karlcarlo
7948b1afc7
- 新增用户登录页面与API端点（/api/auth/login、/api/auth/logout、/api/auth/me） - 引入基于密码哈希的认证机制，支持默认管理员账号登录 - 创建访问控制模块（lib/access-control.ts），实现基于角色的权限验证 - 在现有API端点中集成权限检查，限制非管理员用户只能访问其所属项目数据 - 更新应用布局，要求用户登录后才能访问主界面 - 扩展用户表结构，增加用户名和密码哈希字段 - 调整项目、KR、目标、会议记录等资源的查询逻辑，根据用户权限过滤数据 - 改进管理页面（指标、模板）的删除操作，使用确认对话框替代直接确认 - 优化“我的KR”页面，为管理员提供全员KR概览视图 - 修复.gitignore文件中的拼写错误（.trae → .travis） - 添加数据库迁移脚本，支持任务直接关联项目、禁用RLS、添加求助字段等 - 配置Next.js以支持独立输出和子路径部署
114 lines
3.3 KiB
TypeScript
114 lines
3.3 KiB
TypeScript
export const dynamic = 'force-dynamic';
|
|
|
|
import { NextRequest, NextResponse } from 'next/server';
|
|
import { supabase } from '@/lib/supabase';
|
|
import { ensureAdmin, ensureAuthenticated, getAuthContext, hasProjectAccess } from '@/lib/access-control';
|
|
|
|
export async function GET(
|
|
request: NextRequest,
|
|
{ params }: { params: { id: string } }
|
|
) {
|
|
const ctx = await getAuthContext(request);
|
|
const auth = ensureAuthenticated(ctx);
|
|
if (!auth.ok) {
|
|
return NextResponse.json({ error: auth.error }, { status: auth.status });
|
|
}
|
|
if (!hasProjectAccess(ctx!, params.id)) {
|
|
return NextResponse.json({ error: '无权限' }, { status: 403 });
|
|
}
|
|
|
|
const { data, error } = await supabase
|
|
.from('projects')
|
|
.select(`
|
|
*,
|
|
owner:users!projects_owner_id_fkey(id, name, role, avatar_url),
|
|
pm:users!projects_pm_id_fkey(id, name, role, avatar_url)
|
|
`)
|
|
.eq('id', params.id)
|
|
.maybeSingle();
|
|
|
|
if (error) {
|
|
return NextResponse.json({ error: error.message }, { status: 500 });
|
|
}
|
|
|
|
if (!data) {
|
|
return NextResponse.json({ error: '项目不存在' }, { status: 404 });
|
|
}
|
|
|
|
const { data: members } = await supabase
|
|
.from('project_members')
|
|
.select('user_id, users(id, name, role, avatar_url)')
|
|
.eq('project_id', params.id);
|
|
|
|
return NextResponse.json({ ...data, members: members || [] });
|
|
}
|
|
|
|
export async function PATCH(
|
|
request: NextRequest,
|
|
{ params }: { params: { id: string } }
|
|
) {
|
|
const ctx = await getAuthContext(request);
|
|
const auth = ensureAdmin(ctx);
|
|
if (!auth.ok) {
|
|
return NextResponse.json({ error: auth.error }, { status: auth.status });
|
|
}
|
|
|
|
const body = await request.json();
|
|
const { name, description, owner_id, pm_id, project_type, status, member_ids } = body;
|
|
|
|
const updateData: Record<string, unknown> = { updated_at: new Date().toISOString() };
|
|
if (name !== undefined) updateData.name = name;
|
|
if (description !== undefined) updateData.description = description;
|
|
if (owner_id !== undefined) updateData.owner_id = owner_id;
|
|
if (pm_id !== undefined) updateData.pm_id = pm_id;
|
|
if (project_type !== undefined) updateData.project_type = project_type;
|
|
if (status !== undefined) updateData.status = status;
|
|
|
|
const { data, error } = await supabase
|
|
.from('projects')
|
|
.update(updateData)
|
|
.eq('id', params.id)
|
|
.select()
|
|
.single();
|
|
|
|
if (error) {
|
|
return NextResponse.json({ error: error.message }, { status: 500 });
|
|
}
|
|
|
|
if (member_ids !== undefined) {
|
|
await supabase.from('project_members').delete().eq('project_id', params.id);
|
|
|
|
if (member_ids.length > 0) {
|
|
const memberRecords = member_ids.map((userId: string) => ({
|
|
project_id: params.id,
|
|
user_id: userId,
|
|
}));
|
|
await supabase.from('project_members').insert(memberRecords);
|
|
}
|
|
}
|
|
|
|
return NextResponse.json(data);
|
|
}
|
|
|
|
export async function DELETE(
|
|
request: NextRequest,
|
|
{ params }: { params: { id: string } }
|
|
) {
|
|
const ctx = await getAuthContext(request);
|
|
const auth = ensureAdmin(ctx);
|
|
if (!auth.ok) {
|
|
return NextResponse.json({ error: auth.error }, { status: auth.status });
|
|
}
|
|
|
|
const { error } = await supabase
|
|
.from('projects')
|
|
.delete()
|
|
.eq('id', params.id);
|
|
|
|
if (error) {
|
|
return NextResponse.json({ error: error.message }, { status: 500 });
|
|
}
|
|
|
|
return NextResponse.json({ success: true });
|
|
}
|