feat: 实现 Admin 采购员账号管理 (#51)

2026-08-09 13:50:55 +08:00
parent 771e2ee616
commit eea0d65ef8
12 changed files with 909 additions and 20 deletions
@@ -32,6 +32,20 @@ var (
 	dummyPasswordHash, _ = bcrypt.GenerateFromPassword([]byte("not-a-real-password"), bcrypt.DefaultCost)
 )

+type validationError struct{ message string }
+
+func (e *validationError) Error() string { return e.message }
+
+// IsValidationError 让 Handler 区分可直接展示的表单错误和不可泄露的内部错误。
+func IsValidationError(err error) bool {
+	var target *validationError
+	return errors.As(err, &target)
+}
+
+func invalidInput(message string, args ...any) error {
+	return &validationError{message: fmt.Sprintf(message, args...)}
+}
+
 // HasUsers 判断首次初始化入口是否已经永久关闭。
 func HasUsers(db *sql.DB) (bool, error) {
 	count, err := repository.CountUsers(db)
@@ -41,27 +55,12 @@ func HasUsers(db *sql.DB) (bool, error) {
 // SetupInitialAdmin 校验表单、哈希密码并在事务中创建首位管理员。
 func SetupInitialAdmin(db *sql.DB, username, password, confirmation string, now time.Time) error {
 	username = strings.TrimSpace(username)
-	if username == "" {
-		return fmt.Errorf("用户名不能为空")
+	if err := validateUsername(username); err != nil {
+		return err
 	}
-	if len([]rune(username)) > maxUsernameLen {
-		return fmt.Errorf("用户名不能超过 %d 个字符", maxUsernameLen)
-	}
-	if len([]rune(password)) < minimumPasswordLen {
-		return fmt.Errorf("密码至少需要 %d 个字符", minimumPasswordLen)
-	}
-	// bcrypt 最多接受 72 字节。中文等字符可能占多个字节，因此不能只靠
-	// HTML 的 maxlength；服务端需要在哈希前给出可理解的校验错误。
-	if len([]byte(password)) > 72 {
-		return fmt.Errorf("密码不能超过 72 个字节")
-	}
-	if password != confirmation {
-		return fmt.Errorf("两次输入的密码不一致")
-	}
-
-	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	hash, err := hashConfirmedPassword(password, confirmation)
 	if err != nil {
-		return fmt.Errorf("生成密码哈希失败: %w", err)
+		return err
 	}
 	userID, err := randomID("USR-", 16)
 	if err != nil {
@@ -75,6 +74,35 @@ func SetupInitialAdmin(db *sql.DB, username, password, confirmation string, now
 	})
 }

+func validateUsername(username string) error {
+	if username == "" {
+		return invalidInput("用户名不能为空")
+	}
+	if len([]rune(username)) > maxUsernameLen {
+		return invalidInput("用户名不能超过 %d 个字符", maxUsernameLen)
+	}
+	return nil
+}
+
+func hashConfirmedPassword(password, confirmation string) ([]byte, error) {
+	if len([]rune(password)) < minimumPasswordLen {
+		return nil, invalidInput("密码至少需要 %d 个字符", minimumPasswordLen)
+	}
+	// bcrypt 最多接受 72 字节。中文等字符可能占多个字节，因此不能只靠
+	// HTML 的 maxlength；服务端需要在哈希前给出可理解的校验错误。
+	if len([]byte(password)) > 72 {
+		return nil, invalidInput("密码不能超过 72 个字节")
+	}
+	if password != confirmation {
+		return nil, invalidInput("两次输入的密码不一致")
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return nil, fmt.Errorf("生成密码哈希失败: %w", err)
+	}
+	return hash, nil
+}
+
 // Login 校验统一凭据并创建一个固定 12 小时有效的 Session。
 // 返回的 token 原文只交给 Cookie，数据库仅保存 SHA-256。
 func Login(db *sql.DB, username, password string, now time.Time) (token string, user *model.User, expiresAt time.Time, err error) {
@@ -0,0 +1,112 @@
+// Admin 用户管理业务：列表、新增采购员、启停和重置密码。
+package service
+
+import (
+	"database/sql"
+	"errors"
+	"strings"
+	"time"
+
+	"cmautobuy/admin/model"
+	"cmautobuy/admin/repository"
+)
+
+var ErrAdminRequired = errors.New("只有管理员可以管理用户")
+
+// UserListResult 是用户管理页的分页结果。
+type UserListResult struct {
+	Rows       []model.User
+	Keyword    string
+	Status     model.UserStatus
+	Page       int
+	Total      int
+	TotalPages int
+}
+
+// ListUsers 搜索并分页。用户页沿用全站统一的每页 20 条规则。
+func ListUsers(db *sql.DB, actor *model.User, keyword string, status model.UserStatus, requestedPage int) (*UserListResult, error) {
+	if actor == nil || !actor.IsAdmin() {
+		return nil, ErrAdminRequired
+	}
+	keyword = strings.TrimSpace(keyword)
+	if status != model.UserActive && status != model.UserDisabled {
+		status = ""
+	}
+	page := requestedPage
+	if page < 1 {
+		page = 1
+	}
+	rows, total, err := repository.ListUsers(db, keyword, status, PageSize, (page-1)*PageSize)
+	if err != nil {
+		return nil, err
+	}
+	totalPages := TotalPages(total)
+	clampedPage := ClampPage(page, totalPages)
+	if clampedPage != page {
+		page = clampedPage
+		rows, _, err = repository.ListUsers(db, keyword, status, PageSize, (page-1)*PageSize)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return &UserListResult{
+		Rows: rows, Keyword: keyword, Status: status,
+		Page: page, Total: total, TotalPages: totalPages,
+	}, nil
+}
+
+// CreatePurchaser 创建固定 purchaser 角色的账号，不提供第二管理员入口。
+func CreatePurchaser(db *sql.DB, actor *model.User, username, password, confirmation string, now time.Time) error {
+	if actor == nil || !actor.IsAdmin() {
+		return ErrAdminRequired
+	}
+	username = strings.TrimSpace(username)
+	if err := validateUsername(username); err != nil {
+		return err
+	}
+	hash, err := hashConfirmedPassword(password, confirmation)
+	if err != nil {
+		return err
+	}
+	userID, err := randomID("USR-", 16)
+	if err != nil {
+		return err
+	}
+	at := now.UTC().Format(model.TimeLayout)
+	return repository.CreateUser(db, model.User{
+		UserID: userID, Username: username, PasswordHash: string(hash),
+		Role: model.RolePurchaser, Status: model.UserActive,
+		PasswordChangedAt: at, CreatedAt: at, UpdatedAt: at,
+	})
+}
+
+// ChangeUserStatus 启用或禁用账号。数据库事务负责最后管理员保护和 Session 撤销。
+func ChangeUserStatus(db *sql.DB, actor *model.User, userID string, status model.UserStatus, now time.Time) error {
+	if actor == nil || !actor.IsAdmin() {
+		return ErrAdminRequired
+	}
+	if status != model.UserActive && status != model.UserDisabled {
+		return invalidInput("账号状态无效")
+	}
+	if strings.TrimSpace(userID) == "" {
+		return invalidInput("用户编号不能为空")
+	}
+	return repository.SetUserStatusAndRevokeSessions(
+		db, userID, status, now.UTC().Format(model.TimeLayout))
+}
+
+// ResetUserPassword 更新密码哈希，并在同一事务中撤销目标用户全部 Session。
+func ResetUserPassword(db *sql.DB, actor *model.User, userID, password, confirmation string, now time.Time) error {
+	if actor == nil || !actor.IsAdmin() {
+		return ErrAdminRequired
+	}
+	if strings.TrimSpace(userID) == "" {
+		return invalidInput("用户编号不能为空")
+	}
+	hash, err := hashConfirmedPassword(password, confirmation)
+	if err != nil {
+		return err
+	}
+	return repository.ResetUserPasswordAndRevokeSessions(
+		db, userID, string(hash), now.UTC().Format(model.TimeLayout))
+}
@@ -0,0 +1,147 @@
+package service
+
+import (
+	"database/sql"
+	"errors"
+	"testing"
+	"time"
+
+	"golang.org/x/crypto/bcrypt"
+
+	"cmautobuy/admin/model"
+	"cmautobuy/admin/repository"
+)
+
+func TestCreatePurchaser_固定角色且用户名不区分大小写唯一(t *testing.T) {
+	db := newSyncTestDB(t)
+	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
+	admin := prepareAdminUser(t, db, now)
+	if err := CreatePurchaser(db, admin, "buyer", "buyer-password", "buyer-password", now); err != nil {
+		t.Fatalf("创建采购员失败: %v", err)
+	}
+	buyer, err := repository.FindUserByUsername(db, "BUYER")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if buyer.Role != model.RolePurchaser || buyer.Status != model.UserActive {
+		t.Fatalf("新账号角色或状态错误: %+v", buyer)
+	}
+	if buyer.PasswordHash == "buyer-password" ||
+		bcrypt.CompareHashAndPassword([]byte(buyer.PasswordHash), []byte("buyer-password")) != nil {
+		t.Fatal("采购员密码必须保存为可验证的 bcrypt 哈希")
+	}
+	if err := CreatePurchaser(db, admin, "BUYER", "other-password", "other-password", now); !errors.Is(err, repository.ErrUsernameExists) {
+		t.Fatalf("大小写不同的重复用户名应被拒绝，实际 %v", err)
+	}
+}
+
+func TestChangeUserStatus_禁用撤销全部Session且启用后可重新登录(t *testing.T) {
+	db := newSyncTestDB(t)
+	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
+	admin := prepareAdminUser(t, db, now)
+	if err := CreatePurchaser(db, admin, "buyer", "buyer-password", "buyer-password", now); err != nil {
+		t.Fatal(err)
+	}
+	buyer, _ := repository.FindUserByUsername(db, "buyer")
+	token, _, _, err := Login(db, "buyer", "buyer-password", now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := ChangeUserStatus(db, admin, buyer.UserID, model.UserDisabled, now.Add(time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Authenticate(db, token, now.Add(2*time.Minute)); !errors.Is(err, ErrUnauthenticated) {
+		t.Fatalf("禁用后旧 Session 应失效，实际 %v", err)
+	}
+	if _, _, _, err := Login(db, "buyer", "buyer-password", now.Add(2*time.Minute)); !errors.Is(err, ErrInvalidCredentials) {
+		t.Fatalf("禁用账号不应登录，实际 %v", err)
+	}
+	if err := ChangeUserStatus(db, admin, buyer.UserID, model.UserActive, now.Add(3*time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, _, err := Login(db, "buyer", "buyer-password", now.Add(4*time.Minute)); err != nil {
+		t.Fatalf("重新启用后应可登录: %v", err)
+	}
+}
+
+func TestResetUserPassword_原子撤销Session并更换凭据(t *testing.T) {
+	db := newSyncTestDB(t)
+	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
+	admin := prepareAdminUser(t, db, now)
+	if err := CreatePurchaser(db, admin, "buyer", "old-password", "old-password", now); err != nil {
+		t.Fatal(err)
+	}
+	buyer, _ := repository.FindUserByUsername(db, "buyer")
+	token, _, _, _ := Login(db, "buyer", "old-password", now)
+	if err := ResetUserPassword(db, admin, buyer.UserID, "new-password", "new-password", now.Add(time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Authenticate(db, token, now.Add(2*time.Minute)); !errors.Is(err, ErrUnauthenticated) {
+		t.Fatalf("重置密码后旧 Session 应失效，实际 %v", err)
+	}
+	if _, _, _, err := Login(db, "buyer", "old-password", now.Add(2*time.Minute)); !errors.Is(err, ErrInvalidCredentials) {
+		t.Fatalf("旧密码应失效，实际 %v", err)
+	}
+	if _, _, _, err := Login(db, "buyer", "new-password", now.Add(2*time.Minute)); err != nil {
+		t.Fatalf("新密码应可登录: %v", err)
+	}
+}
+
+func TestChangeUserStatus_最后管理员保护同时保留Session(t *testing.T) {
+	db := newSyncTestDB(t)
+	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
+	admin := prepareAdminUser(t, db, now)
+	token, _, _, err := Login(db, "admin", "admin-password", now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = ChangeUserStatus(db, admin, admin.UserID, model.UserDisabled, now.Add(time.Minute))
+	if !errors.Is(err, repository.ErrLastActiveAdmin) {
+		t.Fatalf("禁用最后管理员应拒绝，实际 %v", err)
+	}
+	if _, err := Authenticate(db, token, now.Add(2*time.Minute)); err != nil {
+		t.Fatalf("失败事务不能撤销管理员 Session: %v", err)
+	}
+}
+
+func TestUserManagement_采购员无权调用且搜索转义通配符(t *testing.T) {
+	db := newSyncTestDB(t)
+	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
+	admin := prepareAdminUser(t, db, now)
+	if err := CreatePurchaser(db, admin, "buyer%", "buyer-password", "buyer-password", now); err != nil {
+		t.Fatal(err)
+	}
+	buyer, _ := repository.FindUserByUsername(db, "buyer%")
+	result, err := ListUsers(db, admin, "%", "", 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.Total != 1 || len(result.Rows) != 1 || result.Rows[0].Username != "buyer%" {
+		t.Fatalf("搜索中的 %% 应按字面量处理: %+v", result)
+	}
+	if err := ChangeUserStatus(db, admin, buyer.UserID, model.UserDisabled, now); err != nil {
+		t.Fatal(err)
+	}
+	disabled, err := ListUsers(db, admin, "", model.UserDisabled, 1)
+	if err != nil || disabled.Total != 1 || disabled.Rows[0].Username != "buyer%" {
+		t.Fatalf("禁用状态筛选错误: result=%+v err=%v", disabled, err)
+	}
+	if _, err := ListUsers(db, buyer, "", "", 1); !errors.Is(err, ErrAdminRequired) {
+		t.Fatalf("采购员不应列出用户，实际 %v", err)
+	}
+	if err := CreatePurchaser(db, buyer, "other", "other-password", "other-password", now); !errors.Is(err, ErrAdminRequired) {
+		t.Fatalf("采购员不应创建用户，实际 %v", err)
+	}
+}
+
+func prepareAdminUser(t *testing.T, db *sql.DB, now time.Time) *model.User {
+	t.Helper()
+	if err := SetupInitialAdmin(db, "admin", "admin-password", "admin-password", now); err != nil {
+		t.Fatalf("准备管理员失败: %v", err)
+	}
+	admin, err := repository.FindUserByUsername(db, "admin")
+	if err != nil {
+		t.Fatalf("读取管理员失败: %v", err)
+	}
+	return admin
+}