403 lines
15 KiB
Python
403 lines
15 KiB
Python
"""用户管理路由"""
|
||
import csv, io, base64, binascii, uuid
|
||
from flask import Blueprint, request, jsonify, session, redirect, url_for, render_template
|
||
from services.db import query
|
||
from services.passwords import hash_password, validate_password
|
||
from routes.auth import login_required, role_required
|
||
|
||
users_bp = Blueprint('users', __name__)
|
||
DEPARTMENTS = ('天猫', '京东', '天猫国际', '京东国际', '阿里', '新媒体', '拼多多', 'AI指挥部', '采购部', '产品部')
|
||
|
||
|
||
def _normalize_department(value):
|
||
department = str(value or '').strip()
|
||
if department and department not in DEPARTMENTS:
|
||
raise ValueError('部门必须为：' + '、'.join(DEPARTMENTS))
|
||
return department
|
||
|
||
|
||
@users_bp.route('/api/users/positions')
|
||
@login_required
|
||
def position_list():
|
||
"""获取启用的岗位列表，供用户管理中的岗位选择和筛选使用。"""
|
||
rows = query(
|
||
"SELECT position_code AS code, position_name AS name "
|
||
"FROM user_positions WHERE status=1 ORDER BY sort_order ASC, id ASC"
|
||
)
|
||
return jsonify({"code": 0, "data": rows})
|
||
|
||
|
||
@users_bp.route('/api/users/positions/create', methods=['POST'])
|
||
@login_required
|
||
def position_create():
|
||
"""新增岗位。岗位编码由系统生成，避免中文岗位名影响现有业务匹配。"""
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可新增岗位"})
|
||
|
||
data = request.get_json(silent=True) or {}
|
||
name = str(data.get('name', '')).strip()
|
||
if not name:
|
||
return jsonify({"code": 400, "msg": "岗位名称不能为空"})
|
||
if len(name) > 100:
|
||
return jsonify({"code": 400, "msg": "岗位名称不能超过100个字符"})
|
||
|
||
try:
|
||
exists = query(
|
||
"SELECT id FROM user_positions WHERE position_name=%s LIMIT 1",
|
||
(name,)
|
||
)
|
||
if exists:
|
||
return jsonify({"code": 400, "msg": "该岗位已存在"})
|
||
|
||
position_code = 'custom_' + uuid.uuid4().hex[:16]
|
||
query(
|
||
"INSERT INTO user_positions (position_code, position_name, sort_order, status) "
|
||
"VALUES (%s, %s, 0, 1)",
|
||
(position_code, name)
|
||
)
|
||
return jsonify({
|
||
"code": 0,
|
||
"msg": "岗位新增成功",
|
||
"data": {"code": position_code, "name": name}
|
||
})
|
||
except Exception as e:
|
||
return jsonify({"code": 500, "msg": str(e)})
|
||
|
||
|
||
@users_bp.route('/users')
|
||
@login_required
|
||
def users_page():
|
||
if not role_required('users'):
|
||
return redirect(url_for('auth.index'))
|
||
return render_template('base.html', page='users')
|
||
|
||
|
||
# ─── API: 用户管理 ───
|
||
@users_bp.route('/api/users/list')
|
||
@login_required
|
||
def user_list():
|
||
search = request.args.get('search', '').strip()
|
||
role = request.args.get('role', '').strip()
|
||
position = request.args.get('position', '').strip()
|
||
status = request.args.get('status', '').strip()
|
||
sort = request.args.get('sort', '').strip()
|
||
|
||
sql = "SELECT id, username, real_name, role, user_level, position, department, phone, email, status, last_login, created_at, is_protected FROM dashboard_users WHERE 1=1"
|
||
params = []
|
||
|
||
if search:
|
||
sql += " AND (real_name LIKE %s OR username LIKE %s OR position LIKE %s OR department LIKE %s)"
|
||
params.extend(['%' + search + '%'] * 4)
|
||
if role:
|
||
sql += " AND role = %s"
|
||
params.append(role)
|
||
if position:
|
||
sql += " AND position = %s"
|
||
params.append(position)
|
||
department = request.args.get('department', '').strip()
|
||
if department:
|
||
sql += " AND department = %s"
|
||
params.append(department)
|
||
if status:
|
||
sql += " AND status = %s"
|
||
params.append(int(status))
|
||
|
||
if sort == 'role_asc':
|
||
sql += " ORDER BY role ASC, id ASC"
|
||
elif sort == 'role_desc':
|
||
sql += " ORDER BY role DESC, id ASC"
|
||
else:
|
||
sql += " ORDER BY CASE WHEN role IN ('super_admin','admin') THEN 0 ELSE 1 END, FIELD(role,'super_admin','admin'), id ASC"
|
||
|
||
users = query(sql, tuple(params) if params else None)
|
||
return jsonify({"code": 0, "data": users})
|
||
|
||
|
||
@users_bp.route('/api/users/create', methods=['POST'])
|
||
@login_required
|
||
def user_create():
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
|
||
data = request.get_json(silent=True) or {}
|
||
valid, message = validate_password(data.get('password', ''))
|
||
if not valid:
|
||
return jsonify({"code": 400, "msg": message})
|
||
try:
|
||
department = _normalize_department(data.get('department'))
|
||
except ValueError as exc:
|
||
return jsonify({"code": 400, "msg": str(exc)})
|
||
try:
|
||
query("""
|
||
INSERT INTO dashboard_users (username, password, real_name, role, user_level, position, department, phone, email, must_change_password)
|
||
VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, 1)
|
||
""", (
|
||
data['username'], hash_password(data['password']), data.get('real_name', ''),
|
||
data.get('role', 'viewer'), data.get('user_level', 'employee'),
|
||
data.get('position', ''), department, data.get('phone', ''), data.get('email', '')
|
||
))
|
||
return jsonify({"code": 0, "msg": "创建成功"})
|
||
except Exception as e:
|
||
return jsonify({"code": 500, "msg": str(e)})
|
||
|
||
|
||
@users_bp.route('/api/users/update', methods=['POST'])
|
||
@login_required
|
||
def user_update():
|
||
if session.get('role') != 'super_admin':
|
||
return jsonify({"code": 403, "msg": "权限不足，仅超级管理员可以编辑用户"})
|
||
|
||
data = request.json
|
||
user_id = data['id']
|
||
try:
|
||
department = _normalize_department(data.get('department'))
|
||
except ValueError as exc:
|
||
return jsonify({"code": 400, "msg": str(exc)})
|
||
|
||
if data.get('password'):
|
||
valid, message = validate_password(data['password'])
|
||
if not valid:
|
||
return jsonify({"code": 400, "msg": message})
|
||
query("""
|
||
UPDATE dashboard_users SET real_name=%s, role=%s, user_level=%s, position=%s, department=%s, phone=%s, email=%s,
|
||
status=%s, password=%s, must_change_password=1
|
||
WHERE id=%s
|
||
""", (
|
||
data.get('real_name', ''), data.get('role', 'viewer'),
|
||
data.get('user_level', 'employee'),
|
||
data.get('position', ''), department, data.get('phone', ''), data.get('email', ''),
|
||
int(data.get('status', 1)), hash_password(data['password']), user_id
|
||
))
|
||
else:
|
||
query("""
|
||
UPDATE dashboard_users SET real_name=%s, role=%s, user_level=%s, position=%s, department=%s, phone=%s, email=%s, status=%s
|
||
WHERE id=%s
|
||
""", (
|
||
data.get('real_name', ''), data.get('role', 'viewer'),
|
||
data.get('user_level', 'employee'),
|
||
data.get('position', ''), department, data.get('phone', ''), data.get('email', ''),
|
||
int(data.get('status', 1)), user_id
|
||
))
|
||
|
||
return jsonify({"code": 0, "msg": "更新成功"})
|
||
|
||
|
||
@users_bp.route('/api/users/delete', methods=['POST'])
|
||
@login_required
|
||
def user_delete():
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
|
||
user_id = request.json.get('id')
|
||
if int(user_id) == session['user_id']:
|
||
return jsonify({"code": 500, "msg": "不能删除自己"})
|
||
|
||
protected = query("SELECT is_protected FROM dashboard_users WHERE id=%s", (user_id,))
|
||
if protected and protected[0].get('is_protected') == 1:
|
||
return jsonify({"code": 500, "msg": "该用户为受保护账号，不可删除"})
|
||
|
||
query("DELETE FROM dashboard_users WHERE id=%s", (user_id,))
|
||
return jsonify({"code": 0, "msg": "删除成功"})
|
||
|
||
|
||
@users_bp.route('/api/users/template')
|
||
@login_required
|
||
def user_template():
|
||
"""下载用户导入CSV模板"""
|
||
csv_content = '\ufeff用户名,密码,真实姓名,角色,员工级别,岗位,部门,手机,邮箱,状态\n'
|
||
csv_content += 'zhangsan,Abc123!@#45,张三,procurement_planner,employee,采购专员,天猫,13800138000,zhangsan@example.com,1\n'
|
||
csv_content += 'lisi,Xyz789$%^01,李四,admin,employee,系统管理员,京东,13900139000,lisi@example.com,1\n'
|
||
from urllib.parse import quote
|
||
filename = '用户导入模板.csv'
|
||
encoded = quote(filename, safe='')
|
||
return csv_content, 200, {
|
||
'Content-Type': 'text/csv; charset=utf-8',
|
||
'Content-Disposition': f"attachment; filename*=UTF-8''{encoded}"
|
||
}
|
||
|
||
|
||
def _validate_user_import_headers(headers):
|
||
normalized = [(str(header).strip() if header is not None else '') for header in headers]
|
||
if not {'用户名', '密码'}.issubset(normalized):
|
||
raise ValueError("导入文件缺少“用户名”或“密码”表头，请使用系统下载的用户导入模板")
|
||
return normalized
|
||
|
||
|
||
def _excel_cell_text(value):
|
||
"""将 Excel 单元格转换为稳定文本，避免手机号等整数出现 .0。"""
|
||
if value is None:
|
||
return ''
|
||
if isinstance(value, bool):
|
||
return '1' if value else '0'
|
||
if isinstance(value, float) and value.is_integer():
|
||
return str(int(value))
|
||
return str(value).strip()
|
||
|
||
|
||
def _rows_from_excel_values(values):
|
||
iterator = iter(values)
|
||
try:
|
||
headers = _validate_user_import_headers(next(iterator))
|
||
except StopIteration:
|
||
raise ValueError("导入文件为空")
|
||
|
||
rows = []
|
||
for values_row in iterator:
|
||
cells = [_excel_cell_text(value) for value in values_row]
|
||
if not any(cells):
|
||
continue
|
||
rows.append({
|
||
header: (cells[index] if index < len(cells) else '')
|
||
for index, header in enumerate(headers) if header
|
||
})
|
||
return rows
|
||
|
||
|
||
def _parse_user_import_csv(raw_bytes):
|
||
"""解码并完整解析用户 CSV，兼容 Excel 导出的 CR/LF/CRLF 换行。"""
|
||
parse_errors = []
|
||
for encoding in ('utf-8-sig', 'gb18030', 'gbk', 'utf-8'):
|
||
try:
|
||
decoded = raw_bytes.decode(encoding)
|
||
except UnicodeDecodeError:
|
||
continue
|
||
|
||
try:
|
||
# newline='' 让 csv 模块自行识别 CR、LF 和 CRLF。StringIO 默认的
|
||
# newline='\n' 会保留单独的 CR，随后触发
|
||
# "new-line character seen in unquoted field"。
|
||
reader = csv.DictReader(io.StringIO(decoded, newline=''), strict=True)
|
||
headers = _validate_user_import_headers(reader.fieldnames or [])
|
||
reader.fieldnames = headers
|
||
return [row for row in reader if any(str(value or '').strip() for value in row.values())]
|
||
except csv.Error as exc:
|
||
parse_errors.append(str(exc))
|
||
except ValueError:
|
||
continue
|
||
|
||
if parse_errors:
|
||
raise ValueError(f"CSV格式错误：{parse_errors[-1]}")
|
||
raise ValueError("无法识别CSV编码或表头，请使用系统下载的用户导入模板")
|
||
|
||
|
||
def _parse_user_import_xlsx(raw_bytes):
|
||
try:
|
||
from openpyxl import load_workbook
|
||
workbook = load_workbook(io.BytesIO(raw_bytes), read_only=True, data_only=True)
|
||
except Exception as exc:
|
||
raise ValueError(f"XLSX文件无法读取：{exc}")
|
||
|
||
try:
|
||
if not workbook.sheetnames:
|
||
raise ValueError("XLSX文件不包含工作表")
|
||
return _rows_from_excel_values(workbook.active.iter_rows(values_only=True))
|
||
finally:
|
||
workbook.close()
|
||
|
||
|
||
def _parse_user_import_xls(raw_bytes):
|
||
try:
|
||
import xlrd
|
||
except ImportError:
|
||
raise ValueError("服务器缺少XLS解析组件，请联系管理员")
|
||
|
||
try:
|
||
workbook = xlrd.open_workbook(file_contents=raw_bytes)
|
||
if workbook.nsheets == 0:
|
||
raise ValueError("XLS文件不包含工作表")
|
||
sheet = workbook.sheet_by_index(0)
|
||
return _rows_from_excel_values(sheet.row_values(index) for index in range(sheet.nrows))
|
||
except ValueError:
|
||
raise
|
||
except Exception as exc:
|
||
raise ValueError(f"XLS文件无法读取：{exc}")
|
||
|
||
|
||
def _parse_user_import_file(raw_bytes, filename):
|
||
extension = (filename or 'users.csv').rsplit('.', 1)[-1].lower()
|
||
if extension == 'csv':
|
||
return _parse_user_import_csv(raw_bytes)
|
||
if extension == 'xlsx':
|
||
return _parse_user_import_xlsx(raw_bytes)
|
||
if extension == 'xls':
|
||
return _parse_user_import_xls(raw_bytes)
|
||
raise ValueError("仅支持CSV、XLSX、XLS格式的用户导入文件")
|
||
|
||
|
||
@users_bp.route('/api/users/import', methods=['POST'])
|
||
@login_required
|
||
def user_import():
|
||
"""导入 CSV、XLSX 或 XLS 用户文件。"""
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
|
||
data = request.get_json(silent=True) or {}
|
||
encoded_file = data.get('file_base64') or data.get('csv_base64')
|
||
filename = str(data.get('filename') or 'users.csv').strip()
|
||
if not encoded_file:
|
||
return jsonify({"code": 400, "msg": "请选择需要导入的用户文件"})
|
||
|
||
try:
|
||
raw_bytes = base64.b64decode(encoded_file, validate=True)
|
||
except (binascii.Error, ValueError, TypeError):
|
||
return jsonify({"code": 400, "msg": "文件传输内容无效，请重新选择文件"})
|
||
|
||
try:
|
||
rows = _parse_user_import_file(raw_bytes, filename)
|
||
except ValueError as exc:
|
||
return jsonify({"code": 400, "msg": str(exc)})
|
||
|
||
success = 0
|
||
errors = []
|
||
|
||
for i, row in enumerate(rows, start=2):
|
||
username = (row.get('用户名') or '').strip()
|
||
password = (row.get('密码') or '').strip()
|
||
|
||
if not username or not password:
|
||
errors.append(f"第{i}行：用户名和密码不能为空")
|
||
continue
|
||
|
||
valid, message = validate_password(password)
|
||
if not valid:
|
||
errors.append(f"第{i}行：{message}")
|
||
continue
|
||
try:
|
||
department = _normalize_department(row.get('部门'))
|
||
except ValueError as exc:
|
||
errors.append(f"第{i}行：{exc}")
|
||
continue
|
||
|
||
try:
|
||
query(
|
||
"""INSERT INTO dashboard_users (username, password, real_name, role, user_level, position, department, phone, email, status, must_change_password)
|
||
VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, 1)""",
|
||
(
|
||
username, hash_password(password),
|
||
(row.get('真实姓名') or '').strip(),
|
||
(row.get('角色') or 'viewer').strip(),
|
||
(row.get('员工级别') or 'employee').strip(),
|
||
(row.get('岗位') or '').strip(),
|
||
department,
|
||
(row.get('手机') or '').strip(),
|
||
(row.get('邮箱') or '').strip(),
|
||
int((row.get('状态') or '1').strip())
|
||
)
|
||
)
|
||
success += 1
|
||
except Exception as e:
|
||
errors.append(f"第{i}行（{username}）：{str(e)}")
|
||
|
||
return jsonify({
|
||
"code": 0,
|
||
"data": {"success": success, "errors": errors},
|
||
"msg": f"成功导入{success}个用户" + (f"，{len(errors)}个失败" if errors else "")
|
||
})
|
||
|
||
@users_bp.route('/api/users/followers')
|
||
@login_required
|
||
def user_followers():
|
||
"""获取采购跟单人员列表"""
|
||
rows = query("SELECT real_name FROM dashboard_users WHERE position='procurement_follower' AND status=1 ORDER BY real_name")
|
||
return jsonify({"code": 0, "data": [r['real_name'] for r in rows]})
|