feat: 实现用户登录认证与权限控制系统
- 新增用户登录页面与API端点（/api/auth/login、/api/auth/logout、/api/auth/me） - 引入基于密码哈希的认证机制，支持默认管理员账号登录 - 创建访问控制模块（lib/access-control.ts），实现基于角色的权限验证 - 在现有API端点中集成权限检查，限制非管理员用户只能访问其所属项目数据 - 更新应用布局，要求用户登录后才能访问主界面 - 扩展用户表结构，增加用户名和密码哈希字段 - 调整项目、KR、目标、会议记录等资源的查询逻辑，根据用户权限过滤数据 - 改进管理页面（指标、模板）的删除操作，使用确认对话框替代直接确认 - 优化“我的KR”页面，为管理员提供全员KR概览视图 - 修复.gitignore文件中的拼写错误（.trae → .travis） - 添加数据库迁移脚本，支持任务直接关联项目、禁用RLS、添加求助字段等 - 配置Next.js以支持独立输出和子路径部署
This commit is contained in:
118
app/api/tasks/[id]/route.ts
Normal file
118
app/api/tasks/[id]/route.ts
Normal file
@@ -0,0 +1,118 @@
|
||||
export const dynamic = 'force-dynamic';
|
||||
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { supabase } from '@/lib/supabase';
|
||||
import { ensureAuthenticated, getAuthContext } from '@/lib/access-control';
|
||||
|
||||
async function canAccessTask(userId: string, isAdmin: boolean, accessibleProjectIds: string[], taskId: string) {
|
||||
if (isAdmin) return { ok: true as const };
|
||||
|
||||
const { data: task, error } = await supabase
|
||||
.from('tasks')
|
||||
.select('id,project_id,owner_user_id,executor_ids,help_requested_to_user_id')
|
||||
.eq('id', taskId)
|
||||
.maybeSingle();
|
||||
|
||||
if (error) return { ok: false as const, status: 500, error: error.message };
|
||||
if (!task) return { ok: false as const, status: 404, error: '计划不存在' };
|
||||
|
||||
if (task.project_id && accessibleProjectIds.includes(task.project_id)) return { ok: true as const };
|
||||
if (task.owner_user_id === userId) return { ok: true as const };
|
||||
if (task.help_requested_to_user_id === userId) return { ok: true as const };
|
||||
if (Array.isArray(task.executor_ids) && task.executor_ids.includes(userId)) return { ok: true as const };
|
||||
|
||||
return { ok: false as const, status: 403, error: '无权限' };
|
||||
}
|
||||
|
||||
export async function PATCH(
|
||||
request: NextRequest,
|
||||
{ params }: { params: { id: string } }
|
||||
) {
|
||||
const ctx = await getAuthContext(request);
|
||||
const auth = ensureAuthenticated(ctx);
|
||||
if (!auth.ok) {
|
||||
return NextResponse.json({ error: auth.error }, { status: auth.status });
|
||||
}
|
||||
|
||||
const access = await canAccessTask(ctx!.user.id, ctx!.isAdmin, ctx!.accessibleProjectIds, params.id);
|
||||
if (!access.ok) {
|
||||
return NextResponse.json({ error: access.error }, { status: access.status });
|
||||
}
|
||||
|
||||
const body = await request.json();
|
||||
const {
|
||||
title,
|
||||
description,
|
||||
status,
|
||||
priority,
|
||||
urgency,
|
||||
owner_user_id,
|
||||
executor_ids,
|
||||
start_date,
|
||||
end_date,
|
||||
help_requested_to_user_id,
|
||||
help_requested_by_user_id,
|
||||
} = body;
|
||||
|
||||
const updateData: Record<string, unknown> = { updated_at: new Date().toISOString() };
|
||||
if (title !== undefined) updateData.title = title;
|
||||
if (description !== undefined) updateData.description = description;
|
||||
if (status !== undefined) updateData.status = status;
|
||||
if (priority !== undefined) updateData.priority = priority;
|
||||
if (urgency !== undefined) updateData.urgency = urgency;
|
||||
if (owner_user_id !== undefined) updateData.owner_user_id = owner_user_id;
|
||||
if (executor_ids !== undefined) updateData.executor_ids = executor_ids;
|
||||
if (start_date !== undefined) updateData.start_date = start_date;
|
||||
if (end_date !== undefined) updateData.end_date = end_date;
|
||||
|
||||
if (help_requested_to_user_id !== undefined) {
|
||||
updateData.help_requested_to_user_id = help_requested_to_user_id;
|
||||
if (help_requested_to_user_id) {
|
||||
updateData.help_requested_by_user_id = help_requested_by_user_id || null;
|
||||
updateData.help_requested_at = new Date().toISOString();
|
||||
} else {
|
||||
updateData.help_requested_by_user_id = null;
|
||||
updateData.help_requested_at = null;
|
||||
}
|
||||
}
|
||||
|
||||
const { data, error } = await supabase
|
||||
.from('tasks')
|
||||
.update(updateData)
|
||||
.eq('id', params.id)
|
||||
.select()
|
||||
.single();
|
||||
|
||||
if (error) {
|
||||
return NextResponse.json({ error: error.message }, { status: 500 });
|
||||
}
|
||||
|
||||
return NextResponse.json(data);
|
||||
}
|
||||
|
||||
export async function DELETE(
|
||||
request: NextRequest,
|
||||
{ params }: { params: { id: string } }
|
||||
) {
|
||||
const ctx = await getAuthContext(request);
|
||||
const auth = ensureAuthenticated(ctx);
|
||||
if (!auth.ok) {
|
||||
return NextResponse.json({ error: auth.error }, { status: auth.status });
|
||||
}
|
||||
|
||||
const access = await canAccessTask(ctx!.user.id, ctx!.isAdmin, ctx!.accessibleProjectIds, params.id);
|
||||
if (!access.ok) {
|
||||
return NextResponse.json({ error: access.error }, { status: access.status });
|
||||
}
|
||||
|
||||
const { error } = await supabase
|
||||
.from('tasks')
|
||||
.delete()
|
||||
.eq('id', params.id);
|
||||
|
||||
if (error) {
|
||||
return NextResponse.json({ error: error.message }, { status: 500 });
|
||||
}
|
||||
|
||||
return NextResponse.json({ success: true });
|
||||
}
|
||||
189
app/api/tasks/route.ts
Normal file
189
app/api/tasks/route.ts
Normal file
@@ -0,0 +1,189 @@
|
||||
export const dynamic = 'force-dynamic';
|
||||
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { supabase } from '@/lib/supabase';
|
||||
import { ensureAuthenticated, getAuthContext, hasProjectAccess } from '@/lib/access-control';
|
||||
|
||||
export async function GET(request: NextRequest) {
|
||||
const ctx = await getAuthContext(request);
|
||||
const auth = ensureAuthenticated(ctx);
|
||||
if (!auth.ok) {
|
||||
return NextResponse.json({ error: auth.error }, { status: auth.status });
|
||||
}
|
||||
|
||||
const searchParams = request.nextUrl.searchParams;
|
||||
const kr_id = searchParams.get('kr_id');
|
||||
const project_id = searchParams.get('project_id');
|
||||
const user_id = searchParams.get('user_id');
|
||||
const help_requested_to_user_id = searchParams.get('help_requested_to_user_id');
|
||||
const include_help = searchParams.get('include_help') === 'true';
|
||||
|
||||
if (!ctx!.isAdmin) {
|
||||
if (user_id && user_id !== ctx!.user.id) {
|
||||
return NextResponse.json({ error: '无权限' }, { status: 403 });
|
||||
}
|
||||
if (help_requested_to_user_id && help_requested_to_user_id !== ctx!.user.id) {
|
||||
return NextResponse.json({ error: '无权限' }, { status: 403 });
|
||||
}
|
||||
if (project_id && !hasProjectAccess(ctx!, project_id)) {
|
||||
return NextResponse.json({ error: '无权限' }, { status: 403 });
|
||||
}
|
||||
if (kr_id) {
|
||||
const { data: kr, error: krErr } = await supabase
|
||||
.from('krs')
|
||||
.select('id,project_id')
|
||||
.eq('id', kr_id)
|
||||
.maybeSingle();
|
||||
if (krErr) return NextResponse.json({ error: krErr.message }, { status: 500 });
|
||||
if (!kr) return NextResponse.json({ error: 'KR不存在' }, { status: 404 });
|
||||
if (!hasProjectAccess(ctx!, kr.project_id)) {
|
||||
return NextResponse.json({ error: '无权限' }, { status: 403 });
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const baseQuery = () =>
|
||||
supabase
|
||||
.from('tasks')
|
||||
.select(`
|
||||
*,
|
||||
steps:task_steps(*)
|
||||
`)
|
||||
.order('created_at', { ascending: false });
|
||||
|
||||
const applyParams = (query: ReturnType<typeof baseQuery>) => {
|
||||
let q = query;
|
||||
if (kr_id) {
|
||||
q = q.eq('kr_id', kr_id);
|
||||
} else if (project_id) {
|
||||
q = q.eq('project_id', project_id).is('kr_id', null);
|
||||
}
|
||||
|
||||
if (help_requested_to_user_id) {
|
||||
q = q.eq('help_requested_to_user_id', help_requested_to_user_id);
|
||||
} else if (user_id) {
|
||||
if (include_help) {
|
||||
q = q.or(`owner_user_id.eq.${user_id},help_requested_to_user_id.eq.${user_id}`);
|
||||
} else {
|
||||
q = q.eq('owner_user_id', user_id);
|
||||
}
|
||||
}
|
||||
|
||||
return q;
|
||||
};
|
||||
|
||||
if (ctx!.isAdmin) {
|
||||
const { data, error } = await applyParams(baseQuery());
|
||||
if (error) {
|
||||
return NextResponse.json({ error: error.message }, { status: 500 });
|
||||
}
|
||||
return NextResponse.json(data);
|
||||
}
|
||||
|
||||
if (project_id || kr_id) {
|
||||
const { data, error } = await applyParams(baseQuery());
|
||||
if (error) {
|
||||
return NextResponse.json({ error: error.message }, { status: 500 });
|
||||
}
|
||||
return NextResponse.json(data);
|
||||
}
|
||||
|
||||
const relatedTasks = new Map<string, any>();
|
||||
const addRows = (rows: any[] | null) => {
|
||||
if (!rows) return;
|
||||
for (const row of rows) {
|
||||
relatedTasks.set(row.id, row);
|
||||
}
|
||||
};
|
||||
|
||||
const projectIds = ctx!.accessibleProjectIds;
|
||||
|
||||
const builders: any[] = [];
|
||||
if (projectIds.length > 0) {
|
||||
builders.push(applyParams(baseQuery().in('project_id', projectIds)));
|
||||
}
|
||||
builders.push(applyParams(baseQuery().or(`owner_user_id.eq.${ctx!.user.id},help_requested_to_user_id.eq.${ctx!.user.id}`)));
|
||||
builders.push(applyParams(baseQuery().contains('executor_ids', [ctx!.user.id])));
|
||||
|
||||
const results = await Promise.all(builders.map(b => b));
|
||||
for (const r of results) {
|
||||
if (r.error) {
|
||||
return NextResponse.json({ error: r.error.message }, { status: 500 });
|
||||
}
|
||||
addRows(r.data);
|
||||
}
|
||||
|
||||
return NextResponse.json(Array.from(relatedTasks.values()));
|
||||
}
|
||||
|
||||
export async function POST(request: NextRequest) {
|
||||
const ctx = await getAuthContext(request);
|
||||
const auth = ensureAuthenticated(ctx);
|
||||
if (!auth.ok) {
|
||||
return NextResponse.json({ error: auth.error }, { status: auth.status });
|
||||
}
|
||||
|
||||
const body = await request.json();
|
||||
const {
|
||||
kr_id,
|
||||
project_id,
|
||||
title,
|
||||
description,
|
||||
status,
|
||||
priority,
|
||||
urgency,
|
||||
owner_user_id,
|
||||
executor_ids,
|
||||
start_date,
|
||||
end_date,
|
||||
help_requested_to_user_id,
|
||||
help_requested_by_user_id,
|
||||
} = body;
|
||||
|
||||
const isHelpRequested = Boolean(help_requested_to_user_id);
|
||||
|
||||
if (!ctx!.isAdmin) {
|
||||
if (project_id && !hasProjectAccess(ctx!, project_id)) {
|
||||
return NextResponse.json({ error: '无权限' }, { status: 403 });
|
||||
}
|
||||
if (kr_id) {
|
||||
const { data: kr, error: krErr } = await supabase
|
||||
.from('krs')
|
||||
.select('id,project_id')
|
||||
.eq('id', kr_id)
|
||||
.maybeSingle();
|
||||
if (krErr) return NextResponse.json({ error: krErr.message }, { status: 500 });
|
||||
if (!kr) return NextResponse.json({ error: 'KR不存在' }, { status: 404 });
|
||||
if (!hasProjectAccess(ctx!, kr.project_id)) {
|
||||
return NextResponse.json({ error: '无权限' }, { status: 403 });
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const { data, error } = await supabase
|
||||
.from('tasks')
|
||||
.insert({
|
||||
kr_id: kr_id || null,
|
||||
project_id: project_id || null,
|
||||
title,
|
||||
description,
|
||||
status: status || 'todo',
|
||||
priority: priority || 3,
|
||||
urgency: urgency || 3,
|
||||
owner_user_id,
|
||||
executor_ids: executor_ids || [],
|
||||
start_date,
|
||||
end_date,
|
||||
help_requested_to_user_id: help_requested_to_user_id || null,
|
||||
help_requested_by_user_id: help_requested_by_user_id || null,
|
||||
help_requested_at: isHelpRequested ? new Date().toISOString() : null,
|
||||
})
|
||||
.select()
|
||||
.single();
|
||||
|
||||
if (error) {
|
||||
return NextResponse.json({ error: error.message }, { status: 500 });
|
||||
}
|
||||
|
||||
return NextResponse.json(data);
|
||||
}
|
||||
Reference in New Issue
Block a user