wangjia/jiu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 130 Wiki Activity

feat: 新增 superadmin 角色和数据清空功能

Browse Source 
后端：
- User.Role enum 增加 superadmin，启动时 ALTER TABLE 兼容已有 DB
- 新增 SuperAdminOnly() 中间件
- 新增 POST /api/v1/admin/clear-data 接口（按表名白名单删除，多租户隔离）

前端：
- AppUser/AuthUser 支持 role 字段持久化与传递
- 数据导入 Tab 末尾增加「危险操作 — 数据清空」区块（仅 superadmin 可见）
- 支持多选：入库单/出库单/库存管理/商品详情/往来单位
- 红色警告框 + 二次确认弹窗（需手动输入"确认清空"）

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
wangjia
2026-05-19 01:07:56 +08:00
parent 56e0d9d5b2
commit 86738c903e
10 changed files with 351 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/internal/handler/admin.go
+60
View File
@@ -0,0 +1,60 @@
package handler
import (
"net/http"
"github.com/gin-gonic/gin"
"gorm.io/gorm"
"github.com/wangjia/jiu/backend/internal/middleware"
)
type AdminHandler struct{ db *gorm.DB }
func NewAdminHandler(db *gorm.DB) *AdminHandler { return &AdminHandler{db: db} }
// ClearData 清空指定表数据（仅限当前 shop，不影响其他租户）
func (h *AdminHandler) ClearData(c *gin.Context) {
shopID := middleware.GetShopID(c)
var body struct {
Tables []string `json:"tables"`
}
if err := c.ShouldBindJSON(&body); err != nil || len(body.Tables) == 0 {
c.JSON(http.StatusBadRequest, gin.H{"error": "tables is required"})
return
}
// 允许清空的表名白名单（key=前端传入标识，value=DB表名列表）
allowed := map[string][]string{
"stock_in": {"stock_in_items", "stock_in_orders"},
"stock_out": {"stock_out_items", "stock_out_orders"},
"inventory": {"inventory_logs", "inventories"},
"products": {"products"},
"partners": {"partners"},
}
cleared := []string{}
err := h.db.Transaction(func(tx *gorm.DB) error {
for _, t := range body.Tables {
tables, ok := allowed[t]
if !ok {
continue
}
for _, tbl := range tables {
if err := tx.Exec("DELETE FROM "+tbl+" WHERE shop_id = ?", shopID).Error; err != nil {
return err
}
}
cleared = append(cleared, t)
}
return nil
})
if err != nil {
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
return
}
c.JSON(http.StatusOK, gin.H{"cleared": cleared})
}
backend/internal/middleware/auth.go
+12
View File
@@ -84,3 +84,15 @@ func GetUserID(c *gin.Context) uint64 {
id, _ := v.(uint64)
return id
}
// SuperAdminOnly 仅超级管理员可访问
func SuperAdminOnly() gin.HandlerFunc {
return func(c *gin.Context) {
role, _ := c.Get(CtxRole)
if role != "superadmin" {
c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "superadmin only"})
return
}
c.Next()
}
}
backend/internal/model/user.go
+1 -1
View File
@@ -6,7 +6,7 @@ type User struct {
PasswordHash string `gorm:"size:255" json:"-"`
RealName string `gorm:"size:50" json:"real_name"`
Phone string `gorm:"size:30" json:"phone"`
Role string `gorm:"type:enum('admin','operator','readonly');default:'operator'" json:"role"`
Role string `gorm:"type:enum('admin','operator','readonly','superadmin');default:'operator'" json:"role"`
IsActive bool `gorm:"default:true" json:"is_active"`
CustomFields JSON `gorm:"type:json" json:"custom_fields,omitempty"`
}
backend/internal/router/router.go
+8
View File
@@ -31,6 +31,7 @@ func Setup(r *gin.Engine, db *gorm.DB) {
financeH := handler.NewFinanceHandler(db)
numberRuleH := handler.NewNumberRuleHandler(db)
publicH := handler.NewPublicHandler(db)
adminH := handler.NewAdminHandler(db)
// 健康检查（无需认证，用于前端连通性探测）
r.GET("/health", func(c *gin.Context) {
@@ -187,5 +188,12 @@ func Setup(r *gin.Engine, db *gorm.DB) {
opts.POST("/specs", productOptH.CreateSpec)
opts.DELETE("/specs/:id", productOptH.DeleteSpec)
}
// 超级管理员专属
superAdmin := api.Group("/admin")
superAdmin.Use(middleware.SuperAdminOnly())
{
superAdmin.POST("/clear-data", adminH.ClearData)
}
}
}
backend/main.go
+3
View File
@@ -21,6 +21,9 @@ func main() {
// 初始化数据库
db := initDB()
// ALTER 已有数据库的 enum，使 superadmin 在已运行实例上也生效（忽略错误）
db.Exec("ALTER TABLE users MODIFY COLUMN role ENUM('admin','operator','readonly','superadmin') NOT NULL DEFAULT 'operator'")
// 自动迁移（GORM AutoMigrate 只增不删，生产安全）
autoMigrate(db)
backend/schema/schema.sql
+1 -1
View File
@@ -38,7 +38,7 @@ CREATE TABLE IF NOT EXISTS `users` (
`password_hash` VARCHAR(255) NOT NULL COMMENT 'bcrypt',
`real_name` VARCHAR(50) DEFAULT NULL,
`phone` VARCHAR(30) DEFAULT NULL,
`role` ENUM('admin','operator','readonly') NOT NULL DEFAULT 'operator',
`role` ENUM('admin','operator','readonly','superadmin') NOT NULL DEFAULT 'operator',
`is_active` TINYINT(1) NOT NULL DEFAULT 1,
`custom_fields` JSON DEFAULT NULL,
`created_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
client/lib/core/auth/auth_state.dart
+8
View File
@@ -8,6 +8,7 @@ const _kUsername = 'username';
const _kRealName = 'real_name';
const _kShopNo = 'shop_no';
const _kShopId = 'shop_id';
const _kRole = 'role';
class AuthUser {
final String accessToken;
@@ -16,6 +17,7 @@ class AuthUser {
final String realName;
final String shopNo;
final int shopId;
final String role;
const AuthUser({
required this.accessToken,
@@ -24,6 +26,7 @@ class AuthUser {
required this.realName,
required this.shopNo,
required this.shopId,
this.role = 'operator',
});
// Kept for ApiClient compatibility
@@ -51,6 +54,7 @@ class AuthNotifier extends StateNotifier<AuthState> {
final shopNo = prefs.getString(_kShopNo);
final shopIdStr = prefs.getString(_kShopId);
final role = prefs.getString(_kRole);
if (accessToken != null && refreshToken != null && username != null) {
state = AuthState(
initialized: true,
@@ -61,6 +65,7 @@ class AuthNotifier extends StateNotifier<AuthState> {
realName: realName ?? username,
shopNo: shopNo ?? '',
shopId: int.tryParse(shopIdStr ?? '') ?? 0,
role: role ?? 'operator',
),
);
return;
@@ -80,6 +85,7 @@ class AuthNotifier extends StateNotifier<AuthState> {
await prefs.setString(_kRealName, user.realName);
await prefs.setString(_kShopNo, user.shopNo);
await prefs.setString(_kShopId, user.shopId.toString());
await prefs.setString(_kRole, user.role);
debugPrint('[Auth] login() setting state, token prefix: ${user.accessToken.substring(0, user.accessToken.length.clamp(0, 20))}...');
state = AuthState(initialized: true, user: user);
debugPrint('[Auth] login() state set, isLoggedIn=${state.isLoggedIn}');
@@ -98,6 +104,7 @@ class AuthNotifier extends StateNotifier<AuthState> {
realName: state.user!.realName,
shopNo: state.user!.shopNo,
shopId: state.user!.shopId,
role: state.user!.role,
),
);
}
@@ -111,6 +118,7 @@ class AuthNotifier extends StateNotifier<AuthState> {
await prefs.remove(_kRealName);
await prefs.remove(_kShopNo);
await prefs.remove(_kShopId);
await prefs.remove(_kRole);
state = const AuthState(initialized: true);
}
}
client/lib/models/user.dart
+2
View File
@@ -19,6 +19,8 @@ class AppUser {
String get roleLabel {
switch (role) {
case 'superadmin':
return '超级管理员';
case 'admin':
return '管理员';
case 'operator':
client/lib/repositories/auth_repository.dart
+1
View File
@@ -53,6 +53,7 @@ class AuthRepository {
realName: user['real_name'] as String? ?? username,
shopNo: shopCode,
shopId: (data['shop_id'] as num).toInt(),
role: user['role'] as String? ?? 'operator',
);
} on DioException catch (e) {
final msg = e.response?.data?['error'] as String?;
client/lib/screens/settings/settings_screen.dart
+255 -2
View File
@@ -595,7 +595,11 @@ class _SettingsScreenState extends ConsumerState<SettingsScreen> {
}
// ── 数据导入 Tab ──────────────────────────────────────────
Widget _buildImportTab() => const _BatchImportWidget();
Widget _buildImportTab() {
final currentUser = ref.watch(authStateProvider).user;
final isSuperAdmin = currentUser?.role == 'superadmin';
return _BatchImportWidget(isSuperAdmin: isSuperAdmin);
}
// ── 关于 Tab ─────────────────────────────────────────────
Widget _buildAboutTab() {
@@ -1160,6 +1164,7 @@ class _UserFormDialogState extends ConsumerState<_UserFormDialog> {
DropdownButtonFormField<String>(
value: _role,
items: const [
DropdownMenuItem(value: 'superadmin', child: Text('超级管理员')),
DropdownMenuItem(value: 'admin', child: Text('管理员')),
DropdownMenuItem(value: 'operator', child: Text('操作员')),
DropdownMenuItem(value: 'readonly', child: Text('只读')),
@@ -1271,6 +1276,10 @@ class _RoleBadge extends StatelessWidget {
final Color bg;
final Color fg;
switch (role) {
case '超级管理员':
bg = const Color(0xFFFCE4EC);
fg = AppTheme.danger;
break;
case '管理员':
bg = const Color(0xFFE3F2FD);
fg = AppTheme.primary;
@@ -1428,7 +1437,8 @@ class _ImportSlot {
}
class _BatchImportWidget extends ConsumerStatefulWidget {
const _BatchImportWidget();
final bool isSuperAdmin;
const _BatchImportWidget({required this.isSuperAdmin});
@override
ConsumerState<_BatchImportWidget> createState() => _BatchImportWidgetState();
@@ -1453,6 +1463,17 @@ class _BatchImportWidgetState extends ConsumerState<_BatchImportWidget> {
'格式：商品编号|商品名称|系列|规格|单位|库存数量|单价|金额|生产日期|批次|分类|所在仓库|入库日期|供应商|上次盘点|备注'),
];
final Set<String> _selectedTables = {};
bool _clearing = false;
static const _clearOptions = [
(key: 'stock_in', label: '入库单'),
(key: 'stock_out', label: '出库单'),
(key: 'inventory', label: '库存管理'),
(key: 'products', label: '商品详情'),
(key: 'partners', label: '往来单位'),
];
@override
void initState() {
super.initState();
@@ -1619,11 +1640,243 @@ class _BatchImportWidgetState extends ConsumerState<_BatchImportWidget> {
],
],
),
if (widget.isSuperAdmin) ...[
const SizedBox(height: 32),
const Divider(),
const SizedBox(height: 16),
_buildClearDataSection(),
],
],
),
);
}
Widget _buildClearDataSection() {
return Column(
crossAxisAlignment: CrossAxisAlignment.start,
children: [
// 标题行
Row(
children: [
const Icon(Icons.delete_forever, color: AppTheme.danger, size: 20),
const SizedBox(width: 8),
const Text('危险操作 — 数据清空',
style: TextStyle(
fontSize: 15,
fontWeight: FontWeight.w600,
color: AppTheme.danger)),
],
),
const SizedBox(height: 12),
// 红色警告框
Container(
padding: const EdgeInsets.all(14),
decoration: BoxDecoration(
color: const Color(0xFFFFF3F3),
border: Border.all(color: AppTheme.danger.withOpacity(0.5)),
borderRadius: BorderRadius.circular(6),
),
child: Column(
crossAxisAlignment: CrossAxisAlignment.start,
children: [
Row(children: [
const Icon(Icons.warning_amber_rounded,
color: AppTheme.danger, size: 18),
const SizedBox(width: 6),
const Text('警告：数据一旦清空，无法恢复！',
style: TextStyle(
color: AppTheme.danger,
fontWeight: FontWeight.w600,
fontSize: 13)),
]),
const SizedBox(height: 6),
const Text(
'• 清空操作仅删除当前门店的数据，不影响其他门店\n'
'• 操作不可撤销，请务必提前备份数据\n'
'• 仅超级管理员可执行此操作',
style: TextStyle(fontSize: 12, color: Color(0xFFB71C1C), height: 1.6),
),
],
),
),
const SizedBox(height: 14),
// 勾选框
Wrap(
spacing: 8,
runSpacing: 4,
children: _clearOptions.map((opt) {
final selected = _selectedTables.contains(opt.key);
return FilterChip(
label: Text(opt.label),
selected: selected,
selectedColor: AppTheme.danger.withOpacity(0.15),
checkmarkColor: AppTheme.danger,
labelStyle: TextStyle(
color: selected ? AppTheme.danger : AppTheme.textPrimary,
fontWeight: selected ? FontWeight.w600 : FontWeight.normal,
),
side: BorderSide(
color: selected ? AppTheme.danger : Colors.grey.shade300,
),
onSelected: _clearing
? null
: (v) => setState(() {
if (v) {
_selectedTables.add(opt.key);
} else {
_selectedTables.remove(opt.key);
}
}),
);
}).toList(),
),
const SizedBox(height: 14),
// 清空按钮
ElevatedButton.icon(
onPressed: (_clearing || _selectedTables.isEmpty)
? null
: () => _confirmClear(),
style: ElevatedButton.styleFrom(
backgroundColor: AppTheme.danger,
foregroundColor: Colors.white,
disabledBackgroundColor: Colors.grey.shade300,
),
icon: _clearing
? const SizedBox(
width: 14, height: 14,
child: CircularProgressIndicator(strokeWidth: 2, color: Colors.white))
: const Icon(Icons.delete_sweep_outlined, size: 18),
label: Text(_clearing ? '清空中...' : '清空选中数据'),
),
],
);
}
Future<void> _confirmClear() async {
final tables = List<String>.from(_selectedTables);
final labels = _clearOptions
.where((o) => tables.contains(o.key))
.map((o) => o.label)
.toList();
final ctrl = TextEditingController();
final confirmed = await showDialog<bool>(
context: context,
barrierDismissible: false,
builder: (ctx) => StatefulBuilder(
builder: (ctx, setS) => AlertDialog(
title: Row(children: [
const Icon(Icons.warning_amber_rounded, color: Colors.red, size: 22),
const SizedBox(width: 8),
const Text('确认清空数据', style: TextStyle(color: Colors.red)),
]),
content: SizedBox(
width: 400,
child: Column(
mainAxisSize: MainAxisSize.min,
crossAxisAlignment: CrossAxisAlignment.start,
children: [
const Text('即将清空以下数据表：',
style: TextStyle(fontWeight: FontWeight.w500)),
const SizedBox(height: 8),
...labels.map((l) => Padding(
padding: const EdgeInsets.only(left: 12, bottom: 4),
child: Row(children: [
const Icon(Icons.remove_circle,
color: Colors.red, size: 14),
const SizedBox(width: 6),
Text(l,
style: const TextStyle(
color: Colors.red, fontWeight: FontWeight.w600)),
]),
)),
const SizedBox(height: 16),
Container(
padding: const EdgeInsets.all(12),
decoration: BoxDecoration(
color: const Color(0xFFFFF3F3),
borderRadius: BorderRadius.circular(4),
border: Border.all(color: Colors.red.shade200),
),
child: const Text(
'⚠️ 此操作不可撤销，数据清空后无法恢复！',
style: TextStyle(
color: Colors.red,
fontSize: 13,
fontWeight: FontWeight.w600),
),
),
const SizedBox(height: 16),
const Text('请输入 "确认清空" 以继续：',
style: TextStyle(fontSize: 13)),
const SizedBox(height: 8),
TextField(
controller: ctrl,
autofocus: true,
decoration: const InputDecoration(
hintText: '确认清空',
border: OutlineInputBorder(),
isDense: true,
),
onChanged: (_) => setS(() {}),
),
],
),
),
actions: [
TextButton(
onPressed: () => Navigator.of(ctx).pop(false),
child: const Text('取消'),
),
ElevatedButton(
onPressed: ctrl.text == '确认清空'
? () => Navigator.of(ctx).pop(true)
: null,
style: ElevatedButton.styleFrom(
backgroundColor: Colors.red,
foregroundColor: Colors.white,
),
child: const Text('确认清空'),
),
],
),
),
);
ctrl.dispose();
if (confirmed != true || !mounted) return;
setState(() => _clearing = true);
try {
final token = ref.read(authStateProvider).user?.accessToken ?? '';
final dio = Dio(BaseOptions(baseUrl: AppConfig.apiBaseUrl));
dio.options.headers['Authorization'] = 'Bearer $token';
await dio.post('/admin/clear-data', data: {'tables': tables});
if (!mounted) return;
setState(() => _selectedTables.clear());
ScaffoldMessenger.of(context).showSnackBar(
SnackBar(
content: Text('已清空：${labels.join('、')}'),
backgroundColor: AppTheme.success,
),
);
} on DioException catch (e) {
if (!mounted) return;
final msg = (e.response?.data is Map ? e.response!.data['error'] : null) ??
e.message ?? '未知错误';
ScaffoldMessenger.of(context).showSnackBar(
SnackBar(content: Text('清空失败：$msg'), backgroundColor: AppTheme.danger),
);
} catch (e) {
if (!mounted) return;
ScaffoldMessenger.of(context).showSnackBar(
SnackBar(content: Text('清空失败：$e'), backgroundColor: AppTheme.danger),
);
} finally {
if (mounted) setState(() => _clearing = false);
}
}
Widget _buildSlotRow(int index) {
final slot = _slots[index];