john
468 lines
18 KiB
JavaScript
468 lines
18 KiB
JavaScript
import express from 'express';
|
|
import { listUsagePaged, listLedgerPaged } from './pagination.mjs';
|
|
|
|
function asyncHandler(handler) {
|
|
return (req, res, next) => Promise.resolve(handler(req, res, next)).catch(next);
|
|
}
|
|
|
|
function wrapRouterAsync(router) {
|
|
for (const method of ['get', 'post', 'put', 'patch', 'delete']) {
|
|
const original = router[method].bind(router);
|
|
router[method] = (path, ...handlers) =>
|
|
original(
|
|
path,
|
|
...handlers.map((handler) =>
|
|
typeof handler === 'function' && handler.length < 4 ? asyncHandler(handler) : handler,
|
|
),
|
|
);
|
|
}
|
|
}
|
|
|
|
export function createAdminApp(services) {
|
|
const { userAuth, llmProviderService, pool, ready, wechatAdmin } = services;
|
|
const app = express();
|
|
app.set('trust proxy', 1);
|
|
|
|
const isSecureRequest = (req) =>
|
|
req.secure || req.get('x-forwarded-proto')?.split(',')[0]?.trim() === 'https';
|
|
const jsonBody = express.json({ limit: '1mb' });
|
|
|
|
let cookieHelpers = null;
|
|
const cookieReady = ready.then(async () => {
|
|
cookieHelpers = {
|
|
parseCookies: services.parseCookies,
|
|
USER_COOKIE: services.USER_COOKIE,
|
|
userLoginCookies: services.userLoginCookies,
|
|
clearUserSessionCookie: services.clearUserSessionCookie,
|
|
resolveCookieDomainForRequest: services.resolveCookieDomainForRequest,
|
|
};
|
|
});
|
|
|
|
function userToken(req) {
|
|
const { parseCookies, USER_COOKIE } = cookieHelpers;
|
|
return parseCookies(req.get('cookie'))[USER_COOKIE];
|
|
}
|
|
|
|
function setUserLoginCookies(res, req, token) {
|
|
const { userLoginCookies, resolveCookieDomainForRequest } = cookieHelpers;
|
|
res.set(
|
|
'Set-Cookie',
|
|
userLoginCookies(token, isSecureRequest(req), resolveCookieDomainForRequest(req)),
|
|
);
|
|
}
|
|
|
|
function clearUserLoginCookies(res, req) {
|
|
const { clearUserSessionCookie, resolveCookieDomainForRequest } = cookieHelpers;
|
|
res.set(
|
|
'Set-Cookie',
|
|
clearUserSessionCookie(isSecureRequest(req), resolveCookieDomainForRequest(req)),
|
|
);
|
|
}
|
|
|
|
app.get('/health', (_req, res) => {
|
|
res.json({ ok: true, service: 'memind_adm' });
|
|
});
|
|
|
|
app.get('/healthz', (_req, res) => {
|
|
res.json({ ok: true, service: 'memind_adm' });
|
|
});
|
|
|
|
app.get('/auth/status', asyncHandler(async (req, res) => {
|
|
await cookieReady;
|
|
await ready;
|
|
const me = await userAuth.getMe(userToken(req));
|
|
if (!me) return res.json({ authenticated: false, mode: 'user' });
|
|
return res.json({ authenticated: true, user: me, mode: 'user' });
|
|
}));
|
|
|
|
app.post('/auth/login', jsonBody, asyncHandler(async (req, res) => {
|
|
await cookieReady;
|
|
await ready;
|
|
const { username, password } = req.body ?? {};
|
|
if (!username || !password) {
|
|
return res.status(400).json({ message: '用户名和密码不能为空' });
|
|
}
|
|
const result = await userAuth.login({ username, password, ip: req.ip });
|
|
if (!result.ok) {
|
|
if (result.retryAfterMs > 0) {
|
|
res.set('Retry-After', String(Math.ceil(result.retryAfterMs / 1000)));
|
|
return res.status(429).json({ message: result.message });
|
|
}
|
|
return res.status(401).json({ message: result.message });
|
|
}
|
|
setUserLoginCookies(res, req, result.token);
|
|
return res.json({ authenticated: true, user: result.user, mode: 'user' });
|
|
}));
|
|
|
|
app.post('/auth/logout', asyncHandler(async (req, res) => {
|
|
await cookieReady;
|
|
await ready;
|
|
await userAuth.revoke(userToken(req));
|
|
clearUserLoginCookies(res, req);
|
|
res.status(204).end();
|
|
}));
|
|
|
|
const adminApi = express.Router();
|
|
wrapRouterAsync(adminApi);
|
|
adminApi.use(jsonBody);
|
|
|
|
adminApi.use(asyncHandler(async (req, res, next) => {
|
|
await cookieReady;
|
|
await ready;
|
|
const me = await userAuth.getMe(userToken(req));
|
|
if (!me) return res.status(401).json({ message: '未登录' });
|
|
req.currentUser = me;
|
|
next();
|
|
}));
|
|
|
|
const requireAdmin = (req, res, next) => {
|
|
if (!req.currentUser || req.currentUser.role !== 'admin') {
|
|
res.status(403).json({ message: '需要管理员权限' });
|
|
return;
|
|
}
|
|
next();
|
|
};
|
|
|
|
function resolveSessionUser(req, res, next) {
|
|
if (!req.currentUser) {
|
|
res.status(401).json({ message: '未授权，请重新登录' });
|
|
return;
|
|
}
|
|
next();
|
|
}
|
|
|
|
adminApi.get('/users', requireAdmin, async (req, res) => {
|
|
const result = await userAuth.listUsers({
|
|
page: Number(req.query.page) || 1,
|
|
pageSize: Number(req.query.pageSize) || 20,
|
|
search: typeof req.query.search === 'string' ? req.query.search.trim() : '',
|
|
role: typeof req.query.role === 'string' ? req.query.role.trim() : '',
|
|
status: typeof req.query.status === 'string' ? req.query.status.trim() : '',
|
|
});
|
|
res.json(result);
|
|
});
|
|
|
|
adminApi.get('/summary', requireAdmin, async (_req, res) => {
|
|
const summary = await userAuth.getAdminSummary();
|
|
let llm = null;
|
|
if (llmProviderService) {
|
|
const keys = await llmProviderService.listKeys();
|
|
const global = await llmProviderService.getGlobalSettings();
|
|
const selected = keys.find((key) => key.isSelected);
|
|
llm = {
|
|
keyCount: keys.length,
|
|
selectedKeyName: selected?.name ?? null,
|
|
globalModel: global?.model ?? null,
|
|
};
|
|
}
|
|
res.json({ summary: { ...summary, llm } });
|
|
});
|
|
|
|
adminApi.post('/users', requireAdmin, async (req, res) => {
|
|
const result = await userAuth.createUser(req.body ?? {});
|
|
if (!result.ok) return res.status(400).json({ message: result.message });
|
|
res.status(201).json({ user: result.user });
|
|
});
|
|
|
|
adminApi.patch('/users/:userId', requireAdmin, async (req, res) => {
|
|
const result = await userAuth.updateUser(req.params.userId, req.body ?? {});
|
|
if (!result.ok) return res.status(400).json({ message: result.message });
|
|
res.json({ user: result.user });
|
|
});
|
|
|
|
adminApi.post('/users/:userId/recharge', requireAdmin, async (req, res) => {
|
|
const amountCents = Number(req.body?.amountCents);
|
|
const note = typeof req.body?.note === 'string' ? req.body.note : '';
|
|
const result = await userAuth.recharge(
|
|
req.params.userId,
|
|
amountCents,
|
|
req.currentUser.id,
|
|
note,
|
|
);
|
|
if (!result.ok) return res.status(400).json({ message: result.message });
|
|
res.json({ user: result.user });
|
|
});
|
|
|
|
adminApi.get('/usage', requireAdmin, async (req, res) => {
|
|
const result = await listUsagePaged(pool, req.query);
|
|
res.json(result);
|
|
});
|
|
|
|
adminApi.get('/ledger', requireAdmin, async (req, res) => {
|
|
const result = await listLedgerPaged(pool, req.query);
|
|
res.json(result);
|
|
});
|
|
|
|
adminApi.get('/wechat/summary', requireAdmin, async (_req, res) => {
|
|
if (!wechatAdmin) return res.status(503).json({ message: '服务号管理未启用' });
|
|
res.json(await wechatAdmin.getSummary());
|
|
});
|
|
|
|
adminApi.get('/wechat/bindings', requireAdmin, async (req, res) => {
|
|
if (!wechatAdmin) return res.status(503).json({ message: '服务号管理未启用' });
|
|
res.json(await wechatAdmin.listBindings(req.query));
|
|
});
|
|
|
|
adminApi.get('/wechat/messages', requireAdmin, async (req, res) => {
|
|
if (!wechatAdmin) return res.status(503).json({ message: '服务号管理未启用' });
|
|
res.json(await wechatAdmin.listMessages(req.query));
|
|
});
|
|
|
|
adminApi.get('/wechat/digests', requireAdmin, async (req, res) => {
|
|
if (!wechatAdmin) return res.status(503).json({ message: '服务号管理未启用' });
|
|
res.json(await wechatAdmin.listDigests(req.query));
|
|
});
|
|
|
|
adminApi.get('/wechat/deliveries', requireAdmin, async (req, res) => {
|
|
if (!wechatAdmin) return res.status(503).json({ message: '服务号管理未启用' });
|
|
res.json(await wechatAdmin.listDeliveries(req.query));
|
|
});
|
|
|
|
adminApi.post('/wechat/users/:userId/route/clear', requireAdmin, async (req, res) => {
|
|
if (!wechatAdmin) return res.status(503).json({ message: '服务号管理未启用' });
|
|
const result = await wechatAdmin.clearRouteForUser(req.params.userId);
|
|
if (!result.ok) return res.status(404).json({ message: result.message ?? '清除失败' });
|
|
res.json(result);
|
|
});
|
|
|
|
adminApi.post('/wechat/digests/:id/cancel', requireAdmin, async (req, res) => {
|
|
if (!wechatAdmin) return res.status(503).json({ message: '服务号管理未启用' });
|
|
const result = await wechatAdmin.cancelDigest(req.params.id);
|
|
if (!result.ok) return res.status(404).json({ message: '订阅不存在或已暂停' });
|
|
res.json(result);
|
|
});
|
|
|
|
adminApi.post('/wechat/digests/:id/resume', requireAdmin, async (req, res) => {
|
|
if (!wechatAdmin) return res.status(503).json({ message: '服务号管理未启用' });
|
|
const result = await wechatAdmin.resumeDigest(req.params.id);
|
|
if (!result.ok) return res.status(404).json({ message: result.message ?? '恢复失败' });
|
|
res.json(result);
|
|
});
|
|
|
|
adminApi.get('/capabilities/catalog', requireAdmin, (_req, res) => {
|
|
res.json({ catalog: userAuth.capabilityCatalog });
|
|
});
|
|
|
|
adminApi.get('/capabilities/role/:role', requireAdmin, async (req, res) => {
|
|
const role = req.params.role === 'admin' ? 'admin' : 'user';
|
|
if (role === 'admin') {
|
|
return res.json({
|
|
role,
|
|
capabilities: Object.fromEntries(
|
|
userAuth.capabilityCatalog.map((item) => [item.key, true]),
|
|
),
|
|
unrestricted: true,
|
|
});
|
|
}
|
|
res.json(await userAuth.getRoleCapabilities('user'));
|
|
});
|
|
|
|
adminApi.put('/capabilities/role/:role', requireAdmin, async (req, res) => {
|
|
const role = req.params.role === 'admin' ? 'admin' : 'user';
|
|
const result = await userAuth.setRoleCapabilities(role, req.body?.capabilities ?? {});
|
|
if (!result.ok) return res.status(400).json({ message: result.message });
|
|
res.json(result);
|
|
});
|
|
|
|
adminApi.get('/users/:userId/capabilities', requireAdmin, async (req, res) => {
|
|
const result = await userAuth.getUserCapabilities(req.params.userId);
|
|
if (!result.ok) return res.status(404).json({ message: result.message });
|
|
res.json(result);
|
|
});
|
|
|
|
adminApi.put('/users/:userId/capabilities', requireAdmin, async (req, res) => {
|
|
const result = await userAuth.setUserCapabilities(
|
|
req.params.userId,
|
|
req.body?.capabilities ?? {},
|
|
);
|
|
if (!result.ok) return res.status(400).json({ message: result.message });
|
|
res.json(result);
|
|
});
|
|
|
|
adminApi.delete('/users/:userId/capabilities', requireAdmin, async (req, res) => {
|
|
const result = await userAuth.clearUserCapabilityOverrides(req.params.userId);
|
|
if (!result.ok) return res.status(404).json({ message: result.message });
|
|
res.json(result);
|
|
});
|
|
|
|
adminApi.get('/policies/catalog', requireAdmin, (_req, res) => {
|
|
res.json({ catalog: userAuth.policyCatalog });
|
|
});
|
|
|
|
adminApi.get('/policies/role/:role', requireAdmin, async (req, res) => {
|
|
const role = req.params.role === 'admin' ? 'admin' : 'user';
|
|
if (role === 'admin') {
|
|
return res.json({ role, policies: {}, unrestricted: true });
|
|
}
|
|
res.json(await userAuth.getRolePolicies('user'));
|
|
});
|
|
|
|
adminApi.put('/policies/role/:role', requireAdmin, async (req, res) => {
|
|
const role = req.params.role === 'admin' ? 'admin' : 'user';
|
|
const result = await userAuth.setRolePolicies(role, req.body?.policies ?? {});
|
|
if (!result.ok) return res.status(400).json({ message: result.message });
|
|
res.json(result);
|
|
});
|
|
|
|
adminApi.get('/users/:userId/policies', requireAdmin, async (req, res) => {
|
|
const result = await userAuth.getUserPolicies(req.params.userId);
|
|
if (!result.ok) return res.status(404).json({ message: result.message });
|
|
res.json(result);
|
|
});
|
|
|
|
adminApi.put('/users/:userId/policies', requireAdmin, async (req, res) => {
|
|
const result = await userAuth.setUserPolicies(req.params.userId, req.body?.policies ?? {});
|
|
if (!result.ok) return res.status(400).json({ message: result.message });
|
|
res.json(result);
|
|
});
|
|
|
|
adminApi.delete('/users/:userId/policies', requireAdmin, async (req, res) => {
|
|
const result = await userAuth.clearUserPolicyOverrides(req.params.userId);
|
|
if (!result.ok) return res.status(404).json({ message: result.message });
|
|
res.json(result);
|
|
});
|
|
|
|
adminApi.get('/skills/catalog', requireAdmin, (_req, res) => {
|
|
res.json({ catalog: userAuth.skillCatalog });
|
|
});
|
|
|
|
adminApi.get('/skills/role/:role', requireAdmin, async (req, res) => {
|
|
const role = req.params.role === 'admin' ? 'admin' : 'user';
|
|
if (role === 'admin') {
|
|
return res.json({
|
|
role,
|
|
skills: Object.fromEntries(userAuth.skillCatalog.map((item) => [item.name, true])),
|
|
});
|
|
}
|
|
res.json(await userAuth.getRoleSkills('user'));
|
|
});
|
|
|
|
adminApi.put('/skills/role/:role', requireAdmin, async (req, res) => {
|
|
const role = req.params.role === 'admin' ? 'admin' : 'user';
|
|
const result = await userAuth.setRoleSkills(role, req.body?.skills ?? {});
|
|
if (!result.ok) return res.status(400).json({ message: result.message });
|
|
res.json(result);
|
|
});
|
|
|
|
adminApi.get('/users/:userId/skills', requireAdmin, async (req, res) => {
|
|
const result = await userAuth.getUserSkills(req.params.userId);
|
|
if (!result.ok) return res.status(404).json({ message: result.message });
|
|
res.json(result);
|
|
});
|
|
|
|
adminApi.put('/users/:userId/skills', requireAdmin, async (req, res) => {
|
|
const result = await userAuth.setUserSkills(req.params.userId, req.body?.skills ?? {});
|
|
if (!result.ok) return res.status(400).json({ message: result.message });
|
|
res.json(result);
|
|
});
|
|
|
|
adminApi.delete('/users/:userId/skills', requireAdmin, async (req, res) => {
|
|
const result = await userAuth.clearUserSkillOverrides(req.params.userId);
|
|
if (!result.ok) return res.status(404).json({ message: result.message });
|
|
res.json(result);
|
|
});
|
|
|
|
adminApi.get('/llm-providers/catalog', requireAdmin, (_req, res) => {
|
|
if (!llmProviderService) return res.status(503).json({ message: '未启用 LLM 配置' });
|
|
res.json({ catalog: llmProviderService.catalog });
|
|
});
|
|
|
|
adminApi.get('/llm-providers/keys', requireAdmin, async (_req, res) => {
|
|
if (!llmProviderService) return res.status(503).json({ message: '未启用 LLM 配置' });
|
|
res.json({ keys: await llmProviderService.listKeys() });
|
|
});
|
|
|
|
adminApi.post('/llm-providers/keys', requireAdmin, async (req, res) => {
|
|
if (!llmProviderService) return res.status(503).json({ message: '未启用 LLM 配置' });
|
|
const result = await llmProviderService.createKey(req.body ?? {});
|
|
if (!result.ok) return res.status(400).json({ message: result.message });
|
|
res.status(201).json({ key: result.key });
|
|
});
|
|
|
|
adminApi.patch('/llm-providers/keys/:keyId', requireAdmin, async (req, res) => {
|
|
if (!llmProviderService) return res.status(503).json({ message: '未启用 LLM 配置' });
|
|
const result = await llmProviderService.updateKey(req.params.keyId, req.body ?? {});
|
|
if (!result.ok) return res.status(400).json({ message: result.message });
|
|
res.json({ key: result.key });
|
|
});
|
|
|
|
adminApi.post('/llm-providers/keys/:keyId/select', requireAdmin, async (req, res) => {
|
|
if (!llmProviderService) return res.status(503).json({ message: '未启用 LLM 配置' });
|
|
const result = await llmProviderService.selectKey(req.params.keyId);
|
|
if (!result.ok) return res.status(400).json({ message: result.message });
|
|
res.json({ key: result.key });
|
|
});
|
|
|
|
adminApi.delete('/llm-providers/keys/:keyId', requireAdmin, async (req, res) => {
|
|
if (!llmProviderService) return res.status(503).json({ message: '未启用 LLM 配置' });
|
|
const result = await llmProviderService.deleteKey(req.params.keyId);
|
|
if (!result.ok) return res.status(400).json({ message: result.message });
|
|
res.json({ ok: true });
|
|
});
|
|
|
|
adminApi.post('/llm-providers/sync', requireAdmin, async (_req, res) => {
|
|
if (!llmProviderService) return res.status(503).json({ message: '未启用 LLM 配置' });
|
|
try {
|
|
res.json(await llmProviderService.syncSelectedToGoosed());
|
|
} catch (err) {
|
|
res.status(500).json({ message: err instanceof Error ? err.message : '同步失败' });
|
|
}
|
|
});
|
|
|
|
adminApi.get('/llm-providers/global', requireAdmin, async (_req, res) => {
|
|
if (!llmProviderService) return res.status(503).json({ message: '未启用 LLM 配置' });
|
|
res.json({ global: await llmProviderService.getGlobalSettings() });
|
|
});
|
|
|
|
adminApi.put('/llm-providers/global', requireAdmin, async (req, res) => {
|
|
if (!llmProviderService) return res.status(503).json({ message: '未启用 LLM 配置' });
|
|
const result = await llmProviderService.setGlobalModel(req.body?.model);
|
|
if (!result.ok) return res.status(400).json({ message: result.message });
|
|
res.json(result);
|
|
});
|
|
|
|
adminApi.post('/llm-providers/test', requireAdmin, async (req, res) => {
|
|
if (!llmProviderService) return res.status(503).json({ message: '未启用 LLM 配置' });
|
|
try {
|
|
res.json(await llmProviderService.testDraft(req.body ?? {}));
|
|
} catch (err) {
|
|
res.status(500).json({ ok: false, message: err instanceof Error ? err.message : '联通测试失败' });
|
|
}
|
|
});
|
|
|
|
adminApi.post('/llm-providers/keys/:keyId/test', requireAdmin, async (req, res) => {
|
|
if (!llmProviderService) return res.status(503).json({ message: '未启用 LLM 配置' });
|
|
try {
|
|
res.json(await llmProviderService.testKey(req.params.keyId, req.body?.model));
|
|
} catch (err) {
|
|
res.status(500).json({ ok: false, message: err instanceof Error ? err.message : '联通测试失败' });
|
|
}
|
|
});
|
|
|
|
app.use('/admin-api', adminApi);
|
|
|
|
if (services.createOpsApi) {
|
|
const opsApi = express.Router();
|
|
wrapRouterAsync(opsApi);
|
|
opsApi.use(asyncHandler(async (req, res, next) => {
|
|
await cookieReady;
|
|
await ready;
|
|
const me = await userAuth.getMe(userToken(req));
|
|
if (!me) return res.status(401).json({ message: '未授权，请重新登录' });
|
|
req.currentUser = me;
|
|
next();
|
|
}));
|
|
opsApi.use(resolveSessionUser);
|
|
opsApi.use('/ops/v1', services.createOpsApi({ jsonBody, plazaOps: services.plazaOps }));
|
|
app.use('/api', opsApi);
|
|
}
|
|
|
|
app.use((err, _req, res, _next) => {
|
|
console.error('Admin API request failed:', err);
|
|
if (res.headersSent) return;
|
|
res.status(500).json({ message: err instanceof Error ? err.message : '管理后台请求失败' });
|
|
});
|
|
|
|
return app;
|
|
}
|