feat: split settings management pages

app/api/settings/accounts/[id]/route.ts

@@ -0,0 +1,240 @@
+import { and, eq } from "drizzle-orm";
+
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission, toPublicAccount } from "@/modules/core/server/auth";
+import { getDatabase } from "@/modules/core/server/db";
+import { hasPermission } from "@/modules/core/server/permissions";
+import { accounts, memberships, organizations, roles, sessions } from "@/modules/core/server/schema";
+import type { AccountStatus, Organization } from "@/modules/core/types";
+
+type RouteContext = {
+  params: Promise<{
+    id: string;
+  }>;
+};
+
+const ACCOUNT_STATUSES: AccountStatus[] = ["active", "disabled", "pending"];
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readString(source: Record<string, unknown>, key: string): string {
+  const value = source[key];
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function readStatus(value: unknown): AccountStatus | null {
+  if (typeof value !== "string") {
+    return null;
+  }
+
+  return ACCOUNT_STATUSES.find((status) => status === value) ?? null;
+}
+
+function toOrganization(row: typeof organizations.$inferSelect): Organization {
+  return {
+    id: row.id,
+    name: row.name,
+    slug: row.slug,
+    status: row.status,
+    createdAt: row.createdAt.toISOString(),
+    updatedAt: row.updatedAt.toISOString(),
+  };
+}
+
+export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("account:manage", {
+    action: "account.update",
+    targetType: "account",
+    targetId: id,
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const body = await readJsonBody(request);
+  if (!isRecord(body)) {
+    return jsonFailure("请求数据格式无效");
+  }
+
+  const name = readString(body, "name");
+  const status = "status" in body ? readStatus(body.status) : null;
+  const roleId = readString(body, "roleId");
+  const requestedOrganizationId = readString(body, "organizationId");
+  const organizationId = requestedOrganizationId || auth.context.organization?.id;
+
+  if ("status" in body && !status) {
+    return jsonFailure("账号状态无效");
+  }
+
+  if (!name && !status && !roleId) {
+    return jsonFailure("请至少填写一个要更新的字段");
+  }
+
+  if (id === auth.context.account.id && status === "disabled") {
+    return jsonFailure("不能停用当前登录账号", 400);
+  }
+
+  const canManagePlatform = hasPermission(auth.context.permissions, "platform:manage");
+  if (!canManagePlatform && requestedOrganizationId && requestedOrganizationId !== auth.context.organization?.id) {
+    return jsonFailure("权限不足", 403);
+  }
+
+  const database = getDatabase();
+  const targetAccountRows = await database.select().from(accounts).where(eq(accounts.id, id)).limit(1);
+  const targetAccount = targetAccountRows[0];
+  if (!targetAccount) {
+    return jsonFailure("账号不存在", 404);
+  }
+
+  if (roleId && !organizationId) {
+    return jsonFailure("请选择机构后分配角色", 400);
+  }
+
+  const organizationRows = organizationId
+    ? await database.select().from(organizations).where(eq(organizations.id, organizationId)).limit(1)
+    : [];
+  const organization = organizationRows[0];
+  if (roleId && !organization) {
+    return jsonFailure("机构不存在", 404);
+  }
+
+  try {
+    await database.transaction(async (transaction) => {
+      if (name || status) {
+        const updateValues: {
+          name?: string;
+          status?: AccountStatus;
+          updatedAt: Date;
+        } = {
+          updatedAt: new Date(),
+        };
+        if (name) {
+          updateValues.name = name;
+        }
+        if (status) {
+          updateValues.status = status;
+        }
+
+        await transaction.update(accounts).set(updateValues).where(eq(accounts.id, id));
+        if (status === "disabled") {
+          await transaction.delete(sessions).where(eq(sessions.accountId, id));
+        }
+      }
+
+      if (roleId && organizationId) {
+        const roleRows = await transaction
+          .select()
+          .from(roles)
+          .where(and(eq(roles.id, roleId), eq(roles.organizationId, organizationId), eq(roles.isEnabled, true)))
+          .limit(1);
+        const role = roleRows[0];
+        if (!role) {
+          throw new Error("角色不存在");
+        }
+
+        const membershipRows = await transaction
+          .select()
+          .from(memberships)
+          .where(and(eq(memberships.accountId, id), eq(memberships.organizationId, organizationId)))
+          .limit(1);
+        const membership = membershipRows[0];
+
+        if (membership) {
+          await transaction
+            .update(memberships)
+            .set({ roleId, status: "active", updatedAt: new Date() })
+            .where(eq(memberships.id, membership.id));
+        } else {
+          await transaction.insert(memberships).values({
+            accountId: id,
+            organizationId,
+            roleId,
+            status: "active",
+          });
+        }
+      }
+    });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : "账号更新失败";
+    return jsonFailure(reason, reason === "角色不存在" ? 404 : 400);
+  }
+
+  const updatedAccountRows = await database.select().from(accounts).where(eq(accounts.id, id)).limit(1);
+  const updatedAccount = updatedAccountRows[0];
+  if (!updatedAccount) {
+    return jsonFailure("账号不存在", 404);
+  }
+
+  const membershipRows = organizationId
+    ? await database
+        .select({ membership: memberships, role: roles })
+        .from(memberships)
+        .innerJoin(roles, eq(roles.id, memberships.roleId))
+        .where(and(eq(memberships.accountId, id), eq(memberships.organizationId, organizationId)))
+        .limit(1)
+    : [];
+  const membership = membershipRows[0];
+  const publicAccount = toPublicAccount(
+    updatedAccount,
+    membership?.role.key,
+    organization ? toOrganization(organization) : undefined,
+  );
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "account.update",
+    targetType: "account",
+    targetId: updatedAccount.id,
+    result: "success",
+    reason: `更新账号：${updatedAccount.email}`,
+  });
+
+  return jsonSuccess("账号已更新", { account: publicAccount });
+}
+
+export async function DELETE(_request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("account:manage", {
+    action: "account.disable",
+    targetType: "account",
+    targetId: id,
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  if (id === auth.context.account.id) {
+    return jsonFailure("不能停用当前登录账号", 400);
+  }
+
+  const database = getDatabase();
+  const rows = await database
+    .update(accounts)
+    .set({ status: "disabled", updatedAt: new Date() })
+    .where(eq(accounts.id, id))
+    .returning();
+  const account = rows[0];
+  if (!account) {
+    return jsonFailure("账号不存在", 404);
+  }
+  await database.delete(sessions).where(eq(sessions.accountId, id));
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId: auth.context.organization?.id,
+    action: "account.disable",
+    targetType: "account",
+    targetId: account.id,
+    result: "success",
+    reason: `停用账号：${account.email}`,
+  });
+
+  return jsonSuccess("账号已停用", { account: toPublicAccount(account) });
+}

app/api/settings/accounts/route.ts

@@ -4,7 +4,7 @@ import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/ap
 import { hashPassword, normalizeEmail, requirePermission, toPublicAccount } from "@/modules/core/server/auth";
 import { recordAuditLog } from "@/modules/core/server/audit";
 import { getDatabase } from "@/modules/core/server/db";
-import { hasPermission } from "@/modules/core/server/permissions";
+import { getRoleDefinitions, hasPermission } from "@/modules/core/server/permissions";
 import { accounts, memberships, organizations, roles } from "@/modules/core/server/schema";
 import { readData } from "@/modules/core/server/store";
 
@@ -30,6 +30,9 @@ export async function GET(): Promise<Response> {
   const data = await readData();
   const canReadAllAccounts = hasPermission(auth.context.permissions, "platform:manage");
   const organizationId = auth.context.organization?.id;
+  const roleDefinitions = await getRoleDefinitions(organizationId);
+  const roleById = new Map(roleDefinitions.map((role) => [role.id, role]));
+  const organizationById = new Map(data.organizations.map((organization) => [organization.id, organization]));
   const scopedAccountIds =
     organizationId && !canReadAllAccounts
       ? new Set(
@@ -42,7 +45,17 @@ export async function GET(): Promise<Response> {
   return jsonSuccess("账号列表已加载", {
     accounts: data.accounts
       .filter((account) => !scopedAccountIds || scopedAccountIds.has(account.id))
-      .map((account) => toPublicAccount(account)),
+      .map((account) => {
+        const membership = organizationId
+          ? data.memberships.find(
+              (item) => item.accountId === account.id && item.organizationId === organizationId && item.status === "active",
+            )
+          : data.memberships.find((item) => item.accountId === account.id && item.status === "active");
+        const organization = membership ? organizationById.get(membership.organizationId) : undefined;
+        const platformRole = account.platformRoleId ? roleById.get(account.platformRoleId) : undefined;
+
+        return toPublicAccount(account, platformRole?.key ?? membership?.roleKey, organization);
+      }),
   });
 }
 

app/api/settings/roles/[id]/route.ts

@@ -0,0 +1,218 @@
+import { eq } from "drizzle-orm";
+
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { getDatabase } from "@/modules/core/server/db";
+import { getRoleDefinitions, hasPermission } from "@/modules/core/server/permissions";
+import { rolePermissions, roles } from "@/modules/core/server/schema";
+import { PERMISSIONS } from "@/modules/core/types";
+import type { Permission } from "@/modules/core/types";
+
+type RouteContext = {
+  params: Promise<{
+    id: string;
+  }>;
+};
+
+const PERMISSION_SET = new Set<string>(PERMISSIONS);
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readString(source: Record<string, unknown>, key: string): string {
+  const value = source[key];
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function readBoolean(source: Record<string, unknown>, key: string): boolean | null {
+  const value = source[key];
+  return typeof value === "boolean" ? value : null;
+}
+
+function readPermissionArray(source: Record<string, unknown>): Permission[] | null {
+  const value = source.permissions;
+  if (!Array.isArray(value)) {
+    return null;
+  }
+
+  const permissions = value.filter((item): item is string => typeof item === "string");
+  if (permissions.length !== value.length || permissions.some((permission) => !PERMISSION_SET.has(permission))) {
+    return null;
+  }
+
+  return permissions as Permission[];
+}
+
+function createRoleKey(label: string): string {
+  return label.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_|_$/g, "");
+}
+
+async function getEditableRole(id: string, organizationId: string | undefined, canManagePlatform: boolean) {
+  const database = getDatabase();
+  const rows = await database.select().from(roles).where(eq(roles.id, id)).limit(1);
+  const role = rows[0];
+  if (!role) {
+    return { success: false as const, response: jsonFailure("角色不存在", 404) };
+  }
+
+  if (role.isSystem) {
+    return { success: false as const, response: jsonFailure("内置角色不可编辑", 400) };
+  }
+
+  if (!canManagePlatform && role.organizationId !== organizationId) {
+    return { success: false as const, response: jsonFailure("角色不存在", 404) };
+  }
+
+  return { success: true as const, role };
+}
+
+export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("role:manage", {
+    action: "role.update",
+    targetType: "role",
+    targetId: id,
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const body = await readJsonBody(request);
+  if (!isRecord(body)) {
+    return jsonFailure("请求数据格式无效");
+  }
+
+  const organizationId = auth.context.organization?.id;
+  const editable = await getEditableRole(id, organizationId, hasPermission(auth.context.permissions, "platform:manage"));
+  if (!editable.success) {
+    return editable.response;
+  }
+
+  const label = readString(body, "label");
+  const key = readString(body, "key") || (label ? createRoleKey(label) : "");
+  const description = readString(body, "description");
+  const isEnabled = "isEnabled" in body ? readBoolean(body, "isEnabled") : null;
+  if ("isEnabled" in body && isEnabled === null) {
+    return jsonFailure("角色状态无效");
+  }
+
+  const permissions = "permissions" in body ? readPermissionArray(body) : null;
+  if ("permissions" in body && permissions === null) {
+    return jsonFailure("权限列表无效");
+  }
+
+  if (!label && !key && !description && isEnabled === null && permissions === null) {
+    return jsonFailure("请至少填写一个要更新的字段");
+  }
+
+  const updateValues: {
+    label?: string;
+    key?: string;
+    description?: string;
+    isEnabled?: boolean;
+    updatedAt: Date;
+  } = {
+    updatedAt: new Date(),
+  };
+
+  if (label) {
+    updateValues.label = label;
+  }
+  if (key) {
+    updateValues.key = key;
+  }
+  if (description) {
+    updateValues.description = description;
+  }
+  if (isEnabled !== null) {
+    updateValues.isEnabled = isEnabled;
+  }
+
+  const database = getDatabase();
+  try {
+    await database.transaction(async (transaction) => {
+      await transaction.update(roles).set(updateValues).where(eq(roles.id, id));
+      if (permissions) {
+        await transaction.delete(rolePermissions).where(eq(rolePermissions.roleId, id));
+        if (permissions.length > 0) {
+          await transaction.insert(rolePermissions).values(
+            permissions.map((permissionId) => ({
+              roleId: id,
+              permissionId,
+            })),
+          );
+        }
+      }
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "";
+    if (message.includes("roles_key_organization_unique")) {
+      return jsonFailure("角色标识已存在", 409);
+    }
+
+    return jsonFailure("角色更新失败", 500);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId: editable.role.organizationId ?? organizationId,
+    action: "role.update",
+    targetType: "role",
+    targetId: id,
+    result: "success",
+    reason: `更新角色：${label || editable.role.label}`,
+  });
+
+  const roleRows = await getRoleDefinitions(editable.role.organizationId ?? organizationId);
+  const role = roleRows.find((item) => item.id === id);
+  if (!role) {
+    return jsonFailure("角色更新后读取失败", 500);
+  }
+
+  return jsonSuccess("角色已更新", { role });
+}
+
+export async function DELETE(_request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("role:manage", {
+    action: "role.disable",
+    targetType: "role",
+    targetId: id,
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  const editable = await getEditableRole(id, organizationId, hasPermission(auth.context.permissions, "platform:manage"));
+  if (!editable.success) {
+    return editable.response;
+  }
+
+  const database = getDatabase();
+  const rows = await database
+    .update(roles)
+    .set({ isEnabled: false, updatedAt: new Date() })
+    .where(eq(roles.id, id))
+    .returning();
+  const role = rows[0];
+  if (!role) {
+    return jsonFailure("角色不存在", 404);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId: role.organizationId ?? organizationId,
+    action: "role.disable",
+    targetType: "role",
+    targetId: role.id,
+    result: "success",
+    reason: `停用角色：${role.label}`,
+  });
+
+  return jsonSuccess("角色已停用", { role });
+}