diff --git a/admin/handler/web/user.go b/admin/handler/web/user.go new file mode 100644 index 0000000..2cbc0ca --- /dev/null +++ b/admin/handler/web/user.go @@ -0,0 +1,128 @@ +package web + +import ( + "errors" + "fmt" + "net/http" + "net/url" + "strings" + "time" + + "github.com/gin-gonic/gin" + + "cmautobuy/admin/model" + "cmautobuy/admin/repository" + "cmautobuy/admin/service" +) + +// AdminRequired 叠加在已认证的 /users 路由上。采购员能使用业务页，但不能管理账号。 +func AdminRequired() gin.HandlerFunc { + return func(c *gin.Context) { + user := currentUser(c) + if user != nil && user.IsAdmin() { + c.Next() + return + } + fail(c, http.StatusForbidden, "只有管理员可以访问用户管理。当前账号仍可使用其他业务页面。") + c.Abort() + } +} + +// UserList 显示用户搜索、分页和管理操作。 +func (h *Handler) UserList(c *gin.Context) { + h.renderUserList(c, http.StatusOK, c.Query("msg"), c.Query("error"), false, "") +} + +func (h *Handler) renderUserList(c *gin.Context, httpStatus int, message, errorMessage string, needCreate bool, createUsername string) { + keyword := strings.TrimSpace(c.Query("q")) + result, err := service.ListUsers(h.db, currentUser(c), keyword, + model.UserStatus(c.Query("status")), service.ParsePage(c.Query("page"))) + if err != nil { + fail(c, http.StatusInternalServerError, "读取用户列表失败，账号数据没有被改动。刷新后重试。") + return + } + values := url.Values{} + if keyword != "" { + values.Set("q", keyword) + } + if result.Status != "" { + values.Set("status", string(result.Status)) + } + status := fmt.Sprintf("共 %d 个用户 · 第 %d/%d 页", result.Total, result.Page, result.TotalPages) + c.HTML(httpStatus, "user/list", page(c, "users", "用户管理", gin.H{ + "Rows": result.Rows, "Keyword": result.Keyword, "Status": status, + "Pagination": service.NewPaginationView(result.Page, result.TotalPages, values.Encode()), + "StatusFilter": result.Status, "Message": message, "Error": errorMessage, + "NeedCreate": needCreate, "CreateUsername": createUsername, + })) +} + +// UserCreate 只创建固定 purchaser 角色，密码不写入 URL、不回显。 +func (h *Handler) UserCreate(c *gin.Context) { + err := service.CreatePurchaser(h.db, currentUser(c), c.PostForm("username"), + c.PostForm("password"), c.PostForm("password_confirm"), time.Now()) + if err != nil { + if isExpectedUserError(err) { + h.renderUserList(c, http.StatusBadRequest, "", err.Error(), true, + strings.TrimSpace(c.PostForm("username"))) + return + } + fail(c, http.StatusInternalServerError, "创建采购员失败，已有账号数据保持不变。刷新后重试。") + return + } + redirectUsers(c, "采购员创建成功", "") +} + +// UserSetStatus 启用或禁用账号，并由 Repository 在同一事务撤销全部 Session。 +func (h *Handler) UserSetStatus(c *gin.Context) { + status := model.UserStatus(c.PostForm("status")) + err := service.ChangeUserStatus(h.db, currentUser(c), c.PostForm("user_id"), status, time.Now()) + if err != nil { + h.userActionFailure(c, err, "修改账号状态失败") + return + } + message := "账号已启用" + if status == model.UserDisabled { + message = "账号已禁用，原有登录已撤销" + } + redirectUsers(c, message, "") +} + +// UserResetPassword 重置密码并撤销目标用户全部 Session。密码不会回显。 +func (h *Handler) UserResetPassword(c *gin.Context) { + err := service.ResetUserPassword(h.db, currentUser(c), c.PostForm("user_id"), + c.PostForm("password"), c.PostForm("password_confirm"), time.Now()) + if err != nil { + h.userActionFailure(c, err, "重置密码失败") + return + } + redirectUsers(c, "密码已重置，原有登录已撤销", "") +} + +func (h *Handler) userActionFailure(c *gin.Context, err error, fallback string) { + if isExpectedUserError(err) { + redirectUsers(c, "", err.Error()) + return + } + fail(c, http.StatusInternalServerError, fallback+"，已有账号数据保持不变。刷新后重试。") +} + +func isExpectedUserError(err error) bool { + return service.IsValidationError(err) || errors.Is(err, repository.ErrUsernameExists) || + errors.Is(err, repository.ErrUserNotFound) || errors.Is(err, repository.ErrLastActiveAdmin) +} + +func redirectUsers(c *gin.Context, message, errorMessage string) { + query := url.Values{} + if message != "" { + query.Set("msg", message) + } + if errorMessage != "" { + query.Set("error", errorMessage) + } + location := "/users" + if encoded := query.Encode(); encoded != "" { + location += "?" + encoded + } + c.Redirect(http.StatusSeeOther, location) +} diff --git a/admin/handler/web/web.go b/admin/handler/web/web.go index 2302815..fa6c402 100644 --- a/admin/handler/web/web.go +++ b/admin/handler/web/web.go @@ -83,6 +83,13 @@ func Register(r *gin.Engine, db *sql.DB, onlineThreshold time.Duration) { // 5. 客户端列表 pages.GET("/clients", h.ClientList) pages.POST("/clients/delete", h.ClientDelete) + + // 6. 用户管理：先经过网页登录，再叠加管理员角色校验。 + users := pages.Group("/users", AdminRequired()) + users.GET("", h.UserList) + users.POST("/create", h.UserCreate) + users.POST("/status", h.UserSetStatus) + users.POST("/reset-password", h.UserResetPassword) } // page 组装每个页面都要的公共数据（导航高亮、标题、CSRF token）。 diff --git a/admin/model/model.go b/admin/model/model.go index 32b5f78..bbe7e04 100644 --- a/admin/model/model.go +++ b/admin/model/model.go @@ -78,6 +78,28 @@ type User struct { UpdatedAt string } +// IsAdmin 供路由权限判断和模板决定是否显示用户管理入口。 +func (u *User) IsAdmin() bool { return u != nil && u.Role == RoleAdmin } + +// IsActive 供模板决定显示“启用”还是“禁用”操作。 +func (u User) IsActive() bool { return u.Status == UserActive } + +// RoleLabel 返回给操作员看的中文角色名。 +func (u User) RoleLabel() string { + if u.Role == RoleAdmin { + return "管理员" + } + return "采购员" +} + +// StatusLabel 返回给操作员看的中文账号状态。 +func (u User) StatusLabel() string { + if u.Status == UserActive { + return "启用" + } + return "禁用" +} + // WebSession 是服务端保存的网页登录状态。SessionHash 是浏览器随机 Token // 的 SHA-256，不是 Token 原文。 type WebSession struct { diff --git a/admin/repository/user.go b/admin/repository/user.go index c844690..855d53a 100644 --- a/admin/repository/user.go +++ b/admin/repository/user.go @@ -5,6 +5,7 @@ import ( "database/sql" "errors" "fmt" + "strings" "cmautobuy/admin/model" ) @@ -14,6 +15,8 @@ var ( ErrUsersAlreadyExist = errors.New("管理员已经初始化") ErrUserNotFound = errors.New("用户不存在") ErrSessionNotFound = errors.New("网页登录会话不存在") + ErrUsernameExists = errors.New("用户名已经存在") + ErrLastActiveAdmin = errors.New("不能禁用最后一个有效管理员") ) // CountUsers 返回所有用户数量，disabled 也算。即使所有账号被禁用， @@ -148,3 +151,131 @@ func DeleteExpiredSessions(q Execer, nowISO string) error { } return nil } + +// ListUsers 按用户名搜索并分页。列表和 COUNT 共用同一段筛选，避免页码漂移。 +func ListUsers(q Execer, keyword string, status model.UserStatus, limit, offset int) ([]model.User, int, error) { + pattern := "%" + escapeLike(keyword) + "%" + where := `WHERE username LIKE ? ESCAPE '\'` + args := []any{pattern} + if status == model.UserActive || status == model.UserDisabled { + where += ` AND status = ?` + args = append(args, status) + } + var total int + if err := q.QueryRow(`SELECT COUNT(*) FROM users `+where, args...).Scan(&total); err != nil { + return nil, 0, fmt.Errorf("统计 Admin 用户失败: %w", err) + } + listArgs := append(append([]any{}, args...), limit, offset) + rows, err := q.Query(` + SELECT user_id, username, role, status, last_login_at, + password_changed_at, created_at, updated_at + FROM users `+where+` + ORDER BY created_at DESC, username ASC + LIMIT ? OFFSET ?`, listArgs...) + if err != nil { + return nil, 0, fmt.Errorf("查询 Admin 用户列表失败: %w", err) + } + defer rows.Close() + + users := make([]model.User, 0) + for rows.Next() { + var user model.User + var lastLogin sql.NullString + if err := rows.Scan(&user.UserID, &user.Username, &user.Role, &user.Status, + &lastLogin, &user.PasswordChangedAt, &user.CreatedAt, &user.UpdatedAt); err != nil { + return nil, 0, fmt.Errorf("读取 Admin 用户列表失败: %w", err) + } + user.LastLoginAt = lastLogin.String + users = append(users, user) + } + if err := rows.Err(); err != nil { + return nil, 0, fmt.Errorf("遍历 Admin 用户列表失败: %w", err) + } + return users, total, nil +} + +// CreateUser 创建一个已经完成密码哈希的账号。用户名由数据库 NOCASE 唯一约束 +// 做最终并发保护。 +func CreateUser(q Execer, user model.User) error { + _, err := q.Exec(` + INSERT INTO users + (user_id, username, password_hash, role, status, last_login_at, + password_changed_at, created_at, updated_at) + VALUES (?, ?, ?, ?, ?, NULL, ?, ?, ?)`, + user.UserID, user.Username, user.PasswordHash, user.Role, user.Status, + user.PasswordChangedAt, user.CreatedAt, user.UpdatedAt) + if err != nil { + if strings.Contains(err.Error(), "UNIQUE constraint failed: users.username") { + return ErrUsernameExists + } + return fmt.Errorf("创建 Admin 用户失败: %w", err) + } + return nil +} + +// SetUserStatusAndRevokeSessions 在同一写事务里修改状态并撤销全部 Session。 +// 禁用管理员前会在事务内保护最后一个有效管理员。 +func SetUserStatusAndRevokeSessions(db *sql.DB, userID string, status model.UserStatus, updatedAt string) error { + tx, err := db.Begin() + if err != nil { + return fmt.Errorf("开始修改用户状态事务失败: %w", err) + } + defer tx.Rollback() + + var role model.UserRole + var current model.UserStatus + if err := tx.QueryRow(`SELECT role, status FROM users WHERE user_id = ?`, userID).Scan(&role, ¤t); errors.Is(err, sql.ErrNoRows) { + return ErrUserNotFound + } else if err != nil { + return fmt.Errorf("读取待修改用户失败: %w", err) + } + if status == model.UserDisabled && current == model.UserActive && role == model.RoleAdmin { + var activeAdmins int + if err := tx.QueryRow(`SELECT COUNT(*) FROM users WHERE role = 'admin' AND status = 'active'`).Scan(&activeAdmins); err != nil { + return fmt.Errorf("统计有效管理员失败: %w", err) + } + if activeAdmins <= 1 { + return ErrLastActiveAdmin + } + } + if _, err := tx.Exec(`UPDATE users SET status = ?, updated_at = ? WHERE user_id = ?`, status, updatedAt, userID); err != nil { + return fmt.Errorf("修改用户状态失败: %w", err) + } + if _, err := tx.Exec(`DELETE FROM web_sessions WHERE user_id = ?`, userID); err != nil { + return fmt.Errorf("撤销用户 Session 失败: %w", err) + } + if err := tx.Commit(); err != nil { + return fmt.Errorf("提交用户状态事务失败: %w", err) + } + return nil +} + +// ResetUserPasswordAndRevokeSessions 原子更新密码哈希并撤销该用户所有 Session。 +func ResetUserPasswordAndRevokeSessions(db *sql.DB, userID, passwordHash, updatedAt string) error { + tx, err := db.Begin() + if err != nil { + return fmt.Errorf("开始重置密码事务失败: %w", err) + } + defer tx.Rollback() + result, err := tx.Exec(` + UPDATE users + SET password_hash = ?, password_changed_at = ?, updated_at = ? + WHERE user_id = ?`, passwordHash, updatedAt, updatedAt, userID) + if err != nil { + return fmt.Errorf("重置用户密码失败: %w", err) + } + affected, err := result.RowsAffected() + if err != nil { + return fmt.Errorf("确认重置密码结果失败: %w", err) + } + if affected == 0 { + return ErrUserNotFound + } + if _, err := tx.Exec(`DELETE FROM web_sessions WHERE user_id = ?`, userID); err != nil { + return fmt.Errorf("撤销用户 Session 失败: %w", err) + } + if err := tx.Commit(); err != nil { + return fmt.Errorf("提交重置密码事务失败: %w", err) + } + return nil +} diff --git a/admin/service/auth.go b/admin/service/auth.go index 5790736..68d95a4 100644 --- a/admin/service/auth.go +++ b/admin/service/auth.go @@ -32,6 +32,20 @@ var ( dummyPasswordHash, _ = bcrypt.GenerateFromPassword([]byte("not-a-real-password"), bcrypt.DefaultCost) ) +type validationError struct{ message string } + +func (e *validationError) Error() string { return e.message } + +// IsValidationError 让 Handler 区分可直接展示的表单错误和不可泄露的内部错误。 +func IsValidationError(err error) bool { + var target *validationError + return errors.As(err, &target) +} + +func invalidInput(message string, args ...any) error { + return &validationError{message: fmt.Sprintf(message, args...)} +} + // HasUsers 判断首次初始化入口是否已经永久关闭。 func HasUsers(db *sql.DB) (bool, error) { count, err := repository.CountUsers(db) @@ -41,27 +55,12 @@ func HasUsers(db *sql.DB) (bool, error) { // SetupInitialAdmin 校验表单、哈希密码并在事务中创建首位管理员。 func SetupInitialAdmin(db *sql.DB, username, password, confirmation string, now time.Time) error { username = strings.TrimSpace(username) - if username == "" { - return fmt.Errorf("用户名不能为空") + if err := validateUsername(username); err != nil { + return err } - if len([]rune(username)) > maxUsernameLen { - return fmt.Errorf("用户名不能超过 %d 个字符", maxUsernameLen) - } - if len([]rune(password)) < minimumPasswordLen { - return fmt.Errorf("密码至少需要 %d 个字符", minimumPasswordLen) - } - // bcrypt 最多接受 72 字节。中文等字符可能占多个字节，因此不能只靠 - // HTML 的 maxlength；服务端需要在哈希前给出可理解的校验错误。 - if len([]byte(password)) > 72 { - return fmt.Errorf("密码不能超过 72 个字节") - } - if password != confirmation { - return fmt.Errorf("两次输入的密码不一致") - } - - hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost) + hash, err := hashConfirmedPassword(password, confirmation) if err != nil { - return fmt.Errorf("生成密码哈希失败: %w", err) + return err } userID, err := randomID("USR-", 16) if err != nil { @@ -75,6 +74,35 @@ func SetupInitialAdmin(db *sql.DB, username, password, confirmation string, now }) } +func validateUsername(username string) error { + if username == "" { + return invalidInput("用户名不能为空") + } + if len([]rune(username)) > maxUsernameLen { + return invalidInput("用户名不能超过 %d 个字符", maxUsernameLen) + } + return nil +} + +func hashConfirmedPassword(password, confirmation string) ([]byte, error) { + if len([]rune(password)) < minimumPasswordLen { + return nil, invalidInput("密码至少需要 %d 个字符", minimumPasswordLen) + } + // bcrypt 最多接受 72 字节。中文等字符可能占多个字节，因此不能只靠 + // HTML 的 maxlength；服务端需要在哈希前给出可理解的校验错误。 + if len([]byte(password)) > 72 { + return nil, invalidInput("密码不能超过 72 个字节") + } + if password != confirmation { + return nil, invalidInput("两次输入的密码不一致") + } + hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost) + if err != nil { + return nil, fmt.Errorf("生成密码哈希失败: %w", err) + } + return hash, nil +} + // Login 校验统一凭据并创建一个固定 12 小时有效的 Session。 // 返回的 token 原文只交给 Cookie，数据库仅保存 SHA-256。 func Login(db *sql.DB, username, password string, now time.Time) (token string, user *model.User, expiresAt time.Time, err error) { diff --git a/admin/service/user.go b/admin/service/user.go new file mode 100644 index 0000000..6979966 --- /dev/null +++ b/admin/service/user.go @@ -0,0 +1,112 @@ +// Admin 用户管理业务：列表、新增采购员、启停和重置密码。 +package service + +import ( + "database/sql" + "errors" + "strings" + "time" + + "cmautobuy/admin/model" + "cmautobuy/admin/repository" +) + +var ErrAdminRequired = errors.New("只有管理员可以管理用户") + +// UserListResult 是用户管理页的分页结果。 +type UserListResult struct { + Rows []model.User + Keyword string + Status model.UserStatus + Page int + Total int + TotalPages int +} + +// ListUsers 搜索并分页。用户页沿用全站统一的每页 20 条规则。 +func ListUsers(db *sql.DB, actor *model.User, keyword string, status model.UserStatus, requestedPage int) (*UserListResult, error) { + if actor == nil || !actor.IsAdmin() { + return nil, ErrAdminRequired + } + keyword = strings.TrimSpace(keyword) + if status != model.UserActive && status != model.UserDisabled { + status = "" + } + page := requestedPage + if page < 1 { + page = 1 + } + rows, total, err := repository.ListUsers(db, keyword, status, PageSize, (page-1)*PageSize) + if err != nil { + return nil, err + } + totalPages := TotalPages(total) + clampedPage := ClampPage(page, totalPages) + if clampedPage != page { + page = clampedPage + rows, _, err = repository.ListUsers(db, keyword, status, PageSize, (page-1)*PageSize) + if err != nil { + return nil, err + } + } + return &UserListResult{ + Rows: rows, Keyword: keyword, Status: status, + Page: page, Total: total, TotalPages: totalPages, + }, nil +} + +// CreatePurchaser 创建固定 purchaser 角色的账号，不提供第二管理员入口。 +func CreatePurchaser(db *sql.DB, actor *model.User, username, password, confirmation string, now time.Time) error { + if actor == nil || !actor.IsAdmin() { + return ErrAdminRequired + } + username = strings.TrimSpace(username) + if err := validateUsername(username); err != nil { + return err + } + hash, err := hashConfirmedPassword(password, confirmation) + if err != nil { + return err + } + userID, err := randomID("USR-", 16) + if err != nil { + return err + } + at := now.UTC().Format(model.TimeLayout) + return repository.CreateUser(db, model.User{ + UserID: userID, Username: username, PasswordHash: string(hash), + Role: model.RolePurchaser, Status: model.UserActive, + PasswordChangedAt: at, CreatedAt: at, UpdatedAt: at, + }) +} + +// ChangeUserStatus 启用或禁用账号。数据库事务负责最后管理员保护和 Session 撤销。 +func ChangeUserStatus(db *sql.DB, actor *model.User, userID string, status model.UserStatus, now time.Time) error { + if actor == nil || !actor.IsAdmin() { + return ErrAdminRequired + } + if status != model.UserActive && status != model.UserDisabled { + return invalidInput("账号状态无效") + } + if strings.TrimSpace(userID) == "" { + return invalidInput("用户编号不能为空") + } + return repository.SetUserStatusAndRevokeSessions( + db, userID, status, now.UTC().Format(model.TimeLayout)) +} + +// ResetUserPassword 更新密码哈希，并在同一事务中撤销目标用户全部 Session。 +func ResetUserPassword(db *sql.DB, actor *model.User, userID, password, confirmation string, now time.Time) error { + if actor == nil || !actor.IsAdmin() { + return ErrAdminRequired + } + if strings.TrimSpace(userID) == "" { + return invalidInput("用户编号不能为空") + } + hash, err := hashConfirmedPassword(password, confirmation) + if err != nil { + return err + } + return repository.ResetUserPasswordAndRevokeSessions( + db, userID, string(hash), now.UTC().Format(model.TimeLayout)) +} diff --git a/admin/service/user_test.go b/admin/service/user_test.go new file mode 100644 index 0000000..db90026 --- /dev/null +++ b/admin/service/user_test.go @@ -0,0 +1,147 @@ +package service + +import ( + "database/sql" + "errors" + "testing" + "time" + + "golang.org/x/crypto/bcrypt" + + "cmautobuy/admin/model" + "cmautobuy/admin/repository" +) + +func TestCreatePurchaser_固定角色且用户名不区分大小写唯一(t *testing.T) { + db := newSyncTestDB(t) + now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC) + admin := prepareAdminUser(t, db, now) + if err := CreatePurchaser(db, admin, "buyer", "buyer-password", "buyer-password", now); err != nil { + t.Fatalf("创建采购员失败: %v", err) + } + buyer, err := repository.FindUserByUsername(db, "BUYER") + if err != nil { + t.Fatal(err) + } + if buyer.Role != model.RolePurchaser || buyer.Status != model.UserActive { + t.Fatalf("新账号角色或状态错误: %+v", buyer) + } + if buyer.PasswordHash == "buyer-password" || + bcrypt.CompareHashAndPassword([]byte(buyer.PasswordHash), []byte("buyer-password")) != nil { + t.Fatal("采购员密码必须保存为可验证的 bcrypt 哈希") + } + if err := CreatePurchaser(db, admin, "BUYER", "other-password", "other-password", now); !errors.Is(err, repository.ErrUsernameExists) { + t.Fatalf("大小写不同的重复用户名应被拒绝，实际 %v", err) + } +} + +func TestChangeUserStatus_禁用撤销全部Session且启用后可重新登录(t *testing.T) { + db := newSyncTestDB(t) + now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC) + admin := prepareAdminUser(t, db, now) + if err := CreatePurchaser(db, admin, "buyer", "buyer-password", "buyer-password", now); err != nil { + t.Fatal(err) + } + buyer, _ := repository.FindUserByUsername(db, "buyer") + token, _, _, err := Login(db, "buyer", "buyer-password", now) + if err != nil { + t.Fatal(err) + } + if err := ChangeUserStatus(db, admin, buyer.UserID, model.UserDisabled, now.Add(time.Minute)); err != nil { + t.Fatal(err) + } + if _, err := Authenticate(db, token, now.Add(2*time.Minute)); !errors.Is(err, ErrUnauthenticated) { + t.Fatalf("禁用后旧 Session 应失效，实际 %v", err) + } + if _, _, _, err := Login(db, "buyer", "buyer-password", now.Add(2*time.Minute)); !errors.Is(err, ErrInvalidCredentials) { + t.Fatalf("禁用账号不应登录，实际 %v", err) + } + if err := ChangeUserStatus(db, admin, buyer.UserID, model.UserActive, now.Add(3*time.Minute)); err != nil { + t.Fatal(err) + } + if _, _, _, err := Login(db, "buyer", "buyer-password", now.Add(4*time.Minute)); err != nil { + t.Fatalf("重新启用后应可登录: %v", err) + } +} + +func TestResetUserPassword_原子撤销Session并更换凭据(t *testing.T) { + db := newSyncTestDB(t) + now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC) + admin := prepareAdminUser(t, db, now) + if err := CreatePurchaser(db, admin, "buyer", "old-password", "old-password", now); err != nil { + t.Fatal(err) + } + buyer, _ := repository.FindUserByUsername(db, "buyer") + token, _, _, _ := Login(db, "buyer", "old-password", now) + if err := ResetUserPassword(db, admin, buyer.UserID, "new-password", "new-password", now.Add(time.Minute)); err != nil { + t.Fatal(err) + } + if _, err := Authenticate(db, token, now.Add(2*time.Minute)); !errors.Is(err, ErrUnauthenticated) { + t.Fatalf("重置密码后旧 Session 应失效，实际 %v", err) + } + if _, _, _, err := Login(db, "buyer", "old-password", now.Add(2*time.Minute)); !errors.Is(err, ErrInvalidCredentials) { + t.Fatalf("旧密码应失效，实际 %v", err) + } + if _, _, _, err := Login(db, "buyer", "new-password", now.Add(2*time.Minute)); err != nil { + t.Fatalf("新密码应可登录: %v", err) + } +} + +func TestChangeUserStatus_最后管理员保护同时保留Session(t *testing.T) { + db := newSyncTestDB(t) + now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC) + admin := prepareAdminUser(t, db, now) + token, _, _, err := Login(db, "admin", "admin-password", now) + if err != nil { + t.Fatal(err) + } + err = ChangeUserStatus(db, admin, admin.UserID, model.UserDisabled, now.Add(time.Minute)) + if !errors.Is(err, repository.ErrLastActiveAdmin) { + t.Fatalf("禁用最后管理员应拒绝，实际 %v", err) + } + if _, err := Authenticate(db, token, now.Add(2*time.Minute)); err != nil { + t.Fatalf("失败事务不能撤销管理员 Session: %v", err) + } +} + +func TestUserManagement_采购员无权调用且搜索转义通配符(t *testing.T) { + db := newSyncTestDB(t) + now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC) + admin := prepareAdminUser(t, db, now) + if err := CreatePurchaser(db, admin, "buyer%", "buyer-password", "buyer-password", now); err != nil { + t.Fatal(err) + } + buyer, _ := repository.FindUserByUsername(db, "buyer%") + result, err := ListUsers(db, admin, "%", "", 1) + if err != nil { + t.Fatal(err) + } + if result.Total != 1 || len(result.Rows) != 1 || result.Rows[0].Username != "buyer%" { + t.Fatalf("搜索中的 %% 应按字面量处理: %+v", result) + } + if err := ChangeUserStatus(db, admin, buyer.UserID, model.UserDisabled, now); err != nil { + t.Fatal(err) + } + disabled, err := ListUsers(db, admin, "", model.UserDisabled, 1) + if err != nil || disabled.Total != 1 || disabled.Rows[0].Username != "buyer%" { + t.Fatalf("禁用状态筛选错误: result=%+v err=%v", disabled, err) + } + if _, err := ListUsers(db, buyer, "", "", 1); !errors.Is(err, ErrAdminRequired) { + t.Fatalf("采购员不应列出用户，实际 %v", err) + } + if err := CreatePurchaser(db, buyer, "other", "other-password", "other-password", now); !errors.Is(err, ErrAdminRequired) { + t.Fatalf("采购员不应创建用户，实际 %v", err) + } +} + +func prepareAdminUser(t *testing.T, db *sql.DB, now time.Time) *model.User { + t.Helper() + if err := SetupInitialAdmin(db, "admin", "admin-password", "admin-password", now); err != nil { + t.Fatalf("准备管理员失败: %v", err) + } + admin, err := repository.FindUserByUsername(db, "admin") + if err != nil { + t.Fatalf("读取管理员失败: %v", err) + } + return admin +} diff --git a/admin/static/css/app.css b/admin/static/css/app.css index baf97e1..375ec6f 100644 --- a/admin/static/css/app.css +++ b/admin/static/css/app.css @@ -247,6 +247,7 @@ tr.empty small { color: #aaa; } } .modal-body { padding: 16px; } .modal-body h3 { font-size: 14px; margin: 20px 0 8px; } +.form-stack { display: grid; gap: 16px; } .modal-foot { display: flex; align-items: center; @@ -307,6 +308,22 @@ input[type="date"] { } input.wide { width: 100%; } +.row-actions { + display: flex; + align-items: center; + gap: 6px; + white-space: nowrap; +} +.row-actions form { margin: 0; } +.status-pill { + display: inline-block; + padding: 2px 8px; + border-radius: 999px; + border: 1px solid currentColor; +} +.status-active { color: #1a7f37; background: #f0fff4; } +.status-disabled { color: #777; background: #f3f4f6; } + select { padding: 5px 8px; border: 1px solid #ccd1d6; diff --git a/admin/static/js/app.js b/admin/static/js/app.js index 09421fc..ef5a6d5 100644 --- a/admin/static/js/app.js +++ b/admin/static/js/app.js @@ -1,7 +1,7 @@ /* Admin 的全部 JavaScript。 * * 原生 JS，没有框架、没有构建步骤——见 admin/AGENTS.md 前端约束。 - * 只做三件纯前端的事：全选、删除前二次确认、按钮禁用。 + * 只做轻量界面交互：全选、操作前确认、按钮禁用和弹窗。 * 搜索、删除、导入本身都是普通表单 POST，服务端渲染，不需要 JS。 * * 不要往这里加业务逻辑。业务逻辑在服务端。 @@ -83,6 +83,34 @@ }); } + /* ── 普通敏感操作的二次确认 ─────────────── + 账号启停和密码重置不是删除，但同样会撤销登录。服务端仍负责权限和事务， + 这里仅降低误操作概率。 */ + function setupConfirmSubmit() { + document.querySelectorAll("form[data-confirm-submit]").forEach(function (form) { + form.addEventListener("submit", function (e) { + if (!window.confirm(form.getAttribute("data-confirm-submit"))) { + e.preventDefault(); + } + }); + }); + } + + /* 用户列表共用一个重置密码弹窗。按钮只把用户编号和显示名放进表单， + 不在前端处理权限、密码或 Session。 */ + function setupUserResetModal() { + var modal = document.getElementById("reset-password-modal"); + if (!modal) return; + var idInput = modal.querySelector("[data-reset-user-id-input]"); + var nameLabel = modal.querySelector("[data-reset-username-label]"); + document.querySelectorAll("[data-reset-user-id]").forEach(function (button) { + button.addEventListener("click", function () { + idInput.value = button.getAttribute("data-reset-user-id") || ""; + nameLabel.textContent = button.getAttribute("data-reset-username") || ""; + }); + }); + } + /* ── 弹窗 ────────────────────────────────── 弹窗**内容由服务端渲染**，这里只负责显示、隐藏和把内容取回来。 不要在这里拼业务数据——价格格式、规格顺序都是业务规则， @@ -190,6 +218,8 @@ document.addEventListener("DOMContentLoaded", function () { document.querySelectorAll("table").forEach(setupCheckAll); setupConfirmDelete(); + setupConfirmSubmit(); + setupUserResetModal(); setupModals(); setupRowDetail(); setupCaptchaRefresh(); diff --git a/admin/templates/partials/header.html b/admin/templates/partials/header.html index f18c58f..734dd65 100644 --- a/admin/templates/partials/header.html +++ b/admin/templates/partials/header.html @@ -15,6 +15,9 @@ 顺运宝数据 采集采购 客户端列表 + {{if and .CurrentUser .CurrentUser.IsAdmin}} + 用户管理 + {{end}} {{if .CurrentUser}} {{.CurrentUser.Username}}
diff --git a/admin/templates/user/list.html b/admin/templates/user/list.html new file mode 100644 index 0000000..61bbd5b --- /dev/null +++ b/admin/templates/user/list.html @@ -0,0 +1,140 @@ +{{define "user/list"}} +{{template "header" .}} + +
+ + + + + + + + +
+ +{{if .Message}}

{{.Message}}

{{end}} +{{if .Error}}{{end}} + +
+ + + + + + + + + + + + + {{range .Rows}} + + + + + + + + + {{else}} + + + + {{end}} + +
用户名角色状态最后登录创建时间操作
{{.Username}}{{.RoleLabel}}{{.StatusLabel}}{{if .LastLoginAt}}{{.LastLoginAt}}{{else}}从未登录{{end}}{{.CreatedAt}} +
+ {{if .IsAdmin}} + + {{else}} +
+ + + + +
+ + {{end}} +
+
+ {{if .Keyword}}没有匹配的用户。清除搜索条件 + {{else}}还没有用户。{{end}} +
+
+ + + + + +{{template "footer" .}} +{{end}} diff --git a/admin/user_integration_test.go b/admin/user_integration_test.go new file mode 100644 index 0000000..29c2df9 --- /dev/null +++ b/admin/user_integration_test.go @@ -0,0 +1,124 @@ +package main + +import ( + "net/http" + "net/http/httptest" + "net/url" + "strings" + "testing" + "time" + + "cmautobuy/admin/repository" + "cmautobuy/admin/service" +) + +func Test用户管理管理员与采购员权限边界(t *testing.T) { + db, err := repository.Open(t.TempDir()) + if err != nil { + t.Fatal(err) + } + defer db.Close() + if err := repository.Migrate(db); err != nil { + t.Fatal(err) + } + now := time.Now() + if err := service.SetupInitialAdmin(db, "admin", "admin-password", "admin-password", now); err != nil { + t.Fatal(err) + } + admin, _ := repository.FindUserByUsername(db, "admin") + if err := service.CreatePurchaser(db, admin, "buyer", "buyer-password", "buyer-password", now); err != nil { + t.Fatal(err) + } + router, err := newRouter(db) + if err != nil { + t.Fatal(err) + } + + adminToken, _, _, err := service.Login(db, "admin", "admin-password", now) + if err != nil { + t.Fatal(err) + } + adminPageRequest := httptest.NewRequest(http.MethodGet, "/users", nil) + adminPageRequest.AddCookie(&http.Cookie{Name: "cmautobuy_session", Value: adminToken}) + adminPage := httptest.NewRecorder() + router.ServeHTTP(adminPage, adminPageRequest) + if adminPage.Code != http.StatusOK { + t.Fatalf("管理员 GET /users = %d，响应：%s", adminPage.Code, adminPage.Body.String()) + } + for _, want := range []string{"用户管理", "新增采购员", "buyer", "重置密码", "data-confirm-submit"} { + if !strings.Contains(adminPage.Body.String(), want) { + t.Errorf("用户管理页缺少 %q", want) + } + } + for _, secret := range []string{"admin-password", "buyer-password"} { + if strings.Contains(adminPage.Body.String(), secret) { + t.Fatalf("用户管理页泄露密码 %q", secret) + } + } + csrfCookie := findResponseCookie(t, adminPage, "cmautobuy_csrf") + + duplicate := postFormRequest("/users/create", url.Values{ + "csrf_token": {csrfCookie.Value}, "username": {"BUYER"}, + "password": {"another-password"}, "password_confirm": {"another-password"}, + }, csrfCookie) + duplicate.AddCookie(&http.Cookie{Name: "cmautobuy_session", Value: adminToken}) + duplicateResponse := httptest.NewRecorder() + router.ServeHTTP(duplicateResponse, duplicate) + if duplicateResponse.Code != http.StatusBadRequest || + !strings.Contains(duplicateResponse.Body.String(), "用户名已经存在") || + !strings.Contains(duplicateResponse.Body.String(), `value="BUYER"`) { + t.Fatalf("重复用户名应保留用户名并重开表单: %d %s", duplicateResponse.Code, duplicateResponse.Body.String()) + } + if strings.Contains(duplicateResponse.Body.String(), "another-password") { + t.Fatal("校验失败页面不能回显密码") + } + + // 即使已登录管理员，没有 CSRF 也不能创建账号。 + noCSRF := postFormRequest("/users/create", url.Values{ + "username": {"staff"}, "password": {"staff-password"}, + "password_confirm": {"staff-password"}, + }) + noCSRF.AddCookie(&http.Cookie{Name: "cmautobuy_session", Value: adminToken}) + noCSRFResponse := httptest.NewRecorder() + router.ServeHTTP(noCSRFResponse, noCSRF) + if noCSRFResponse.Code != http.StatusForbidden { + t.Fatalf("无 CSRF 创建采购员 = %d，期望 403", noCSRFResponse.Code) + } + + create := postFormRequest("/users/create", url.Values{ + "csrf_token": {csrfCookie.Value}, "username": {"staff"}, + "password": {"staff-password"}, "password_confirm": {"staff-password"}, + }, csrfCookie) + create.AddCookie(&http.Cookie{Name: "cmautobuy_session", Value: adminToken}) + createResponse := httptest.NewRecorder() + router.ServeHTTP(createResponse, create) + if createResponse.Code != http.StatusSeeOther || !strings.HasPrefix(createResponse.Header().Get("Location"), "/users?") { + t.Fatalf("创建采购员 = %d %s", createResponse.Code, createResponse.Header().Get("Location")) + } + if _, err := repository.FindUserByUsername(db, "STAFF"); err != nil { + t.Fatalf("HTTP 创建的采购员不存在: %v", err) + } + + buyerToken, _, _, err := service.Login(db, "buyer", "buyer-password", now) + if err != nil { + t.Fatal(err) + } + buyerBusiness := httptest.NewRequest(http.MethodGet, "/shopee", nil) + buyerBusiness.AddCookie(&http.Cookie{Name: "cmautobuy_session", Value: buyerToken}) + buyerBusinessResponse := httptest.NewRecorder() + router.ServeHTTP(buyerBusinessResponse, buyerBusiness) + if buyerBusinessResponse.Code != http.StatusOK { + t.Fatalf("采购员应可访问业务页，实际 %d", buyerBusinessResponse.Code) + } + if strings.Contains(buyerBusinessResponse.Body.String(), `href="/users"`) { + t.Fatal("采购员导航不应显示用户管理入口") + } + + buyerUsers := httptest.NewRequest(http.MethodGet, "/users", nil) + buyerUsers.AddCookie(&http.Cookie{Name: "cmautobuy_session", Value: buyerToken}) + buyerUsersResponse := httptest.NewRecorder() + router.ServeHTTP(buyerUsersResponse, buyerUsers) + if buyerUsersResponse.Code != http.StatusForbidden || !strings.Contains(buyerUsersResponse.Body.String(), "只有管理员") { + t.Fatalf("采购员访问 /users = %d，响应：%s", buyerUsersResponse.Code, buyerUsersResponse.Body.String()) + } +}