view')
   compareClasses(@Param('id') id: string) {