fix: use real settings data boundaries

2026-07-02 19:53:41 -07:00
parent 1cdf89c608
commit 5412bbb143
14 changed files with 414 additions and 170 deletions
--- a/app/api/organizations/[id]/route.ts
+++ b/app/api/organizations/[id]/route.ts
@@ -37,6 +37,10 @@ function readStatus(value: unknown): OrganizationStatus | null {
  return ORGANIZATION_STATUSES.find((status) => status === value) ?? null;
 }

+function isValidSlug(value: string): boolean {
+  return /^[a-z0-9][a-z0-9-]{1,47}$/.test(value) && !value.endsWith("-");
+}
+
 export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
  const { id } = await context.params;
  const auth = await requirePermission("organization:manage", {
@@ -55,7 +59,7 @@ export async function PATCH(request: Request, context: RouteContext): Promise<Re
  }

  const name = readString(body, "name");
-  const slug = readString(body, "slug");
+  const slug = readString(body, "slug").toLowerCase();
  const oidcIssuerUrl = readString(body, "oidcIssuerUrl");
  const oidcClientId = readString(body, "oidcClientId");
  const oidcClientSecret = readString(body, "oidcClientSecret");
@@ -66,6 +70,12 @@ export async function PATCH(request: Request, context: RouteContext): Promise<Re
  if ("status" in body && !status) {
    return jsonFailure("机构状态无效");
  }
+  if ("slug" in body && !slug) {
+    return jsonFailure("机构标识不能为空");
+  }
+  if (slug && !isValidSlug(slug)) {
+    return jsonFailure("机构标识仅支持小写字母、数字和连字符，长度 2-48 位，且不能以连字符结尾");
+  }
  const registrationEnabled = "registrationEnabled" in body ? readBoolean(body, "registrationEnabled") : null;
  const oidcEnabled = "oidcEnabled" in body ? readBoolean(body, "oidcEnabled") : null;
  const oidcAutoProvision = "oidcAutoProvision" in body ? readBoolean(body, "oidcAutoProvision") : null;
--- a/app/api/organizations/route.ts
+++ b/app/api/organizations/route.ts
@@ -17,14 +17,8 @@ function readString(source: Record<string, unknown>, key: string): string {
  return typeof value === "string" ? value.trim() : "";
 }

-function createSlug(name: string): string {
-  const base = name
-    .trim()
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-|-$/g, "");
-
-  return base.length > 0 ? base : `org-${Date.now()}`;
+function isValidSlug(value: string): boolean {
+  return /^[a-z0-9][a-z0-9-]{1,47}$/.test(value) && !value.endsWith("-");
 }

 export async function GET(): Promise<Response> {
@@ -76,31 +70,47 @@ export async function POST(request: Request): Promise<Response> {
  if (!name) {
    return jsonFailure("机构名称不能为空");
  }
-
-  const database = getDatabase();
-  const rows = await database
-    .insert(organizations)
-    .values({
-      name,
-      slug: readString(body, "slug") || createSlug(name),
-      status: "active",
-    })
-    .returning();
-  const organization = rows[0];
-  if (!organization) {
-    return jsonFailure("机构创建失败", 500);
+  const slug = readString(body, "slug").toLowerCase();
+  if (!slug) {
+    return jsonFailure("机构标识不能为空");
+  }
+  if (!isValidSlug(slug)) {
+    return jsonFailure("机构标识仅支持小写字母、数字和连字符，长度 2-48 位，且不能以连字符结尾");
  }

-  await seedOrganizationRoles(organization.id);
-  await recordAuditLog({
-    actor: auth.context.account,
-    organizationId: organization.id,
-    action: "organization.create",
-    targetType: "organization",
-    targetId: organization.id,
-    result: "success",
-    reason: `创建机构：${organization.name}`,
-  });
+  const database = getDatabase();
+  try {
+    const rows = await database
+      .insert(organizations)
+      .values({
+        name,
+        slug,
+        status: "active",
+      })
+      .returning();
+    const organization = rows[0];
+    if (!organization) {
+      return jsonFailure("机构创建失败", 500);
+    }

-  return jsonSuccess("机构已创建", { organization }, 201);
+    await seedOrganizationRoles(organization.id);
+    await recordAuditLog({
+      actor: auth.context.account,
+      organizationId: organization.id,
+      action: "organization.create",
+      targetType: "organization",
+      targetId: organization.id,
+      result: "success",
+      reason: `创建机构：${organization.name}`,
+    });
+
+    return jsonSuccess("机构已创建", { organization }, 201);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "";
+    if (message.includes("organizations_slug_unique")) {
+      return jsonFailure("机构标识已存在", 409);
+    }
+
+    return jsonFailure("机构创建失败", 500);
+  }
 }
--- a/app/api/settings/accounts/route.ts
+++ b/app/api/settings/accounts/route.ts
@@ -6,7 +6,11 @@ import { recordAuditLog } from "@/modules/core/server/audit";
 import { getDatabase } from "@/modules/core/server/db";
 import { getRoleDefinitions, hasPermission } from "@/modules/core/server/permissions";
 import { accounts, memberships, organizations, roles } from "@/modules/core/server/schema";
-import { readData } from "@/modules/core/server/store";
+import {
+  listSettingsAccounts,
+  listSettingsMemberships,
+  listSettingsOrganizations,
+} from "@/modules/core/server/settings";

 function isRecord(value: unknown): value is Record<string, unknown> {
  return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -27,35 +31,30 @@ export async function GET(): Promise<Response> {
    return auth.response;
  }

-  const data = await readData();
-  const canReadAllAccounts = hasPermission(auth.context.permissions, "platform:manage");
-  const organizationId = auth.context.organization?.id;
-  const roleDefinitions = await getRoleDefinitions(organizationId);
+  const canReadAllAccounts = Boolean(auth.context.account.platformRoleId) || hasPermission(auth.context.permissions, "platform:manage");
+  const organizationId = canReadAllAccounts ? undefined : auth.context.organization?.id;
+  const [accountRows, membershipRows, organizationRows, roleDefinitions] = await Promise.all([
+    listSettingsAccounts(organizationId ? { organizationId } : {}),
+    listSettingsMemberships(organizationId ? { organizationId } : {}),
+    listSettingsOrganizations(organizationId ? { organizationId } : {}),
+    getRoleDefinitions(auth.context.organization?.id),
+  ]);
  const roleById = new Map(roleDefinitions.map((role) => [role.id, role]));
-  const organizationById = new Map(data.organizations.map((organization) => [organization.id, organization]));
-  const scopedAccountIds =
-    organizationId && !canReadAllAccounts
-      ? new Set(
-          data.memberships
-            .filter((membership) => membership.organizationId === organizationId)
-            .map((membership) => membership.accountId),
-        )
-      : null;
+  const organizationById = new Map(organizationRows.map((organization) => [organization.id, organization]));

  return jsonSuccess("账号列表已加载", {
-    accounts: data.accounts
-      .filter((account) => !scopedAccountIds || scopedAccountIds.has(account.id))
-      .map((account) => {
-        const membership = organizationId
-          ? data.memberships.find(
-              (item) => item.accountId === account.id && item.organizationId === organizationId && item.status === "active",
+    accounts: accountRows.map((account) => {
+      const membership = auth.context.organization?.id
+        ? membershipRows.find(
+            (item) =>
+              item.accountId === account.id && item.organizationId === auth.context.organization?.id && item.status === "active",
            )
-          : data.memberships.find((item) => item.accountId === account.id && item.status === "active");
-        const organization = membership ? organizationById.get(membership.organizationId) : undefined;
-        const platformRole = account.platformRoleId ? roleById.get(account.platformRoleId) : undefined;
+        : membershipRows.find((item) => item.accountId === account.id && item.status === "active");
+      const organization = membership ? organizationById.get(membership.organizationId) : undefined;
+      const platformRole = account.platformRoleId ? roleById.get(account.platformRoleId) : undefined;

-        return toPublicAccount(account, platformRole?.key ?? membership?.roleKey, organization);
-      }),
+      return toPublicAccount(account, platformRole?.key ?? membership?.roleKey, organization);
+    }),
  });
 }

--- a/app/api/settings/join-requests/route.ts
+++ b/app/api/settings/join-requests/route.ts
@@ -1,6 +1,6 @@
 import { jsonSuccess } from "@/modules/core/server/api";
 import { requirePermission } from "@/modules/core/server/auth";
-import { readData } from "@/modules/core/server/store";
+import { listSettingsJoinRequests } from "@/modules/core/server/settings";

 export async function GET(): Promise<Response> {
  const auth = await requirePermission("account:read", {
@@ -12,12 +12,9 @@ export async function GET(): Promise<Response> {
    return auth.response;
  }

-  const data = await readData();
-  const organizationId = auth.context.organization?.id;
+  const organizationId = auth.context.account.platformRoleId ? undefined : auth.context.organization?.id;

  return jsonSuccess("加入申请已加载", {
-    joinRequests: organizationId
-      ? data.joinRequests.filter((request) => request.organizationId === organizationId)
-      : data.joinRequests,
+    joinRequests: await listSettingsJoinRequests(organizationId ? { organizationId } : {}),
  });
 }