104 lines
3.0 KiB
TypeScript
104 lines
3.0 KiB
TypeScript
import { randomBytes } from "node:crypto";
|
|
|
|
import { and, eq } from "drizzle-orm";
|
|
|
|
import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
|
|
import { recordAuditLog } from "@/modules/core/server/audit";
|
|
import { requirePermission } from "@/modules/core/server/auth";
|
|
import { getDatabase } from "@/modules/core/server/db";
|
|
import { organizationInvitations, organizations, roles } from "@/modules/core/server/schema";
|
|
|
|
type RouteContext = {
|
|
params: Promise<{
|
|
id: string;
|
|
}>;
|
|
};
|
|
|
|
function isRecord(value: unknown): value is Record<string, unknown> {
|
|
return typeof value === "object" && value !== null && !Array.isArray(value);
|
|
}
|
|
|
|
function readString(source: Record<string, unknown>, key: string): string {
|
|
const value = source[key];
|
|
return typeof value === "string" ? value.trim() : "";
|
|
}
|
|
|
|
function createInvitationToken(): string {
|
|
return randomBytes(24).toString("base64url");
|
|
}
|
|
|
|
export async function POST(request: Request, context: RouteContext): Promise<Response> {
|
|
const { id } = await context.params;
|
|
const auth = await requirePermission("account:manage", {
|
|
action: "organizationInvitation.create",
|
|
targetType: "organization",
|
|
targetId: id,
|
|
});
|
|
|
|
if (!auth.success) {
|
|
return auth.response;
|
|
}
|
|
|
|
const activeOrganizationId = auth.context.organization?.id;
|
|
if (activeOrganizationId && activeOrganizationId !== id) {
|
|
return jsonFailure("不能为其他机构创建邀请", 403);
|
|
}
|
|
|
|
const body = await readJsonBody(request);
|
|
if (!isRecord(body)) {
|
|
return jsonFailure("请求数据格式无效");
|
|
}
|
|
|
|
const email = readString(body, "email");
|
|
const roleId = readString(body, "roleId");
|
|
if (!roleId) {
|
|
return jsonFailure("请选择邀请角色");
|
|
}
|
|
|
|
const database = getDatabase();
|
|
const organizationRows = await database.select().from(organizations).where(eq(organizations.id, id)).limit(1);
|
|
const organization = organizationRows[0];
|
|
if (!organization) {
|
|
return jsonFailure("机构不存在", 404);
|
|
}
|
|
|
|
const roleRows = await database
|
|
.select()
|
|
.from(roles)
|
|
.where(and(eq(roles.id, roleId), eq(roles.organizationId, id), eq(roles.isEnabled, true)))
|
|
.limit(1);
|
|
const role = roleRows[0];
|
|
if (!role) {
|
|
return jsonFailure("角色不存在", 404);
|
|
}
|
|
|
|
const rows = await database
|
|
.insert(organizationInvitations)
|
|
.values({
|
|
organizationId: id,
|
|
roleId: role.id,
|
|
email,
|
|
token: createInvitationToken(),
|
|
status: "active",
|
|
createdByAccountId: auth.context.account.id,
|
|
expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
|
|
})
|
|
.returning();
|
|
const invitation = rows[0];
|
|
if (!invitation) {
|
|
return jsonFailure("邀请创建失败", 500);
|
|
}
|
|
|
|
await recordAuditLog({
|
|
actor: auth.context.account,
|
|
organizationId: id,
|
|
action: "organizationInvitation.create",
|
|
targetType: "organizationInvitation",
|
|
targetId: invitation.id,
|
|
result: "success",
|
|
reason: `创建机构邀请：${email || "通用邀请"}`,
|
|
});
|
|
|
|
return jsonSuccess("邀请已创建", { invitation }, 201);
|
|
}
|