wufengping/koc-loop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: optimize user management and add account deletion

Browse Source
This commit is contained in:
巫凤萍
2026-08-07 17:08:56 +08:00
parent 5670a7939b
commit 1f1887c860
5 changed files with 329 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
app/api/users/route.ts
View File

@@ -57,14 +57,14 @@ export async function POST(request: Request) {
role?: UserRole;
userId?: string;
};
const password = String(body.password ?? "");
if (!validatePassword(password)) {
return Response.json({ error: "密码需为8—72位" }, { status: 400 });
}
const db = getRawDb();
const passwordRecord = await createPasswordRecord(password);
if (body.action === "create") {
const password = String(body.password ?? "");
if (!validatePassword(password)) {
return Response.json({ error: "密码需为8—72位" }, { status: 400 });
}
const passwordRecord = await createPasswordRecord(password);
const username = normalizeUsername(body.username);
const role = body.role === "admin" ? "admin" : "user";
if (!validateUsername(username)) {
@@ -92,6 +92,11 @@ export async function POST(request: Request) {
)
.run();
} else if (body.action === "reset_password") {
const password = String(body.password ?? "");
if (!validatePassword(password)) {
return Response.json({ error: "密码需为8—72位" }, { status: 400 });
}
const passwordRecord = await createPasswordRecord(password);
const target = await db
.prepare("SELECT id, role FROM users WHERE id = ?")
.bind(String(body.userId ?? ""))
@@ -124,6 +129,27 @@ export async function POST(request: Request) {
),
db.prepare("DELETE FROM auth_sessions WHERE user_id = ?").bind(target.id),
]);
} else if (body.action === "delete") {
const target = await db
.prepare("SELECT id, role FROM users WHERE id = ?")
.bind(String(body.userId ?? ""))
.first<{ id: string; role: UserRole }>();
if (!target) {
return Response.json({ error: "没有找到这个账号" }, { status: 404 });
}
if (target.id === currentUser.id) {
return Response.json({ error: "不能删除当前登录账号" }, { status: 400 });
}
if (target.role === "super_admin") {
return Response.json({ error: "不能删除超级管理员账号" }, { status: 403 });
}
if (currentUser.role !== "super_admin" && target.role !== "user") {
return managerForbidden();
}
await db.batch([
db.prepare("DELETE FROM auth_sessions WHERE user_id = ?").bind(target.id),
db.prepare("DELETE FROM users WHERE id = ? AND role <> 'super_admin'").bind(target.id),
]);
} else {
return Response.json({ error: "不支持的操作" }, { status: 400 });
}