opensource/sub2api
3
0
Fork 0
mirror of https://github.com/Wei-Shaw/sub2api.git synced 2026-09-24 16:05:44 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(admin): 用户创建/编辑支持选择与修改角色 (user/admin)

Browse Source 
- 创建用户时可指定角色，缺省仍为 user，不再硬编码为普通用户
- 编辑用户时可在 user/admin 之间切换角色
- 后端对角色做 admin/user 合法性校验
- 防锁死保护：管理员不能把自己降级为普通用户（与既有"不能禁用/删除 admin"保护一致；降级其他管理员仍允许）
- 前端创建/编辑弹窗新增角色下拉，复用既有 i18n 文案
- 新增角色创建/更新/非法值/防降级单元测试

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Birditch
2026-07-09 06:04:06 -04:00
co-authored by Claude Opus 4.8
parent 0438057c0b
commit 64fdc11ec4
7 changed files with 146 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/internal/handler/admin/user_handler.go
+11
View File
@@ -53,6 +53,7 @@ type CreateUserRequest struct {
Password string `json:"password" binding:"required,min=6"`
Username string `json:"username"`
Notes string `json:"notes"`
Role string `json:"role" binding:"omitempty,oneof=admin user"`
Balance *float64 `json:"balance"`
Concurrency int `json:"concurrency"`
RPMLimit int `json:"rpm_limit"`
@@ -66,6 +67,7 @@ type UpdateUserRequest struct {
Password string `json:"password" binding:"omitempty,min=6"`
Username *string `json:"username"`
Notes *string `json:"notes"`
Role string `json:"role" binding:"omitempty,oneof=admin user"`
Balance *float64 `json:"balance"`
Concurrency *int `json:"concurrency"`
RPMLimit *int `json:"rpm_limit"`
@@ -269,6 +271,7 @@ func (h *UserHandler) Create(c *gin.Context) {
Password: req.Password,
Username: req.Username,
Notes: req.Notes,
Role: req.Role,
Balance: req.Balance,
Concurrency: req.Concurrency,
RPMLimit: req.RPMLimit,
@@ -297,12 +300,20 @@ func (h *UserHandler) Update(c *gin.Context) {
return
}
// 防锁死保护：管理员不能把自己降级为普通用户(单管理员场景下会失去后台访问权)。
// 与既有"不能禁用/删除 admin"保护一致。降级其他管理员仍然允许。
if req.Role == service.RoleUser && userID == getAdminIDFromContext(c) {
response.BadRequest(c, "cannot demote yourself from admin")
return
}
// 使用指针类型直接传递，nil 表示未提供该字段
user, err := h.adminService.UpdateUser(c.Request.Context(), userID, &service.UpdateUserInput{
Email: req.Email,
Password: req.Password,
Username: req.Username,
Notes: req.Notes,
Role: req.Role,
Balance: req.Balance,
Concurrency: req.Concurrency,
RPMLimit: req.RPMLimit,
backend/internal/service/admin_service.go
+2
View File
@@ -125,6 +125,7 @@ type CreateUserInput struct {
Password string
Username string
Notes string
Role string // 空字符串表示使用默认角色(user);合法值 admin/user
Balance *float64
Concurrency int
RPMLimit int
@@ -136,6 +137,7 @@ type UpdateUserInput struct {
Password string
Username *string
Notes *string
Role string // 空字符串表示"未提供"(不修改);合法值 admin/user
Balance *float64 // 使用指针区分"未提供"和"设置为0"
Concurrency *int // 使用指针区分"未提供"和"设置为0"
RPMLimit *int // 使用指针区分"未提供"和"设置为0"
backend/internal/service/admin_service_role_test.go
+85
View File
@@ -0,0 +1,85 @@
//go:build unit
package service
import (
"context"
"testing"
"github.com/stretchr/testify/require"
)
func TestAdminService_CreateUser_WithAdminRole(t *testing.T) {
repo := &userRepoStub{nextID: 30}
svc := &adminServiceImpl{userRepo: repo}
user, err := svc.CreateUser(context.Background(), &CreateUserInput{
Email: "admin@test.com",
Password: "strong-pass",
Role: RoleAdmin,
})
require.NoError(t, err)
require.Equal(t, RoleAdmin, user.Role)
}
func TestAdminService_CreateUser_DefaultsToUserRole(t *testing.T) {
repo := &userRepoStub{nextID: 31}
svc := &adminServiceImpl{userRepo: repo}
user, err := svc.CreateUser(context.Background(), &CreateUserInput{
Email: "plain@test.com",
Password: "strong-pass",
})
require.NoError(t, err)
require.Equal(t, RoleUser, user.Role)
}
func TestAdminService_CreateUser_InvalidRoleRejected(t *testing.T) {
repo := &userRepoStub{nextID: 32}
svc := &adminServiceImpl{userRepo: repo}
_, err := svc.CreateUser(context.Background(), &CreateUserInput{
Email: "bad@test.com",
Password: "strong-pass",
Role: "superuser",
})
require.Error(t, err)
require.Empty(t, repo.created, "非法角色不应写入用户")
}
func TestAdminService_UpdateUser_PromoteToAdmin(t *testing.T) {
base := &userRepoStub{user: &User{ID: 42, Email: "u@example.com", Role: RoleUser}}
repo := &rpmUserRepoStub{userRepoStub: base}
invalidator := &authCacheInvalidatorStub{}
svc := &adminServiceImpl{
userRepo: repo,
redeemCodeRepo: &redeemRepoStub{},
authCacheInvalidator: invalidator,
}
updated, err := svc.UpdateUser(context.Background(), 42, &UpdateUserInput{Role: RoleAdmin})
require.NoError(t, err)
require.Equal(t, RoleAdmin, updated.Role)
require.Equal(t, []int64{42}, invalidator.userIDs, "角色变更应失效认证缓存")
}
func TestAdminService_UpdateUser_RoleOmittedKeepsExisting(t *testing.T) {
base := &userRepoStub{user: &User{ID: 42, Email: "u@example.com", Role: RoleAdmin}}
repo := &rpmUserRepoStub{userRepoStub: base}
svc := &adminServiceImpl{userRepo: repo, redeemCodeRepo: &redeemRepoStub{}}
newName := "renamed"
updated, err := svc.UpdateUser(context.Background(), 42, &UpdateUserInput{Username: &newName})
require.NoError(t, err)
require.Equal(t, RoleAdmin, updated.Role, "未提供 role 时不应改变现有角色")
}
func TestAdminService_UpdateUser_InvalidRoleRejected(t *testing.T) {
base := &userRepoStub{user: &User{ID: 42, Email: "u@example.com", Role: RoleUser}}
repo := &rpmUserRepoStub{userRepoStub: base}
svc := &adminServiceImpl{userRepo: repo, redeemCodeRepo: &redeemRepoStub{}}
_, err := svc.UpdateUser(context.Background(), 42, &UpdateUserInput{Role: "root"})
require.Error(t, err)
require.Nil(t, repo.lastUpdated, "非法角色不应触发持久化")
}
backend/internal/service/admin_user.go
+28 -1
View File
@@ -105,6 +105,18 @@ func (s *adminServiceImpl) GetUserIncludeDeleted(ctx context.Context, id int64)
return s.userRepo.GetByIDIncludeDeleted(ctx, id)
}
// normalizeUserRole 校验并归一化角色输入。
// 空字符串返回 fallback(未提供时的默认角色);非法值返回错误。
func normalizeUserRole(role, fallback string) (string, error) {
if role == "" {
return fallback, nil
}
if role != RoleAdmin && role != RoleUser {
return "", fmt.Errorf("invalid role: %q (must be %s or %s)", role, RoleAdmin, RoleUser)
}
return role, nil
}
func (s *adminServiceImpl) CreateUser(ctx context.Context, input *CreateUserInput) (*User, error) {
balance := 0.0
if input.Balance != nil {
@@ -113,11 +125,17 @@ func (s *adminServiceImpl) CreateUser(ctx context.Context, input *CreateUserInpu
balance = s.settingService.GetDefaultBalance(ctx)
}
// 角色可由管理员在创建时指定(admin/user);未提供时默认 user。
role, err := normalizeUserRole(input.Role, RoleUser)
if err != nil {
return nil, err
}
user := &User{
Email: input.Email,
Username: input.Username,
Notes: input.Notes,
Role: RoleUser, // Always create as regular user, never admin
Role: role,
Balance: balance,
Concurrency: input.Concurrency,
RPMLimit: input.RPMLimit,
@@ -197,6 +215,15 @@ func (s *adminServiceImpl) UpdateUser(ctx context.Context, id int64, input *Upda
user.Status = input.Status
}
// 角色变更(admin/user);空字符串表示不修改。
if input.Role != "" {
role, err := normalizeUserRole(input.Role, user.Role)
if err != nil {
return nil, err
}
user.Role = role
}
if input.Concurrency != nil {
user.Concurrency = *input.Concurrency
}
frontend/src/api/admin/users.ts
+1
View File
@@ -121,6 +121,7 @@ export async function create(userData: {
password: string
username?: string
notes?: string
role?: 'admin' | 'user'
balance?: number
concurrency?: number
rpm_limit?: number
frontend/src/components/admin/user/UserCreateModal.vue
+9 -2
View File
@@ -25,6 +25,13 @@
<label class="input-label">{{ t('admin.users.username') }}</label>
<input v-model="form.username" type="text" class="input" :placeholder="t('admin.users.enterUsername')" />
</div>
<div>
<label class="input-label">{{ t('admin.users.form.roleLabel') }}</label>
<select v-model="form.role" class="input">
<option value="user">{{ t('admin.users.roles.user') }}</option>
<option value="admin">{{ t('admin.users.roles.admin') }}</option>
</select>
</div>
<div class="grid grid-cols-1 sm:grid-cols-2 gap-4">
<div>
<label class="input-label">{{ t('admin.users.columns.balance') }}</label>
@@ -69,7 +76,7 @@ import Icon from '@/components/icons/Icon.vue'
const props = defineProps<{ show: boolean }>()
const emit = defineEmits(['close', 'success']); const { t } = useI18n()
const form = reactive({ email: '', password: '', username: '', notes: '', balance: '', concurrency: 1, rpm_limit: 0 })
const form = reactive({ email: '', password: '', username: '', notes: '', role: 'user' as 'user' | 'admin', balance: '', concurrency: 1, rpm_limit: 0 })
const { loading, submit } = useForm({
form,
@@ -86,7 +93,7 @@ const { loading, submit } = useForm({
successMsg: t('admin.users.userCreated')
})
watch(() => props.show, (v) => { if(v) Object.assign(form, { email: '', password: '', username: '', notes: '', balance: '', concurrency: 1, rpm_limit: 0 }) })
watch(() => props.show, (v) => { if(v) Object.assign(form, { email: '', password: '', username: '', notes: '', role: 'user', balance: '', concurrency: 1, rpm_limit: 0 }) })
const generateRandomPassword = () => {
const chars = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz23456789!@#$%^&*'
frontend/src/components/admin/user/UserEditModal.vue
+10 -3
View File
@@ -29,6 +29,13 @@
<label class="input-label">{{ t('admin.users.username') }}</label>
<input v-model="form.username" type="text" class="input" />
</div>
<div>
<label class="input-label">{{ t('admin.users.form.roleLabel') }}</label>
<select v-model="form.role" class="input">
<option value="user">{{ t('admin.users.roles.user') }}</option>
<option value="admin">{{ t('admin.users.roles.admin') }}</option>
</select>
</div>
<div>
<label class="input-label">{{ t('admin.users.notes') }}</label>
<textarea v-model="form.notes" rows="3" class="input"></textarea>
@@ -78,11 +85,11 @@ const emit = defineEmits(['close', 'success'])
const { t } = useI18n(); const appStore = useAppStore(); const { copyToClipboard } = useClipboard()
const submitting = ref(false); const passwordCopied = ref(false)
const form = reactive({ email: '', password: '', username: '', notes: '', concurrency: 1, rpm_limit: 0, customAttributes: {} as UserAttributeValuesMap })
const form = reactive({ email: '', password: '', username: '', notes: '', role: 'user', concurrency: 1, rpm_limit: 0, customAttributes: {} as UserAttributeValuesMap })
watch(() => props.user, (u) => {
if (u) {
Object.assign(form, { email: u.email, password: '', username: u.username || '', notes: u.notes || '', concurrency: u.concurrency, rpm_limit: u.rpm_limit ?? 0, customAttributes: {} })
Object.assign(form, { email: u.email, password: '', username: u.username || '', notes: u.notes || '', role: u.role || 'user', concurrency: u.concurrency, rpm_limit: u.rpm_limit ?? 0, customAttributes: {} })
passwordCopied.value = false
}
}, { immediate: true })
@@ -109,7 +116,7 @@ const handleUpdateUser = async () => {
}
submitting.value = true
try {
const data: any = { email: form.email, username: form.username, notes: form.notes, concurrency: form.concurrency, rpm_limit: form.rpm_limit }
const data: any = { email: form.email, username: form.username, notes: form.notes, role: form.role, concurrency: form.concurrency, rpm_limit: form.rpm_limit }
if (form.password.trim()) data.password = form.password.trim()
await adminAPI.users.update(props.user.id, data)
if (Object.keys(form.customAttributes).length > 0) await adminAPI.userAttributes.updateUserAttributeValues(props.user.id, form.customAttributes)