990 lines
78 KiB
JavaScript
990 lines
78 KiB
JavaScript
import { admissionMixingScopes, buildAdmissionArrangement } from '../services/admission-arrangement.mjs';
|
||
|
||
export function createAdminRoutes(context) {
|
||
const {
|
||
database,
|
||
readDb,
|
||
sendJson,
|
||
sendError,
|
||
readJson,
|
||
readBodyBuffer,
|
||
sendWorkbook,
|
||
currentUser,
|
||
safeUser,
|
||
requireUser,
|
||
hasPermission,
|
||
requirePermission,
|
||
profileInScope,
|
||
registrationInScope,
|
||
adminScopeLabel,
|
||
adminsForStep,
|
||
selectAdminForStep,
|
||
activeWorkflow,
|
||
createWorkflowSubmission,
|
||
workflowView,
|
||
pendingWorkflow,
|
||
candidateSequence,
|
||
generateCandidateNumber,
|
||
cleanText,
|
||
centerScopeProfile,
|
||
workflowScopeProfile,
|
||
candidateAccountBatchView,
|
||
centerChangeView,
|
||
parseCenterChange,
|
||
maskId,
|
||
publicExam,
|
||
examResultSummary,
|
||
subjectPassText,
|
||
resultRankInfo,
|
||
subjectPassEvaluation,
|
||
examRegistrationView,
|
||
logAction,
|
||
excelResourceNames,
|
||
excelRowsForResource,
|
||
admissionRowsForRegistrations,
|
||
centerMaterialRows,
|
||
importExcelResource,
|
||
prepareResultImport,
|
||
commitResultImport,
|
||
admitCardHtml,
|
||
admitCardsHtml,
|
||
hashPassword,
|
||
verifyPassword,
|
||
randomBytes,
|
||
uid,
|
||
nowIso,
|
||
sessions,
|
||
buildWorkbook,
|
||
buildCenterMaterialsWorkbook,
|
||
hasExcelResource,
|
||
parseWorkbook,
|
||
adminLevelNames,
|
||
permissionsByLevel
|
||
} = context;
|
||
|
||
const passPolicies = new Set(['fixed_score', 'rank_percent', 'subject_scores', 'none']);
|
||
const subjectPassRules = new Set(['fixed_score', 'rank_percent', 'none']);
|
||
|
||
function normalizeSubjects(input, examStart) {
|
||
const source = Array.isArray(input) ? input : String(input || '').split(/[,，]/);
|
||
return source.map((item, index) => {
|
||
const structured = item && typeof item === 'object';
|
||
const name = cleanText(structured ? item.name : item, 50);
|
||
if (!name) return null;
|
||
const fullScore = Number(structured ? item.fullScore : 150);
|
||
const requestedRule = item?.passRule === 'score_ratio' ? 'rank_percent' : item?.passRule;
|
||
const passRule = subjectPassRules.has(requestedRule) ? requestedRule : 'fixed_score';
|
||
const passValue = passRule === 'none' ? 0 : Number(structured ? (item.passValue ?? item.passScore ?? fullScore * .6) : fullScore * .6);
|
||
const passScore = passRule === 'fixed_score' ? Number(passValue.toFixed(2)) : null;
|
||
return {
|
||
id: uid('sub'),
|
||
name,
|
||
date: cleanText(structured ? item.date : '', 10) || String(examStart).slice(0, 10),
|
||
start: cleanText(structured ? item.start : '', 5) || '09:00',
|
||
end: cleanText(structured ? item.end : '', 5) || '11:00',
|
||
fee: Number(structured ? item.fee ?? 0 : 0),
|
||
fullScore,
|
||
passRule,
|
||
passValue,
|
||
passScore,
|
||
order: index + 1
|
||
};
|
||
}).filter(Boolean);
|
||
}
|
||
|
||
function validateExamScoring(subjects, passPolicy, passValue) {
|
||
if (!subjects.length) return '请至少添加一个考试科目';
|
||
if (subjects.some(item => !Number.isFinite(item.fullScore) || item.fullScore <= 0 || item.fullScore > 1000)) return '科目满分必须大于 0 且不超过 1000';
|
||
if (subjects.some(item => !subjectPassRules.has(item.passRule))) return '请选择有效的单科合格线计算方式';
|
||
if (subjects.some(item => item.passRule === 'fixed_score' && (!Number.isFinite(item.passValue) || item.passValue < 0 || item.passValue > item.fullScore))) return '固定单科合格分必须在 0 与该科满分之间';
|
||
if (subjects.some(item => item.passRule === 'rank_percent' && (!Number.isFinite(item.passValue) || item.passValue <= 0 || item.passValue > 100))) return '单科排名比例必须大于 0 且不超过 100%';
|
||
if (subjects.some(item => !Number.isFinite(item.fee) || item.fee < 0 || item.fee > 100000)) return '科目费用必须在有效范围内';
|
||
if (!passPolicies.has(passPolicy)) return '请选择有效的合格线策略';
|
||
const totalScore = subjects.reduce((sum, item) => sum + item.fullScore, 0);
|
||
if (passPolicy === 'fixed_score' && (!Number.isFinite(passValue) || passValue < 0 || passValue > totalScore)) return `固定合格线必须在 0 与总分 ${totalScore} 之间`;
|
||
if (passPolicy === 'rank_percent' && (!Number.isFinite(passValue) || passValue <= 0 || passValue > 100)) return '排名比例必须大于 0 且不超过 100';
|
||
return '';
|
||
}
|
||
|
||
async function handleAdmin(request, response, pathname) {
|
||
if (!pathname.startsWith('/api/admin/')) return false;
|
||
const user = await requireUser(request, response, 'admin');
|
||
if (!user) return true;
|
||
const db = await readDb();
|
||
|
||
if (request.method === 'GET' && pathname === '/api/admin/context') {
|
||
return sendJson(response, 200, {
|
||
ok: true,
|
||
admin: safeUser(user),
|
||
adminLevelName: adminLevelNames[user.adminLevel || 'super'],
|
||
permissions: permissionsByLevel[user.adminLevel || 'super'],
|
||
scopeLabel: adminScopeLabel(db, user),
|
||
schools: db.schools,
|
||
classes: db.classes
|
||
});
|
||
}
|
||
|
||
const excelMatch = pathname.match(/^\/api\/admin\/excel\/(classes|class_admins|account_quotas|account_results|candidates|centers|results)$/);
|
||
if (excelMatch && request.method === 'GET') {
|
||
const resource = excelMatch[1];
|
||
if (!hasExcelResource(resource)) return sendError(response, 404, 'Excel 数据类型不存在');
|
||
if (['classes', 'class_admins', 'account_quotas', 'account_results'].includes(resource) && !['school', 'super'].includes(user.adminLevel)) return sendError(response, 403, '当前账号不能导出该数据');
|
||
if (resource === 'centers' && !hasPermission(user, 'centers.read')) return sendError(response, 403, '当前账号不能导出考点考场');
|
||
if (resource === 'candidates' && !hasPermission(user, 'candidates.read')) return sendError(response, 403, '当前账号不能导出考生资料');
|
||
if (resource === 'results' && !hasPermission(user, 'results.read')) return sendError(response, 403, '当前账号不能导出成绩');
|
||
const requestUrl = new URL(request.url, `http://${request.headers.host || '127.0.0.1'}`);
|
||
const template = requestUrl.searchParams.get('template') === '1';
|
||
const rows = template ? [] : excelRowsForResource(db, user, resource, requestUrl.searchParams);
|
||
const subtitle = user.adminLevel === 'super' ? '全部数据范围' : adminScopeLabel(db, user);
|
||
const buffer = Buffer.from(await buildWorkbook(resource, rows, { template, subtitle }));
|
||
return sendWorkbook(response, buffer, `${excelResourceNames[resource]}-${template ? '导入模板' : '导出'}-${new Date().toISOString().slice(0, 10)}.xlsx`);
|
||
}
|
||
if (excelMatch && request.method === 'POST') {
|
||
const resource = excelMatch[1];
|
||
if (resource === 'account_results') return sendError(response, 400, '账号结果清单只支持导出');
|
||
const rows = await parseWorkbook(resource, await readBodyBuffer(request));
|
||
if (resource === 'results') {
|
||
if (user.adminLevel !== 'super') return sendError(response, 403, '只有超级管理员可以预览导入成绩');
|
||
return sendJson(response, 200, { ok: true, preview: true, ...prepareResultImport(db, rows) });
|
||
}
|
||
const result = await importExcelResource(db, user, resource, rows);
|
||
return sendJson(response, 200, { ok: true, ...result });
|
||
}
|
||
|
||
if (pathname === '/api/admin/school-organization' && request.method === 'GET') {
|
||
if (user.adminLevel !== 'school') return sendError(response, 403, '只有校级管理员可以维护本校组织');
|
||
const school = db.schools.find(item => item.id === user.schoolId);
|
||
const classes = db.classes.filter(item => item.schoolId === user.schoolId).map(item => ({
|
||
...item,
|
||
candidateCount: db.candidateProfiles.filter(profile => profile.classId === item.id).length,
|
||
admins: db.users.filter(admin => admin.role === 'admin' && admin.adminLevel === 'class' && admin.classId === item.id).map(admin => ({ ...safeUser(admin), active: admin.active }))
|
||
}));
|
||
return sendJson(response, 200, { ok: true, school, classes });
|
||
}
|
||
if (pathname === '/api/admin/classes' && request.method === 'POST') {
|
||
if (user.adminLevel !== 'school') return sendError(response, 403, '只有校级管理员可以新增本校班级');
|
||
const body = await readJson(request);
|
||
const name = cleanText(body.name, 100); const grade = cleanText(body.grade, 60);
|
||
if (!name || !grade) return sendError(response, 400, '年级和班级名称不能为空');
|
||
if (db.classes.some(item => item.schoolId === user.schoolId && item.name === name)) return sendError(response, 409, '本校已存在同名班级');
|
||
const schoolClass = { id: uid('class'), schoolId: user.schoolId, name, grade, active: body.active !== false };
|
||
await database.saveSchoolClass(schoolClass, true, logAction(db, user, '新增本校班级', `${grade} · ${name}`));
|
||
return sendJson(response, 201, { ok: true, schoolClass });
|
||
}
|
||
const classMatch = pathname.match(/^\/api\/admin\/classes\/([^/]+)$/);
|
||
if (classMatch && request.method === 'PATCH') {
|
||
if (user.adminLevel !== 'school') return sendError(response, 403, '只有校级管理员可以维护本校班级');
|
||
const body = await readJson(request);
|
||
const schoolClass = db.classes.find(item => item.id === classMatch[1] && item.schoolId === user.schoolId);
|
||
if (!schoolClass) return sendError(response, 404, '班级不存在');
|
||
const name = cleanText(body.name ?? schoolClass.name, 100); const grade = cleanText(body.grade ?? schoolClass.grade, 60);
|
||
if (!name || !grade) return sendError(response, 400, '年级和班级名称不能为空');
|
||
if (db.classes.some(item => item.id !== schoolClass.id && item.schoolId === user.schoolId && item.name === name)) return sendError(response, 409, '本校已存在同名班级');
|
||
Object.assign(schoolClass, { name, grade, active: body.active == null ? schoolClass.active : Boolean(body.active) });
|
||
await database.saveSchoolClass(schoolClass, false, logAction(db, user, '更新本校班级', `${grade} · ${name} · ${schoolClass.active ? '启用' : '停用'}`));
|
||
return sendJson(response, 200, { ok: true, schoolClass });
|
||
}
|
||
|
||
if (pathname === '/api/admin/admins' && request.method === 'GET') {
|
||
if (!['super', 'school'].includes(user.adminLevel)) return sendError(response, 403, '当前账号不能管理管理员');
|
||
const admins = db.users.filter(item => item.role === 'admin' && (user.adminLevel === 'super' || (item.adminLevel === 'class' && item.schoolId === user.schoolId))).map(item => ({
|
||
...safeUser(item),
|
||
active: item.active,
|
||
levelName: adminLevelNames[item.adminLevel],
|
||
schoolName: db.schools.find(school => school.id === item.schoolId)?.name || '',
|
||
className: db.classes.find(schoolClass => schoolClass.id === item.classId)?.name || ''
|
||
}));
|
||
return sendJson(response, 200, { ok: true, admins, schools: db.schools, classes: db.classes, selfRegistrationEnabled: db.settings.selfRegistrationEnabled });
|
||
}
|
||
if (pathname === '/api/admin/admins' && request.method === 'POST') {
|
||
const body = await readJson(request);
|
||
const username = cleanText(body.username, 50);
|
||
const password = String(body.password || '');
|
||
const displayName = cleanText(body.displayName, 50);
|
||
const adminLevel = user.adminLevel === 'school' ? 'class' : cleanText(body.adminLevel, 20);
|
||
if (!['super', 'school'].includes(user.adminLevel)) return sendError(response, 403, '当前账号不能创建管理员');
|
||
if (!username || !displayName || password.length < 8 || !['super', 'school', 'class'].includes(adminLevel)) return sendError(response, 400, '请完整填写管理员账号、姓名、层级和至少 8 位密码');
|
||
if (db.users.some(item => item.username.toLowerCase() === username.toLowerCase())) return sendError(response, 409, '该登录账号已存在');
|
||
const schoolId = adminLevel === 'super' ? null : user.adminLevel === 'school' ? user.schoolId : cleanText(body.schoolId, 64);
|
||
const classId = adminLevel === 'class' ? cleanText(body.classId, 64) : null;
|
||
if (adminLevel !== 'super' && !db.schools.some(item => item.id === schoolId)) return sendError(response, 400, '校级和班级管理员必须绑定学校');
|
||
if (adminLevel === 'class' && !db.classes.some(item => item.id === classId && item.schoolId === schoolId)) return sendError(response, 400, '请选择该学校下的有效班级');
|
||
const created = { id: uid('usr'), username, passwordHash: hashPassword(password), role: 'admin', adminLevel, schoolId, classId, displayName, active: true, createdAt: nowIso() };
|
||
const log = logAction(db, user, '创建管理员', `${displayName} · ${adminLevelNames[adminLevel]}`);
|
||
await database.createAdmin(created, log);
|
||
return sendJson(response, 201, { ok: true, admin: safeUser(created) });
|
||
}
|
||
const adminMatch = pathname.match(/^\/api\/admin\/admins\/([^/]+)$/);
|
||
if (adminMatch && request.method === 'PATCH') {
|
||
if (user.adminLevel !== 'school') return sendError(response, 403, '只有校级管理员可以维护本校班级管理员');
|
||
const body = await readJson(request);
|
||
const target = db.users.find(item => item.id === adminMatch[1] && item.role === 'admin' && item.adminLevel === 'class' && item.schoolId === user.schoolId);
|
||
if (!target) return sendError(response, 404, '班级管理员不存在');
|
||
const schoolClass = db.classes.find(item => item.id === cleanText(body.classId || target.classId, 64) && item.schoolId === user.schoolId);
|
||
if (!schoolClass) return sendError(response, 400, '请选择本校有效班级');
|
||
const password = String(body.password || '');
|
||
if (password && password.length < 8) return sendError(response, 400, '重置密码至少 8 位');
|
||
Object.assign(target, { displayName: cleanText(body.displayName || target.displayName, 50), classId: schoolClass.id, active: body.active == null ? target.active : Boolean(body.active) });
|
||
if (password) target.passwordHash = hashPassword(password);
|
||
await database.updateAdmin(target, Boolean(password), logAction(db, user, '维护班级管理员', `${target.displayName} · ${schoolClass.name}`));
|
||
return sendJson(response, 200, { ok: true, admin: safeUser(target) });
|
||
}
|
||
if (pathname === '/api/admin/settings/self-registration' && request.method === 'PUT') {
|
||
if (!requirePermission(user, response, '*')) return true;
|
||
const body = await readJson(request);
|
||
const enabled = Boolean(body.enabled);
|
||
const log = logAction(db, user, enabled ? '开启自主注册' : '关闭自主注册', enabled ? '考生可从公开入口申请报名号' : '仅允许使用学校下发的报名号登录');
|
||
await database.updateRegistrationSetting(enabled, log);
|
||
return sendJson(response, 200, { ok: true, enabled });
|
||
}
|
||
if (pathname === '/api/admin/candidate-account-batches' && request.method === 'GET') {
|
||
if (!requirePermission(user, response, 'candidates.write')) return true;
|
||
if (!['school', 'super'].includes(user.adminLevel)) return sendError(response, 403, '只有校级管理员可以申领批量报名号');
|
||
const batches = db.candidateAccountBatches
|
||
.filter(item => user.adminLevel === 'super' || item.schoolId === user.schoolId)
|
||
.sort((a, b) => new Date(b.createdAt) - new Date(a.createdAt))
|
||
.map(item => candidateAccountBatchView(db, item));
|
||
const classes = db.classes.filter(item => item.active && (user.adminLevel === 'super' || item.schoolId === user.schoolId));
|
||
return sendJson(response, 200, { ok: true, batches, classes, schools: db.schools.filter(item => item.active) });
|
||
}
|
||
if (pathname === '/api/admin/candidate-account-batches' && request.method === 'POST') {
|
||
if (user.adminLevel !== 'school' || !requirePermission(user, response, 'candidates.write')) return user.adminLevel === 'school' ? true : sendError(response, 403, '批量报名号由校级管理员发起申领');
|
||
const body = await readJson(request);
|
||
const requestedQuotas = Array.isArray(body.quotas) ? body.quotas : [];
|
||
const quotas = requestedQuotas.map(item => ({ classId: cleanText(item.classId, 64), count: Number(item.count) })).filter(item => item.count > 0);
|
||
if (!quotas.length) return sendError(response, 400, '请至少为一个班级填写申领数量');
|
||
if (new Set(quotas.map(item => item.classId)).size !== quotas.length) return sendError(response, 400, '同一班级只能填写一次申领数量');
|
||
if (quotas.some(item => !Number.isInteger(item.count) || item.count < 1 || item.count > 200)) return sendError(response, 400, '每个班级一次可申领 1—200 个报名号');
|
||
if (quotas.some(item => !db.classes.some(schoolClass => schoolClass.id === item.classId && schoolClass.schoolId === user.schoolId && schoolClass.active))) return sendError(response, 400, '只能为本校有效班级申领报名号');
|
||
const totalCount = quotas.reduce((sum, item) => sum + item.count, 0);
|
||
if (totalCount > 500) return sendError(response, 400, '单个批次最多申领 500 个报名号');
|
||
const batch = { id: uid('account_batch'), schoolId: user.schoolId, requestedBy: user.id, status: 'pending', reviewNote: '', createdAt: nowIso(), reviewedAt: null };
|
||
const items = [];
|
||
let position = 1;
|
||
for (const quota of quotas) for (let index = 0; index < quota.count; index += 1) {
|
||
items.push({ id: uid('account_batch_item'), batchId: batch.id, classId: quota.classId, position, candidateNumber: '', initialPassword: '', userId: null, createdAt: null });
|
||
position += 1;
|
||
}
|
||
const { instance, action } = createWorkflowSubmission(db, 'candidate_account_batch', batch.id, centerScopeProfile(db, user.schoolId), user.id);
|
||
const quotaSummary = quotas.map(item => `${db.classes.find(entry => entry.id === item.classId)?.name} ${item.count} 人`).join('；');
|
||
const log = logAction(db, user, '提交批量报名号申领', `${totalCount} 个账户 · ${quotaSummary}`);
|
||
await database.createCandidateAccountBatch(batch, items, instance, action, log);
|
||
const fresh = await readDb();
|
||
return sendJson(response, 202, { ok: true, batch: candidateAccountBatchView(fresh, fresh.candidateAccountBatches.find(item => item.id === batch.id)) });
|
||
}
|
||
const accountBatchMatch = pathname.match(/^\/api\/admin\/candidate-account-batches\/([^/]+)$/);
|
||
if (accountBatchMatch && request.method === 'PATCH') {
|
||
if (!requirePermission(user, response, 'candidates.write')) return true;
|
||
const body = await readJson(request);
|
||
if (!['approved', 'rejected'].includes(body.status)) return sendError(response, 400, '审批状态无效');
|
||
const batch = db.candidateAccountBatches.find(item => item.id === accountBatchMatch[1] && item.status === 'pending');
|
||
if (!batch) return sendError(response, 404, '待审批的批量报名号申请不存在');
|
||
const instance = pendingWorkflow(db, 'candidate_account_batch', batch.id);
|
||
const workflow = instance && db.workflows.find(item => item.id === instance.workflowId);
|
||
const step = workflow?.steps.find(item => item.position === instance.currentStep);
|
||
if (!instance || !workflow || !step) return sendError(response, 409, '批量报名号审批流程状态异常');
|
||
if (user.adminLevel !== 'super' && (instance.assigneeId !== user.id || step.adminLevel !== user.adminLevel)) return sendError(response, 403, '该流程当前未分配给你，可由当前处理人转交');
|
||
const note = cleanText(body.reviewNote, 300);
|
||
const action = { id: uid('flow_action'), instanceId: instance.id, actorId: user.id, action: body.status === 'approved' ? 'approve' : 'reject', note, fromAssigneeId: instance.assigneeId, toAssigneeId: null, createdAt: nowIso() };
|
||
const log = logAction(db, user, body.status === 'approved' ? '审批批量报名号申领' : '退回批量报名号申领', `${db.schools.find(item => item.id === batch.schoolId)?.name} · ${note || '无备注'}`);
|
||
if (body.status === 'rejected') {
|
||
instance.status = 'rejected'; instance.completedAt = nowIso(); instance.assigneeId = null;
|
||
batch.status = 'rejected'; batch.reviewNote = note; batch.reviewedAt = nowIso();
|
||
await database.processWorkflow(instance, action, batch, log);
|
||
} else if (instance.currentStep < workflow.steps.length) {
|
||
const nextStep = workflow.steps.find(item => item.position === instance.currentStep + 1);
|
||
const nextAssignee = selectAdminForStep(db, nextStep.adminLevel, centerScopeProfile(db, batch.schoolId));
|
||
if (!nextAssignee) return sendError(response, 409, `没有可承接“${nextStep.name}”的管理员`);
|
||
instance.currentStep += 1; instance.assigneeId = nextAssignee.id; action.toAssigneeId = nextAssignee.id;
|
||
batch.reviewNote = note;
|
||
await database.processWorkflow(instance, action, batch, log);
|
||
} else {
|
||
const batchItems = db.candidateAccountBatchItems.filter(item => item.batchId === batch.id).sort((a, b) => a.position - b.position);
|
||
if (!batchItems.length || batchItems.some(item => item.userId || item.candidateNumber)) return sendError(response, 409, '批次明细异常或已经生成过账号');
|
||
const generationDb = { ...db, users: [...db.users] };
|
||
const users = [];
|
||
const profiles = [];
|
||
for (const [index, item] of batchItems.entries()) {
|
||
const schoolClass = db.classes.find(entry => entry.id === item.classId && entry.schoolId === batch.schoolId);
|
||
if (!schoolClass) return sendError(response, 409, '批次包含无效班级，无法生成账号');
|
||
const generated = generateCandidateNumber(generationDb, { schoolId: batch.schoolId, classId: item.classId, gender: '' });
|
||
const userId = uid('usr');
|
||
const initialPassword = `Init-${randomBytes(6).toString('base64url')}`;
|
||
const displayName = `待补录考生 ${String(index + 1).padStart(3, '0')}`;
|
||
const candidateUser = { id: userId, username: generated.number, candidateNumber: generated.number, passwordHash: hashPassword(initialPassword), role: 'candidate', displayName, schoolId: batch.schoolId, classId: item.classId, active: true, mustChangePassword: true, createdAt: nowIso() };
|
||
const profile = { id: uid('profile'), userId, name: displayName, gender: '', idNumber: `PENDING-${userId}`, phone: '', email: '', school: db.schools.find(entry => entry.id === batch.schoolId)?.name || '', grade: schoolClass.name, schoolId: batch.schoolId, classId: item.classId, address: '', emergencyContact: '', emergencyPhone: '', nativePlace: '', birthDate: '', ethnicity: '', postalCode: '', guardianName: '', guardianPhone: '', profileCompleted: false, status: 'pending', reviewNote: '', updatedAt: nowIso() };
|
||
item.candidateNumber = generated.number; item.initialPassword = initialPassword; item.userId = userId; item.createdAt = nowIso();
|
||
users.push(candidateUser); profiles.push(profile); generationDb.users.push(candidateUser);
|
||
}
|
||
instance.status = 'approved'; instance.completedAt = nowIso(); instance.assigneeId = null;
|
||
batch.status = 'approved'; batch.reviewNote = note; batch.reviewedAt = nowIso();
|
||
await database.completeCandidateAccountBatch(batch, batchItems, users, profiles, instance, action, log);
|
||
}
|
||
const fresh = await readDb();
|
||
return sendJson(response, 200, { ok: true, batch: candidateAccountBatchView(fresh, fresh.candidateAccountBatches.find(item => item.id === batch.id)) });
|
||
}
|
||
|
||
if (pathname === '/api/admin/centers' && request.method === 'GET') {
|
||
if (!requirePermission(user, response, 'centers.read')) return true;
|
||
const centers = db.testCenters.filter(item => user.adminLevel === 'super' || item.schoolId === user.schoolId).map(item => ({
|
||
...item,
|
||
schoolName: db.schools.find(school => school.id === item.schoolId)?.name || '',
|
||
rooms: db.testRooms.filter(room => room.centerId === item.id),
|
||
totalCapacity: db.testRooms.filter(room => room.centerId === item.id && room.status === 'active').reduce((sum, room) => sum + Number(room.capacity || 0), 0),
|
||
pendingChange: db.centerChangeRequests.some(change => change.centerId === item.id && change.status === 'pending')
|
||
}));
|
||
const changeRequests = db.centerChangeRequests
|
||
.filter(item => user.adminLevel === 'super' || item.schoolId === user.schoolId)
|
||
.sort((a, b) => new Date(b.createdAt) - new Date(a.createdAt))
|
||
.map(item => centerChangeView(db, item));
|
||
return sendJson(response, 200, { ok: true, centers, changeRequests, schools: user.adminLevel === 'super' ? db.schools : db.schools.filter(item => item.id === user.schoolId) });
|
||
}
|
||
if (pathname === '/api/admin/centers' && request.method === 'POST') {
|
||
if (!requirePermission(user, response, 'centers.write')) return true;
|
||
const body = await readJson(request);
|
||
const schoolId = user.adminLevel === 'super' ? cleanText(body.schoolId, 64) : user.schoolId;
|
||
if (!db.schools.some(item => item.id === schoolId)) return sendError(response, 400, '考点必须归属有效学校');
|
||
const parsed = parseCenterChange(db, body, schoolId);
|
||
const change = { id: uid('center_change'), centerId: null, schoolId, requestType: 'create', ...parsed.center, status: 'pending', reviewNote: '', requestedBy: user.id, createdAt: nowIso(), reviewedAt: null };
|
||
const { instance, action } = createWorkflowSubmission(db, 'center_change', change.id, centerScopeProfile(db, schoolId), user.id);
|
||
const log = logAction(db, user, '提交新增考点审批', `${change.name} · ${parsed.rooms.length} 个考场`);
|
||
await database.createCenterChangeRequest(change, parsed.rooms, instance, action, log);
|
||
return sendJson(response, 202, { ok: true, changeRequest: { ...change, rooms: parsed.rooms, workflow: workflowView({ ...db, workflowActions: [...db.workflowActions, action] }, instance) } });
|
||
}
|
||
const centerMatch = pathname.match(/^\/api\/admin\/centers\/([^/]+)$/);
|
||
if (centerMatch && request.method === 'PATCH') {
|
||
if (!requirePermission(user, response, 'centers.write')) return true;
|
||
const body = await readJson(request);
|
||
const center = db.testCenters.find(item => item.id === centerMatch[1]);
|
||
if (!center) return sendError(response, 404, '考点不存在');
|
||
if (user.adminLevel !== 'super' && center.schoolId !== user.schoolId) return sendError(response, 403, '只能维护本校考点');
|
||
if (db.centerChangeRequests.some(item => item.centerId === center.id && item.status === 'pending')) return sendError(response, 409, '该考点已有待审批变更，请处理完成后再提交');
|
||
const parsed = parseCenterChange(db, body, center.schoolId, center);
|
||
const change = { id: uid('center_change'), centerId: center.id, schoolId: center.schoolId, requestType: 'update', ...parsed.center, status: 'pending', reviewNote: '', requestedBy: user.id, createdAt: nowIso(), reviewedAt: null };
|
||
const { instance, action } = createWorkflowSubmission(db, 'center_change', change.id, centerScopeProfile(db, center.schoolId), user.id);
|
||
const log = logAction(db, user, '提交考点变更审批', `${change.name} · ${parsed.rooms.length} 个考场`);
|
||
await database.createCenterChangeRequest(change, parsed.rooms, instance, action, log);
|
||
return sendJson(response, 202, { ok: true, changeRequest: { ...change, rooms: parsed.rooms, workflow: workflowView({ ...db, workflowActions: [...db.workflowActions, action] }, instance) } });
|
||
}
|
||
const centerChangeMatch = pathname.match(/^\/api\/admin\/center-change-requests\/([^/]+)$/);
|
||
if (centerChangeMatch && request.method === 'PATCH') {
|
||
if (!requirePermission(user, response, 'centers.write')) return true;
|
||
const body = await readJson(request);
|
||
if (!['approved', 'rejected'].includes(body.status)) return sendError(response, 400, '审批状态无效');
|
||
const change = db.centerChangeRequests.find(item => item.id === centerChangeMatch[1] && item.status === 'pending');
|
||
if (!change) return sendError(response, 404, '待审批的考点变更不存在');
|
||
if (user.adminLevel !== 'super' && change.schoolId !== user.schoolId) return sendError(response, 403, '该变更不在你的学校范围内');
|
||
const instance = pendingWorkflow(db, 'center_change', change.id);
|
||
const workflow = instance && db.workflows.find(item => item.id === instance.workflowId);
|
||
const step = workflow?.steps.find(item => item.position === instance.currentStep);
|
||
if (!instance || !workflow || !step) return sendError(response, 409, '考点变更审批流程状态异常');
|
||
if (user.adminLevel !== 'super' && (instance.assigneeId !== user.id || step.adminLevel !== user.adminLevel)) return sendError(response, 403, '该流程当前未分配给你，可由当前处理人转交');
|
||
const note = cleanText(body.reviewNote, 300);
|
||
const action = { id: uid('flow_action'), instanceId: instance.id, actorId: user.id, action: body.status === 'approved' ? 'approve' : 'reject', note, fromAssigneeId: instance.assigneeId, toAssigneeId: null, createdAt: nowIso() };
|
||
const log = logAction(db, user, body.status === 'approved' ? '审批考点变更' : '退回考点变更', `${change.name} · ${note || '无备注'}`);
|
||
if (body.status === 'rejected') {
|
||
instance.status = 'rejected'; instance.completedAt = nowIso(); instance.assigneeId = null;
|
||
change.status = 'rejected'; change.reviewNote = note; change.reviewedAt = nowIso();
|
||
await database.applyCenterChange(change, instance, action, null, [], log);
|
||
} else if (instance.currentStep < workflow.steps.length) {
|
||
const nextStep = workflow.steps.find(item => item.position === instance.currentStep + 1);
|
||
const nextAssignee = selectAdminForStep(db, nextStep.adminLevel, centerScopeProfile(db, change.schoolId));
|
||
if (!nextAssignee) return sendError(response, 409, `没有可承接“${nextStep.name}”的管理员`);
|
||
instance.currentStep += 1; instance.assigneeId = nextAssignee.id; action.toAssigneeId = nextAssignee.id;
|
||
change.reviewNote = note;
|
||
await database.processWorkflow(instance, action, change, log);
|
||
} else {
|
||
instance.status = 'approved'; instance.completedAt = nowIso(); instance.assigneeId = null;
|
||
change.status = 'approved'; change.reviewNote = note; change.reviewedAt = nowIso();
|
||
const centerId = change.centerId || uid('center');
|
||
const proposedRooms = db.centerChangeRooms.filter(item => item.requestId === change.id);
|
||
const rooms = proposedRooms.map(room => ({ ...room, id: room.roomId || uid('room'), centerId }));
|
||
const center = {
|
||
id: centerId, schoolId: change.schoolId, code: change.code, name: change.name,
|
||
provinceCode: change.provinceCode, provinceName: change.provinceName, cityCode: change.cityCode,
|
||
cityName: change.cityName, districtCode: change.districtCode, districtName: change.districtName,
|
||
address: change.address,
|
||
contact: change.contact, managerName: change.managerName, managerPhone: change.managerPhone,
|
||
emergencyPhone: change.emergencyPhone, gateOpenTime: change.gateOpenTime, transport: change.transport,
|
||
status: change.centerStatus, notes: change.notes,
|
||
rooms: rooms.map(room => `${room.building} ${room.name}`).join('；'), updatedAt: nowIso()
|
||
};
|
||
await database.applyCenterChange(change, instance, action, center, rooms, log);
|
||
}
|
||
return sendJson(response, 200, { ok: true, changeRequest: centerChangeView({ ...db, workflowActions: [...db.workflowActions, action] }, change) });
|
||
}
|
||
|
||
if (pathname === '/api/admin/number-rules' && request.method === 'GET') {
|
||
if (!requirePermission(user, response, '*')) return true;
|
||
const rule = db.numberRules.find(item => item.active) || null;
|
||
const previewProfile = db.candidateProfiles[0] || { gender: '女', schoolId: db.schools[0]?.id };
|
||
let preview = '';
|
||
if (rule) preview = generateCandidateNumber(db, previewProfile).number;
|
||
return sendJson(response, 200, { ok: true, rules: db.numberRules, activeRule: rule, preview });
|
||
}
|
||
if (pathname === '/api/admin/number-rules' && request.method === 'POST') {
|
||
if (!requirePermission(user, response, '*')) return true;
|
||
const body = await readJson(request);
|
||
const allowedTypes = ['year', 'school_code', 'gender', 'sequence', 'literal'];
|
||
const requested = Array.isArray(body.segments) ? body.segments : [];
|
||
if (!requested.length || requested.some(item => !allowedTypes.includes(item.type)) || !requested.some(item => item.type === 'sequence')) return sendError(response, 400, '报名号规则至少包含一个流水号段');
|
||
const existing = db.numberRules.find(item => item.id === body.id);
|
||
const rule = {
|
||
id: existing?.id || uid('rule'), name: cleanText(body.name, 80) || '自定义报名号规则', separator: cleanText(body.separator, 3),
|
||
active: true, createdBy: user.id, updatedAt: nowIso(), segments: requested.map((item, index) => ({
|
||
id: uid('segment'), position: index + 1, type: item.type, value: cleanText(item.value, 20), width: Math.min(12, Math.max(0, Number(item.width || 0)))
|
||
}))
|
||
};
|
||
const log = logAction(db, user, '更新报名号规则', `${rule.name} · ${rule.segments.map(item => item.type).join(' + ')}`);
|
||
await database.saveNumberRule(rule, !existing, log);
|
||
return sendJson(response, 200, { ok: true, rule });
|
||
}
|
||
if (pathname === '/api/admin/workflows' && request.method === 'GET') {
|
||
if (!requirePermission(user, response, '*')) return true;
|
||
return sendJson(response, 200, { ok: true, workflows: db.workflows });
|
||
}
|
||
const workflowDefinitionMatch = pathname.match(/^\/api\/admin\/workflows\/(profile_change|registration_review|center_change|candidate_account_batch|score_appeal)$/);
|
||
if (workflowDefinitionMatch && request.method === 'PUT') {
|
||
if (!requirePermission(user, response, '*')) return true;
|
||
const body = await readJson(request);
|
||
const workflow = activeWorkflow(db, workflowDefinitionMatch[1]);
|
||
if (!workflow) return sendError(response, 404, '审批流程不存在');
|
||
const steps = Array.isArray(body.steps) ? body.steps : [];
|
||
if (!steps.length || steps.some(item => !['class', 'school', 'super'].includes(item.adminLevel))) return sendError(response, 400, '流程至少需要一个班级、校级或超级管理员审批步骤');
|
||
if (['center_change', 'candidate_account_batch'].includes(workflowDefinitionMatch[1]) && steps.some(item => item.adminLevel === 'class')) return sendError(response, 400, '该业务不对应单一班级，不能配置班级管理员审批步骤');
|
||
if (workflowDefinitionMatch[1] === 'candidate_account_batch' && steps.at(-1)?.adminLevel !== 'super') return sendError(response, 400, '批量报名号申领的最终步骤必须由超级管理员审批');
|
||
workflow.name = cleanText(body.name, 80) || workflow.name;
|
||
workflow.updatedBy = user.id;
|
||
workflow.updatedAt = nowIso();
|
||
workflow.steps = steps.map((item, index) => ({ id: uid('workflow_step'), position: index + 1, name: cleanText(item.name, 80) || `第 ${index + 1} 步`, adminLevel: item.adminLevel }));
|
||
const log = logAction(db, user, '修改审批流程', `${workflow.name} · ${workflow.steps.length} 个步骤`);
|
||
await database.saveWorkflow(workflow, log);
|
||
return sendJson(response, 200, { ok: true, workflow });
|
||
}
|
||
|
||
if (pathname === '/api/admin/workflow-instances' && request.method === 'GET') {
|
||
if (!requirePermission(user, response, 'workflows.inbox')) return true;
|
||
const instances = db.workflowInstances.filter(instance => {
|
||
if (user.adminLevel === 'super') return true;
|
||
const profile = workflowScopeProfile(db, instance);
|
||
return Boolean(profile && profileInScope(user, profile));
|
||
}).map(instance => {
|
||
const profile = workflowScopeProfile(db, instance);
|
||
const registration = instance.businessType === 'registration_review' ? db.registrations.find(item => item.id === instance.businessId) : null;
|
||
const centerChange = instance.businessType === 'center_change' ? db.centerChangeRequests.find(item => item.id === instance.businessId) : null;
|
||
const accountBatch = instance.businessType === 'candidate_account_batch' ? db.candidateAccountBatches.find(item => item.id === instance.businessId) : null;
|
||
const appealResult = instance.businessType === 'score_appeal' ? db.results.find(item => item.id === instance.businessId) : null;
|
||
const appealRegistration = appealResult ? db.registrations.find(item => item.id === appealResult.registrationId) : null;
|
||
const appealExam = appealRegistration ? db.exams.find(item => item.id === appealRegistration.examId) : null;
|
||
const appealSubject = appealExam?.subjects.find(item => item.id === appealResult?.subjectId);
|
||
const appealRank = appealResult ? resultRankInfo(db, appealResult) : null;
|
||
const appealPass = appealResult ? subjectPassEvaluation(db, appealResult, appealSubject) : null;
|
||
return {
|
||
...workflowView(db, instance), candidateName: profile?.name || '', schoolName: profile?.school || '', className: profile?.grade || '',
|
||
examName: registration ? db.exams.find(item => item.id === registration.examId)?.name || '' : '',
|
||
centerName: centerChange?.name || '', requestType: centerChange?.requestType || '', centerChange: centerChange ? centerChangeView(db, centerChange) : null,
|
||
accountBatch: accountBatch ? candidateAccountBatchView(db, accountBatch) : null,
|
||
batchTotalCount: accountBatch ? db.candidateAccountBatchItems.filter(item => item.batchId === accountBatch.id).length : 0,
|
||
appealResult: appealResult ? {
|
||
score: appealResult.score, grade: appealRank?.grade || appealResult.grade, rank: appealRank?.rank, cohortSize: appealRank?.cohortSize, rankPercent: appealRank?.rankPercent,
|
||
examName: appealExam?.name || '', examCode: appealExam?.code || '', subjectName: appealSubject?.name || '',
|
||
fullScore: appealSubject?.fullScore, passRule: appealSubject?.passRule || 'fixed_score', passValue: appealSubject?.passValue ?? appealSubject?.passScore,
|
||
passScore: appealPass?.passScore ?? null, cutoffRank: appealPass?.cutoffRank ?? null,
|
||
passText: subjectPassText(appealSubject), qualified: appealPass?.qualified ?? null
|
||
} : null
|
||
};
|
||
});
|
||
const availableAdmins = db.users.filter(item => item.role === 'admin' && item.active).map(safeUser);
|
||
return sendJson(response, 200, { ok: true, instances, availableAdmins, canSupervise: user.adminLevel === 'super' });
|
||
}
|
||
const transferMatch = pathname.match(/^\/api\/admin\/workflow-instances\/([^/]+)\/transfer$/);
|
||
if (transferMatch && request.method === 'PATCH') {
|
||
const body = await readJson(request);
|
||
const instance = db.workflowInstances.find(item => item.id === transferMatch[1] && item.status === 'pending');
|
||
if (!instance) return sendError(response, 404, '待处理流程不存在');
|
||
const workflow = db.workflows.find(item => item.id === instance.workflowId);
|
||
const step = workflow?.steps.find(item => item.position === instance.currentStep);
|
||
if (user.adminLevel !== 'super' && instance.assigneeId !== user.id) return sendError(response, 403, '只有当前处理人可以转交该流程');
|
||
const target = db.users.find(item => item.id === body.assigneeId && item.role === 'admin' && item.active && item.adminLevel === step?.adminLevel);
|
||
if (!target) return sendError(response, 400, '只能转交给当前步骤同级管理员');
|
||
const profile = workflowScopeProfile(db, instance);
|
||
if (step.adminLevel === 'school' && target.schoolId !== profile?.schoolId) return sendError(response, 400, '校级流程只能转交给本校同级管理员');
|
||
if (step.adminLevel === 'class' && (target.schoolId !== profile?.schoolId || target.classId !== profile?.classId)) return sendError(response, 400, '班级流程只能转交给本班同级管理员');
|
||
const previous = instance.assigneeId;
|
||
instance.assigneeId = target.id;
|
||
const action = { id: uid('flow_action'), instanceId: instance.id, actorId: user.id, action: 'transfer', note: cleanText(body.note, 300), fromAssigneeId: previous, toAssigneeId: target.id, createdAt: nowIso() };
|
||
const log = logAction(db, user, '转交审批流程', `${workflow.name} → ${target.displayName}`);
|
||
await database.transferWorkflow(instance, action, log);
|
||
return sendJson(response, 200, { ok: true, workflow: workflowView({ ...db, workflowActions: [...db.workflowActions, action] }, instance) });
|
||
}
|
||
const superviseMatch = pathname.match(/^\/api\/admin\/workflow-instances\/([^/]+)\/supervise$/);
|
||
if (superviseMatch && request.method === 'PATCH') {
|
||
if (!requirePermission(user, response, '*')) return true;
|
||
const body = await readJson(request);
|
||
const instance = db.workflowInstances.find(item => item.id === superviseMatch[1]);
|
||
if (!instance) return sendError(response, 404, '流程不存在');
|
||
if (instance.businessType === 'candidate_account_batch' && db.candidateAccountBatchItems.some(item => item.batchId === instance.businessId && item.userId)) return sendError(response, 409, '已生成账号的批次不可重新打开，避免重复建号');
|
||
const workflow = db.workflows.find(item => item.id === instance.workflowId);
|
||
const requestedStep = Math.min(workflow.steps.length, Math.max(1, Number(body.currentStep || instance.currentStep)));
|
||
const step = workflow.steps.find(item => item.position === requestedStep);
|
||
const profile = workflowScopeProfile(db, instance);
|
||
const eligible = adminsForStep(db, step.adminLevel, profile);
|
||
const requestedAssignee = body.assigneeId ? eligible.find(item => item.id === body.assigneeId) : null;
|
||
if (body.assigneeId && !requestedAssignee) return sendError(response, 400, '指定管理员不在该学校或班级的目标步骤范围内');
|
||
const assignee = requestedAssignee || selectAdminForStep(db, step.adminLevel, profile);
|
||
if (!assignee) return sendError(response, 409, '目标步骤没有可用管理员');
|
||
const previous = instance.assigneeId;
|
||
const previousStep = instance.currentStep;
|
||
instance.status = 'pending'; instance.completedAt = null; instance.currentStep = requestedStep; instance.assigneeId = assignee.id;
|
||
const note = cleanText(body.note, 300) || `超级管理员将流程调整到第 ${requestedStep} 步`;
|
||
const action = { id: uid('flow_action'), instanceId: instance.id, actorId: user.id, action: requestedStep < previousStep ? 'return' : 'supervise', note, fromAssigneeId: previous, toAssigneeId: assignee.id, createdAt: nowIso() };
|
||
const business = instance.businessType === 'profile_change'
|
||
? profile
|
||
: instance.businessType === 'registration_review'
|
||
? db.registrations.find(item => item.id === instance.businessId)
|
||
: instance.businessType === 'center_change'
|
||
? db.centerChangeRequests.find(item => item.id === instance.businessId)
|
||
: instance.businessType === 'candidate_account_batch'
|
||
? db.candidateAccountBatches.find(item => item.id === instance.businessId)
|
||
: null;
|
||
if (business) {
|
||
business.status = 'pending'; business.reviewNote = note; business.reviewedAt = null; business.reviewerId = null;
|
||
}
|
||
const log = logAction(db, user, '监督调整审批流程', `${workflow.name} · 第 ${requestedStep} 步 · ${assignee.displayName}`);
|
||
await database.processWorkflow(instance, action, business, log);
|
||
return sendJson(response, 200, { ok: true, workflow: workflowView({ ...db, workflowActions: [...db.workflowActions, action] }, instance) });
|
||
}
|
||
|
||
if (request.method === 'GET' && pathname === '/api/admin/dashboard') {
|
||
const profiles = db.candidateProfiles.filter(item => profileInScope(user, item));
|
||
const registrations = db.registrations.filter(item => registrationInScope(db, user, item));
|
||
const visibleFlows = db.workflowInstances.filter(instance => {
|
||
if (user.adminLevel === 'super') return true;
|
||
const business = workflowScopeProfile(db, instance);
|
||
return business && profileInScope(user, business) && (instance.assigneeId === user.id || instance.status !== 'pending');
|
||
});
|
||
const pendingCandidates = profiles.filter(item => item.status === 'pending').length;
|
||
const pendingRegistrations = registrations.filter(item => item.status === 'pending').length;
|
||
return sendJson(response, 200, {
|
||
ok: true,
|
||
admin: safeUser(user),
|
||
scopeLabel: adminScopeLabel(db, user),
|
||
permissions: permissionsByLevel[user.adminLevel || 'super'],
|
||
metrics: { candidates: profiles.length, pendingCandidates, registrations: registrations.length, pendingRegistrations, pendingFlows: visibleFlows.filter(item => item.status === 'pending').length, publishedExams: db.exams.filter(item => item.status === 'published').length, notices: db.notices.filter(item => item.status === 'published').length },
|
||
logs: user.adminLevel === 'super' ? db.auditLogs.slice(0, 8) : db.auditLogs.filter(log => log.actorId === user.id).slice(0, 8)
|
||
});
|
||
}
|
||
if (request.method === 'GET' && pathname === '/api/admin/candidates') {
|
||
if (!requirePermission(user, response, 'candidates.read')) return true;
|
||
const candidates = db.candidateProfiles.filter(profile => profileInScope(user, profile)).map(profile => {
|
||
const instance = pendingWorkflow(db, 'profile_change', profile.id) || db.workflowInstances.filter(item => item.businessType === 'profile_change' && item.businessId === profile.id)[0];
|
||
const account = db.users.find(item => item.id === profile.userId);
|
||
return { ...profile, idNumberMasked: profile.idNumber.startsWith('PENDING-') ? '待考生补充' : maskId(profile.idNumber), username: account?.username, candidateNumber: account?.candidateNumber || '', mustChangePassword: Boolean(account?.mustChangePassword), workflow: workflowView(db, instance) };
|
||
});
|
||
return sendJson(response, 200, { ok: true, candidates, schools: user.adminLevel === 'super' ? db.schools.filter(item => item.active) : db.schools.filter(item => item.id === user.schoolId && item.active), classes: db.classes.filter(item => item.active && (user.adminLevel === 'super' || item.schoolId === user.schoolId)) });
|
||
}
|
||
const candidateMatch = pathname.match(/^\/api\/admin\/candidates\/([^/]+)$/);
|
||
if (request.method === 'PATCH' && candidateMatch) {
|
||
if (!requirePermission(user, response, 'candidates.review')) return true;
|
||
const body = await readJson(request);
|
||
const profile = db.candidateProfiles.find(item => item.id === candidateMatch[1]);
|
||
if (!profile) return sendError(response, 404, '考生资料不存在');
|
||
if (!profileInScope(user, profile) && user.adminLevel !== 'super') return sendError(response, 403, '该考生不在你的数据范围内');
|
||
if (!['approved', 'rejected'].includes(body.status)) return sendError(response, 400, '审核状态无效');
|
||
const instance = pendingWorkflow(db, 'profile_change', profile.id);
|
||
if (!instance) return sendError(response, 409, '当前没有待处理的考生信息流程');
|
||
const workflow = db.workflows.find(item => item.id === instance.workflowId);
|
||
const step = workflow?.steps.find(item => item.position === instance.currentStep);
|
||
if (user.adminLevel !== 'super' && (instance.assigneeId !== user.id || step?.adminLevel !== user.adminLevel)) return sendError(response, 403, '该流程当前未分配给你，可由当前处理人转交');
|
||
const note = cleanText(body.reviewNote, 300);
|
||
const action = { id: uid('flow_action'), instanceId: instance.id, actorId: user.id, action: body.status === 'approved' ? 'approve' : 'reject', note, fromAssigneeId: instance.assigneeId, toAssigneeId: null, createdAt: nowIso() };
|
||
if (body.status === 'rejected') {
|
||
instance.status = 'rejected'; instance.completedAt = nowIso(); instance.assigneeId = null;
|
||
profile.status = 'rejected'; profile.reviewNote = note; profile.reviewedAt = nowIso(); profile.reviewerId = user.id;
|
||
} else if (instance.currentStep < workflow.steps.length) {
|
||
const nextStep = workflow.steps.find(item => item.position === instance.currentStep + 1);
|
||
const nextAssignee = selectAdminForStep(db, nextStep.adminLevel, profile);
|
||
if (!nextAssignee) return sendError(response, 409, `没有可承接“${nextStep.name}”的管理员`);
|
||
instance.currentStep += 1; instance.assigneeId = nextAssignee.id; action.toAssigneeId = nextAssignee.id;
|
||
profile.status = 'pending'; profile.reviewNote = note;
|
||
} else {
|
||
instance.status = 'approved'; instance.completedAt = nowIso(); instance.assigneeId = null;
|
||
profile.status = 'approved'; profile.reviewNote = note; profile.reviewedAt = nowIso(); profile.reviewerId = user.id;
|
||
}
|
||
const log = logAction(db, user, body.status === 'approved' ? '处理考生信息流程' : '退回考生信息', `${profile.name}：${note || '无备注'}`);
|
||
await database.processWorkflow(instance, action, profile, log);
|
||
return sendJson(response, 200, { ok: true, profile, workflow: workflowView({ ...db, workflowActions: [...db.workflowActions, action] }, instance) });
|
||
}
|
||
if (request.method === 'GET' && pathname === '/api/admin/registrations') {
|
||
if (!requirePermission(user, response, 'registrations.read')) return true;
|
||
const registrations = db.registrations.filter(registration => registrationInScope(db, user, registration)).map(registration => {
|
||
const profile = db.candidateProfiles.find(item => item.userId === registration.userId);
|
||
return { ...examRegistrationView(db, registration), candidate: profile ? { ...profile, idNumber: maskId(profile.idNumber) } : null };
|
||
});
|
||
return sendJson(response, 200, { ok: true, registrations });
|
||
}
|
||
if (request.method === 'GET' && pathname === '/api/admin/admission-arrangements') {
|
||
if (!requirePermission(user, response, 'registrations.read')) return true;
|
||
const scopedRegistrations = db.registrations.filter(item => item.status === 'approved' && registrationInScope(db, user, item));
|
||
const registrations = scopedRegistrations.map(registration => {
|
||
const profile = db.candidateProfiles.find(item => item.userId === registration.userId);
|
||
return { ...examRegistrationView(db, registration), candidate: profile ? { ...profile, idNumber: maskId(profile.idNumber) } : null };
|
||
});
|
||
const plans = db.arrangementPlans.map(plan => ({
|
||
...plan,
|
||
examName: db.exams.find(item => item.id === plan.examId)?.name || '',
|
||
ruleName: db.admissionNumberRules.find(item => item.id === plan.numberRuleId)?.name || '',
|
||
mixingScopeName: admissionMixingScopes.find(item => item.code === plan.mixingScope)?.name || plan.mixingScope
|
||
}));
|
||
const visibleExams = user.adminLevel === 'super' ? db.exams : db.exams.filter(exam => scopedRegistrations.some(item => item.examId === exam.id));
|
||
const exams = visibleExams.map(exam => ({
|
||
...publicExam(exam),
|
||
approvedCount: scopedRegistrations.filter(item => item.examId === exam.id).length,
|
||
arrangedCount: scopedRegistrations.filter(item => item.examId === exam.id && item.admitCard).length,
|
||
plan: plans.find(item => item.examId === exam.id) || null
|
||
}));
|
||
const centerScope = user.adminLevel === 'super'
|
||
? db.testCenters
|
||
: user.adminLevel === 'school' ? db.testCenters.filter(item => item.schoolId === user.schoolId) : [];
|
||
return sendJson(response, 200, {
|
||
ok: true,
|
||
canArrange: user.adminLevel === 'super',
|
||
canExportCenterMaterials: user.adminLevel === 'school',
|
||
scopeLabel: adminScopeLabel(db, user),
|
||
exams,
|
||
registrations,
|
||
plans: user.adminLevel === 'super' ? plans : [],
|
||
rules: user.adminLevel === 'super' ? db.admissionNumberRules.filter(item => item.active) : [],
|
||
mixingScopes: user.adminLevel === 'super' ? admissionMixingScopes : [],
|
||
centers: centerScope.filter(item => item.status === 'active').map(center => ({
|
||
...center,
|
||
roomCount: db.testRooms.filter(room => room.centerId === center.id && room.status === 'active').length,
|
||
capacity: db.testRooms.filter(room => room.centerId === center.id && room.status === 'active' && room.roomType !== 'spare').reduce((sum, room) => sum + room.capacity, 0)
|
||
}))
|
||
});
|
||
}
|
||
const admissionExportMatch = pathname.match(/^\/api\/admin\/admission-exports\/(admit-cards|info|center-materials)$/);
|
||
if (request.method === 'GET' && admissionExportMatch) {
|
||
if (!requirePermission(user, response, 'registrations.read')) return true;
|
||
const requestUrl = new URL(request.url, `http://${request.headers.host || '127.0.0.1'}`);
|
||
const examId = cleanText(requestUrl.searchParams.get('examId'), 64);
|
||
const exam = db.exams.find(item => item.id === examId);
|
||
if (!exam) return sendError(response, 404, '请选择有效考试');
|
||
const type = admissionExportMatch[1];
|
||
if (type === 'center-materials') {
|
||
if (user.adminLevel !== 'school') return sendError(response, 403, '考点桌贴、门贴和签名单只能由维护该考点的校级管理员导出');
|
||
const rows = centerMaterialRows(db, user.schoolId, exam.id);
|
||
if (!rows.length) return sendError(response, 404, '本校维护考点暂无该考试的已编排考生');
|
||
const buffer = Buffer.from(await buildCenterMaterialsWorkbook(rows, `${exam.name}｜${adminScopeLabel(db, user)}`));
|
||
return sendWorkbook(response, buffer, `${exam.name}-${adminScopeLabel(db, user)}-考点桌贴门贴签名单.xlsx`);
|
||
}
|
||
const scoped = db.registrations.filter(item => item.examId === exam.id && item.admitCard && registrationInScope(db, user, item));
|
||
if (!scoped.length) return sendError(response, 404, '当前范围暂无已生成的准考证');
|
||
if (type === 'admit-cards') {
|
||
const html = admitCardsHtml(db, scoped, `${exam.name}-${adminScopeLabel(db, user)}-准考证`);
|
||
const filename = encodeURIComponent(`${exam.name}-${adminScopeLabel(db, user)}-准考证批量打印.html`);
|
||
response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Content-Disposition': `attachment; filename*=UTF-8''${filename}`, 'Cache-Control': 'no-store' });
|
||
response.end(html);
|
||
return true;
|
||
}
|
||
const rows = admissionRowsForRegistrations(db, scoped);
|
||
const buffer = Buffer.from(await buildWorkbook('admit_cards', rows, { subtitle: `${exam.name}｜${adminScopeLabel(db, user)}` }));
|
||
return sendWorkbook(response, buffer, `${exam.name}-${adminScopeLabel(db, user)}-准考证信息.xlsx`);
|
||
}
|
||
const registrationMatch = pathname.match(/^\/api\/admin\/registrations\/([^/]+)$/);
|
||
if (request.method === 'PATCH' && registrationMatch) {
|
||
if (!requirePermission(user, response, 'registrations.review')) return true;
|
||
const body = await readJson(request);
|
||
const registration = db.registrations.find(item => item.id === registrationMatch[1]);
|
||
if (!registration) return sendError(response, 404, '报名记录不存在');
|
||
if (!registrationInScope(db, user, registration) && user.adminLevel !== 'super') return sendError(response, 403, '该报名不在你的数据范围内');
|
||
if (!['approved', 'rejected'].includes(body.status)) return sendError(response, 400, '审核状态无效');
|
||
const profile = db.candidateProfiles.find(item => item.userId === registration.userId);
|
||
const instance = pendingWorkflow(db, 'registration_review', registration.id);
|
||
if (!instance) return sendError(response, 409, '当前没有待处理的报名审核流程');
|
||
const workflow = db.workflows.find(item => item.id === instance.workflowId);
|
||
const step = workflow?.steps.find(item => item.position === instance.currentStep);
|
||
if (user.adminLevel !== 'super' && (instance.assigneeId !== user.id || step?.adminLevel !== user.adminLevel)) return sendError(response, 403, '该流程当前未分配给你，可由当前处理人转交');
|
||
const note = cleanText(body.reviewNote, 300);
|
||
const action = { id: uid('flow_action'), instanceId: instance.id, actorId: user.id, action: body.status === 'approved' ? 'approve' : 'reject', note, fromAssigneeId: instance.assigneeId, toAssigneeId: null, createdAt: nowIso() };
|
||
if (body.status === 'rejected') {
|
||
instance.status = 'rejected'; instance.completedAt = nowIso(); instance.assigneeId = null;
|
||
registration.status = 'rejected'; registration.reviewNote = note; registration.reviewedAt = nowIso();
|
||
} else if (instance.currentStep < workflow.steps.length) {
|
||
const nextStep = workflow.steps.find(item => item.position === instance.currentStep + 1);
|
||
const nextAssignee = selectAdminForStep(db, nextStep.adminLevel, profile);
|
||
if (!nextAssignee) return sendError(response, 409, `没有可承接“${nextStep.name}”的管理员`);
|
||
instance.currentStep += 1; instance.assigneeId = nextAssignee.id; action.toAssigneeId = nextAssignee.id;
|
||
registration.status = 'pending'; registration.reviewNote = note;
|
||
} else {
|
||
const account = db.users.find(item => item.id === registration.userId);
|
||
if (!account?.candidateNumber) return sendError(response, 409, '考生账户尚未分配报名号，请先在报名号管理中完成分配');
|
||
instance.status = 'approved'; instance.completedAt = nowIso(); instance.assigneeId = null;
|
||
registration.status = 'approved'; registration.paymentStatus = 'paid'; registration.reviewNote = note; registration.reviewedAt = nowIso();
|
||
registration.registrationNumber = account.candidateNumber;
|
||
registration.numberRuleId = db.numberRules.find(item => item.active)?.id || registration.numberRuleId;
|
||
}
|
||
const log = logAction(db, user, body.status === 'approved' ? '处理报名审核流程' : '退回考试报名', `${profile?.name || registration.userId} · ${db.exams.find(item => item.id === registration.examId)?.name}`);
|
||
await database.processWorkflow(instance, action, registration, log);
|
||
return sendJson(response, 200, { ok: true, registration, workflow: workflowView({ ...db, workflowActions: [...db.workflowActions, action] }, instance) });
|
||
}
|
||
const scoreAppealMatch = pathname.match(/^\/api\/admin\/score-appeals\/([^/]+)$/);
|
||
if (request.method === 'PATCH' && scoreAppealMatch) {
|
||
if (!requirePermission(user, response, 'workflows.inbox')) return true;
|
||
const body = await readJson(request);
|
||
if (!['approved', 'rejected'].includes(body.status)) return sendError(response, 400, '复议处理状态无效');
|
||
const result = db.results.find(item => item.id === scoreAppealMatch[1] && item.published);
|
||
const registration = db.registrations.find(item => item.id === result?.registrationId);
|
||
const profile = db.candidateProfiles.find(item => item.userId === registration?.userId);
|
||
if (!result || !registration || !profile) return sendError(response, 404, '待处理的成绩复议不存在');
|
||
if (!profileInScope(user, profile)) return sendError(response, 403, '该成绩复议不在你的数据范围内');
|
||
const instance = pendingWorkflow(db, 'score_appeal', result.id);
|
||
const workflow = instance && db.workflows.find(item => item.id === instance.workflowId);
|
||
const step = workflow?.steps.find(item => item.position === instance.currentStep);
|
||
if (!instance || !workflow || !step) return sendError(response, 409, '成绩复议流程状态异常');
|
||
if (user.adminLevel !== 'super' && (instance.assigneeId !== user.id || step.adminLevel !== user.adminLevel)) return sendError(response, 403, '该流程当前未分配给你，可由当前处理人转交');
|
||
const note = cleanText(body.reviewNote, 300);
|
||
const action = { id: uid('flow_action'), instanceId: instance.id, actorId: user.id, action: body.status === 'approved' ? 'approve' : 'reject', note, fromAssigneeId: instance.assigneeId, toAssigneeId: null, createdAt: nowIso() };
|
||
const exam = db.exams.find(item => item.id === registration.examId);
|
||
const subject = exam?.subjects.find(item => item.id === result.subjectId);
|
||
const finalStep = instance.currentStep >= workflow.steps.length;
|
||
let reviewedScore = null;
|
||
if (body.status === 'approved' && finalStep) {
|
||
reviewedScore = body.reviewedScore == null || String(body.reviewedScore).trim() === '' ? Number.NaN : Number(body.reviewedScore);
|
||
if (!Number.isFinite(reviewedScore) || reviewedScore < 0 || reviewedScore > Number(subject?.fullScore || 0)) return sendError(response, 400, `最终审批必须填写 0—${subject?.fullScore || 0} 之间的复核后分数`);
|
||
}
|
||
if (body.status === 'rejected') {
|
||
instance.status = 'rejected'; instance.completedAt = nowIso(); instance.assigneeId = null;
|
||
} else if (instance.currentStep < workflow.steps.length) {
|
||
const nextStep = workflow.steps.find(item => item.position === instance.currentStep + 1);
|
||
const nextAssignee = selectAdminForStep(db, nextStep.adminLevel, profile);
|
||
if (!nextAssignee) return sendError(response, 409, `没有可承接“${nextStep.name}”的管理员`);
|
||
instance.currentStep += 1; instance.assigneeId = nextAssignee.id; action.toAssigneeId = nextAssignee.id;
|
||
} else {
|
||
instance.status = 'approved'; instance.completedAt = nowIso(); instance.assigneeId = null;
|
||
const originalScore = result.score;
|
||
result.score = reviewedScore;
|
||
const rank = resultRankInfo(db, result, reviewedScore);
|
||
result.grade = rank.grade;
|
||
result.updatedAt = nowIso();
|
||
const pass = subjectPassEvaluation(db, result, subject, reviewedScore);
|
||
const passConclusion = pass.qualified == null
|
||
? '本科不判定单科达线'
|
||
: `${pass.qualified ? '达到' : '未达到'}${subject.passRule === 'rank_percent' ? `排名前 ${subject.passValue}%（当前第 ${pass.rank}/${pass.cohortSize} 名，截止第 ${pass.cutoffRank} 名）` : `固定及格线 ${pass.passScore} 分`}`;
|
||
action.note = [`原分 ${originalScore} → 复核后 ${reviewedScore}`, passConclusion, note].filter(Boolean).join('；');
|
||
}
|
||
const log = logAction(db, user, body.status === 'approved' ? (finalStep ? '复议终审并更新成绩' : '处理成绩复议') : '退回成绩复议', `${profile.name} · ${exam?.name || ''} · ${subject?.name || ''}${finalStep && body.status === 'approved' ? ` · ${result.score} 分` : ''}`);
|
||
await database.processWorkflow(instance, action, finalStep && body.status === 'approved' ? result : null, log);
|
||
const rank = resultRankInfo(db, result);
|
||
const pass = subjectPassEvaluation(db, result, subject);
|
||
return sendJson(response, 200, {
|
||
ok: true, workflow: workflowView({ ...db, workflowActions: [...db.workflowActions, action] }, instance),
|
||
result: { ...result, ...rank, passScore: pass.passScore, cutoffRank: pass.cutoffRank, qualified: pass.qualified }
|
||
});
|
||
}
|
||
const arrangementMatch = pathname.match(/^\/api\/admin\/exams\/([^/]+)\/admission-arrangement(\/preview)?$/);
|
||
if (request.method === 'POST' && arrangementMatch) {
|
||
if (!requirePermission(user, response, '*')) return true;
|
||
const body = await readJson(request);
|
||
const generatedAt = nowIso();
|
||
const result = buildAdmissionArrangement(db, {
|
||
examId: arrangementMatch[1],
|
||
mixingScope: cleanText(body.mixingScope, 20),
|
||
numberRuleId: cleanText(body.numberRuleId, 64),
|
||
seed: cleanText(body.seed, 80),
|
||
generatedAt
|
||
});
|
||
if (arrangementMatch[2]) return sendJson(response, 200, {
|
||
ok: true,
|
||
preview: true,
|
||
summary: result.summary,
|
||
warnings: result.warnings,
|
||
samples: result.cards.slice(0, 5)
|
||
});
|
||
const plan = {
|
||
id: uid('arrangement'),
|
||
examId: result.exam.id,
|
||
numberRuleId: result.rule.id,
|
||
mixingScope: result.mixingScope,
|
||
randomSeed: result.seed,
|
||
...result.summary,
|
||
warnings: result.warnings,
|
||
generatedBy: user.id,
|
||
generatedAt
|
||
};
|
||
const log = logAction(db, user, db.arrangementPlans.some(item => item.examId === result.exam.id) ? '重新编排准考证' : '批量编排准考证',
|
||
`${result.exam.name} · ${plan.candidateCount} 人 · ${plan.centerCount} 个考点 · ${result.rule.name}`);
|
||
await database.saveAdmissionArrangement(plan, result.cards, log);
|
||
return sendJson(response, 200, { ok: true, plan, summary: result.summary, warnings: result.warnings, cards: result.cards });
|
||
}
|
||
const legacyAdmitMatch = pathname.match(/^\/api\/admin\/registrations\/([^/]+)\/admit-card$/);
|
||
if (request.method === 'POST' && legacyAdmitMatch) {
|
||
return sendError(response, 410, '单人生成已停用，请在“准考证编排”中按整场考试预检并批量生成');
|
||
}
|
||
if (request.method === 'GET' && pathname === '/api/admin/exams') {
|
||
if (!requirePermission(user, response, '*')) return true;
|
||
return sendJson(response, 200, { ok: true, exams: db.exams.map(exam => ({ ...publicExam(exam), registrationCount: db.registrations.filter(reg => reg.examId === exam.id).length })) });
|
||
}
|
||
if (request.method === 'POST' && pathname === '/api/admin/exams') {
|
||
if (!requirePermission(user, response, '*')) return true;
|
||
const body = await readJson(request);
|
||
const name = cleanText(body.name, 100);
|
||
if (!name || !body.registrationStart || !body.registrationEnd || !body.examStart || !body.examEnd) return sendError(response, 400, '请完整填写考试名称和关键日期');
|
||
const subjects = normalizeSubjects(body.subjects, body.examStart);
|
||
const requestedPolicy = body.passPolicy === 'score_ratio' ? 'rank_percent' : body.passPolicy;
|
||
const passPolicy = passPolicies.has(requestedPolicy) ? requestedPolicy : 'rank_percent';
|
||
const passValue = ['subject_scores', 'none'].includes(passPolicy) ? 0 : Number(body.passValue ?? 60);
|
||
const scoringError = validateExamScoring(subjects, passPolicy, passValue);
|
||
if (scoringError) return sendError(response, 400, scoringError);
|
||
const exam = { id: uid('exam'), code: cleanText(body.code, 30) || `EX-${new Date().getFullYear()}-${String(db.exams.length + 1).padStart(2, '0')}`, name, description: cleanText(body.description, 500), registrationStart: body.registrationStart, registrationEnd: body.registrationEnd, examStart: body.examStart, examEnd: body.examEnd, admitDownloadStart: body.admitDownloadStart || body.registrationEnd, admitDownloadEnd: body.admitDownloadEnd || body.examStart, location: cleanText(body.location, 100), passPolicy, passValue, status: body.status === 'published' ? 'published' : 'draft', subjects, createdAt: nowIso() };
|
||
const log = logAction(db, user, '创建考试', `${exam.name} · ${subjects.length} 个科目`);
|
||
await database.createExam(exam, log);
|
||
return sendJson(response, 201, { ok: true, exam });
|
||
}
|
||
const examMatch = pathname.match(/^\/api\/admin\/exams\/([^/]+)$/);
|
||
if (request.method === 'PATCH' && examMatch) {
|
||
if (!requirePermission(user, response, '*')) return true;
|
||
const body = await readJson(request);
|
||
const exam = db.exams.find(item => item.id === examMatch[1]);
|
||
if (!exam) return sendError(response, 404, '考试不存在');
|
||
const originalStatus = exam.status;
|
||
const detailFields = ['code', 'name', 'description', 'location', 'registrationStart', 'registrationEnd', 'examStart', 'examEnd', 'admitDownloadStart', 'admitDownloadEnd'];
|
||
const editingDetails = detailFields.some(field => body[field] != null) || body.subjects != null || body.passPolicy != null || body.passValue != null;
|
||
if (editingDetails && originalStatus !== 'draft') return sendError(response, 409, '请先将考试撤回为草稿后再编辑');
|
||
if (body.status && ['draft', 'published', 'closed'].includes(body.status)) exam.status = body.status;
|
||
detailFields.forEach(field => { if (body[field] != null) exam[field] = cleanText(body[field], field === 'description' ? 500 : 100); });
|
||
if (body.passPolicy != null) {
|
||
const requestedPolicy = body.passPolicy === 'score_ratio' ? 'rank_percent' : body.passPolicy;
|
||
if (passPolicies.has(requestedPolicy)) exam.passPolicy = requestedPolicy;
|
||
}
|
||
if (body.passValue != null) exam.passValue = Number(body.passValue);
|
||
let replaceSubjects = false;
|
||
if (body.subjects != null) {
|
||
if (db.registrations.some(registration => registration.examId === exam.id)) return sendError(response, 409, '已有报名记录，不能修改考试科目');
|
||
exam.subjects = normalizeSubjects(body.subjects, exam.examStart);
|
||
replaceSubjects = true;
|
||
}
|
||
const scoringError = validateExamScoring(exam.subjects, exam.passPolicy, Number(exam.passValue));
|
||
if (scoringError) return sendError(response, 400, scoringError);
|
||
if (!exam.name || !exam.registrationStart || !exam.registrationEnd || !exam.examStart || !exam.examEnd) return sendError(response, 400, '请完整填写考试名称和关键日期');
|
||
if (exam.status === 'published' && !exam.subjects.length) return sendError(response, 400, '请先配置考试科目再发布');
|
||
const log = logAction(db, user, '更新考试', `${exam.name} · 状态 ${exam.status}`);
|
||
await database.updateExam(exam, log, replaceSubjects);
|
||
return sendJson(response, 200, { ok: true, exam });
|
||
}
|
||
if (request.method === 'GET' && pathname === '/api/admin/notices') {
|
||
if (!requirePermission(user, response, '*')) return true;
|
||
return sendJson(response, 200, { ok: true, notices: db.notices.sort((a, b) => new Date(b.publishAt || b.createdAt) - new Date(a.publishAt || a.createdAt)) });
|
||
}
|
||
if (request.method === 'POST' && pathname === '/api/admin/notices') {
|
||
if (!requirePermission(user, response, '*')) return true;
|
||
const body = await readJson(request);
|
||
const title = cleanText(body.title, 120);
|
||
const content = cleanText(body.content, 5000);
|
||
if (!title || !content) return sendError(response, 400, '通知标题和正文不能为空');
|
||
const notice = { id: uid('notice'), title, summary: cleanText(body.summary, 260) || content.slice(0, 80), content, category: cleanText(body.category, 30) || '通知公告', pinned: Boolean(body.pinned), status: body.status === 'draft' ? 'draft' : 'published', publishAt: body.status === 'draft' ? null : nowIso(), createdAt: nowIso(), author: user.displayName };
|
||
const log = logAction(db, user, notice.status === 'published' ? '发布通知' : '保存通知草稿', notice.title);
|
||
await database.createNotice(notice, log);
|
||
return sendJson(response, 201, { ok: true, notice });
|
||
}
|
||
const noticeMatch = pathname.match(/^\/api\/admin\/notices\/([^/]+)$/);
|
||
if (request.method === 'PATCH' && noticeMatch) {
|
||
if (!requirePermission(user, response, '*')) return true;
|
||
const body = await readJson(request);
|
||
const notice = db.notices.find(item => item.id === noticeMatch[1]);
|
||
if (!notice) return sendError(response, 404, '通知不存在');
|
||
['title', 'summary', 'content', 'category'].forEach(field => { if (body[field] != null) notice[field] = cleanText(body[field], field === 'content' ? 5000 : 260); });
|
||
if (body.pinned != null) notice.pinned = Boolean(body.pinned);
|
||
if (body.status && ['draft', 'published'].includes(body.status)) {
|
||
notice.status = body.status;
|
||
if (body.status === 'published' && !notice.publishAt) notice.publishAt = nowIso();
|
||
}
|
||
const log = logAction(db, user, '更新通知', `${notice.title} · ${notice.status}`);
|
||
await database.updateNotice(notice, log);
|
||
return sendJson(response, 200, { ok: true, notice });
|
||
}
|
||
if (request.method === 'GET' && pathname === '/api/admin/results') {
|
||
if (!requirePermission(user, response, 'results.read')) return true;
|
||
const scopedRegistrations = db.registrations.filter(item => registrationInScope(db, user, item));
|
||
const results = db.results.filter(result => scopedRegistrations.some(item => item.id === result.registrationId)).map(result => {
|
||
const registration = db.registrations.find(item => item.id === result.registrationId);
|
||
const profile = db.candidateProfiles.find(item => item.userId === registration?.userId);
|
||
const account = db.users.find(item => item.id === registration?.userId);
|
||
const exam = db.exams.find(item => item.id === registration?.examId);
|
||
const subject = exam?.subjects.find(item => item.id === result.subjectId);
|
||
const pass = subjectPassEvaluation(db, result, subject);
|
||
const rank = resultRankInfo(db, result);
|
||
return {
|
||
...result, grade: result.published ? rank.grade : result.grade, rank: rank.rank, cohortSize: rank.cohortSize, rankPercent: rank.rankPercent,
|
||
candidateName: profile?.name, candidateNumber: account?.candidateNumber || registration?.registrationNumber || '',
|
||
schoolName: profile?.school || '', className: db.classes.find(item => item.id === profile?.classId)?.name || profile?.grade || '',
|
||
examId: exam?.id, examCode: exam?.code, examName: exam?.name, subjectName: subject?.name,
|
||
fullScore: subject?.fullScore, passRule: subject?.passRule || 'fixed_score', passValue: subject?.passValue ?? subject?.passScore,
|
||
passScore: pass.passScore, cutoffRank: pass.cutoffRank, passText: subjectPassText(subject),
|
||
qualified: pass.qualified
|
||
};
|
||
});
|
||
const appeals = db.workflowInstances.filter(instance => instance.businessType === 'score_appeal' && results.some(result => result.id === instance.businessId)).map(instance => {
|
||
const result = results.find(item => item.id === instance.businessId);
|
||
const workflow = workflowView(db, instance);
|
||
return { ...workflow, result, reason: workflow.actions.find(action => action.action === 'submit')?.note || '' };
|
||
});
|
||
const approved = scopedRegistrations.filter(item => item.status === 'approved');
|
||
const exams = db.exams.map(exam => {
|
||
const examRegistrations = approved.filter(item => item.examId === exam.id);
|
||
const examResults = results.filter(item => item.examId === exam.id);
|
||
const summaries = examRegistrations.map(item => examResultSummary(db, item)).filter(Boolean);
|
||
const enrolledSubjects = examRegistrations.reduce((sum, item) => sum + item.subjectIds.length, 0);
|
||
const scored = examResults.length;
|
||
return {
|
||
...publicExam(exam), registrationCount: examRegistrations.length, enrolledSubjects, scored,
|
||
published: examResults.filter(item => item.published).length, missing: Math.max(0, enrolledSubjects - scored),
|
||
complete: summaries.filter(item => item.complete).length,
|
||
qualified: summaries.filter(item => item.complete && item.qualified === true).length,
|
||
unqualified: summaries.filter(item => item.complete && item.qualified === false).length,
|
||
appeals: appeals.filter(item => item.result?.examId === exam.id).length
|
||
};
|
||
}).filter(exam => exam.registrationCount || results.some(item => item.examId === exam.id) || user.adminLevel === 'super');
|
||
const registrations = user.adminLevel === 'super' ? approved.map(item => {
|
||
const view = examRegistrationView(db, item);
|
||
const profile = db.candidateProfiles.find(profileItem => profileItem.userId === item.userId);
|
||
const account = db.users.find(accountItem => accountItem.id === item.userId);
|
||
return { ...view, candidateName: profile?.name || account?.displayName || '', candidateNumber: account?.candidateNumber || item.registrationNumber || '', schoolName: profile?.school || '', className: db.classes.find(classItem => classItem.id === profile?.classId)?.name || profile?.grade || '' };
|
||
}) : [];
|
||
return sendJson(response, 200, { ok: true, results, appeals, registrations, exams });
|
||
}
|
||
if (request.method === 'POST' && pathname === '/api/admin/results/import') {
|
||
if (!requirePermission(user, response, '*')) return true;
|
||
const body = await readJson(request);
|
||
const result = await commitResultImport(db, user, body.rows);
|
||
return sendJson(response, 200, { ok: true, ...result });
|
||
}
|
||
if (request.method === 'POST' && pathname === '/api/admin/results') {
|
||
if (!requirePermission(user, response, '*')) return true;
|
||
const body = await readJson(request);
|
||
const registration = db.registrations.find(item => item.id === body.registrationId && item.status === 'approved');
|
||
if (!registration) return sendError(response, 404, '已通过的报名记录不存在');
|
||
const exam = db.exams.find(item => item.id === registration.examId);
|
||
if (!registration.subjectIds.includes(body.subjectId) || !exam.subjects.some(item => item.id === body.subjectId)) return sendError(response, 400, '该考生未报名此科目');
|
||
const score = Number(body.score);
|
||
const subject = exam.subjects.find(item => item.id === body.subjectId);
|
||
if (!Number.isFinite(score) || score < 0 || score > subject.fullScore) return sendError(response, 400, `成绩必须在 0—${subject.fullScore} 之间`);
|
||
let result = db.results.find(item => item.registrationId === registration.id && item.subjectId === body.subjectId);
|
||
const isNew = !result;
|
||
if (!result) {
|
||
result = { id: uid('result'), registrationId: registration.id, subjectId: body.subjectId };
|
||
db.results.push(result);
|
||
}
|
||
Object.assign(result, { score, published: Boolean(body.published), updatedAt: nowIso(), publishedAt: body.published ? (result.publishedAt || nowIso()) : null });
|
||
result.grade = result.published ? resultRankInfo(db, result, score).grade : '待发布';
|
||
const profile = db.candidateProfiles.find(item => item.userId === registration.userId);
|
||
const log = logAction(db, user, body.published ? '发布成绩' : '保存成绩', `${profile?.name} · ${subject?.name} · ${score}`);
|
||
await database.saveResult(result, isNew, log);
|
||
return sendJson(response, 200, { ok: true, result });
|
||
}
|
||
return sendError(response, 404, '管理功能接口不存在');
|
||
}
|
||
|
||
return handleAdmin;
|
||
}
|