feat: add full-stack API persistence and RBAC

app/api/elders/[id]/route.ts

@@ -0,0 +1,99 @@
+import { validateElderInput } from "@/modules/elders/types";
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { updateData } from "@/modules/core/server/store";
+
+type RouteContext = {
+  params: Promise<{
+    id: string;
+  }>;
+};
+
+export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("elder:update", {
+    action: "elder.update",
+    targetType: "elder",
+    targetId: id,
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const input = validateElderInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const updated = await updateData((data) => {
+    const elder = data.elders.find((item) => item.id === id);
+    if (!elder) {
+      return null;
+    }
+
+    const nextElder = {
+      ...elder,
+      ...input.data,
+      updatedAt: new Date().toISOString(),
+    };
+
+    data.elders = data.elders.map((item) => (item.id === id ? nextElder : item));
+    return nextElder;
+  });
+
+  if (!updated) {
+    return jsonFailure("老人档案不存在", 404);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    action: "elder.update",
+    targetType: "elder",
+    targetId: updated.id,
+    result: "success",
+    reason: `更新老人档案：${updated.name}`,
+  });
+
+  return jsonSuccess("老人档案已更新", { elder: updated });
+}
+
+export async function DELETE(_request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("elder:delete", {
+    action: "elder.delete",
+    targetType: "elder",
+    targetId: id,
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const deleted = await updateData((data) => {
+    const elder = data.elders.find((item) => item.id === id);
+    if (!elder) {
+      return null;
+    }
+
+    data.elders = data.elders.filter((item) => item.id !== id);
+    return elder;
+  });
+
+  if (!deleted) {
+    return jsonFailure("老人档案不存在", 404);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    action: "elder.delete",
+    targetType: "elder",
+    targetId: deleted.id,
+    result: "success",
+    reason: `删除老人档案：${deleted.name}`,
+  });
+
+  return jsonSuccess("老人档案已删除", { elder: deleted });
+}
+