48fdca12bd
- 新增 users 数据库表，存储用户名、密码哈希、角色 - 启动时自动从 .env 创建初始管理员账号 - 登录改为数据库校验，不再硬编码比对 - 新增 /api/users 管理接口（仅管理员） - ConfigView 新增用户管理页（创建、改密码、切换角色、删除）
104 lines
3.6 KiB
Python
104 lines
3.6 KiB
Python
"""用户管理 API（仅管理员）"""
|
||
import uuid
|
||
import hashlib
|
||
from fastapi import APIRouter, Depends, HTTPException
|
||
from sqlalchemy.orm import Session
|
||
|
||
from ..database import get_db
|
||
from ..models import User
|
||
from ..deps import get_current_user
|
||
|
||
router = APIRouter(prefix="/api/users", tags=["users"], dependencies=[Depends(get_current_user)])
|
||
|
||
|
||
def _require_admin(user: dict):
|
||
if not user.get("is_admin"):
|
||
raise HTTPException(status_code=403, detail="需要管理员权限")
|
||
|
||
|
||
def _hash_password(password: str) -> str:
|
||
return hashlib.sha256(password.encode()).hexdigest()
|
||
|
||
|
||
@router.get("")
|
||
async def list_users(user: dict = Depends(get_current_user), db: Session = Depends(get_db)):
|
||
"""获取用户列表"""
|
||
_require_admin(user)
|
||
users = db.query(User).order_by(User.created_at.desc()).all()
|
||
return [{"id": u.id, "username": u.username, "is_admin": u.is_admin, "created_at": str(u.created_at) if u.created_at else None} for u in users]
|
||
|
||
|
||
@router.post("")
|
||
async def create_user(data: dict, user: dict = Depends(get_current_user), db: Session = Depends(get_db)):
|
||
"""创建用户"""
|
||
_require_admin(user)
|
||
|
||
username = data.get("username", "").strip()
|
||
password = data.get("password", "").strip()
|
||
is_admin = data.get("is_admin", False)
|
||
|
||
if not username or not password:
|
||
raise HTTPException(status_code=400, detail="用户名和密码不能为空")
|
||
if len(password) < 6:
|
||
raise HTTPException(status_code=400, detail="密码至少 6 位")
|
||
if db.query(User).filter(User.username == username).first():
|
||
raise HTTPException(status_code=400, detail="用户名已存在")
|
||
|
||
new_user = User(
|
||
id=str(uuid.uuid4()),
|
||
username=username,
|
||
password_hash=_hash_password(password),
|
||
is_admin=is_admin,
|
||
)
|
||
db.add(new_user)
|
||
db.commit()
|
||
return {"message": "用户已创建", "id": new_user.id}
|
||
|
||
|
||
@router.put("/{user_id}/password")
|
||
async def change_password(user_id: str, data: dict, user: dict = Depends(get_current_user), db: Session = Depends(get_db)):
|
||
"""修改密码（管理员可改任意用户）"""
|
||
_require_admin(user)
|
||
|
||
target = db.query(User).filter(User.id == user_id).first()
|
||
if not target:
|
||
raise HTTPException(status_code=404, detail="用户不存在")
|
||
|
||
new_password = data.get("password", "").strip()
|
||
if not new_password or len(new_password) < 6:
|
||
raise HTTPException(status_code=400, detail="密码至少 6 位")
|
||
|
||
target.password_hash = _hash_password(new_password)
|
||
db.commit()
|
||
return {"message": "密码已更新"}
|
||
|
||
|
||
@router.put("/{user_id}/role")
|
||
async def change_role(user_id: str, data: dict, user: dict = Depends(get_current_user), db: Session = Depends(get_db)):
|
||
"""切换管理员状态"""
|
||
_require_admin(user)
|
||
|
||
target = db.query(User).filter(User.id == user_id).first()
|
||
if not target:
|
||
raise HTTPException(status_code=404, detail="用户不存在")
|
||
|
||
target.is_admin = data.get("is_admin", not target.is_admin)
|
||
db.commit()
|
||
return {"message": "角色已更新", "is_admin": target.is_admin}
|
||
|
||
|
||
@router.delete("/{user_id}")
|
||
async def delete_user(user_id: str, user: dict = Depends(get_current_user), db: Session = Depends(get_db)):
|
||
"""删除用户"""
|
||
_require_admin(user)
|
||
|
||
target = db.query(User).filter(User.id == user_id).first()
|
||
if not target:
|
||
raise HTTPException(status_code=404, detail="用户不存在")
|
||
if target.username == user["username"]:
|
||
raise HTTPException(status_code=400, detail="不能删除自己")
|
||
|
||
db.delete(target)
|
||
db.commit()
|
||
return {"message": "用户已删除"}
|