patch3

src/routes/admin.routes.mjs

@@ -225,7 +225,10 @@ export function createAdminRoutes(context) {
         const profile = db.candidateProfiles.find(item => item.userId === preference.userId) || {};
         return { ...preference, candidate: { registrationNumber: account.candidateNumber, name: profile.name }, choices: (preference.payload?.choices || []).map(choice => ({ ...choice, schoolName: db.schools.find(item => item.id === choice.schoolId)?.name || '' })) };
       });
-      const schoolAccounts = db.users.filter(item => item.role === 'admission_school').map(safeUser);
+      const schoolAccounts = db.users.filter(item => item.role === 'admission_school').map(item => {
+        const school = db.schools.find(entry => entry.id === item.schoolId);
+        return { ...safeUser(item), active: item.active !== false, createdAt: item.createdAt, schoolName: school?.name || '', schoolCode: school?.code || '' };
+      });
       return sendJson(response, 200, { ok: true, settings, plans, preferences, placements, schoolAccounts, schools: db.schools.filter(item => item.active), admissionSchools: db.schools.filter(item => item.active && item.isAdmissionSchool), sourceSchools: db.schools.filter(item => item.active && item.isSourceSchool), exams: db.exams.filter(item => !item.archivedAt) });
     }
     if (pathname === '/api/admin/admission-school-accounts' && request.method === 'POST') {
@@ -240,6 +243,30 @@ export function createAdminRoutes(context) {
       await database.createAdmissionSchoolAccount(account, logAction(db, user, '创建招生学校账号', `${school.name} · ${username}`));
       return sendJson(response, 201, { ok: true, account: safeUser(account) });
     }
+    const admissionAccountMatch = pathname.match(/^\/api\/admin\/admission-school-accounts\/([^/]+)$/);
+    if (admissionAccountMatch && request.method === 'PATCH') {
+      if (user.adminLevel !== 'super') return sendError(response, 403, '只有超级管理员可以维护招生学校账号');
+      const target = db.users.find(item => item.id === admissionAccountMatch[1] && item.role === 'admission_school');
+      if (!target) return sendError(response, 404, '招生学校账号不存在');
+      const body = await readJson(request);
+      target.active = body.active == null ? target.active : Boolean(body.active);
+      target.displayName = cleanText(body.displayName || target.displayName, 80);
+      await database.updateAdmin(target, false, logAction(db, user, target.active ? '启用招生学校账号' : '停用招生学校账号', `${target.displayName} · ${target.username}`));
+      if (!target.active) for (const [token, session] of sessions) if (session.userId === target.id) sessions.delete(token);
+      return sendJson(response, 200, { ok: true, account: { ...safeUser(target), active: target.active } });
+    }
+    const admissionAccountResetMatch = pathname.match(/^\/api\/admin\/admission-school-accounts\/([^/]+)\/reset-password$/);
+    if (admissionAccountResetMatch && request.method === 'POST') {
+      if (user.adminLevel !== 'super') return sendError(response, 403, '只有超级管理员可以重置招生学校账号密码');
+      const target = db.users.find(item => item.id === admissionAccountResetMatch[1] && item.role === 'admission_school');
+      if (!target) return sendError(response, 404, '招生学校账号不存在');
+      const temporaryPassword = `Reset-${randomBytes(7).toString('base64url')}`;
+      target.passwordHash = hashPassword(temporaryPassword);
+      target.active = true;
+      await database.updateAdmin(target, true, logAction(db, user, '重置招生学校账号密码', `${target.displayName} · ${target.username}`));
+      for (const [token, session] of sessions) if (session.userId === target.id) sessions.delete(token);
+      return sendJson(response, 200, { ok: true, username: target.username, temporaryPassword });
+    }
     const settingMatch = pathname.match(/^\/api\/admin\/admissions\/([^/]+)\/setting$/);
     if (settingMatch && request.method === 'PUT') {
       if (user.adminLevel !== 'super') return sendError(response, 403, '只有超级管理员可以设置志愿填报');