feat: add full-stack API persistence and RBAC
This commit is contained in:
32
modules/core/server/api.ts
Normal file
32
modules/core/server/api.ts
Normal file
@@ -0,0 +1,32 @@
|
||||
export type ApiFailure = {
|
||||
success: false;
|
||||
reason: string;
|
||||
};
|
||||
|
||||
export type ApiSuccess<T extends Record<string, unknown>> = {
|
||||
success: true;
|
||||
reason: string;
|
||||
} & T;
|
||||
|
||||
export type ApiResult<T extends Record<string, unknown>> = ApiSuccess<T> | ApiFailure;
|
||||
|
||||
export function jsonSuccess<T extends Record<string, unknown>>(
|
||||
reason: string,
|
||||
payload: T,
|
||||
status = 200,
|
||||
): Response {
|
||||
return Response.json({ success: true, reason, ...payload }, { status });
|
||||
}
|
||||
|
||||
export function jsonFailure(reason: string, status = 400): Response {
|
||||
return Response.json({ success: false, reason }, { status });
|
||||
}
|
||||
|
||||
export async function readJsonBody(request: Request): Promise<unknown> {
|
||||
try {
|
||||
return await request.json();
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
35
modules/core/server/audit.ts
Normal file
35
modules/core/server/audit.ts
Normal file
@@ -0,0 +1,35 @@
|
||||
import { randomUUID } from "node:crypto";
|
||||
|
||||
import type { AuditLog, AuditResult, PublicAccount } from "@/modules/core/types";
|
||||
import { updateData } from "@/modules/core/server/store";
|
||||
|
||||
type AuditInput = {
|
||||
actor?: PublicAccount;
|
||||
action: string;
|
||||
targetType: string;
|
||||
targetId?: string;
|
||||
result: AuditResult;
|
||||
reason: string;
|
||||
};
|
||||
|
||||
export async function recordAuditLog(input: AuditInput): Promise<AuditLog> {
|
||||
const timestamp = new Date().toISOString();
|
||||
|
||||
return await updateData((data) => {
|
||||
const nextLog: AuditLog = {
|
||||
id: randomUUID(),
|
||||
timestamp,
|
||||
actorAccountId: input.actor?.id,
|
||||
actorEmail: input.actor?.email,
|
||||
action: input.action,
|
||||
targetType: input.targetType,
|
||||
targetId: input.targetId,
|
||||
result: input.result,
|
||||
reason: input.reason,
|
||||
};
|
||||
|
||||
data.auditLogs = [nextLog, ...data.auditLogs].slice(0, 500);
|
||||
return nextLog;
|
||||
});
|
||||
}
|
||||
|
||||
205
modules/core/server/auth.ts
Normal file
205
modules/core/server/auth.ts
Normal file
@@ -0,0 +1,205 @@
|
||||
import { randomBytes, randomUUID, scryptSync, timingSafeEqual } from "node:crypto";
|
||||
|
||||
import { cookies } from "next/headers";
|
||||
|
||||
import type { Account, AuthContext, Permission, PublicAccount, RoleId, Session } from "@/modules/core/types";
|
||||
import { jsonFailure } from "@/modules/core/server/api";
|
||||
import { recordAuditLog } from "@/modules/core/server/audit";
|
||||
import { getPermissionsForRole, hasPermission } from "@/modules/core/server/permissions";
|
||||
import { readData, updateData } from "@/modules/core/server/store";
|
||||
|
||||
const SESSION_COOKIE = "teatea_session";
|
||||
const SESSION_MAX_AGE_SECONDS = 60 * 60 * 24 * 7;
|
||||
|
||||
export function normalizeEmail(email: string): string {
|
||||
return email.trim().toLowerCase();
|
||||
}
|
||||
|
||||
export function toPublicAccount(account: Account): PublicAccount {
|
||||
return {
|
||||
id: account.id,
|
||||
name: account.name,
|
||||
email: account.email,
|
||||
role: account.role,
|
||||
organization: account.organization,
|
||||
status: account.status,
|
||||
createdAt: account.createdAt,
|
||||
updatedAt: account.updatedAt,
|
||||
};
|
||||
}
|
||||
|
||||
export function hashPassword(password: string, salt = randomBytes(16).toString("hex")): {
|
||||
hash: string;
|
||||
salt: string;
|
||||
} {
|
||||
return {
|
||||
hash: scryptSync(password, salt, 64).toString("hex"),
|
||||
salt,
|
||||
};
|
||||
}
|
||||
|
||||
export function verifyPassword(password: string, account: Account): boolean {
|
||||
const candidate = Buffer.from(hashPassword(password, account.passwordSalt).hash, "hex");
|
||||
const stored = Buffer.from(account.passwordHash, "hex");
|
||||
|
||||
if (candidate.length !== stored.length) {
|
||||
return false;
|
||||
}
|
||||
|
||||
return timingSafeEqual(candidate, stored);
|
||||
}
|
||||
|
||||
export function createAccountRecord(input: {
|
||||
name: string;
|
||||
email: string;
|
||||
password: string;
|
||||
role: RoleId;
|
||||
organization?: string;
|
||||
}): Account {
|
||||
const now = new Date().toISOString();
|
||||
const password = hashPassword(input.password);
|
||||
|
||||
return {
|
||||
id: randomUUID(),
|
||||
name: input.name.trim(),
|
||||
email: normalizeEmail(input.email),
|
||||
role: input.role,
|
||||
organization: input.organization?.trim(),
|
||||
passwordHash: password.hash,
|
||||
passwordSalt: password.salt,
|
||||
status: "active",
|
||||
createdAt: now,
|
||||
updatedAt: now,
|
||||
};
|
||||
}
|
||||
|
||||
export function createSessionRecord(accountId: string): Session {
|
||||
const now = new Date();
|
||||
const expiresAt = new Date(now.getTime() + SESSION_MAX_AGE_SECONDS * 1000);
|
||||
|
||||
return {
|
||||
id: randomUUID(),
|
||||
accountId,
|
||||
createdAt: now.toISOString(),
|
||||
expiresAt: expiresAt.toISOString(),
|
||||
};
|
||||
}
|
||||
|
||||
export async function setSessionCookie(sessionId: string): Promise<void> {
|
||||
const cookieStore = await cookies();
|
||||
cookieStore.set({
|
||||
name: SESSION_COOKIE,
|
||||
value: sessionId,
|
||||
httpOnly: true,
|
||||
sameSite: "lax",
|
||||
path: "/",
|
||||
maxAge: SESSION_MAX_AGE_SECONDS,
|
||||
});
|
||||
}
|
||||
|
||||
export async function clearSessionCookie(): Promise<void> {
|
||||
const cookieStore = await cookies();
|
||||
cookieStore.delete(SESSION_COOKIE);
|
||||
}
|
||||
|
||||
export async function getBootstrapState(): Promise<{ setupRequired: boolean }> {
|
||||
const data = await readData();
|
||||
return { setupRequired: data.accounts.length === 0 };
|
||||
}
|
||||
|
||||
export async function getCurrentAuthContext(): Promise<AuthContext | null> {
|
||||
const cookieStore = await cookies();
|
||||
const sessionId = cookieStore.get(SESSION_COOKIE)?.value;
|
||||
|
||||
if (!sessionId) {
|
||||
return null;
|
||||
}
|
||||
|
||||
const data = await readData();
|
||||
const session = data.sessions.find((item) => item.id === sessionId);
|
||||
if (!session || Date.parse(session.expiresAt) <= Date.now()) {
|
||||
return null;
|
||||
}
|
||||
|
||||
const account = data.accounts.find((item) => item.id === session.accountId);
|
||||
if (!account || account.status !== "active") {
|
||||
return null;
|
||||
}
|
||||
|
||||
return {
|
||||
account: toPublicAccount(account),
|
||||
permissions: getPermissionsForRole(account.role),
|
||||
session,
|
||||
};
|
||||
}
|
||||
|
||||
export async function removeCurrentSession(): Promise<PublicAccount | null> {
|
||||
const context = await getCurrentAuthContext();
|
||||
const cookieStore = await cookies();
|
||||
const sessionId = cookieStore.get(SESSION_COOKIE)?.value;
|
||||
|
||||
if (sessionId) {
|
||||
await updateData((data) => {
|
||||
data.sessions = data.sessions.filter((item) => item.id !== sessionId);
|
||||
});
|
||||
}
|
||||
|
||||
await clearSessionCookie();
|
||||
return context?.account ?? null;
|
||||
}
|
||||
|
||||
type PermissionCheckSuccess = {
|
||||
success: true;
|
||||
context: AuthContext;
|
||||
};
|
||||
|
||||
type PermissionCheckFailure = {
|
||||
success: false;
|
||||
response: Response;
|
||||
};
|
||||
|
||||
type DeniedAuditContext = {
|
||||
action: string;
|
||||
targetType: string;
|
||||
targetId?: string;
|
||||
};
|
||||
|
||||
export async function requirePermission(
|
||||
permission: Permission,
|
||||
auditContext: DeniedAuditContext,
|
||||
): Promise<PermissionCheckSuccess | PermissionCheckFailure> {
|
||||
const context = await getCurrentAuthContext();
|
||||
|
||||
if (!context) {
|
||||
await recordAuditLog({
|
||||
action: auditContext.action,
|
||||
targetType: auditContext.targetType,
|
||||
targetId: auditContext.targetId,
|
||||
result: "denied",
|
||||
reason: "未登录或会话已过期",
|
||||
});
|
||||
|
||||
return {
|
||||
success: false,
|
||||
response: jsonFailure("未登录或会话已过期", 401),
|
||||
};
|
||||
}
|
||||
|
||||
if (!hasPermission(context.account.role, permission)) {
|
||||
await recordAuditLog({
|
||||
actor: context.account,
|
||||
action: auditContext.action,
|
||||
targetType: auditContext.targetType,
|
||||
targetId: auditContext.targetId,
|
||||
result: "denied",
|
||||
reason: `缺少权限：${permission}`,
|
||||
});
|
||||
|
||||
return {
|
||||
success: false,
|
||||
response: jsonFailure("权限不足", 403),
|
||||
};
|
||||
}
|
||||
|
||||
return { success: true, context };
|
||||
}
|
||||
59
modules/core/server/permissions.ts
Normal file
59
modules/core/server/permissions.ts
Normal file
@@ -0,0 +1,59 @@
|
||||
import type { Permission, RoleDefinition, RoleId } from "@/modules/core/types";
|
||||
import { ROLE_LABELS } from "@/modules/core/types";
|
||||
|
||||
export const ROLE_DEFINITIONS: RoleDefinition[] = [
|
||||
{
|
||||
id: "admin",
|
||||
label: ROLE_LABELS.admin,
|
||||
description: "管理账号、权限、审计日志与全部业务数据。",
|
||||
permissions: [
|
||||
"account:read",
|
||||
"account:manage",
|
||||
"audit:read",
|
||||
"elder:read",
|
||||
"elder:create",
|
||||
"elder:update",
|
||||
"elder:delete",
|
||||
],
|
||||
},
|
||||
{
|
||||
id: "manager",
|
||||
label: ROLE_LABELS.manager,
|
||||
description: "处理运营业务，可查看账号与审计日志，不管理账号角色。",
|
||||
permissions: ["account:read", "audit:read", "elder:read", "elder:create", "elder:update", "elder:delete"],
|
||||
},
|
||||
{
|
||||
id: "caregiver",
|
||||
label: ROLE_LABELS.caregiver,
|
||||
description: "查看老人档案并维护照护相关信息。",
|
||||
permissions: ["elder:read", "elder:update"],
|
||||
},
|
||||
{
|
||||
id: "viewer",
|
||||
label: ROLE_LABELS.viewer,
|
||||
description: "只读查看老人档案。",
|
||||
permissions: ["elder:read"],
|
||||
},
|
||||
];
|
||||
|
||||
export function getRoleDefinition(role: RoleId): RoleDefinition {
|
||||
const roleDefinition = ROLE_DEFINITIONS.find((item) => item.id === role);
|
||||
if (roleDefinition) {
|
||||
return roleDefinition;
|
||||
}
|
||||
|
||||
return {
|
||||
id: "viewer",
|
||||
label: ROLE_LABELS.viewer,
|
||||
description: "只读查看老人档案。",
|
||||
permissions: ["elder:read"],
|
||||
};
|
||||
}
|
||||
|
||||
export function getPermissionsForRole(role: RoleId): Permission[] {
|
||||
return [...getRoleDefinition(role).permissions];
|
||||
}
|
||||
|
||||
export function hasPermission(role: RoleId, permission: Permission): boolean {
|
||||
return getRoleDefinition(role).permissions.includes(permission);
|
||||
}
|
||||
63
modules/core/server/store.ts
Normal file
63
modules/core/server/store.ts
Normal file
@@ -0,0 +1,63 @@
|
||||
import { promises as fs } from "node:fs";
|
||||
import path from "node:path";
|
||||
|
||||
import type { AppData } from "@/modules/core/types";
|
||||
|
||||
const DATA_DIR = process.env.TEATEA_DATA_DIR ?? path.join(process.cwd(), ".data");
|
||||
const DATA_FILE = path.join(DATA_DIR, "teatea.json");
|
||||
|
||||
function createEmptyData(): AppData {
|
||||
return {
|
||||
accounts: [],
|
||||
sessions: [],
|
||||
elders: [],
|
||||
auditLogs: [],
|
||||
};
|
||||
}
|
||||
|
||||
function normalizeData(data: Partial<AppData>): AppData {
|
||||
return {
|
||||
accounts: Array.isArray(data.accounts) ? data.accounts : [],
|
||||
sessions: Array.isArray(data.sessions) ? data.sessions : [],
|
||||
elders: Array.isArray(data.elders) ? data.elders : [],
|
||||
auditLogs: Array.isArray(data.auditLogs) ? data.auditLogs : [],
|
||||
};
|
||||
}
|
||||
|
||||
function isMissingFileError(error: unknown): boolean {
|
||||
return (
|
||||
typeof error === "object" &&
|
||||
error !== null &&
|
||||
"code" in error &&
|
||||
(error as { code?: unknown }).code === "ENOENT"
|
||||
);
|
||||
}
|
||||
|
||||
export async function readData(): Promise<AppData> {
|
||||
try {
|
||||
const raw = await fs.readFile(DATA_FILE, "utf8");
|
||||
const parsed = JSON.parse(raw) as Partial<AppData>;
|
||||
return normalizeData(parsed);
|
||||
} catch (error) {
|
||||
if (isMissingFileError(error)) {
|
||||
return createEmptyData();
|
||||
}
|
||||
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
export async function writeData(data: AppData): Promise<void> {
|
||||
await fs.mkdir(DATA_DIR, { recursive: true });
|
||||
const temporaryFile = `${DATA_FILE}.tmp`;
|
||||
await fs.writeFile(temporaryFile, JSON.stringify(data, null, 2), "utf8");
|
||||
await fs.rename(temporaryFile, DATA_FILE);
|
||||
}
|
||||
|
||||
export async function updateData<T>(mutator: (data: AppData) => T): Promise<T> {
|
||||
const data = await readData();
|
||||
const result = mutator(data);
|
||||
await writeData(data);
|
||||
return result;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user