b0c498fbb6
- 实现用户登录、登出、密码修改等认证功能 - 添加会话管理和权限控制中间件 - 创建图片批注组件和相关API路由 - 实现批注的增删改查功能 - 添加Docker和Git忽略配置文件 - 创建系统架构文档和开发约定说明 - 集成认证模块到前端应用路由中
29 lines
2.1 KiB
TypeScript
29 lines
2.1 KiB
TypeScript
import { Router, type Response } from 'express';
|
||
import { database } from '../database.js';
|
||
import { canWriteProject, requireWriter, type AuthRequest } from '../auth.js';
|
||
import type { WorkComment } from '../../shared/types.js';
|
||
|
||
const router = Router();
|
||
|
||
router.post('/notes/:noteId/comments', requireWriter, async (req: AuthRequest, res: Response) => {
|
||
const noteId = Number(req.params.noteId); const content = String(req.body?.content ?? '').trim();
|
||
const context = await database.one<{ project_id: number }>('SELECT c.project_id FROM notes n JOIN collections c ON c.id = n.collection_id WHERE n.id = ?', [noteId]);
|
||
if (!context) { res.status(404).json({ error: '作品不存在' }); return; }
|
||
if (!await canWriteProject(req, context.project_id)) { res.status(403).json({ error: '无权操作该作品' }); return; }
|
||
if (!content || content.length > 2000) { res.status(400).json({ error: '回复内容须为 1–2000 个字符' }); return; }
|
||
const id = await database.insertId("INSERT INTO work_comments (note_id, content, author_name, author_role) VALUES (?, ?, ?, 'operator')", [noteId, content, req.authUser?.display_name || 'API']);
|
||
res.status(201).json(await database.one<WorkComment>('SELECT * FROM work_comments WHERE id = ?', [id]));
|
||
});
|
||
|
||
router.patch('/comments/:commentId', requireWriter, async (req: AuthRequest, res: Response) => {
|
||
const id = Number(req.params.commentId); const status = req.body?.status;
|
||
if (!['open', 'resolved', 'confirmed'].includes(status)) { res.status(400).json({ error: '无效状态' }); return; }
|
||
const context = await database.one<{ project_id: number }>('SELECT c.project_id FROM work_comments wc JOIN notes n ON n.id = wc.note_id JOIN collections c ON c.id = n.collection_id WHERE wc.id = ?', [id]);
|
||
if (!context) { res.status(404).json({ error: '反馈不存在' }); return; }
|
||
if (!await canWriteProject(req, context.project_id)) { res.status(403).json({ error: '无权操作该反馈' }); return; }
|
||
await database.execute('UPDATE work_comments SET status = ? WHERE id = ?', [status, id]);
|
||
res.json(await database.one<WorkComment>('SELECT * FROM work_comments WHERE id = ?', [id]));
|
||
});
|
||
|
||
export default router;
|