289 lines
10 KiB
Go
289 lines
10 KiB
Go
package httpapi
|
|
|
|
import (
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"net/http"
|
|
"strings"
|
|
|
|
"git.nianxx.cn/wangxuming/NianAIGC/backend/internal/administration"
|
|
"git.nianxx.cn/wangxuming/NianAIGC/backend/internal/identity"
|
|
)
|
|
|
|
type adminHandler struct {
|
|
authorizer *PlatformAuthorizer
|
|
service *administration.Service
|
|
}
|
|
|
|
func NewAdminHandler(authorizer *PlatformAuthorizer, service *administration.Service) (http.Handler, error) {
|
|
if authorizer == nil || service == nil {
|
|
return nil, fmt.Errorf("admin HTTP: authorizer and service are required")
|
|
}
|
|
return &adminHandler{authorizer: authorizer, service: service}, nil
|
|
}
|
|
|
|
func (handler *adminHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
|
switch r.URL.Path {
|
|
case "/api/admin/accounts/groups":
|
|
handler.serveGroups(w, r)
|
|
case "/api/admin/accounts/password":
|
|
handler.servePasswordReset(w, r)
|
|
case "/api/admin/accounts":
|
|
handler.serveAccounts(w, r)
|
|
case "/api/admin/organizations":
|
|
handler.serveOrganizations(w, r)
|
|
default:
|
|
http.NotFound(w, r)
|
|
}
|
|
}
|
|
|
|
func (handler *adminHandler) authorize(w http.ResponseWriter, r *http.Request) (identity.Session, administration.Actor, bool) {
|
|
session, err := handler.authorizer.Authorize(r, PlatformAdmin)
|
|
if err != nil {
|
|
writeAdminError(w, err)
|
|
return identity.Session{}, administration.Actor{}, false
|
|
}
|
|
return session, administration.Actor{ID: session.User.ID, Role: administration.Role(session.User.Role), OrganizationID: session.User.OrganizationID}, true
|
|
}
|
|
|
|
func (handler *adminHandler) serveGroups(w http.ResponseWriter, r *http.Request) {
|
|
if r.Method != http.MethodPost {
|
|
adminMethodNotAllowed(w, http.MethodPost)
|
|
return
|
|
}
|
|
writeAdminJSON(w, http.StatusGone, map[string]any{"error": "平台账号体系不再使用外部部门接口，请直接管理组织。"})
|
|
}
|
|
|
|
func (handler *adminHandler) serveAccounts(w http.ResponseWriter, r *http.Request) {
|
|
session, actor, ok := handler.authorize(w, r)
|
|
if !ok {
|
|
return
|
|
}
|
|
switch r.Method {
|
|
case http.MethodGet:
|
|
organizationID := strings.TrimSpace(r.URL.Query().Get("organizationId"))
|
|
if actor.Role != administration.RoleSuperAdmin {
|
|
organizationID = actor.OrganizationID
|
|
}
|
|
members, err := handler.service.ListAccounts(r.Context(), actor, administration.AccountFilters{OrganizationID: organizationID, IncludeDisabled: true})
|
|
if err != nil {
|
|
writeAdminError(w, err)
|
|
return
|
|
}
|
|
organizations, err := handler.service.ListOrganizations(r.Context(), actor)
|
|
if err != nil {
|
|
writeAdminError(w, err)
|
|
return
|
|
}
|
|
writeAdminJSON(w, http.StatusOK, map[string]any{"configured": true, "currentOrganizationId": nullableAdminString(organizationID), "organizations": adminOrganizationProjections(organizations), "members": adminAccountProjections(members), "canManageOrganizations": actor.Role == administration.RoleSuperAdmin, "canAssignOrganizationAdmin": actor.Role == administration.RoleSuperAdmin, "canCreateSuperAdmin": actor.Role == administration.RoleSuperAdmin})
|
|
case http.MethodPost:
|
|
body, ok := readAdminBody(w, r)
|
|
if !ok {
|
|
return
|
|
}
|
|
role := administration.Role(adminOptionalString(body["role"]))
|
|
if role == "" {
|
|
role = administration.RoleUser
|
|
}
|
|
account, err := handler.service.CreateAccount(r.Context(), actor, administration.CreateAccountInput{Phone: adminRequiredString(body["phone"]), DisplayName: adminRequiredString(body["displayName"]), Password: adminRequiredString(body["password"]), Role: role, OrganizationID: adminOptionalString(body["organizationId"]), LegacySubject: adminOptionalString(body["legacySubject"])})
|
|
if err != nil {
|
|
writeAdminError(w, err)
|
|
return
|
|
}
|
|
writeAdminJSON(w, http.StatusCreated, map[string]any{"ok": true, "user": adminAccountProjection(administration.ProjectAccount(account))})
|
|
case http.MethodPatch:
|
|
body, ok := readAdminBody(w, r)
|
|
if !ok {
|
|
return
|
|
}
|
|
patch := administration.UpdateAccountInput{ClearLoginLock: body["clearLoginLock"] == true}
|
|
if value, exists := body["displayName"]; exists {
|
|
v := adminOptionalString(value)
|
|
patch.DisplayName = &v
|
|
}
|
|
if value, exists := body["role"]; exists {
|
|
v := administration.Role(adminOptionalString(value))
|
|
patch.Role = &v
|
|
}
|
|
if value, exists := body["organizationId"]; exists {
|
|
v := adminOptionalString(value)
|
|
patch.OrganizationID = &v
|
|
}
|
|
if value, exists := body["status"]; exists {
|
|
v := administration.Status(adminOptionalString(value))
|
|
patch.Status = &v
|
|
}
|
|
account, err := handler.service.UpdateAccount(r.Context(), actor, adminRequiredString(body["userId"]), patch)
|
|
if err != nil {
|
|
writeAdminError(w, err)
|
|
return
|
|
}
|
|
writeAdminJSON(w, http.StatusOK, map[string]any{"ok": true, "user": adminAccountProjection(administration.ProjectAccount(account))})
|
|
case http.MethodPut:
|
|
body, ok := readAdminBody(w, r)
|
|
if !ok {
|
|
return
|
|
}
|
|
account, err := handler.service.SetAccountStatus(r.Context(), actor, adminRequiredString(body["userId"]), administration.Status(adminRequiredString(body["status"])))
|
|
if err != nil {
|
|
writeAdminError(w, err)
|
|
return
|
|
}
|
|
writeAdminJSON(w, http.StatusOK, map[string]any{"ok": true, "user": adminAccountProjection(administration.ProjectAccount(account))})
|
|
case http.MethodDelete:
|
|
body, ok := readAdminBody(w, r)
|
|
if !ok {
|
|
return
|
|
}
|
|
archive, err := handler.service.DeleteAccount(r.Context(), actor, adminRequiredString(body["userId"]))
|
|
if err != nil {
|
|
writeAdminError(w, err)
|
|
return
|
|
}
|
|
writeAdminJSON(w, http.StatusOK, map[string]any{"ok": true, "archivedOwnerId": archive})
|
|
default:
|
|
adminMethodNotAllowed(w, "GET, POST, PATCH, PUT, DELETE")
|
|
}
|
|
_ = session
|
|
}
|
|
|
|
func (handler *adminHandler) servePasswordReset(w http.ResponseWriter, r *http.Request) {
|
|
if r.Method != http.MethodPost {
|
|
adminMethodNotAllowed(w, http.MethodPost)
|
|
return
|
|
}
|
|
_, actor, ok := handler.authorize(w, r)
|
|
if !ok {
|
|
return
|
|
}
|
|
body, ok := readAdminBody(w, r)
|
|
if !ok {
|
|
return
|
|
}
|
|
account, err := handler.service.ResetPassword(r.Context(), actor, adminRequiredString(body["userId"]), adminRequiredString(body["newPassword"]))
|
|
if err != nil {
|
|
writeAdminError(w, err)
|
|
return
|
|
}
|
|
writeAdminJSON(w, http.StatusOK, map[string]any{"ok": true, "userId": account.ID})
|
|
}
|
|
|
|
func (handler *adminHandler) serveOrganizations(w http.ResponseWriter, r *http.Request) {
|
|
_, actor, ok := handler.authorize(w, r)
|
|
if !ok {
|
|
return
|
|
}
|
|
switch r.Method {
|
|
case http.MethodGet:
|
|
organizations, err := handler.service.ListOrganizations(r.Context(), actor)
|
|
if err != nil {
|
|
writeAdminError(w, err)
|
|
return
|
|
}
|
|
writeAdminJSON(w, http.StatusOK, map[string]any{"organizations": adminOrganizationProjections(organizations)})
|
|
case http.MethodPost:
|
|
body, ok := readAdminBody(w, r)
|
|
if !ok {
|
|
return
|
|
}
|
|
organization, err := handler.service.CreateOrganization(r.Context(), actor, adminRequiredString(body["name"]))
|
|
if err != nil {
|
|
writeAdminError(w, err)
|
|
return
|
|
}
|
|
writeAdminJSON(w, http.StatusCreated, map[string]any{"ok": true, "organization": adminOrganizationProjection(administration.ProjectOrganization(organization))})
|
|
case http.MethodPatch:
|
|
body, ok := readAdminBody(w, r)
|
|
if !ok {
|
|
return
|
|
}
|
|
patch := administration.UpdateOrganizationInput{}
|
|
if value, exists := body["name"]; exists {
|
|
v := adminOptionalString(value)
|
|
patch.Name = &v
|
|
}
|
|
if value, exists := body["status"]; exists {
|
|
v := administration.Status(adminOptionalString(value))
|
|
patch.Status = &v
|
|
}
|
|
organization, err := handler.service.UpdateOrganization(r.Context(), actor, adminRequiredString(body["organizationId"]), patch)
|
|
if err != nil {
|
|
writeAdminError(w, err)
|
|
return
|
|
}
|
|
writeAdminJSON(w, http.StatusOK, map[string]any{"ok": true, "organization": adminOrganizationProjection(administration.ProjectOrganization(organization))})
|
|
case http.MethodDelete:
|
|
body, ok := readAdminBody(w, r)
|
|
if !ok {
|
|
return
|
|
}
|
|
if err := handler.service.DeleteOrganization(r.Context(), actor, adminRequiredString(body["organizationId"])); err != nil {
|
|
writeAdminError(w, err)
|
|
return
|
|
}
|
|
writeAdminJSON(w, http.StatusOK, map[string]any{"ok": true})
|
|
default:
|
|
adminMethodNotAllowed(w, "GET, POST, PATCH, DELETE")
|
|
}
|
|
}
|
|
|
|
func readAdminBody(w http.ResponseWriter, r *http.Request) (map[string]any, bool) {
|
|
var body map[string]any
|
|
if json.NewDecoder(r.Body).Decode(&body) != nil {
|
|
writeAdminJSON(w, http.StatusBadRequest, map[string]any{"error": "请求内容格式不正确。"})
|
|
return nil, false
|
|
}
|
|
return body, true
|
|
}
|
|
func adminOptionalString(value any) string {
|
|
text, ok := value.(string)
|
|
if !ok {
|
|
return ""
|
|
}
|
|
return strings.TrimSpace(text)
|
|
}
|
|
func adminRequiredString(value any) string { return adminOptionalString(value) }
|
|
func nullableAdminString(value string) any {
|
|
if value == "" {
|
|
return nil
|
|
}
|
|
return value
|
|
}
|
|
func adminMethodNotAllowed(w http.ResponseWriter, allow string) {
|
|
w.Header().Set("Allow", allow)
|
|
w.WriteHeader(http.StatusMethodNotAllowed)
|
|
}
|
|
func writeAdminError(w http.ResponseWriter, err error) {
|
|
status, message := http.StatusInternalServerError, "服务器内部错误。"
|
|
var authErr *PlatformAuthError
|
|
if errors.As(err, &authErr) {
|
|
status, message = authErr.Status, authErr.Message
|
|
} else if administration.StatusCode(err) != http.StatusInternalServerError {
|
|
status, message = administration.StatusCode(err), err.Error()
|
|
}
|
|
writeAdminJSON(w, status, map[string]any{"error": message})
|
|
}
|
|
func writeAdminJSON(w http.ResponseWriter, status int, body any) { writeJSON(w, status, body) }
|
|
|
|
func adminAccountProjection(a administration.AccountProjection) map[string]any {
|
|
return map[string]any{"id": a.ID, "phone": a.Phone, "displayName": a.DisplayName, "role": a.Role, "organizationId": nullableAdminString(a.OrganizationID), "status": a.Status, "createdAt": a.CreatedAt, "lastLoginAt": a.LastLoginAt, "lockedUntil": a.LockedUntil}
|
|
}
|
|
func adminAccountProjections(values []administration.AccountProjection) []map[string]any {
|
|
out := make([]map[string]any, len(values))
|
|
for i, value := range values {
|
|
out[i] = adminAccountProjection(value)
|
|
}
|
|
return out
|
|
}
|
|
func adminOrganizationProjection(o administration.OrganizationProjection) map[string]any {
|
|
return map[string]any{"id": o.ID, "name": o.Name, "status": o.Status}
|
|
}
|
|
func adminOrganizationProjections(values []administration.OrganizationProjection) []map[string]any {
|
|
out := make([]map[string]any, len(values))
|
|
for i, value := range values {
|
|
out[i] = adminOrganizationProjection(value)
|
|
}
|
|
return out
|
|
}
|