Cheng Zhou
5b97ea32ab
- 用户注册/创建不再需要选择角色，账号管理只管资料和状态 - 移除前后端所有系统级 role 字段的暴露，改用 is_admin 标识管理员 - PM（项目负责人）角色自动拥有全部项目权限且不可修改 - 系统管理员在项目中的成员身份不可被删除 - 管理界面全面美化 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
99 lines
4.4 KiB
Python
99 lines
4.4 KiB
Python
import uuid
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException, status
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.core.deps import get_db_session, require_roles
|
|
from app.schemas.common import PaginatedResponse
|
|
from app.crud import user as user_crud
|
|
from app.crud import member as member_crud
|
|
from app.utils.pagination import paginate
|
|
from app.schemas.user import UserCreate, UserRead, UserUpdate
|
|
|
|
router = APIRouter()
|
|
|
|
|
|
@router.get("/", response_model=PaginatedResponse[UserRead], summary="用户列表", description="仅 ADMIN 可用，支持 skip/limit。")
|
|
async def list_users(
|
|
skip: int = 0,
|
|
limit: int = 100,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
current_user=Depends(require_roles(["ADMIN"])),
|
|
) -> PaginatedResponse[UserRead]:
|
|
users = await user_crud.list_users(db, skip=skip, limit=limit)
|
|
total_users = await user_crud.list_users(db, skip=0, limit=10_000_000)
|
|
return paginate(list(users), total=len(total_users))
|
|
|
|
|
|
@router.post("/", response_model=UserRead, status_code=status.HTTP_201_CREATED)
|
|
async def create_user(
|
|
user_in: UserCreate,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
current_user=Depends(require_roles(["ADMIN"])),
|
|
) -> UserRead:
|
|
existing = await user_crud.get_by_email(db, user_in.email)
|
|
if existing:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_409_CONFLICT,
|
|
detail="邮箱已存在",
|
|
)
|
|
user = await user_crud.create_user(db, user_in)
|
|
return user
|
|
|
|
|
|
@router.patch("/{user_id}", response_model=UserRead)
|
|
async def update_user(
|
|
user_id: uuid.UUID,
|
|
user_in: UserUpdate,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
current_user=Depends(require_roles(["ADMIN"])),
|
|
) -> UserRead:
|
|
db_user = await user_crud.get_by_id(db, user_id)
|
|
if not db_user:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="用户不存在")
|
|
if user_crud.is_protected_admin_user(db_user):
|
|
if user_in.email is not None and user_in.email != db_user.email:
|
|
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="系统管理员邮箱不允许修改")
|
|
requested_status = user_in.status
|
|
if user_in.is_active is not None:
|
|
requested_status = "ACTIVE" if user_in.is_active else "DISABLED"
|
|
if requested_status is not None and requested_status != "ACTIVE":
|
|
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="系统管理员不允许停用")
|
|
if db_user.role.value == "ADMIN":
|
|
requested_status = user_in.status
|
|
if user_in.is_active is not None:
|
|
requested_status = "ACTIVE" if user_in.is_active else "DISABLED"
|
|
will_disable = requested_status is not None and requested_status != "ACTIVE"
|
|
if will_disable and db_user.status.value == "ACTIVE":
|
|
active_admins = await user_crud.count_active_admins(db)
|
|
if active_admins <= 1:
|
|
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="至少保留一个管理员账号")
|
|
user = await user_crud.update_user(db, db_user, user_in)
|
|
return user
|
|
|
|
|
|
@router.delete("/{user_id}", status_code=status.HTTP_204_NO_CONTENT)
|
|
async def delete_user(
|
|
user_id: uuid.UUID,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
current_user=Depends(require_roles(["ADMIN"])),
|
|
):
|
|
db_user = await user_crud.get_by_id(db, user_id)
|
|
if not db_user:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="用户不存在")
|
|
if user_crud.is_protected_admin_user(db_user):
|
|
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="系统管理员账号不允许删除")
|
|
if db_user.id == current_user.id:
|
|
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="不允许删除自己")
|
|
if db_user.role.value == "ADMIN" and db_user.status.value == "ACTIVE":
|
|
active_admins = await user_crud.count_active_admins(db)
|
|
if active_admins <= 1:
|
|
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="至少保留一个管理员账号")
|
|
has_membership = await member_crud.user_has_memberships(db, db_user.id)
|
|
if has_membership:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="该账号仍在项目成员中，请先在项目成员配置中移除后再删除",
|
|
)
|
|
await user_crud.delete_user(db, db_user)
|