v0.2测试

backend/routes/admin.py

@@ -214,6 +214,9 @@ async def get_assignments(request: Request):
     获取作业列表
     """
     user = await get_current_user(request)
+    role = await PermissionChecker.get_user_role(user["user_id"])
+    if role not in ["班主任", "学习委员"]:
+        return error_response(message="无权限", code=403)
     
     result = await HomeworkService.get_assignments(user["user_id"])
     
@@ -268,10 +271,10 @@ async def create_assignment(
 
 @router.put("/homework/submission")
 async def update_submission_status(request: Request, req: UpdateHomeworkStatusRequest):
-    """
-    更新作业提交状态（科代表）
-    """
     user = await get_current_user(request)
+    role = await PermissionChecker.get_user_role(user["user_id"])
+    if role not in ["班主任", "学习委员"]:
+        return error_response(message="无权进行此操作", code=403)
     
     result = await HomeworkService.update_submission_status(
         submission_id=req.submission_id,
@@ -340,9 +343,19 @@ async def add_admin(request: Request, req: AddAdminRequest):
     """
     user = await get_current_user(request)
     
-    is_teacher = await PermissionChecker.check_is_teacher(user["user_id"])
-    if not is_teacher:
+    if not await PermissionChecker.check_is_teacher(user["user_id"]):
         return error_response(message="仅班主任可添加管理员", code=403)
+
+    # 验证角色类型是否合法
+    if req.role_type not in ["班长", "学习委员", "考勤委员", "劳动委员"]:
+        return error_response(message="无效的角色类型", code=400)
+    result = await AdminService.add_admin(
+        username=req.username,
+        real_name=req.real_name,
+        password=req.password,
+        role_type=req.role_type,
+        operator_id=user["user_id"]
+    )
     
     result = await AdminService.add_admin(
         username=req.username,

backend/routes/debug.py

@@ -1,5 +1,5 @@
 # ===========================================
-# 班级操行分管理系统 - 后端服务
+# 班级操行分管理系统 - 调试入口
 # 
 # 开发者: Canglan
 # 联系方式: admin@sea-studio.top
@@ -9,7 +9,7 @@
 # 版权所有 © Sea Network Technology Studio
 # ===========================================
 
-from fastapi import APIRouter, Request, HTTPException
+from fastapi import APIRouter, Request
 from pydantic import BaseModel
 from typing import Optional
 
@@ -23,12 +23,10 @@ logger = get_logger(__name__)
 
 
 class AddAdminDebugRequest(BaseModel):
-    """添加管理员请求"""
     username: str
     password: str
     real_name: str
-    role_type: str  # 班主任/班长/科代表/考勤委员/劳动委员
-    class_id: int
+    role_type: str  # 班主任/班长/学习委员/考勤委员/劳动委员
     subject_id: Optional[int] = None
 
 
@@ -38,20 +36,22 @@ async def debug_add_admin(request: Request, req: AddAdminDebugRequest):
     调试入口 - 添加第一批管理员
     注意：此接口仅用于首次部署，使用后建议注释掉此路由
     """
-    # 检查是否已存在管理员
     from models.user import UserModel
     existing = await UserModel.get_by_username(req.username)
     if existing:
         return error_response(message="用户名已存在")
     
+    # 验证角色类型
+    valid_roles = ["班主任", "班长", "学习委员", "考勤委员", "劳动委员"]
+    if req.role_type not in valid_roles:
+        return error_response(message=f"无效的角色类型，可选: {', '.join(valid_roles)}")
+    
     # 创建管理员账号
     result = await AdminService.add_admin(
         username=req.username,
         real_name=req.real_name,
         password=req.password,
         role_type=req.role_type,
-        class_id=req.class_id,
-        subject_id=req.subject_id,
         operator_id=0  # 系统添加
     )
     

backend/routes/subject.py

@@ -9,97 +9,41 @@
 # 版权所有 © Sea Network Technology Studio
 # ===========================================
 
-from fastapi import APIRouter, Request, Query
+from fastapi import APIRouter, Request
 from typing import Optional
-
 from middleware.permission import get_current_user, PermissionChecker
 from services.subject_service import SubjectService
 from schemas.subject import CreateSubjectRequest, UpdateSubjectRequest
 from utils.response import success_response, error_response
-from utils.logger import get_logger
 
 router = APIRouter()
-logger = get_logger(__name__)
-
 
 @router.get("/list")
-async def get_subjects(
-    request: Request,
-    is_active: Optional[bool] = None
-):
-    """
-    获取科目列表
-    """
+async def get_subjects(request: Request, is_active: Optional[bool] = None):
     user = await get_current_user(request)
-    
     result = await SubjectService.get_subjects(is_active=is_active)
-    
     return success_response(data=result)
 
-
 @router.post("/create")
 async def create_subject(request: Request, req: CreateSubjectRequest):
-    """
-    创建科目（班主任）
-    """
     user = await get_current_user(request)
-    
-    is_teacher = await PermissionChecker.check_is_teacher(user["user_id"])
-    if not is_teacher:
-        return error_response(message="仅班主任可创建科目", code=403)
-    
-    result = await SubjectService.create_subject(
-        subject_name=req.subject_name,
-        subject_code=req.subject_code,
-        sort_order=req.sort_order
-    )
-    
-    if result["success"]:
-        return success_response(data=result, message="科目创建成功")
-    else:
-        return error_response(message=result["message"])
-
+    if not await PermissionChecker.check_can_manage_subjects(user["user_id"]):
+        return error_response(message="无权限", code=403)
+    result = await SubjectService.create_subject(req.subject_name, req.subject_code, req.sort_order)
+    return success_response(data=result, message="科目创建成功") if result["success"] else error_response(message=result["message"])
 
 @router.put("/update/{subject_id}")
-async def update_subject(
-    request: Request,
-    subject_id: int,
-    req: UpdateSubjectRequest
-):
-    """
-    更新科目（班主任）
-    """
+async def update_subject(request: Request, subject_id: int, req: UpdateSubjectRequest):
     user = await get_current_user(request)
-    
-    is_teacher = await PermissionChecker.check_is_teacher(user["user_id"])
-    if not is_teacher:
-        return error_response(message="仅班主任可更新科目", code=403)
-    
-    result = await SubjectService.update_subject(
-        subject_id=subject_id,
-        **req.dict(exclude_none=True)
-    )
-    
-    if result["success"]:
-        return success_response(message="科目更新成功")
-    else:
-        return error_response(message=result["message"])
-
+    if not await PermissionChecker.check_can_manage_subjects(user["user_id"]):
+        return error_response(message="无权限", code=403)
+    result = await SubjectService.update_subject(subject_id, **req.dict(exclude_none=True))
+    return success_response(message="科目更新成功") if result["success"] else error_response(message=result["message"])
 
 @router.delete("/delete/{subject_id}")
 async def delete_subject(request: Request, subject_id: int):
-    """
-    删除科目（软删除，班主任）
-    """
     user = await get_current_user(request)
-    
-    is_teacher = await PermissionChecker.check_is_teacher(user["user_id"])
-    if not is_teacher:
-        return error_response(message="仅班主任可删除科目", code=403)
-    
+    if not await PermissionChecker.check_can_manage_subjects(user["user_id"]):
+        return error_response(message="无权限", code=403)
     result = await SubjectService.delete_subject(subject_id)
-    
-    if result["success"]:
-        return success_response(message="科目已禁用")
-    else:
-        return error_response(message=result["message"])
+    return success_response(message="科目已禁用") if result["success"] else error_response(message=result["message"])