chfei/StoreWeb
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

提交管理员操作一切

Browse Source
This commit is contained in:
chfei committed 2026-10-23 18:16:05 +08:00
1 parent a87ebeaffb
commit d6471f97d3
23 files changed
+600 -73
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

Modules/Store.Users/Services/UserManagementService.cs
+71 -19
View File
@@ -23,10 +23,7 @@ public sealed partial class UserManagementService(IFreeSql orm, ICurrentUser cur
?? throw new UnauthorizedAccessException("登录账户不存在");
}
private static bool IsAdmin(UserEntity actor) => actor.SaLevel == 1;
private static bool Owns(UserEntity actor, UserEntity target) =>
actor.IsMainUser && string.Equals(target.ParentUserName, actor.UserName, StringComparison.OrdinalIgnoreCase);
private static bool IsAdmin(UserEntity actor) => UserAccessPolicy.IsAdmin(actor);
/// <summary>仅本人、直属主账号或超级管理员可以读取账户详情。</summary>
public async Task<UserInfo> GetUser(string? userName, CancellationToken ct)
{
@@ -36,21 +33,53 @@ public sealed partial class UserManagementService(IFreeSql orm, ICurrentUser cur
UserInputChecks.Length(name, 20, "用户名");
var target = await orm.Select<UserEntity>().Where(u => u.UserName == name).FirstAsync(ct)
?? throw new AppException("用户不存在");
if (!IsAdmin(actor) && actor.Id != target.Id && !Owns(actor, target))
if (!UserAccessPolicy.CanRead(actor, target))
throw new AppException("无权访问该账户", 403);
return await query.GetUser(target.UserName);
}
/// <summary>管理员查询全部账户；普通主账号只能查询自己的直属子账号。</summary>
/// <summary>解析代操作目标，服务端校验管理员或主子账号归属，省略用户名时操作本人。</summary>
public async Task<string> GetManagedUserName(string? userName, CancellationToken ct)
{
var actor = await Actor(orm, ct);
var name = string.IsNullOrWhiteSpace(userName) ? actor.UserName : userName.Trim();
UserInputChecks.Length(name, 20, "用户名");
var target = await orm.Select<UserEntity>().Where(u => u.UserName == name).FirstAsync(ct)
?? throw new AppException("用户不存在");
if (!UserAccessPolicy.CanManage(actor, target) && actor.Id != target.Id)
throw new AppException("无权操作该账户", 403);
return target.UserName;
}
/// <summary>管理员查询全部账户；普通主账号的列表范围为本人和直属子账号。</summary>
public async Task<UserPage<UserInfo>> Search(UserSearchRequest request, bool subUsersOnly, CancellationToken ct)
{
RequestValidator.Validate(request);
UserInputChecks.Search(request);
var actor = await Actor(orm, ct);
if (!subUsersOnly && !IsAdmin(actor)) throw new AppException("仅管理员可以查询全部账户", 403);
if (subUsersOnly && !actor.IsMainUser) throw new AppException("子账号不能管理其他账户", 403);
if (!subUsersOnly && !IsAdmin(actor) && !actor.IsMainUser) throw new AppException("无权查询账户列表", 403);
if (subUsersOnly && !IsAdmin(actor) && !actor.IsMainUser) throw new AppException("子账号不能管理其他账户", 403);
var select = orm.Select<UserEntity>();
if (subUsersOnly) select = select.Where(u => u.ParentUserName == actor.UserName);
if (subUsersOnly)
{
var parentUserName = request.ParentUserName?.Trim();
if (IsAdmin(actor))
{
// 管理员省略父账号时查询所有子账号，但不混入主账号。
select = select.Where(u => u.ParentUserName != null && u.ParentUserName.Trim() != "");
if (!string.IsNullOrWhiteSpace(parentUserName))
select = select.Where(u => u.ParentUserName == parentUserName);
}
else
{
if (!string.IsNullOrWhiteSpace(parentUserName)
&& !string.Equals(parentUserName, actor.UserName, StringComparison.OrdinalIgnoreCase))
throw new AppException("只能查询自己的子账号", 403);
select = select.Where(u => u.ParentUserName == actor.UserName);
}
}
else if (!IsAdmin(actor))
select = select.Where(u => u.Id == actor.Id || u.ParentUserName == actor.UserName);
if (request.GroupId.HasValue) select = select.Where(u => u.GroupId == request.GroupId.Value);
if (!string.IsNullOrWhiteSpace(request.Keyword))
{
@@ -70,6 +99,7 @@ public sealed partial class UserManagementService(IFreeSql orm, ICurrentUser cur
UserInputChecks.Length(request.UserName, 20, "用户名");
UserInputChecks.Length(request.Password, 128, "密码", 6);
UserInputChecks.Edit(request);
UserInputChecks.Length(request.ParentUserName, 20, "父账号");
using var work = orm.CreateUnitOfWork();
work.GetOrBeginTransaction();
@@ -78,12 +108,23 @@ public sealed partial class UserManagementService(IFreeSql orm, ICurrentUser cur
// 锁住主账号，使其创建子账号和删除操作串行化。
actor = await db.Select<UserEntity>().Where(u => u.Id == actor.Id).ForUpdate().FirstAsync(ct)
?? throw new AppException("操作者账户不存在");
if (subUser ? !actor.IsMainUser : !IsAdmin(actor)) throw new AppException("无权创建该账户", 403);
if (subUser ? !IsAdmin(actor) && !actor.IsMainUser : !IsAdmin(actor)) throw new AppException("无权创建该账户", 403);
var parentName = "";
if (subUser)
{
parentName = string.IsNullOrWhiteSpace(request.ParentUserName) ? actor.UserName : request.ParentUserName.Trim();
if (!IsAdmin(actor) && !string.Equals(parentName, actor.UserName, StringComparison.OrdinalIgnoreCase))
throw new AppException("只能在自己的账户下创建子账号", 403);
var parent = await db.Select<UserEntity>().Where(u => u.UserName == parentName).ForUpdate().FirstAsync(ct)
?? throw new AppException("父账号不存在");
if (!parent.IsMainUser) throw new AppException("父账号必须是主账号");
parentName = parent.UserName;
}
var name = request.UserName.Trim();
if (await db.Select<UserEntity>().Where(u => u.UserName == name).AnyAsync(ct)) throw new AppException("用户名已存在");
var user = new UserEntity
{
UserName = name, ParentUserName = subUser ? actor.UserName : "", GroupId = subUser ? (byte)4 : (byte)3,
UserName = name, ParentUserName = parentName, GroupId = subUser ? (byte)4 : (byte)3,
NickName = name, Mobile = "", CompanyName = "", Notes = "", CardId = "", Authority = "",
ForbiddenPage = "", OemId = "", SaLevel = 0, ShopPointsPerMonth = 30,
PostagePerOrder = 2.2m, RefundPostagePerOrder = 2.5m, GiftOemAmountPerOrder = 0,
@@ -111,7 +152,8 @@ public sealed partial class UserManagementService(IFreeSql orm, ICurrentUser cur
var actor = await Actor(db, ct);
var target = await db.Select<UserEntity>().Where(u => u.Id == id).ForUpdate().FirstAsync(ct)
?? throw new AppException("用户不存在");
if (subUser ? !Owns(actor, target) : !IsAdmin(actor)) throw new AppException("无权修改该账户", 403);
if (!UserAccessPolicy.CanManage(actor, target)) throw new AppException("无权修改该账户", 403);
if (subUser && target.IsMainUser) throw new AppException("目标账户不是子账号");
Apply(target, request, actor, !target.IsMainUser);
await CheckOem(db, target, ct);
target.MdyTime = DateTime.Now;
@@ -139,7 +181,7 @@ public sealed partial class UserManagementService(IFreeSql orm, ICurrentUser cur
var target = await db.Select<UserEntity>().Where(u => u.Id == id).ForUpdate().FirstAsync(ct)
?? throw new AppException("用户不存在");
if (actor.Id == target.Id) throw new AppException("不能删除当前登录账户");
if (!IsAdmin(actor) && !Owns(actor, target)) throw new AppException("无权删除该账户", 403);
if (!UserAccessPolicy.CanManage(actor, target)) throw new AppException("无权删除该账户", 403);
if ((target.Balance ?? 0) != 0 || target.Points != 0) throw new AppException("账户仍有余额或积分，不能删除");
if (await db.Select<UserEntity>().Where(u => u.ParentUserName == target.UserName).AnyAsync(ct))
throw new AppException("请先处理该账户的子账号");
@@ -152,19 +194,29 @@ public sealed partial class UserManagementService(IFreeSql orm, ICurrentUser cur
onlineUsers.SignOut(target.UserName);
}
/// <summary>比较并更新密码，防止并发密码变更丢失；成功后立即失效已有登录会话。</summary>
/// <summary>本人改密校验原密码，管理者可重置授权账户密码；比较并更新后失效目标账户会话。</summary>
public async Task ChangePassword(ChangePasswordRequest request, CancellationToken ct)
{
RequestValidator.Validate(request);
UserInputChecks.Length(request.OldPassword, 128, "原密码");
UserInputChecks.Length(request.NewPassword, 128, "新密码", 6);
var actor = await Actor(orm, ct);
if (!UserPassword.Verify(actor, request.OldPassword)) throw new AppException("原密码错误");
var hash = UserPassword.Hash(actor, request.NewPassword);
var name = string.IsNullOrWhiteSpace(request.UserName) ? actor.UserName : request.UserName.Trim();
UserInputChecks.Length(name, 20, "用户名");
var target = await orm.Select<UserEntity>().Where(u => u.UserName == name).FirstAsync(ct)
?? throw new AppException("用户不存在");
if (target.Id == actor.Id)
{
RequestValidator.Validate(new UserPasswordProofRequest { OldPassword = request.OldPassword! });
if (!UserPassword.Verify(target, request.OldPassword!)) throw new AppException("原密码错误");
}
else if (!UserAccessPolicy.CanManage(actor, target))
throw new AppException("无权修改该账户密码", 403);
var hash = UserPassword.Hash(target, request.NewPassword);
if (await orm.Update<UserEntity>().Set(u => u.Password, hash).Set(u => u.MdyTime, DateTime.Now)
.Where(u => u.Id == actor.Id && u.Password == actor.Password).ExecuteAffrowsAsync(ct) != 1)
.Where(u => u.Id == target.Id && u.Password == target.Password).ExecuteAffrowsAsync(ct) != 1)
throw new AppException("密码已发生变化，请重新登录");
onlineUsers.SignOut(actor.UserName);
onlineUsers.SignOut(target.UserName);
}
/// <summary>按账户归属查询积分流水；分页与账户详情使用相同的访问范围。</summary>
@@ -222,7 +274,7 @@ public sealed partial class UserManagementService(IFreeSql orm, ICurrentUser cur
throw new AppException("仅管理员可以修改计费配置", 403);
if (request.SaLevel.HasValue)
{
if (!IsAdmin(actor) || (subUser && request.SaLevel != 0)) throw new AppException("无权设置管理员级别", 403);
if (!IsAdmin(actor)) throw new AppException("无权设置管理员级别", 403);
user.SaLevel = request.SaLevel;
}
user.NickName = request.NickName?.Trim() ?? user.NickName;