freefire/jiang13-bbs
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

feat: 实现完整的板块级RBAC内容审核系统

Browse Source 
- 新增站长/超级管理员/管理员/板块管理员四级角色体系
- 实现实时权限快照加载与细粒度权限校验
- 新增内容审核队列与前后端页面
- 重构用户权限管理与站点管理逻辑
- 新增评论/帖子审核状态与通知推送
- 优化前端权限控制与角色徽章展示
- 修正数据库迁移与默认值问题
This commit is contained in:
姜十三
2026-09-15 04:47:34 +08:00
parent 6da4309453
commit a7b6421840
44 changed files with 3149 additions and 585 deletions
Download Patch File Download Diff File Expand all files Collapse all files

246
backend/service/admin_user.go
View File

@@ -8,16 +8,25 @@ import (
"gorm.io/gorm"
)
// 管理员用户操作的业务护栏（handler 层映射为 400，前端只展示消息）
// 管理员用户操作的业务护栏（handler 层映射为 4xx，前端只展示消息）
var (
// ErrAdminSelfAction 不能对自己的账号执行管理操作（自锁/误操作保护）
ErrAdminSelfAction = errors.New("不能对自己的账号执行该操作")
// ErrLastAdmin 至少保留一名未封禁的管理员，防止站点失去管理入口
ErrLastAdmin = errors.New("至少保留一名未封禁的管理员")
// ErrInvalidUserRole 角色入参非法
ErrInvalidUserRole = errors.New("角色参数无效")
// ErrInvalidRole 角色入参非法
ErrInvalidRole = errors.New("角色参数无效")
// ErrProtectedOwner 站长账号受保护，任何人不可改角色/封禁
ErrProtectedOwner = errors.New("站长账号受保护，不可操作")
// ErrCannotAssignRole 当前操作者无权授予该角色
ErrCannotAssignRole = errors.New("无权授予该角色")
// ErrBoardRequired 板块管理员至少要授权一个板块
ErrBoardRequired = errors.New("板块管理员至少需要授权一个板块")
// ErrBoardNotFound 授权的板块不存在
ErrBoardNotFound = errors.New("部分板块不存在")
)
// onlineThreshold last_seen_at 在该窗口内视为在线
const onlineThreshold = 5 * time.Minute
// AdminUserService 后台用户管理
type AdminUserService struct {
db *gorm.DB
@@ -27,7 +36,7 @@ func NewAdminUserService(db *gorm.DB) *AdminUserService {
return &AdminUserService{db: db}
}
// AdminUserItem 后台用户列表项：email / last_seen 在 User 模型上 json:"-"，
// AdminUserItem 后台用户列表项：email / last_seen / 登录 IP 在 User 模型上 json:"-"，
// 仅管理员接口通过此 DTO 显式带出
type AdminUserItem struct {
ID uint `json:"id"`
@@ -37,14 +46,18 @@ type AdminUserItem struct {
Avatar string `json:"avatar"`
Signature string `json:"signature"`
Role string `json:"role"`
BoardIDs []uint `json:"board_ids"`
Banned bool `json:"banned"`
PostCount int64 `json:"post_count"`
CommentCount int64 `json:"comment_count"`
CreatedAt time.Time `json:"created_at"`
LastSeenAt *time.Time `json:"last_seen_at"`
Online bool `json:"online"`
LastLoginIP string `json:"last_login_ip"`
LastLoginAt *time.Time `json:"last_login_at"`
}
// AdminUserSummary 列表顶部汇总（总数/管理员/封禁/今日新增）
// AdminUserSummary 列表顶部汇总（总数/管理团队/封禁/今日新增）
type AdminUserSummary struct {
Total int64 `json:"total"`
Admins int64 `json:"admins"`
@@ -52,12 +65,18 @@ type AdminUserSummary struct {
TodayNew int64 `json:"today_new"`
}
// staffRoles 管理团队角色集合
var staffRoles = []string{
string(model.RoleBoardAdmin), string(model.RoleAdmin),
string(model.RoleSuperAdmin), string(model.RoleOwner),
}
// AdminUserListQuery 用户列表查询
type AdminUserListQuery struct {
Page int
Size int
Keyword string // 用户名 / 昵称 / 邮箱模糊匹配
Role string // "" 全部 | "admin" 仅管理员
Role string // "" 全部 | "staff" 管理团队 | 具体角色枚举
Status string // "" 全部 | "banned" 已封禁 | "normal" 正常
}
@@ -84,8 +103,11 @@ func (s *AdminUserService) List(q AdminUserListQuery) (*AdminUserListResult, err
like := "%" + kw + "%"
query = query.Where("username ILIKE ? OR nickname ILIKE ? OR email ILIKE ?", like, like, like)
}
if q.Role == string(model.RoleAdmin) {
query = query.Where("role = ?", model.RoleAdmin)
switch {
case q.Role == "staff":
query = query.Where("role IN ?", staffRoles)
case q.Role != "" && model.ValidRole(model.Role(q.Role)):
query = query.Where("role = ?", q.Role)
}
if q.Status == "banned" {
query = query.Where("banned = ?", true)
@@ -112,7 +134,7 @@ func (s *AdminUserService) List(q AdminUserListQuery) (*AdminUserListResult, err
dayStart := time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 0, 0, now.Location())
summary := AdminUserSummary{}
s.db.Model(&model.User{}).Count(&summary.Total)
s.db.Model(&model.User{}).Where("role = ?", model.RoleAdmin).Count(&summary.Admins)
s.db.Model(&model.User{}).Where("role IN ?", staffRoles).Count(&summary.Admins)
s.db.Model(&model.User{}).Where("banned = ?", true).Count(&summary.Banned)
s.db.Model(&model.User{}).Where("created_at >= ?", dayStart).Count(&summary.TodayNew)
@@ -125,13 +147,14 @@ func (s *AdminUserService) List(q AdminUserListQuery) (*AdminUserListResult, err
}, nil
}
// toItems 批量把 User 模型转为 DTO，并用两条 GROUP BY 填充计数
// toItems 批量把 User 模型转为 DTO，并用聚合查询填充计数/授权板块/最近登录
func (s *AdminUserService) toItems(users []model.User) []AdminUserItem {
items := make([]AdminUserItem, 0, len(users))
ids := make([]uint, 0, len(users))
now := time.Now()
for _, u := range users {
ids = append(ids, u.ID)
items = append(items, AdminUserItem{
item := AdminUserItem{
ID: u.ID,
Username: u.Username,
Nickname: u.Nickname,
@@ -139,15 +162,33 @@ func (s *AdminUserService) toItems(users []model.User) []AdminUserItem {
Avatar: u.Avatar,
Signature: u.Signature,
Role: string(u.Role),
BoardIDs: []uint{},
Banned: u.Banned,
CreatedAt: u.CreatedAt,
LastSeenAt: u.LastSeenAt,
})
}
if u.LastSeenAt != nil && now.Sub(*u.LastSeenAt) <= onlineThreshold {
item.Online = true
}
items = append(items, item)
}
if len(ids) == 0 {
return items
}
// 板块授权：一次查出本页全部映射
type ubRow struct {
UserID uint
BoardID uint
}
var ubRows []ubRow
s.db.Model(&model.UserBoard{}).Where("user_id IN ?", ids).
Order("board_id ASC").Scan(&ubRows)
boardsMap := map[uint][]uint{}
for _, r := range ubRows {
boardsMap[r.UserID] = append(boardsMap[r.UserID], r.BoardID)
}
type countRow struct {
UserID uint
Cnt int64
@@ -173,9 +214,32 @@ func (s *AdminUserService) toItems(users []model.User) []AdminUserItem {
commentCounts[r.UserID] = r.Cnt
}
// 每个用户最近一次成功登录（DISTINCT ON 走 user_id+created_at 索引）
type loginRow struct {
UserID uint
IP string
CreatedAt time.Time
}
var loginRows []loginRow
s.db.Raw(`SELECT DISTINCT ON (user_id) user_id, ip, created_at
FROM login_logs WHERE user_id IN ? AND success = true
ORDER BY user_id, created_at DESC`, ids).Scan(&loginRows)
lastLogin := map[uint]loginRow{}
for _, r := range loginRows {
lastLogin[r.UserID] = r
}
for i := range items {
items[i].PostCount = postCounts[items[i].ID]
items[i].CommentCount = commentCounts[items[i].ID]
if b := boardsMap[items[i].ID]; len(b) > 0 {
items[i].BoardIDs = b
}
if l, ok := lastLogin[items[i].ID]; ok {
t := l.CreatedAt
items[i].LastLoginIP = l.IP
items[i].LastLoginAt = &t
}
}
return items
}
@@ -190,42 +254,78 @@ func (s *AdminUserService) getItem(tx *gorm.DB, id uint) (*AdminUserItem, error)
return &items[0], nil
}
// SetRole 修改用户角色。管理员降级时递增 token_version 并撤销 refresh token，
// 使其旧 JWT（claims 中仍带 admin）立即失效，需重新登录获得新角色身份
func (s *AdminUserService) SetRole(operatorID, targetID uint, role string) (*AdminUserItem, error) {
if role != string(model.RoleAdmin) && role != string(model.RoleUser) {
return nil, ErrInvalidUserRole
// SetStaff 修改用户管理角色与板块授权。角色变更后强制下线，
// 使其旧 JWT（claims 中带旧角色）立即失效，需重新登录获得新身份。
// 站长账号任何时候都不可被操作；只有站长可授予超管；站长身份不可被授予。
func (s *AdminUserService) SetStaff(operator *Actor, targetID uint, role model.Role, boardIDs []uint) (*AdminUserItem, error) {
if operator == nil {
return nil, ErrCannotAssignRole
}
if operatorID == targetID {
if operator.ID == targetID {
return nil, ErrAdminSelfAction
}
if !model.ValidRole(role) || role == model.RoleOwner {
return nil, ErrInvalidRole
}
if !operator.CanAssignRole(role) {
return nil, ErrCannotAssignRole
}
// 板块管理员：规整、去重并校验板块存在
var normBoards []uint
if role == model.RoleBoardAdmin {
seen := map[uint]bool{}
for _, b := range boardIDs {
if b > 0 && !seen[b] {
seen[b] = true
normBoards = append(normBoards, b)
}
}
if len(normBoards) == 0 {
return nil, ErrBoardRequired
}
var boardCnt int64
if err := s.db.Model(&model.Board{}).Where("id IN ?", normBoards).Count(&boardCnt).Error; err != nil {
return nil, err
}
if int(boardCnt) != len(normBoards) {
return nil, ErrBoardNotFound
}
}
var item *AdminUserItem
err := s.db.Transaction(func(tx *gorm.DB) error {
var u model.User
if err := tx.First(&u, targetID).Error; err != nil {
return err
}
if string(u.Role) == role {
return nil
// 站长账号是唯一硬保护对象
if u.Role == model.RoleOwner {
return ErrProtectedOwner
}
// 降级管理员：确保还存在另一名未封禁管理员
if u.Role == model.RoleAdmin {
var otherAdmins int64
if err := tx.Model(&model.User{}).
Where("role = ? AND banned = ? AND id <> ?", model.RoleAdmin, false, targetID).
Count(&otherAdmins).Error; err != nil {
roleChanged := u.Role != role
if roleChanged {
if err := tx.Model(&u).Update("role", role).Error; err != nil {
return err
}
if otherAdmins == 0 {
return ErrLastAdmin
}
}
if err := tx.Model(&u).Update("role", model.Role(role)).Error; err != nil {
// 同步板块授权：整体替换；非板块管理员清空
if err := tx.Where("user_id = ?", targetID).Delete(&model.UserBoard{}).Error; err != nil {
return err
}
// 管理员被降级：强制下线，避免 15 分钟 JWT 窗口内仍保有管理权限
if role == string(model.RoleUser) {
if role == model.RoleBoardAdmin {
rows := make([]model.UserBoard, 0, len(normBoards))
for _, b := range normBoards {
rows = append(rows, model.UserBoard{UserID: targetID, BoardID: b})
}
if err := tx.Create(&rows).Error; err != nil {
return err
}
}
// 任何角色变化都强制下线（板块授权变化因 Actor 每次现查 DB，无需下线）
if roleChanged {
if err := invalidateUserSessions(tx, targetID); err != nil {
return err
}
@@ -235,13 +335,15 @@ func (s *AdminUserService) SetRole(operatorID, targetID uint, role string) (*Adm
if err != nil {
return nil, err
}
item, err = s.getItem(s.db, targetID)
return item, err
return s.getItem(s.db, targetID)
}
// SetBanned 封禁/解封用户。封禁时同事务使该用户全部登录态立即失效
func (s *AdminUserService) SetBanned(operatorID, targetID uint, banned bool) (*AdminUserItem, error) {
if operatorID == targetID {
// SetBanned 封禁/解封用户。站长账号不可封禁；封禁时同事务使登录态立即失效
func (s *AdminUserService) SetBanned(operator *Actor, targetID uint, banned bool) (*AdminUserItem, error) {
if operator == nil {
return nil, ErrProtectedOwner
}
if operator.ID == targetID {
return nil, ErrAdminSelfAction
}
@@ -250,21 +352,12 @@ func (s *AdminUserService) SetBanned(operatorID, targetID uint, banned bool) (*A
if err := tx.First(&u, targetID).Error; err != nil {
return err
}
if u.Role == model.RoleOwner {
return ErrProtectedOwner
}
if u.Banned == banned {
return nil
}
// 封禁管理员：确保还存在另一名未封禁管理员，避免站点失去管理入口
if banned && u.Role == model.RoleAdmin {
var otherAdmins int64
if err := tx.Model(&model.User{}).
Where("role = ? AND banned = ? AND id <> ?", model.RoleAdmin, false, targetID).
Count(&otherAdmins).Error; err != nil {
return err
}
if otherAdmins == 0 {
return ErrLastAdmin
}
}
if err := tx.Model(&u).Update("banned", banned).Error; err != nil {
return err
}
@@ -281,6 +374,55 @@ func (s *AdminUserService) SetBanned(operatorID, targetID uint, banned bool) (*A
return s.getItem(s.db, targetID)
}
// RecordLogin 记录一次登录尝试（成功/失败都写）。失败时用户可能不存在，
// userID 传 0，username 仍落库便于异常登录排查
func (s *AdminUserService) RecordLogin(userID uint, username, ip, ua string, success bool) {
if len([]rune(ua)) > 500 {
ua = string([]rune(ua)[:500])
}
log := model.LoginLog{
UserID: userID,
Username: truncateStr(username, 128),
IP: truncateStr(ip, 45),
UserAgent: ua,
Success: success,
}
// Select 强制写入全部字段：Success=false 是 Go 零值，
// 否则 GORM 会因 default 标签省略该列，导致失败记录被写成默认值
_ = s.db.Select("user_id", "username", "ip", "user_agent", "success", "created_at").
Create(&log).Error // 审计写失败不应阻断登录
}
// ListLoginLogs 查询某用户的登录历史（最近在前）
func (s *AdminUserService) ListLoginLogs(targetID uint, page, size int) ([]model.LoginLog, int64, error) {
if page < 1 {
page = 1
}
if size < 1 || size > 50 {
size = 15
}
q := s.db.Model(&model.LoginLog{}).Where("user_id = ?", targetID)
var total int64
if err := q.Count(&total).Error; err != nil {
return nil, 0, err
}
var logs []model.LoginLog
if err := q.Order("created_at DESC").
Offset((page - 1) * size).Limit(size).
Find(&logs).Error; err != nil {
return nil, 0, err
}
return logs, total, nil
}
func truncateStr(s string, n int) string {
r := []rune(s)
if len(r) > n {
return string(r[:n])
}
return s
}
// invalidateUserSessions 在事务内递增 token_version 并撤销全部 refresh token，
// 与 AuthService 的强制下线逻辑等价（封禁/管理员降级时调用）
func invalidateUserSessions(tx *gorm.DB, userID uint) error {