feat(admin): add operations resources and audit UI

2026-08-06 19:49:55 +08:00
parent 28e04857fa
commit 5622ab448a
39 changed files with 3770 additions and 293 deletions
@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server";

-import { requireAdminSession } from "@/lib/admin/auth";
+import { requirePermission } from "@/lib/admin/auth";
 import { pageOffset, queryAdminRows } from "@/lib/admin/database";
 import {
  adminErrorResponse,
@@ -39,7 +39,7 @@ export const DELETE = readonlyAdminMutation;

 export async function GET(request: Request) {
  try {
-    await requireAdminSession();
+    await requirePermission("audit.read");
    const parsed = parseListQuery(request);
    if (!parsed.success) return invalidQueryResponse(parsed.error.flatten());
    const { page, pageSize, sort, order, q, status } = parsed.data;
@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server";

-import { requireAdminSession } from "@/lib/admin/auth";
+import { requirePermission } from "@/lib/admin/auth";
 import { pageOffset, queryAdminRows } from "@/lib/admin/database";
 import {
  adminErrorResponse,
@@ -35,7 +35,7 @@ export const DELETE = readonlyAdminMutation;

 export async function GET(request: Request) {
  try {
-    await requireAdminSession();
+    await requirePermission("billing.orders.read");
    const parsed = parseListQuery(request);
    if (!parsed.success) return invalidQueryResponse(parsed.error.flatten());
    const { page, pageSize, sort, order, q, status } = parsed.data;
@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server";

-import { requireAdminSession } from "@/lib/admin/auth";
+import { requirePermission } from "@/lib/admin/auth";
 import { pageOffset, queryAdminRows } from "@/lib/admin/database";
 import {
  adminErrorResponse,
@@ -40,7 +40,7 @@ export const DELETE = readonlyAdminMutation;

 export async function GET(request: Request) {
  try {
-    await requireAdminSession();
+    await requirePermission("billing.orders.read");
    const parsed = parseListQuery(request);
    if (!parsed.success) return invalidQueryResponse(parsed.error.flatten());
    const { page, pageSize, sort, order, q, status } = parsed.data;
@@ -0,0 +1,115 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+
+import { requirePermission } from "@/lib/admin/auth";
+import { pageOffset, queryAdminRows } from "@/lib/admin/database";
+import {
+  adminErrorResponse,
+  invalidQueryResponse,
+  parseListQuery,
+  readonlyAdminMutation,
+  requestId,
+} from "@/lib/admin/http";
+
+export const runtime = "nodejs";
+
+type UserRow = {
+  id: string;
+  email: string;
+  name: string | null;
+  role: string;
+  email_verified: boolean;
+  banned: boolean;
+  created_at: Date;
+  credits: number;
+  total_count: string;
+};
+
+type BirthDataRow = {
+  user_id: string;
+  birth_date: string | null;
+  birth_time_status: string | null;
+  birth_place_label: string | null;
+};
+
+const sortColumns = new Map([
+  ["createdAt", "u.created_at"],
+  ["email", "u.email"],
+  ["credits", "p.credits"],
+  ["name", "u.name"],
+]);
+const userIdSchema = z.string().uuid();
+
+export const POST = readonlyAdminMutation;
+export const PUT = readonlyAdminMutation;
+export const PATCH = readonlyAdminMutation;
+export const DELETE = readonlyAdminMutation;
+
+async function revealCustomerBirthData(request: Request, revealUserId: string) {
+  const parsedUserId = userIdSchema.safeParse(revealUserId);
+  if (!parsedUserId.success) return invalidQueryResponse({ revealUserId: ["必须是有效用户 ID"] });
+  const session = await requirePermission("admin.customers.birth_data.read");
+  const rows = await queryAdminRows<BirthDataRow>(
+    "select * from public.admin_read_customer_birth_data($1, $2::uuid[], $3)",
+    [session.user.id, [parsedUserId.data], requestId(request)],
+  );
+  const row = rows[0];
+  if (!row) return NextResponse.json({ error: "用户资料不存在" }, { status: 404 });
+  return NextResponse.json({
+    data: {
+      userId: row.user_id,
+      birthDate: row.birth_date,
+      birthTimeStatus: row.birth_time_status,
+      birthPlace: row.birth_place_label,
+    },
+  });
+}
+
+export async function GET(request: Request) {
+  try {
+    const revealUserId = new URL(request.url).searchParams.get("revealUserId");
+    if (revealUserId) return await revealCustomerBirthData(request, revealUserId);
+
+    await requirePermission("admin.customers.read");
+    const parsed = parseListQuery(request);
+    if (!parsed.success) return invalidQueryResponse(parsed.error.flatten());
+    const { page, pageSize, sort, order, q } = parsed.data;
+    const values: unknown[] = [];
+    const conditions: string[] = [];
+    if (q) {
+      values.push(`%${q}%`);
+      conditions.push(`(u.email ilike $${values.length} or u.name ilike $${values.length})`);
+    }
+    values.push(pageSize, pageOffset(page, pageSize));
+    const sortColumn = sortColumns.get(sort ?? "createdAt") ?? "u.created_at";
+    const rows = await queryAdminRows<UserRow>(`
+      select
+        u.id, u.email, u.name, u.role, u.email_verified, u.banned,
+        u.created_at, p.credits, count(*) over()::text as total_count
+      from identity.users u
+      join public.profiles p on p.id = u.id
+      ${conditions.length ? `where ${conditions.join(" and ")}` : ""}
+      order by ${sortColumn} ${order === "asc" ? "asc" : "desc"}, u.id asc
+      limit $${values.length - 1} offset $${values.length}
+    `, values);
+    return NextResponse.json({
+      data: rows.map((row) => ({
+        id: row.id,
+        email: row.email,
+        name: row.name,
+        role: row.role,
+        emailVerified: row.email_verified,
+        banned: row.banned,
+        createdAt: row.created_at.toISOString(),
+        credits: row.credits,
+        birthDate: null,
+        birthTimeStatus: null,
+        birthPlace: null,
+        birthDataMasked: true,
+      })),
+      total: Number(rows[0]?.total_count ?? 0),
+    });
+  } catch (error) {
+    return adminErrorResponse(error);
+  }
+}
@@ -0,0 +1,13 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { requirePermission } from "@/lib/admin/auth";
+import { pageOffset, queryAdminRows } from "@/lib/admin/database";
+import { adminErrorResponse, invalidQueryResponse, parseListQuery, requestId, requireAdminMutation, requireHighRiskAdminMutation } from "@/lib/admin/http";
+export const runtime="nodejs";
+const schema=z.discriminatedUnion("action",[
+  z.object({action:z.literal("save"),id:z.string().uuid().nullable().optional(),flagKey:z.string().regex(/^[a-z][a-z0-9._-]{1,99}$/),enabled:z.boolean(),rolloutPercentage:z.number().int().min(0).max(100),config:z.record(z.string(),z.unknown()).default({}),expectedVersion:z.number().int().positive().nullable().optional(),reason:z.string().trim().min(1).max(500)}).strict(),
+  z.object({action:z.literal("publish"),id:z.string().uuid(),expectedVersion:z.number().int().positive(),reason:z.string().trim().min(1).max(500)}).strict(),
+]);
+type Row={id:string;flag_key:string;version:number;enabled:boolean;rollout_percentage:number;config:Record<string,unknown>;status:string;created_at:Date;published_at:Date|null;total_count:string};
+export async function GET(request:Request){try{await requirePermission("admin.access");const p=parseListQuery(request);if(!p.success)return invalidQueryResponse(p.error.flatten());const q=p.data.q?`%${p.data.q}%`:null;const rows=await queryAdminRows<Row>(`select f.*,count(*) over()::text total_count from public.feature_flags f where ($1::text is null or f.flag_key ilike $1) and ($2::text is null or f.status=$2) order by f.created_at desc limit $3 offset $4`,[q,p.data.status??null,p.data.pageSize,pageOffset(p.data.page,p.data.pageSize)]);return NextResponse.json({data:rows.map(r=>({id:r.id,flagKey:r.flag_key,version:r.version,enabled:r.enabled,rolloutPercentage:r.rollout_percentage,config:r.config,status:r.status,createdAt:r.created_at.toISOString(),publishedAt:r.published_at?.toISOString()??null})),total:Number(rows[0]?.total_count??0)});}catch(e){return adminErrorResponse(e)}}
+export async function POST(request:Request){try{const b=schema.safeParse(await request.json().catch(()=>null));if(!b.success)return invalidQueryResponse(b.error.flatten());const session=b.data.action==="publish"?await requireHighRiskAdminMutation(request,"ops.flags.write"):await requireAdminMutation(request,"ops.flags.write");const rid=requestId(request);if(b.data.action==="publish"){const rows=await queryAdminRows<{id:string}>("select public.admin_publish_feature_flag($1,$2,$3,$4,$5) id",[session.user.id,b.data.id,b.data.expectedVersion,b.data.reason,rid]);return NextResponse.json({data:{id:rows[0]!.id,requestId:rid}})}const v=b.data;const rows=await queryAdminRows<{id:string}>("select public.admin_save_feature_flag($1,$2,$3,$4,$5,$6::jsonb,$7,$8,$9) id",[session.user.id,v.id??null,v.flagKey,v.enabled,v.rolloutPercentage,JSON.stringify(v.config),v.expectedVersion??null,v.reason,rid]);return NextResponse.json({data:{id:rows[0]!.id,requestId:rid}})}catch(e){return adminErrorResponse(e)}}
@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
-import { requireAdminSession } from "@/lib/admin/auth";
+import { requirePermission } from "@/lib/admin/auth";
 import { queryAdminRows } from "@/lib/admin/database";
 import { adminErrorResponse } from "@/lib/admin/http";

@@ -38,7 +38,7 @@ type PaymentStatsRow = {

 export async function GET(request: Request) {
  try {
-    await requireAdminSession("read");
+    await requirePermission("billing.orders.read");

    const url = new URL(request.url);
    const parsed = querySchema.safeParse(Object.fromEntries(url.searchParams));
@@ -1,85 +1 @@
-import { NextResponse } from "next/server";
-
-import { requireAdminSession } from "@/lib/admin/auth";
-import { pageOffset, queryAdminRows } from "@/lib/admin/database";
-import {
-  adminErrorResponse,
-  invalidQueryResponse,
-  parseListQuery,
-  readonlyAdminMutation,
-} from "@/lib/admin/http";
-
-export const runtime = "nodejs";
-
-type UserRow = {
-  id: string;
-  email: string;
-  name: string | null;
-  role: string;
-  email_verified: boolean;
-  banned: boolean;
-  created_at: Date;
-  credits: number;
-  birth_date: string | null;
-  birth_time_status: string | null;
-  birth_place_label: string | null;
-  total_count: string;
-};
-
-const sortColumns = new Map([
-  ["createdAt", "u.created_at"],
-  ["email", "u.email"],
-  ["credits", "p.credits"],
-  ["name", "u.name"],
-]);
-
-export const POST = readonlyAdminMutation;
-export const PUT = readonlyAdminMutation;
-export const PATCH = readonlyAdminMutation;
-export const DELETE = readonlyAdminMutation;
-
-export async function GET(request: Request) {
-  try {
-    await requireAdminSession();
-    const parsed = parseListQuery(request);
-    if (!parsed.success) return invalidQueryResponse(parsed.error.flatten());
-    const { page, pageSize, sort, order, q } = parsed.data;
-    const values: unknown[] = [];
-    const conditions: string[] = [];
-    if (q) {
-      values.push(`%${q}%`);
-      conditions.push(`(u.email ilike $${values.length} or u.name ilike $${values.length})`);
-    }
-    values.push(pageSize, pageOffset(page, pageSize));
-    const sortColumn = sortColumns.get(sort ?? "createdAt") ?? "u.created_at";
-    const rows = await queryAdminRows<UserRow>(`
-      select
-        u.id, u.email, u.name, u.role, u.email_verified, u.banned,
-        u.created_at, p.credits, p.birth_date, p.birth_time_status,
-        p.birth_place_label, count(*) over()::text as total_count
-      from identity.users u
-      join public.profiles p on p.id = u.id
-      ${conditions.length ? `where ${conditions.join(" and ")}` : ""}
-      order by ${sortColumn} ${order === "asc" ? "asc" : "desc"}, u.id asc
-      limit $${values.length - 1} offset $${values.length}
-    `, values);
-    return NextResponse.json({
-      data: rows.map((row) => ({
-        id: row.id,
-        email: row.email,
-        name: row.name,
-        role: row.role,
-        emailVerified: row.email_verified,
-        banned: row.banned,
-        createdAt: row.created_at.toISOString(),
-        credits: row.credits,
-        birthDate: row.birth_date,
-        birthTimeStatus: row.birth_time_status,
-        birthPlace: row.birth_place_label,
-      })),
-      total: Number(rows[0]?.total_count ?? 0),
-    });
-  } catch (error) {
-    return adminErrorResponse(error);
-  }
-}
+export { DELETE, GET, PATCH, POST, PUT, runtime } from "../customers/route";