68 lines
4.5 KiB
JavaScript
68 lines
4.5 KiB
JavaScript
const express = require('express');
|
|
const bcrypt = require('bcryptjs');
|
|
const { query, getRow } = require('../db');
|
|
const { authenticate, requireRole } = require('../middleware/auth');
|
|
|
|
const router = express.Router();
|
|
|
|
router.get('/', authenticate, requireRole('owner','admin'), async (req, res) => {
|
|
res.json(await query('SELECT id, username, email, game_name, game_uid, source, role, active, email_verified, created_at FROM users ORDER BY created_at DESC'));
|
|
});
|
|
|
|
router.get('/:id', authenticate, requireRole('owner','admin'), async (req, res) => {
|
|
const u = await getRow('SELECT id, username, email, game_name, game_uid, source, role, active, email_verified, created_at FROM users WHERE id = ?', [req.params.id]);
|
|
if (!u) return res.status(404).json({ error: '用户不存在' });
|
|
u.servers = await query('SELECT group_name, server_name FROM user_servers WHERE user_id = ?', [req.params.id]);
|
|
res.json(u);
|
|
});
|
|
|
|
router.get('/:id/servers', authenticate, requireRole('owner','admin'), async (req, res) => {
|
|
res.json(await query('SELECT group_name, server_name FROM user_servers WHERE user_id = ?', [req.params.id]));
|
|
});
|
|
|
|
router.post('/', authenticate, requireRole('owner','admin'), async (req, res) => {
|
|
const { username, password, email, game_name, game_uid, role, source } = req.body;
|
|
if (!username||!password||!email||!game_name||!game_uid||!role) return res.status(400).json({ error: '所有字段必填' });
|
|
if (!['owner','admin','player'].includes(role)) return res.status(400).json({ error: '无效角色' });
|
|
if (role === 'owner' && req.user.role !== 'owner') return res.status(403).json({ error: '仅服主可创建服主账号' });
|
|
if (password.length < 6) return res.status(400).json({ error: '密码至少6位' });
|
|
if (await getRow('SELECT id FROM users WHERE username = ?', [username])) return res.status(400).json({ error: '用户名已存在' });
|
|
const hashed = bcrypt.hashSync(password, 10);
|
|
const r = await query('INSERT INTO users(username, password, email, game_name, game_uid, role, source, active, email_verified) VALUES (?,?,?,?,?,?,?,1,1)', [username, hashed, email, game_name, game_uid, role, source || 'netease']);
|
|
await query("INSERT INTO audit_logs(user_id, username, action, entity_type, entity_id, details) VALUES (?,?,?,?,?,?)", [req.user.id, req.user.username, 'create_user', 'user', r.insertId, `创建用户 ${username}`]);
|
|
res.status(201).json({ id: r.insertId, message: '创建成功' });
|
|
});
|
|
|
|
router.put('/:id', authenticate, requireRole('owner','admin'), async (req, res) => {
|
|
const u = await getRow('SELECT * FROM users WHERE id = ?', [req.params.id]);
|
|
if (!u) return res.status(404).json({ error: '用户不存在' });
|
|
if (u.role === 'owner' && req.user.role !== 'owner') return res.status(403).json({ error: '无权修改服主' });
|
|
const fields = {};
|
|
if (req.body.email) fields.email = req.body.email;
|
|
if (req.body.game_name) fields.game_name = req.body.game_name;
|
|
if (req.body.game_uid) fields.game_uid = req.body.game_uid;
|
|
if (req.body.source) { if (!['netease','skin'].includes(req.body.source)) return res.status(400).json({ error: '无效来源' }); fields.source = req.body.source; }
|
|
if (req.body.role) { if (!['owner','admin','player'].includes(req.body.role)) return res.status(400).json({ error: '无效角色' }); fields.role = req.body.role; }
|
|
if (req.body.active !== undefined) fields.active = req.body.active ? 1 : 0;
|
|
if (req.body.password) { if (req.body.password.length < 6) return res.status(400).json({ error: '密码至少6位' }); fields.password = bcrypt.hashSync(req.body.password, 10); }
|
|
if (!Object.keys(fields).length) return res.status(400).json({ error: '无更新内容' });
|
|
const sets = Object.keys(fields).map(k => `${k} = ?`).join(', ');
|
|
await query(`UPDATE users SET ${sets} WHERE id = ?`, [...Object.values(fields), req.params.id]);
|
|
|
|
if (req.body.admin_servers !== undefined) {
|
|
await query('DELETE FROM user_servers WHERE user_id = ?', [req.params.id]);
|
|
if (Array.isArray(req.body.admin_servers)) {
|
|
for (const s of req.body.admin_servers) {
|
|
if (s.group_name && s.server_name) {
|
|
await query('INSERT IGNORE INTO user_servers(user_id, group_name, server_name) VALUES (?,?,?)', [req.params.id, s.group_name, s.server_name]);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
await query("INSERT INTO audit_logs(user_id, username, action, entity_type, entity_id, details) VALUES (?,?,?,?,?,?)", [req.user.id, req.user.username, 'update_user', 'user', req.params.id, '更新用户']);
|
|
res.json({ message: '更新成功' });
|
|
});
|
|
|
|
module.exports = router;
|