biss/Exam-Information-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases 6 Wiki Activity

修正权限

Browse Source
This commit is contained in:
biss
2026-07-20 21:27:48 +08:00 Unverified
parent c31602593a
commit 76a1b66f53
12 changed files with 584 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/routes/admin.routes.mjs
+43
View File
@@ -156,6 +156,49 @@ export function createAdminRoutes(context) {
const result = await importExcelResource(db, user, resource, rows);
return sendJson(response, 200, { ok: true, ...result });
}
if (pathname === '/api/admin/schools' && request.method === 'GET') {
if (user.adminLevel !== 'super') return sendError(response, 403, '只有超级管理员可以管理学校');
const schools = db.schools.map(school => ({
...school,
classCount: db.classes.filter(item => item.schoolId === school.id).length,
adminCount: db.users.filter(item => item.role === 'admin' && item.schoolId === school.id).length,
candidateCount: db.candidateProfiles.filter(item => item.schoolId === school.id).length,
centerCount: db.testCenters.filter(item => item.schoolId === school.id).length
}));
return sendJson(response, 200, { ok: true, schools });
}
if (pathname === '/api/admin/schools' && request.method === 'POST') {
if (user.adminLevel !== 'super') return sendError(response, 403, '只有超级管理员可以创建学校');
const body = await readJson(request);
const name = cleanText(body.name, 100);
const code = cleanText(body.code, 40).toUpperCase();
const address = cleanText(body.address, 200);
if (!name || !code) return sendError(response, 400, '学校名称和学校代码不能为空');
if (!/^[A-Z0-9_-]+$/.test(code)) return sendError(response, 400, '学校代码只能包含字母、数字、下划线和连字符');
if (db.schools.some(item => item.code.toLowerCase() === code.toLowerCase())) return sendError(response, 409, '学校代码已存在');
if (db.schools.some(item => item.name.toLowerCase() === name.toLowerCase())) return sendError(response, 409, '学校名称已存在');
const school = { id: uid('school'), name, code, address, active: body.active !== false };
await database.saveSchool(school, true, logAction(db, user, '创建学校', `${name} · ${code}`));
return sendJson(response, 201, { ok: true, school });
}
const schoolMatch = pathname.match(/^\/api\/admin\/schools\/([^/]+)$/);
if (schoolMatch && request.method === 'PATCH') {
if (user.adminLevel !== 'super') return sendError(response, 403, '只有超级管理员可以维护学校');
const body = await readJson(request);
const school = db.schools.find(item => item.id === schoolMatch[1]);
if (!school) return sendError(response, 404, '学校不存在');
const name = cleanText(body.name ?? school.name, 100);
const code = cleanText(body.code ?? school.code, 40).toUpperCase();
const address = cleanText(body.address ?? school.address, 200);
if (!name || !code) return sendError(response, 400, '学校名称和学校代码不能为空');
if (!/^[A-Z0-9_-]+$/.test(code)) return sendError(response, 400, '学校代码只能包含字母、数字、下划线和连字符');
if (db.schools.some(item => item.id !== school.id && item.code.toLowerCase() === code.toLowerCase())) return sendError(response, 409, '学校代码已存在');
if (db.schools.some(item => item.id !== school.id && item.name.toLowerCase() === name.toLowerCase())) return sendError(response, 409, '学校名称已存在');
Object.assign(school, { name, code, address, active: body.active == null ? school.active : Boolean(body.active) });
await database.saveSchool(school, false, logAction(db, user, '维护学校', `${name} · ${code} · ${school.active ? '启用' : '停用'}`));
return sendJson(response, 200, { ok: true, school });
}
if (pathname === '/api/admin/school-organization' && request.method === 'GET') {
if (user.adminLevel !== 'school') return sendError(response, 403, '只有校级管理员可以维护本校组织');