Skip to content

X
xyw_asset_console
Commit 1625ba48 by DaiJiezhang
Options

Merge branch 'codex/integrate-authentication-to-master' into 'master' 

集成认证、刷新重定向与本地 CORS 修复

See merge request !4
parents 27c7b6d1 d9d3df13
Showing with 1849 additions and 151 deletions
backend/pom.xml
......@@ -32,6 +32,27 @@
<artifactId>spring-boot-starter-validation</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-api</artifactId>
<version>0.12.6</version>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-impl</artifactId>
<version>0.12.6</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-jackson</artifactId>
<version>0.12.6</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>com.baomidou</groupId>
<artifactId>mybatis-plus-spring-boot3-starter</artifactId>
<version>${mybatis-plus.version}</version>
......
backend/src/main/java/com/xyw/console/asset/controller/DeviceAssetController.java
......@@ -2,6 +2,7 @@ package com.xyw.console.asset.controller;
import com.xyw.console.asset.dto.*;
import com.xyw.console.asset.service.DeviceAssetService;
import com.xyw.console.auth.PagePermissionService;
import com.xyw.console.common.ApiResponse;
import jakarta.validation.Valid;
import java.util.List;
......@@ -15,26 +16,26 @@ import org.springframework.web.bind.annotation.*;
@RestController
@RequestMapping("/api/device-assets")
public class DeviceAssetController {
private final DeviceAssetService service;
private final DeviceAssetService service; private final PagePermissionService permissions;
/** 代码作用（白话）：接收设备业务服务。关联文件：DeviceAssetService.java。关联逻辑（调用链/数据流）：HTTP Controller -> Service -> Mapper/文件服务。 */
public DeviceAssetController(DeviceAssetService service) { this.service=service; }
public DeviceAssetController(DeviceAssetService service, PagePermissionService permissions) { this.service=service; this.permissions=permissions; }
/** 代码作用（白话）：返回设备分页列表。关联文件：DeviceAssetPageQuery.java、DeviceAssetService.java。关联逻辑（调用链/数据流）：GET 参数 -> page -> ApiResponse -> Vue 表格。 */
@GetMapping public ApiResponse<DeviceAssetPageResponse> page(@Valid DeviceAssetPageQuery query) { return ApiResponse.success(service.page(query)); }
@GetMapping public ApiResponse<DeviceAssetPageResponse> page(@Valid DeviceAssetPageQuery query) { permissions.requireAdministrator(); return ApiResponse.success(service.page(query)); }
/** 代码作用（白话）：创建设备及可选图片。关联文件：DeviceAssetSaveRequest.java、DeviceAssetService.java。关联逻辑（调用链/数据流）：multipart POST -> create -> 文件/数据库 -> JSON 响应。 */
@PostMapping(consumes = MediaType.MULTIPART_FORM_DATA_VALUE) public ApiResponse<DeviceAssetResponse> create(@Valid @ModelAttribute DeviceAssetSaveRequest request) { return ApiResponse.success("新增成功",service.create(request)); }
@PostMapping(consumes = MediaType.MULTIPART_FORM_DATA_VALUE) public ApiResponse<DeviceAssetResponse> create(@Valid @ModelAttribute DeviceAssetSaveRequest request) { permissions.requireAdministrator(); return ApiResponse.success("新增成功",service.create(request)); }
/** 代码作用（白话）：编辑有效设备并可替换或移除图片。关联文件：DeviceAssetSaveRequest.java、DeviceAssetService.java。关联逻辑（调用链/数据流）：multipart PUT -> update -> 文件/数据库 -> JSON 响应。 */
@PutMapping(value="/{id}",consumes=MediaType.MULTIPART_FORM_DATA_VALUE) public ApiResponse<DeviceAssetResponse> update(@PathVariable Long id,@Valid @ModelAttribute DeviceAssetSaveRequest request) { return ApiResponse.success("编辑成功",service.update(id,request)); }
@PutMapping(value="/{id}",consumes=MediaType.MULTIPART_FORM_DATA_VALUE) public ApiResponse<DeviceAssetResponse> update(@PathVariable Long id,@Valid @ModelAttribute DeviceAssetSaveRequest request) { permissions.requireAdministrator(); return ApiResponse.success("编辑成功",service.update(id,request)); }
/** 代码作用（白话）：在没有有效引用时软删除设备。关联文件：DeviceAssetService.java、PhoneAssetEntity.java。关联逻辑（调用链/数据流）：DELETE -> 引用检查 -> deleteTime 更新 -> 前端刷新。 */
@DeleteMapping("/{id}") public ApiResponse<Void> delete(@PathVariable Long id) { service.softDelete(id); return ApiResponse.success("删除成功",null); }
@DeleteMapping("/{id}") public ApiResponse<Void> delete(@PathVariable Long id) { permissions.requireAdministrator(); service.softDelete(id); return ApiResponse.success("删除成功",null); }
/** 代码作用（白话）：按关键字搜索可作为设备使用人的公司人员。关联文件：DevicePersonLookupResponse.java、DeviceAssetService.java。关联逻辑（调用链/数据流）：远程选择器 -> lookup -> Mapper -> 选项。 */
@GetMapping("/lookups/company-persons") public ApiResponse<List<DevicePersonLookupResponse>> companyPersons(@RequestParam(defaultValue="") String keyword) { return ApiResponse.success(service.searchCompanyPersons(keyword)); }
@GetMapping("/lookups/company-persons") public ApiResponse<List<DevicePersonLookupResponse>> companyPersons(@RequestParam(defaultValue="") String keyword) { permissions.requireAdministrator(); return ApiResponse.success(service.searchCompanyPersons(keyword)); }
/** 代码作用（白话）：按不透明标识读取设备图片，不返回服务器路径。关联文件：DeviceAssetFileStorageService.java、DeviceAssetResponse.java。关联逻辑（调用链/数据流）：img URL -> findImage -> Resource -> 浏览器预览。 */
@GetMapping("/files/{identifier:.+}") public ResponseEntity<Resource> file(@PathVariable String identifier) { Resource resource=service.findImage(identifier); MediaType type=MediaTypeFactory.getMediaType(resource).orElse(MediaType.APPLICATION_OCTET_STREAM); return ResponseEntity.ok().contentType(type).body(resource); }
@GetMapping("/files/{identifier:.+}") public ResponseEntity<Resource> file(@PathVariable String identifier) { permissions.requireAdministrator(); Resource resource=service.findImage(identifier); MediaType type=MediaTypeFactory.getMediaType(resource).orElse(MediaType.APPLICATION_OCTET_STREAM); return ResponseEntity.ok().contentType(type).body(resource); }
}
backend/src/main/java/com/xyw/console/asset/controller/PhoneAssetController.java
package com.xyw.console.asset.controller;
import com.xyw.console.asset.dto.*;
import com.xyw.console.asset.service.PhoneAssetService;
import com.xyw.console.auth.PagePermissionService;
import com.xyw.console.common.ApiResponse;
import jakarta.validation.Valid;
import org.springframework.web.bind.annotation.*;
......@@ -8,14 +9,16 @@ import org.springframework.web.bind.annotation.*;
@RequestMapping("/api/phone-assets")
public class PhoneAssetController {
private final PhoneAssetService service;
private final PagePermissionService permissions;
/** 代码作用（白话）：接收手机号资产接口所需的业务服务。关联文件：PhoneAssetService.java、phone-api-client.js。关联逻辑（调用链/数据流）：浏览器请求 -> Controller -> Service -> Mapper。 */
public PhoneAssetController(PhoneAssetService service){this.service=service;}
/** 代码作用（白话）：接收手机号业务服务和页面权限服务。关联文件：PagePermissionService.java、PhoneAssetService.java。关联逻辑（调用链/数据流）：HTTP 请求 -> READ/EDIT 校验 -> 原有业务服务。 */
public PhoneAssetController(PhoneAssetService service, PagePermissionService permissions){this.service=service;this.permissions=permissions;}
/** 代码作用（白话）：接收浏览器分页查询并返回统一 JSON。关联文件：PhoneAssetService.java、phone-api-client.js。关联逻辑（调用链/数据流）：GET /api/phone-assets -> Service -> ApiResponse -> Vue 表格。 */
@GetMapping public ApiResponse<PhoneAssetPageResponse> page(@Valid PhoneAssetPageQuery query){return ApiResponse.success(service.page(query));}
@GetMapping public ApiResponse<PhoneAssetPageResponse> page(@Valid PhoneAssetPageQuery query){permissions.require(PagePermissionService.PHONE,"READ");return ApiResponse.success(service.page(query));}
/** 代码作用（白话）：接收新增表单并创建手机号资产。关联文件：PhoneAssetSaveRequest.java、PhoneAssetService.java、phone-api-client.js。关联逻辑（调用链/数据流）：POST -> DTO -> Service.create -> ApiResponse -> 弹窗。 */
@PostMapping public ApiResponse<PhoneAssetResponse> create(@Valid @RequestBody PhoneAssetSaveRequest request){return ApiResponse.success("新增成功",service.create(request));}
@PostMapping public ApiResponse<PhoneAssetResponse> create(@Valid @RequestBody PhoneAssetSaveRequest request){permissions.require(PagePermissionService.PHONE,"EDIT");return ApiResponse.success("新增成功",service.create(request));}
/** 代码作用（白话）：接收编辑表单并更新允许修改的字段。关联文件：PhoneAssetSaveRequest.java、PhoneAssetService.java、phone-api-client.js。关联逻辑（调用链/数据流）：PUT -> Service.update -> ApiResponse -> 列表刷新。 */
@PutMapping("/{id}") public ApiResponse<PhoneAssetResponse> update(@PathVariable Long id,@Valid @RequestBody PhoneAssetSaveRequest request){return ApiResponse.success("编辑成功",service.update(id,request));}
@PutMapping("/{id}") public ApiResponse<PhoneAssetResponse> update(@PathVariable Long id,@Valid @RequestBody PhoneAssetSaveRequest request){permissions.require(PagePermissionService.PHONE,"EDIT");return ApiResponse.success("编辑成功",service.update(id,request));}
/** 代码作用（白话）：软删除没有关联阻止的手机号资产。关联文件：PhoneAssetService.java、phone-api-client.js。关联逻辑（调用链/数据流）：DELETE -> Service.softDelete -> ApiResponse -> 列表刷新。 */
@DeleteMapping("/{id}") public ApiResponse<Void> delete(@PathVariable Long id){service.softDelete(id);return ApiResponse.success("删除成功",null);}
@DeleteMapping("/{id}") public ApiResponse<Void> delete(@PathVariable Long id){permissions.require(PagePermissionService.PHONE,"EDIT");service.softDelete(id);return ApiResponse.success("删除成功",null);}
}
backend/src/main/java/com/xyw/console/asset/controller/WecomAccountController.java
......@@ -7,6 +7,7 @@ import com.xyw.console.asset.dto.WecomAccountPageQuery;
import com.xyw.console.asset.dto.WecomAccountPageResponse;
import com.xyw.console.asset.dto.WecomAccountSaveRequest;
import com.xyw.console.asset.service.WecomAccountService;
import com.xyw.console.auth.PagePermissionService;
import com.xyw.console.common.ApiResponse;
import jakarta.validation.Valid;
import java.util.List;
......@@ -22,27 +23,29 @@ import org.springframework.web.bind.annotation.RestController;
@RequestMapping("/api/wecom-accounts")
public class WecomAccountController {
private final WecomAccountService service;
private final PagePermissionService permissions;
/** Code purpose (plain language): receives the service that coordinates WeCom assets and referenced assets. Related files: WecomAccountService.java. Data flow: HTTP controller -> service -> mappers. */
public WecomAccountController(WecomAccountService service) { this.service = service; }
/** 代码作用（白话）：接收企微业务服务和页面权限服务。关联文件：PagePermissionService.java、WecomAccountService.java。关联逻辑（调用链/数据流）：HTTP 请求 -> READ/EDIT 校验 -> 原有企微业务服务。 */
public WecomAccountController(WecomAccountService service, PagePermissionService permissions) { this.service = service; this.permissions = permissions; }
/** Code purpose (plain language): saves a new enterprise WeChat asset. Related files: WecomAccountSaveRequest.java, WecomAccountService.java. Data flow: create dialog -> POST -> transaction -> response. */
@PostMapping
public ApiResponse<?> create(@Valid @RequestBody WecomAccountSaveRequest request) { return ApiResponse.success("新增成功", service.create(request)); }
public ApiResponse<?> create(@Valid @RequestBody WecomAccountSaveRequest request) { permissions.require(PagePermissionService.WECOM, "EDIT"); return ApiResponse.success("新增成功", service.create(request)); }
/** Code purpose (plain language): returns the paged enterprise WeChat asset list and optional registration-phone filter. Related files: WecomAccountPageQuery.java, WecomAccountService.java. Data flow: list query -> GET -> service.page -> table. */
@GetMapping
public ApiResponse<WecomAccountPageResponse> page(@Valid WecomAccountPageQuery query) { return ApiResponse.success(service.page(query)); }
public ApiResponse<WecomAccountPageResponse> page(@Valid WecomAccountPageQuery query) { permissions.require(PagePermissionService.WECOM, "READ"); return ApiResponse.success(service.page(query)); }
/** Code purpose (plain language): searches registration subjects by company name or short name. Related files: CompanyProfileLookupResponse.java, WecomAccountService.java. Data flow: remote select -> GET -> compact options. */
@GetMapping("/lookups/company-profiles")
public ApiResponse<List<CompanyProfileLookupResponse>> companyProfiles(@RequestParam(defaultValue = "") String keyword) { return ApiResponse.success(service.searchCompanyProfiles(keyword)); }
public ApiResponse<List<CompanyProfileLookupResponse>> companyProfiles(@RequestParam(defaultValue = "") String keyword) { permissions.require(PagePermissionService.WECOM, "READ"); return ApiResponse.success(service.searchCompanyProfiles(keyword)); }
/** Code purpose (plain language): searches reusable registration phone assets. Related files: PhoneAssetLookupResponse.java, WecomAccountService.java. Data flow: remote select -> GET -> compact options. */
@GetMapping("/lookups/phone-assets")
public ApiResponse<List<PhoneAssetLookupResponse>> phoneAssets(@RequestParam(defaultValue = "") String keyword) { return ApiResponse.success(service.searchPhoneAssets(keyword)); }
public ApiResponse<List<PhoneAssetLookupResponse>> phoneAssets(@RequestParam(defaultValue = "") String keyword) { permissions.require(PagePermissionService.WECOM, "READ"); return ApiResponse.success(service.searchPhoneAssets(keyword)); }
/** Code purpose (plain language): searches optional WeCom owners from company people. Related files: CompanyPersonLookupResponse.java, WecomAccountService.java. Data flow: remote select -> GET -> compact options. */
@GetMapping("/lookups/company-persons")
public ApiResponse<List<CompanyPersonLookupResponse>> companyPersons(@RequestParam(defaultValue = "") String keyword) { return ApiResponse.success(service.searchCompanyPersons(keyword)); }
public ApiResponse<List<CompanyPersonLookupResponse>> companyPersons(@RequestParam(defaultValue = "") String keyword) { permissions.require(PagePermissionService.WECOM, "READ"); return ApiResponse.success(service.searchCompanyPersons(keyword)); }
}
backend/src/main/java/com/xyw/console/asset/entity/SystemUserEntity.java
......@@ -18,4 +18,7 @@ public class SystemUserEntity extends AssetBaseEntity {
private String passwordHash;
private String roleCode;
private String status;
private String pagePermissions;
private LocalDateTime passwordUpdatedAt;
private Integer authVersion;
}
backend/src/main/java/com/xyw/console/asset/service/DeviceAssetService.java
......@@ -2,101 +2,155 @@ package com.xyw.console.asset.service;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
import com.xyw.console.asset.dto.*;
import com.xyw.console.asset.entity.*;
import com.xyw.console.asset.dto.DeviceAssetPageQuery;
import com.xyw.console.asset.dto.DeviceAssetPageResponse;
import com.xyw.console.asset.dto.DeviceAssetResponse;
import com.xyw.console.asset.dto.DeviceAssetSaveRequest;
import com.xyw.console.asset.dto.DevicePersonLookupResponse;
import com.xyw.console.asset.entity.AssetDeviceEntity;
import com.xyw.console.asset.entity.CompanyPersonEntity;
import com.xyw.console.asset.entity.DouyinAccountEntity;
import com.xyw.console.asset.entity.PhoneAssetEntity;
import com.xyw.console.asset.entity.WechatAccountEntity;
import com.xyw.console.asset.entity.WecomAccountEntity;
import com.xyw.console.asset.exception.DeviceAssetNotFoundException;
import com.xyw.console.asset.exception.DeviceAssetValidationException;
import com.xyw.console.asset.mapper.*;
import com.xyw.console.asset.mapper.AssetDeviceMapper;
import com.xyw.console.asset.mapper.CompanyPersonMapper;
import com.xyw.console.asset.mapper.DouyinAccountMapper;
import com.xyw.console.asset.mapper.PhoneAssetMapper;
import com.xyw.console.asset.mapper.WechatAccountMapper;
import com.xyw.console.asset.mapper.WecomAccountMapper;
import java.time.LocalDateTime;
import java.util.*;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.function.Function;
import org.springframework.core.io.Resource;
import org.springframework.stereotype.Service;
/** 文件用途（白话）：实现设备资产查询、增改删、使用人解析、图片引用与关联保护规则。 */
/** File purpose: device asset CRUD, user-name resolution, image references, and reference-safe deletion. */
@Service
public class DeviceAssetService {
private static final Set<String> USAGE_STATUSES = Set.of("使用中", "闲置", "维修中", "停用");
private static final Set<String> RELATION_STATUSES = Set.of("已关联", "未关联", "待确认");
private final AssetDeviceMapper deviceMapper; private final CompanyPersonMapper personMapper; private final PhoneAssetMapper phoneMapper;
private final WecomAccountMapper wecomMapper; private final WechatAccountMapper wechatMapper; private final DouyinAccountMapper douyinMapper;
private static final Set<String> USAGE_STATUSES = Set.of("\u4f7f\u7528\u4e2d", "\u95f2\u7f6e", "\u7ef4\u4fee\u4e2d", "\u505c\u7528");
private static final Set<String> RELATION_STATUSES = Set.of("\u5df2\u5173\u8054", "\u672a\u5173\u8054", "\u5f85\u786e\u8ba4");
private final AssetDeviceMapper deviceMapper;
private final CompanyPersonMapper personMapper;
private final PhoneAssetMapper phoneMapper;
private final WecomAccountMapper wecomMapper;
private final WechatAccountMapper wechatMapper;
private final DouyinAccountMapper douyinMapper;
private final DeviceAssetFileStorageService fileStorage;
/** 代码作用（白话）：接收设备、人员、引用资产和文件服务入口。关联文件：DeviceAssetController.java、各 Mapper。关联逻辑（调用链/数据流）：Controller -> Service -> Mapper/文件服务。 */
/** Plain purpose: wire controller-facing persistence and storage collaborators. Related files: DeviceAssetController.java and Mapper classes. Flow: Controller -> Service -> Mapper/file storage. */
public DeviceAssetService(AssetDeviceMapper deviceMapper, CompanyPersonMapper personMapper, PhoneAssetMapper phoneMapper,
WecomAccountMapper wecomMapper, WechatAccountMapper wechatMapper, DouyinAccountMapper douyinMapper, DeviceAssetFileStorageService fileStorage) {
this.deviceMapper=deviceMapper; this.personMapper=personMapper; this.phoneMapper=phoneMapper; this.wecomMapper=wecomMapper; this.wechatMapper=wechatMapper; this.douyinMapper=douyinMapper; this.fileStorage=fileStorage;
}
/** 代码作用（白话）：按条件读取未删除设备并补齐使用人名称。关联文件：DeviceAssetPageQuery.java、DeviceAssetController.java。关联逻辑（调用链/数据流）：GET 参数 -> page -> Mapper -> Response -> Vue 表格。 */
/** Plain purpose: return one active device page with display names. Related files: DeviceAssetPageQuery.java, DeviceAssetController.java. Flow: GET filters -> Mapper page -> response rows -> Vue table. */
public DeviceAssetPageResponse page(DeviceAssetPageQuery query) {
Page<AssetDeviceEntity> result=deviceMapper.selectPage(new Page<>(query.resolvedPage(),query.resolvedSize()),activeQuery(query));
Map<Long,String> names=personNames(collectIds(result.getRecords(),AssetDeviceEntity::getUserPersonId));
return new DeviceAssetPageResponse(result.getRecords().stream().map(item->toResponse(item,names)).toList(),result.getTotal(),query.resolvedPage(),query.resolvedSize());
}
/** 代码作用（白话）：创建一条设备和其两张可选图片引用。关联文件：DeviceAssetSaveRequest.java、DeviceAssetFileStorageService.java。关联逻辑（调用链/数据流）：multipart POST -> create -> 文件保存 + Mapper.insert -> JSON 响应。 */
/** Plain purpose: save a new device and its optional images, removing newly stored files if database creation fails. Related files: DeviceAssetSaveRequest.java, DeviceAssetFileStorageService.java. Flow: multipart POST -> store -> insert -> response or cleanup. */
public DeviceAssetResponse create(DeviceAssetSaveRequest request) {
validateSaveRequest(request,null); String image1=null,image2=null;
try { image1=fileStorage.store(request.getImageAttachment1()); image2=fileStorage.store(request.getImageAttachment2());
try {
image1=fileStorage.store(request.getImageAttachment1()); image2=fileStorage.store(request.getImageAttachment2());
AssetDeviceEntity entity=new AssetDeviceEntity(); applyEditableFields(entity,request,image1,image2); LocalDateTime now=LocalDateTime.now(); entity.setCreateTime(now); entity.setUpdateTime(now); entity.setDeleteTime(0L);
if(deviceMapper.insert(entity)!=1) throw new IllegalStateException("设备资产新增失败"); return toResponse(entity,personNames(singleId(entity.getUserPersonId())));
if(deviceMapper.insert(entity)!=1) throw new IllegalStateException("\u8bbe\u5907\u8d44\u4ea7\u65b0\u589e\u5931\u8d25");
return toResponse(entity,personNames(singleId(entity.getUserPersonId())));
} catch (RuntimeException exception) { fileStorage.cleanupNewFile(image1); fileStorage.cleanupNewFile(image2); throw exception; }
}
/** 代码作用（白话）：更新有效设备，未选择新图时保留旧图。关联文件：DeviceAssetSaveRequest.java、DeviceAssetFileStorageService.java。关联逻辑（调用链/数据流）：multipart PUT -> update -> 文件标识调整 + Mapper.update -> 列表刷新。 */
/** Plain purpose: update an active device while retaining old images unless a new image or remove flag is supplied. Related files: DeviceAssetSaveRequest.java, DeviceAssetFileStorageService.java. Flow: multipart PUT -> replace references -> update -> response. */
public DeviceAssetResponse update(Long id, DeviceAssetSaveRequest request) {
AssetDeviceEntity entity=requireActiveDevice(id); validateSaveRequest(request,id); String image1=null,image2=null;
try { image1=fileStorage.replace(entity.getImageAttachment1(),request.getImageAttachment1(),Boolean.TRUE.equals(request.getRemoveImageAttachment1())); image2=fileStorage.replace(entity.getImageAttachment2(),request.getImageAttachment2(),Boolean.TRUE.equals(request.getRemoveImageAttachment2()));
applyEditableFields(entity,request,image1,image2); entity.setUpdateTime(LocalDateTime.now()); if(deviceMapper.updateById(entity)!=1) throw new DeviceAssetNotFoundException("设备资产不存在或已删除"); return toResponse(entity,personNames(singleId(entity.getUserPersonId())));
} catch (RuntimeException exception) { if(image1!=null&&!image1.equals(entity.getImageAttachment1())) fileStorage.cleanupNewFile(image1); if(image2!=null&&!image2.equals(entity.getImageAttachment2())) fileStorage.cleanupNewFile(image2); throw exception; }
AssetDeviceEntity entity=requireActiveDevice(id); validateSaveRequest(request,id); String originalImage1=entity.getImageAttachment1(),originalImage2=entity.getImageAttachment2(),image1=null,image2=null;
try {
image1=fileStorage.replace(entity.getImageAttachment1(),request.getImageAttachment1(),Boolean.TRUE.equals(request.getRemoveImageAttachment1()));
image2=fileStorage.replace(entity.getImageAttachment2(),request.getImageAttachment2(),Boolean.TRUE.equals(request.getRemoveImageAttachment2()));
applyEditableFields(entity,request,image1,image2); entity.setUpdateTime(LocalDateTime.now());
if(deviceMapper.updateById(entity)!=1) throw new DeviceAssetNotFoundException("\u8bbe\u5907\u8d44\u4ea7\u4e0d\u5b58\u5728\u6216\u5df2\u5220\u9664");
return toResponse(entity,personNames(singleId(entity.getUserPersonId())));
} catch (RuntimeException exception) {
if(image1!=null&&!image1.equals(originalImage1)) fileStorage.cleanupNewFile(image1);
if(image2!=null&&!image2.equals(originalImage2)) fileStorage.cleanupNewFile(image2);
throw exception;
}
}
/** 代码作用（白话）：在确认没有有效关联资产后软删除设备。关联文件：PhoneAssetEntity.java、WecomAccountEntity.java。关联逻辑（调用链/数据流）：DELETE -> 引用检查 -> deleteTime 更新 -> 列表隐藏。 */
public void softDelete(Long id) { AssetDeviceEntity entity=requireActiveDevice(id); checkActiveReferences(id); entity.setDeleteTime(System.currentTimeMillis()); entity.setUpdateTime(LocalDateTime.now()); if(deviceMapper.updateById(entity)!=1) throw new DeviceAssetNotFoundException("设备资产不存在或已删除"); }
/** Plain purpose: soft-delete an unreferenced active device without physically deleting its images. Related files: PhoneAssetEntity.java and account entities. Flow: DELETE -> reference counts -> update deleteTime -> hidden from page. */
public void softDelete(Long id) {
AssetDeviceEntity entity=requireActiveDevice(id); checkActiveReferences(id); entity.setDeleteTime(System.currentTimeMillis()); entity.setUpdateTime(LocalDateTime.now());
if(deviceMapper.updateById(entity)!=1) throw new DeviceAssetNotFoundException("\u8bbe\u5907\u8d44\u4ea7\u4e0d\u5b58\u5728\u6216\u5df2\u5220\u9664");
}
/** 代码作用（白话）：按姓名返回可选择的有效公司人员。关联文件：DeviceAssetController.java、CompanyPersonEntity.java。关联逻辑（调用链/数据流）：远程下拉输入 -> lookup -> person Mapper -> option 列表。 */
public List<DevicePersonLookupResponse> searchCompanyPersons(String keyword) { return personMapper.selectList(new LambdaQueryWrapper<CompanyPersonEntity>().eq(CompanyPersonEntity::getDeleteTime,0L).like(hasText(keyword),CompanyPersonEntity::getPersonName,keyword).orderByDesc(CompanyPersonEntity::getId)).stream().limit(20).map(item->new DevicePersonLookupResponse(item.getId(),item.getPersonName())).toList(); }
/** Plain purpose: return up to twenty active company persons for remote select. Related files: DeviceAssetController.java, CompanyPersonEntity.java. Flow: select input -> service lookup -> mapper -> dropdown options. */
public List<DevicePersonLookupResponse> searchCompanyPersons(String keyword) {
return personMapper.selectList(new LambdaQueryWrapper<CompanyPersonEntity>().eq(CompanyPersonEntity::getDeleteTime,0L).like(hasText(keyword),CompanyPersonEntity::getPersonName,keyword).orderByDesc(CompanyPersonEntity::getId))
.stream().limit(20).map(item->new DevicePersonLookupResponse(item.getId(),item.getPersonName())).toList();
}
/** 代码作用（白话）：读取一张受控设备图片。关联文件：DeviceAssetController.java、DeviceAssetFileStorageService.java。关联逻辑（调用链/数据流）：图片 URL -> findImage -> 文件服务 -> Resource 响应。 */
/** Plain purpose: resolve a safe image identifier to a controlled resource. Related files: DeviceAssetController.java, DeviceAssetFileStorageService.java. Flow: image URL -> service -> storage -> response body. */
public Resource findImage(String identifier) { return fileStorage.resolve(identifier); }
/** 代码作用（白话）：组合列表筛选和未删除条件。关联文件：DeviceAssetPageQuery.java、AssetDeviceEntity.java。关联逻辑（调用链/数据流）：Query DTO -> LambdaQueryWrapper -> SQL where。 */
private LambdaQueryWrapper<AssetDeviceEntity> activeQuery(DeviceAssetPageQuery query) { return new LambdaQueryWrapper<AssetDeviceEntity>().eq(AssetDeviceEntity::getDeleteTime,0L).like(hasText(query.deviceName()),AssetDeviceEntity::getDeviceName,query.deviceName()).eq(query.userPersonId()!=null,AssetDeviceEntity::getUserPersonId,query.userPersonId()).eq(hasText(query.userUsageStatus()),AssetDeviceEntity::getUserUsageStatus,query.userUsageStatus()).eq(hasText(query.assetRelationStatus()),AssetDeviceEntity::getAssetRelationStatus,query.assetRelationStatus()).orderByDesc(AssetDeviceEntity::getId); }
/** 代码作用（白话）：读取一条仍有效设备，供编辑和删除共用。关联文件：AssetDeviceMapper.java、DeviceAssetExceptionHandler.java。关联逻辑（调用链/数据流）：Service 查询 -> 无记录 -> 404 JSON。 */
private AssetDeviceEntity requireActiveDevice(Long id) { AssetDeviceEntity entity=deviceMapper.selectOne(new LambdaQueryWrapper<AssetDeviceEntity>().eq(AssetDeviceEntity::getId,id).eq(AssetDeviceEntity::getDeleteTime,0L)); if(entity==null) throw new DeviceAssetNotFoundException("设备资产不存在或已删除"); return entity; }
/** Plain purpose: combine active-only and optional page filters. Related files: DeviceAssetPageQuery.java, AssetDeviceEntity.java. Flow: query DTO -> LambdaQueryWrapper -> SQL WHERE. */
private LambdaQueryWrapper<AssetDeviceEntity> activeQuery(DeviceAssetPageQuery query) {
return new LambdaQueryWrapper<AssetDeviceEntity>().eq(AssetDeviceEntity::getDeleteTime,0L).like(hasText(query.deviceName()),AssetDeviceEntity::getDeviceName,query.deviceName()).eq(query.userPersonId()!=null,AssetDeviceEntity::getUserPersonId,query.userPersonId()).eq(hasText(query.userUsageStatus()),AssetDeviceEntity::getUserUsageStatus,query.userUsageStatus()).eq(hasText(query.assetRelationStatus()),AssetDeviceEntity::getAssetRelationStatus,query.assetRelationStatus()).orderByDesc(AssetDeviceEntity::getId);
}
/** 代码作用（白话）：校验设备名称、状态、使用人和有效名称唯一性。关联文件：DeviceAssetSaveRequest.java、CompanyPersonMapper.java。关联逻辑（调用链/数据流）：POST/PUT 表单 -> validateSaveRequest -> 允许写库或返回 400。 */
private void validateSaveRequest(DeviceAssetSaveRequest request,Long currentId) { if(request.getDeviceName()==null||request.getDeviceName().isBlank()) throw new DeviceAssetValidationException("设备名称不能为空"); validateStatus(request.getUserUsageStatus(),USAGE_STATUSES,"使用状态"); validateStatus(request.getAssetRelationStatus(),RELATION_STATUSES,"资产关联状态"); validateUserPerson(request.getUserPersonId()); long sameName=deviceMapper.selectCount(new LambdaQueryWrapper<AssetDeviceEntity>().eq(AssetDeviceEntity::getDeleteTime,0L).eq(AssetDeviceEntity::getDeviceName,request.getDeviceName().trim()).ne(currentId!=null,AssetDeviceEntity::getId,currentId)); if(sameName>0) throw new DeviceAssetValidationException("设备名称已存在"); }
/** Plain purpose: require one non-deleted device for edit and delete. Related files: AssetDeviceMapper.java, DeviceAssetExceptionHandler.java. Flow: service query -> missing item -> HTTP 404. */
private AssetDeviceEntity requireActiveDevice(Long id) {
AssetDeviceEntity entity=deviceMapper.selectOne(new LambdaQueryWrapper<AssetDeviceEntity>().eq(AssetDeviceEntity::getId,id).eq(AssetDeviceEntity::getDeleteTime,0L));
if(entity==null) throw new DeviceAssetNotFoundException("\u8bbe\u5907\u8d44\u4ea7\u4e0d\u5b58\u5728\u6216\u5df2\u5220\u9664"); return entity;
}
/** 代码作用（白话）：确认选择的使用人仍有效。关联文件：CompanyPersonEntity.java、DeviceAssetSaveRequest.java。关联逻辑（调用链/数据流）：表单 personId -> Mapper 查询 -> 允许保存或错误提示。 */
private void validateUserPerson(Long userPersonId) { if(userPersonId==null) return; Long count=personMapper.selectCount(new LambdaQueryWrapper<CompanyPersonEntity>().eq(CompanyPersonEntity::getId,userPersonId).eq(CompanyPersonEntity::getDeleteTime,0L)); if(count==0) throw new DeviceAssetValidationException("使用人不存在或已删除"); }
/** Plain purpose: validate names, dropdown values, optional person, and active-name uniqueness before writes. Related files: DeviceAssetSaveRequest.java, CompanyPersonMapper.java. Flow: POST/PUT -> validation -> write or HTTP 400. */
private void validateSaveRequest(DeviceAssetSaveRequest request,Long currentId) {
if(request.getDeviceName()==null||request.getDeviceName().isBlank()) throw new DeviceAssetValidationException("\u8bbe\u5907\u540d\u79f0\u4e0d\u80fd\u4e3a\u7a7a");
validateStatus(request.getUserUsageStatus(),USAGE_STATUSES,"\u4f7f\u7528\u72b6\u6001"); validateStatus(request.getAssetRelationStatus(),RELATION_STATUSES,"\u8d44\u4ea7\u5173\u8054\u72b6\u6001"); validateUserPerson(request.getUserPersonId());
long sameName=deviceMapper.selectCount(new LambdaQueryWrapper<AssetDeviceEntity>().eq(AssetDeviceEntity::getDeleteTime,0L).eq(AssetDeviceEntity::getDeviceName,request.getDeviceName().trim()).ne(currentId!=null,AssetDeviceEntity::getId,currentId));
if(sameName>0) throw new DeviceAssetValidationException("\u8bbe\u5907\u540d\u79f0\u5df2\u5b58\u5728");
}
/** 代码作用（白话）：限制状态只能来自已确认下拉选项。关联文件：DeviceAssetView.js、DeviceAssetSaveRequest.java。关联逻辑（调用链/数据流）：前端下拉/请求参数 -> validateStatus -> 安全写库。 */
private void validateStatus(String value,Set<String> allowed,String label) { if(value==null||!allowed.contains(value)) throw new DeviceAssetValidationException(label+"取值无效"); }
/** Plain purpose: ensure an optional selected person is still active. Related files: CompanyPersonEntity.java, DeviceAssetSaveRequest.java. Flow: form person ID -> mapper count -> allow save or HTTP 400. */
private void validateUserPerson(Long userPersonId) {
if(userPersonId==null) return;
Long count=personMapper.selectCount(new LambdaQueryWrapper<CompanyPersonEntity>().eq(CompanyPersonEntity::getId,userPersonId).eq(CompanyPersonEntity::getDeleteTime,0L));
if(count==0) throw new DeviceAssetValidationException("\u4f7f\u7528\u4eba\u4e0d\u5b58\u5728\u6216\u5df2\u5220\u9664");
}
/** 代码作用（白话）：查找仍引用设备的四类资产并阻止删除。关联文件：PhoneAssetEntity.java、WecomAccountEntity.java、WechatAccountEntity.java、DouyinAccountEntity.java。关联逻辑（调用链/数据流）：DELETE -> 各 Mapper count -> 引用提示或软删除。 */
private void checkActiveReferences(Long deviceId) { List<String> types=new ArrayList<>(); if(phoneMapper.selectCount(new LambdaQueryWrapper<PhoneAssetEntity>().eq(PhoneAssetEntity::getDeviceId,deviceId).eq(PhoneAssetEntity::getDeleteTime,0L))>0) types.add("手机号资产"); if(wecomMapper.selectCount(new LambdaQueryWrapper<WecomAccountEntity>().eq(WecomAccountEntity::getDeviceId,deviceId).eq(WecomAccountEntity::getDeleteTime,0L))>0) types.add("企业微信资产"); if(wechatMapper.selectCount(new LambdaQueryWrapper<WechatAccountEntity>().eq(WechatAccountEntity::getDeviceId,deviceId).eq(WechatAccountEntity::getDeleteTime,0L))>0) types.add("微信资产"); if(douyinMapper.selectCount(new LambdaQueryWrapper<DouyinAccountEntity>().eq(DouyinAccountEntity::getDeviceId,deviceId).eq(DouyinAccountEntity::getDeleteTime,0L))>0) types.add("抖音资产"); if(!types.isEmpty()) throw new DeviceAssetValidationException("设备仍被"+String.join("、",types)+"引用，不能删除"); }
/** Plain purpose: reject forged dropdown values. Related files: DeviceAssetView.js, DeviceAssetSaveRequest.java. Flow: dropdown value -> validation -> safe database write. */
private void validateStatus(String value,Set<String> allowed,String label) { if(value==null||!allowed.contains(value)) throw new DeviceAssetValidationException(label+"\u53d6\u503c\u65e0\u6548"); }
/** Plain purpose: prevent deletion while any active phone or account references the device. Related files: PhoneAssetEntity.java and account entities. Flow: DELETE -> four reference counts -> error or soft delete. */
private void checkActiveReferences(Long deviceId) {
List<String> types=new ArrayList<>();
if(phoneMapper.selectCount(new LambdaQueryWrapper<PhoneAssetEntity>().eq(PhoneAssetEntity::getDeviceId,deviceId).eq(PhoneAssetEntity::getDeleteTime,0L))>0) types.add("\u624b\u673a\u53f7\u8d44\u4ea7");
if(wecomMapper.selectCount(new LambdaQueryWrapper<WecomAccountEntity>().eq(WecomAccountEntity::getDeviceId,deviceId).eq(WecomAccountEntity::getDeleteTime,0L))>0) types.add("\u4f01\u4e1a\u5fae\u4fe1\u8d44\u4ea7");
if(wechatMapper.selectCount(new LambdaQueryWrapper<WechatAccountEntity>().eq(WechatAccountEntity::getDeviceId,deviceId).eq(WechatAccountEntity::getDeleteTime,0L))>0) types.add("\u5fae\u4fe1\u8d44\u4ea7");
if(douyinMapper.selectCount(new LambdaQueryWrapper<DouyinAccountEntity>().eq(DouyinAccountEntity::getDeviceId,deviceId).eq(DouyinAccountEntity::getDeleteTime,0L))>0) types.add("\u6296\u97f3\u8d44\u4ea7");
if(!types.isEmpty()) throw new DeviceAssetValidationException("\u8bbe\u5907\u4ecd\u88ab"+String.join("\u3001",types)+"\u5f15\u7528\uff0c\u4e0d\u80fd\u5220\u9664");
}
/** 代码作用（白话）：收集当前页不为空的使用人 ID，供一次性查姓名。关联文件：DeviceAssetResponse.java、CompanyPersonMapper.java。关联逻辑（调用链/数据流）：分页记录 -> collectIds -> 批量人员查询。 */
/** Plain purpose: collect non-null person IDs for one batch query. Related files: DeviceAssetResponse.java, CompanyPersonMapper.java. Flow: page records -> IDs -> person query. */
private <T> Set<Long> collectIds(List<T> items,Function<T,Long> getter) { Set<Long> ids=new HashSet<>(); items.forEach(item->{Long id=getter.apply(item);if(id!=null)ids.add(id);}); return ids; }
/** 代码作用（白话）：把一个可空人员 ID 转成供批量查询复用的集合。关联文件：DeviceAssetService.java、CompanyPersonMapper.java。关联逻辑（调用链/数据流）：单条保存结果 -> singleId -> personNames -> 返回姓名。 */
/** Plain purpose: adapt one optional person ID into the batch-name lookup shape. Related files: DeviceAssetService.java, CompanyPersonMapper.java. Flow: created/updated row -> single ID -> personNames. */
private Set<Long> singleId(Long id) { return id == null ? Set.of() : Set.of(id); }
/** 代码作用（白话）：批量把人员 ID 转为人员姓名，避免逐行查询。关联文件：CompanyPersonEntity.java、DeviceAssetResponse.java。关联逻辑（调用链/数据流）：设备 userPersonId 集合 -> IN 查询 -> 姓名映射 -> 响应。 */
/** Plain purpose: resolve person IDs in one query to avoid row-by-row lookups. Related files: CompanyPersonEntity.java, DeviceAssetResponse.java. Flow: IDs -> mapper IN query -> name map -> response. */
private Map<Long,String> personNames(Set<Long> ids) { if(ids.isEmpty()) return Map.of(); Map<Long,String> result=new HashMap<>(); personMapper.selectList(new LambdaQueryWrapper<CompanyPersonEntity>().in(CompanyPersonEntity::getId,ids).eq(CompanyPersonEntity::getDeleteTime,0L)).forEach(item->result.put(item.getId(),item.getPersonName())); return result; }
/** 代码作用（白话）：将数据库实体转换为页面安全字段。关联文件：DeviceAssetResponse.java、DeviceAssetController.java。关联逻辑（调用链/数据流）：Entity + 人员名 -> toResponse -> ApiResponse -> Vue 行。 */
/** Plain purpose: expose safe URLs rather than internal image identifiers or paths. Related files: DeviceAssetResponse.java, DeviceAssetController.java. Flow: entity -> URL conversion -> API JSON -> image tag. */
private DeviceAssetResponse toResponse(AssetDeviceEntity entity,Map<Long,String> names) { return new DeviceAssetResponse(entity.getId(),entity.getDeviceName(),imageUrl(entity.getImageAttachment1()),imageUrl(entity.getImageAttachment2()),entity.getUserPersonId(),entity.getUserPersonId()==null?null:names.get(entity.getUserPersonId()),entity.getUserUsageStatus(),entity.getAssetRelationStatus(),entity.getCreateTime(),entity.getUpdateTime()); }
/** 代码作用（白话）：将内部图片标识转换为浏览器受控访问 URL。关联文件：DeviceAssetController.java、DeviceAssetFileStorageService.java。关联逻辑（调用链/数据流）：数据库标识 -> imageUrl -> 浏览器 img 请求。 */
/** Plain purpose: translate a stored opaque image identifier into a controlled URL. Related files: DeviceAssetController.java, DeviceAssetFileStorageService.java. Flow: identifier -> imageUrl -> browser GET. */
private String imageUrl(String identifier) { return identifier==null||identifier.isBlank()?null:"/api/device-assets/files/"+identifier; }
/** 代码作用（白话）：把可编辑表单字段写入实体。关联文件：DeviceAssetSaveRequest.java、AssetDeviceEntity.java。关联逻辑（调用链/数据流）：DTO -> applyEditableFields -> Entity -> Mapper 写库。 */
/** Plain purpose: copy editable request fields into a database entity. Related files: DeviceAssetSaveRequest.java, AssetDeviceEntity.java. Flow: DTO -> entity -> mapper insert/update. */
private void applyEditableFields(AssetDeviceEntity entity,DeviceAssetSaveRequest request,String image1,String image2) { entity.setDeviceName(request.getDeviceName().trim()); entity.setUserPersonId(request.getUserPersonId()); entity.setUserUsageStatus(request.getUserUsageStatus()); entity.setAssetRelationStatus(request.getAssetRelationStatus()); entity.setImageAttachment1(image1); entity.setImageAttachment2(image2); }
/** 代码作用（白话）：判断筛选文本是否有内容。关联文件：DeviceAssetPageQuery.java、DeviceAssetService.java。关联逻辑（调用链/数据流）：HTTP 参数 -> hasText -> 是否追加 SQL 条件。 */
/** Plain purpose: decide whether a text filter has meaningful input. Related files: DeviceAssetPageQuery.java, DeviceAssetService.java. Flow: HTTP query -> filter presence -> SQL predicate. */
private boolean hasText(String value) { return value!=null&&!value.isBlank(); }
}
backend/src/main/java/com/xyw/console/auth/AuthController.java 0 → 100644
package com.xyw.console.auth;
import com.xyw.console.auth.dto.CurrentUserResponse; import com.xyw.console.auth.dto.LoginRequest; import com.xyw.console.common.ApiResponse;
import jakarta.servlet.http.HttpServletResponse; import jakarta.validation.Valid;
import org.springframework.security.web.csrf.CsrfToken;
import org.springframework.web.bind.annotation.*;
@RestController @RequestMapping("/api/auth")
public class AuthController {
private final AuthService service;
/** 代码作用（白话）：接收认证业务服务；关联文件：AuthService.java。关联逻辑（调用链/数据流）：浏览器认证请求 -> Controller -> Service。 */
public AuthController(AuthService service) { this.service=service; }
/** 代码作用（白话）：接收登录表单并写入安全 Cookie；关联文件：LoginRequest.java、LoginView.js。关联逻辑（调用链/数据流）：用户名密码 -> AuthService -> Set-Cookie/当前用户。 */
@PostMapping("/login") public ApiResponse<CurrentUserResponse> login(@Valid @RequestBody LoginRequest request, HttpServletResponse response) { return ApiResponse.success(service.login(request,response)); }
/** 代码作用（白话）：返回当前登录身份及页面权限；关联文件：AuthService.java、auth-store.js。关联逻辑（调用链/数据流）：Cookie -> Filter -> me -> 菜单路由。 */
@GetMapping("/me") public ApiResponse<CurrentUserResponse> me() { return ApiResponse.success(service.me()); }
/** 代码作用（白话）：让浏览器取得写操作所需的 CSRF 校验值；关联文件：auth-api-client.js、SecurityConfig.java。关联逻辑（调用链/数据流）：应用启动/提交前 -> csrf 接口 -> XSRF-TOKEN Cookie 和请求头。 */
@GetMapping("/csrf") public ApiResponse<String> csrf(CsrfToken token) { return ApiResponse.success(token.getToken()); }
/** 代码作用（白话）：清除登录 Cookie 结束当前浏览器会话；关联文件：AuthService.java、App.js。关联逻辑（调用链/数据流）：登出 -> Controller -> 过期 Cookie。 */
@PostMapping("/logout") public ApiResponse<Void> logout(HttpServletResponse response) { service.logout(response); return ApiResponse.success(null); }
}
backend/src/main/java/com/xyw/console/auth/AuthExceptionHandler.java 0 → 100644
package com.xyw.console.auth;
import com.xyw.console.common.ApiResponse;
import org.springframework.http.HttpStatus;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.ResponseStatus;
import org.springframework.web.bind.annotation.RestControllerAdvice;
/** 代码作用（白话）：把认证与账号管理的预期失败统一转成前端可读取的 JSON；关联文件：AuthController.java、system-user-api-client.js。关联逻辑（调用链/数据流）：Service 抛出规则异常 -> 本处理器 -> ApiResponse -> 提示消息。 */
@RestControllerAdvice
public class AuthExceptionHandler {
/** 代码作用（白话）：隐藏登录失败细节并返回统一未认证状态；关联文件：AuthService.java、LoginView.js。关联逻辑（调用链/数据流）：密码校验失败 -> 401 JSON -> 登录页通用错误提示。 */
@ExceptionHandler(BadCredentialsException.class) @ResponseStatus(HttpStatus.UNAUTHORIZED)
public ApiResponse<Void> badCredentials(BadCredentialsException error) { return ApiResponse.error(401, "账号或密码错误"); }
/** 代码作用（白话）：把账号、角色和密码规则失败返回为明确的 400 提示；关联文件：SystemUserAdminService.java、UserPermissionView.js。关联逻辑（调用链/数据流）：规则校验失败 -> 400 JSON -> 表单提示。 */
@ExceptionHandler(IllegalArgumentException.class) @ResponseStatus(HttpStatus.BAD_REQUEST)
public ApiResponse<Void> invalidArgument(IllegalArgumentException error) { return ApiResponse.error(400, error.getMessage()); }
}
backend/src/main/java/com/xyw/console/auth/AuthPrincipal.java 0 → 100644
package com.xyw.console.auth;
/**
* 代码作用（白话）：保存已通过令牌验证的最小用户身份，避免把密码哈希放进 Spring Security 上下文。
* 关联文件：AuthTokenFilter.java、PagePermissionService.java。
* 关联逻辑（调用链/数据流）：Cookie -> AuthTokenFilter -> AuthPrincipal -> Controller/权限服务。
*/
public record AuthPrincipal(Long userId, String username, String roleCode, int authVersion) {}
backend/src/main/java/com/xyw/console/auth/AuthService.java 0 → 100644
package com.xyw.console.auth;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.xyw.console.asset.entity.SystemUserEntity;
import com.xyw.console.asset.mapper.SystemUserMapper;
import com.xyw.console.auth.dto.CurrentUserResponse;
import com.xyw.console.auth.dto.LoginRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;
@Service
public class AuthService {
private final SystemUserMapper users; private final PasswordEncoder encoder; private final AuthTokenService tokens; private final PagePermissionService permissions;
/** 代码作用（白话）：接收认证依赖；关联文件：AuthController.java、SystemUserMapper.java。关联逻辑（调用链/数据流）：Controller -> Service -> 用户表/令牌/权限。 */
public AuthService(SystemUserMapper users, PasswordEncoder encoder, AuthTokenService tokens, PagePermissionService permissions) { this.users = users; this.encoder = encoder; this.tokens = tokens; this.permissions = permissions; }
/** 代码作用（白话）：验证账号密码并签发登录 Cookie；关联文件：LoginRequest.java、AuthTokenService.java。关联逻辑（调用链/数据流）：登录表单 -> 用户表/BCrypt -> Cookie -> 当前用户响应。 */
public CurrentUserResponse login(LoginRequest request, HttpServletResponse response) { SystemUserEntity user = users.selectOne(new LambdaQueryWrapper<SystemUserEntity>().eq(SystemUserEntity::getUsername, request.username()).eq(SystemUserEntity::getDeleteTime, 0L)); if (user == null || !"ACTIVE".equals(user.getStatus()) || user.getPasswordHash() == null || !encoder.matches(request.password(), user.getPasswordHash())) throw new BadCredentialsException("账号或密码错误"); tokens.issue(new AuthPrincipal(user.getId(), user.getUsername(), user.getRoleCode(), user.getAuthVersion() == null ? 1 : user.getAuthVersion()), response); return responseOf(user); }
/** 代码作用（白话）：把当前令牌身份重新读取为最新菜单资料；关联文件：AuthTokenFilter.java、App.js。关联逻辑（调用链/数据流）：Cookie -> SecurityContext -> 用户表 -> 菜单权限响应。 */
public CurrentUserResponse me() { Object value = SecurityContextHolder.getContext().getAuthentication().getPrincipal(); if (!(value instanceof AuthPrincipal principal)) throw new BadCredentialsException("登录已失效"); SystemUserEntity user = users.selectById(principal.userId()); if (user == null || !"ACTIVE".equals(user.getStatus())) throw new BadCredentialsException("登录已失效"); return responseOf(user); }
/** 代码作用（白话）：让浏览器删除登录 Cookie；关联文件：AuthController.java。关联逻辑（调用链/数据流）：登出按钮 -> Service -> 过期 Cookie。 */
public void logout(HttpServletResponse response) { tokens.clear(response); }
/** 代码作用（白话）：将用户实体转换为绝不包含密码哈希的当前登录响应；关联文件：CurrentUserResponse.java、auth-store.js。关联逻辑（调用链/数据流）：用户表 -> 计算有效权限 -> 前端会话状态。 */
private CurrentUserResponse responseOf(SystemUserEntity user) { return new CurrentUserResponse(user.getId(), user.getUsername(), user.getRoleCode(), permissions.effectivePermissions(user)); }
}
backend/src/main/java/com/xyw/console/auth/AuthTokenFilter.java 0 → 100644
package com.xyw.console.auth;
import com.xyw.console.asset.entity.SystemUserEntity;
import com.xyw.console.asset.mapper.SystemUserMapper;
import jakarta.servlet.FilterChain; import jakarta.servlet.ServletException; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException; import java.util.Collections;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.authority.SimpleGrantedAuthority; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.stereotype.Component; import org.springframework.web.filter.OncePerRequestFilter;
@Component
public class AuthTokenFilter extends OncePerRequestFilter {
private final AuthTokenService tokens; private final SystemUserMapper users; private final PagePermissionService permissions;
/** 代码作用（白话）：接收令牌、用户表和权限服务；关联文件：SecurityConfig.java。关联逻辑（调用链/数据流）：Security Filter Chain -> 本过滤器 -> 用户表/权限。 */
public AuthTokenFilter(AuthTokenService tokens, SystemUserMapper users, PagePermissionService permissions) { this.tokens=tokens; this.users=users; this.permissions=permissions; }
/** 代码作用（白话）：跳过登录和 CSRF 令牌接口，避免公开的初始化请求被自身拦截；关联文件：AuthController.java。关联逻辑（调用链/数据流）：/api/auth/login 或 /api/auth/csrf -> Controller，不进入验签。 */
@Override protected boolean shouldNotFilter(HttpServletRequest request) { return "/api/auth/login".equals(request.getRequestURI()) || "/api/auth/csrf".equals(request.getRequestURI()); }
/** 代码作用（白话）：将有效 Cookie 转成 Spring Security 身份并二次核验账号状态和版本；关联文件：AuthTokenService.java、SystemUserEntity.java。关联逻辑（调用链/数据流）：请求 Cookie -> JWT -> 用户表 -> SecurityContext -> Controller。 */
@Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException { try { String token=tokens.extract(request.getCookies()); if (token != null) { AuthPrincipal principal=tokens.parse(token); SystemUserEntity user=users.selectById(principal.userId()); if (user != null && "ACTIVE".equals(user.getStatus()) && user.getAuthVersion()!=null && user.getAuthVersion()==principal.authVersion()) { var authentication=new UsernamePasswordAuthenticationToken(principal, null, Collections.singleton(new SimpleGrantedAuthority("ROLE_"+principal.roleCode()))); authentication.setDetails(permissions.effectivePermissions(user)); SecurityContextHolder.getContext().setAuthentication(authentication); } } } catch (Exception ignored) { SecurityContextHolder.clearContext(); } chain.doFilter(request,response); }
}
backend/src/main/java/com/xyw/console/auth/AuthTokenService.java 0 → 100644
package com.xyw.console.auth;
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.security.Keys;
import jakarta.servlet.http.Cookie;
import jakarta.servlet.http.HttpServletResponse;
import java.nio.charset.StandardCharsets;
import java.security.Key;
import java.time.Duration;
import java.time.Instant;
import java.util.Date;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.ResponseCookie;
import org.springframework.stereotype.Service;
@Service
public class AuthTokenService {
private static final String COOKIE_NAME = "XYW_SESSION";
private final String secret;
private final Duration lifetime;
private final boolean cookieSecure;
/** 代码作用（白话）：读取部署密钥和会话时长；关联文件：application.yml。关联逻辑（调用链/数据流）：环境变量 -> 配置 -> JWT 签发/验签。 */
public AuthTokenService(@Value("${xyw.auth.jwt-secret:}") String secret, @Value("${xyw.auth.session-hours:8}") long sessionHours, @Value("${xyw.auth.cookie-secure:false}") boolean cookieSecure) { this.secret = secret; this.lifetime = Duration.ofHours(sessionHours); this.cookieSecure = cookieSecure; }
/** 代码作用（白话）：为已登录用户签发仅浏览器自动携带的 HttpOnly Cookie；关联文件：AuthService.java。关联逻辑（调用链/数据流）：登录成功 -> JWT -> Set-Cookie -> 后续过滤器。 */
public void issue(AuthPrincipal principal, HttpServletResponse response) {
Instant now = Instant.now();
String token = Jwts.builder().subject(principal.userId().toString()).claim("username", principal.username()).claim("role", principal.roleCode()).claim("version", principal.authVersion()).issuedAt(Date.from(now)).expiration(Date.from(now.plus(lifetime))).signWith(key()).compact();
response.addHeader("Set-Cookie", ResponseCookie.from(COOKIE_NAME, token).httpOnly(true).secure(cookieSecure).sameSite("Lax").path("/").maxAge(lifetime).build().toString());
}
/** 代码作用（白话）：解析并验签 Cookie 中的短期登录票据；关联文件：AuthTokenFilter.java。关联逻辑（调用链/数据流）：请求 Cookie -> JWT claims -> 数据库二次核验。 */
public AuthPrincipal parse(String token) {
Claims claims = Jwts.parser().verifyWith((javax.crypto.SecretKey) key()).build().parseSignedClaims(token).getPayload();
return new AuthPrincipal(Long.valueOf(claims.getSubject()), claims.get("username", String.class), claims.get("role", String.class), claims.get("version", Integer.class));
}
/** 代码作用（白话）：清空浏览器登录 Cookie；关联文件：AuthService.java。关联逻辑（调用链/数据流）：登出 -> 过期 Cookie -> 下次请求无身份。 */
public void clear(HttpServletResponse response) { response.addHeader("Set-Cookie", ResponseCookie.from(COOKIE_NAME, "").httpOnly(true).secure(cookieSecure).sameSite("Lax").path("/").maxAge(Duration.ZERO).build().toString()); }
/** 代码作用（白话）：从请求 Cookie 取出登录票据；关联文件：AuthTokenFilter.java。关联逻辑（调用链/数据流）：HTTP 请求 -> Cookie 数组 -> JWT 文本。 */
public String extract(Cookie[] cookies) { if (cookies != null) for (Cookie cookie : cookies) if (COOKIE_NAME.equals(cookie.getName())) return cookie.getValue(); return null; }
/** 代码作用（白话）：验证密钥足够安全，避免使用默认或过短密钥签发票据；关联文件：application.yml。关联逻辑（调用链/数据流）：配置 -> HMAC Key -> JWT 签名。 */
private Key key() { if (secret == null || secret.getBytes(StandardCharsets.UTF_8).length < 32) throw new IllegalStateException("认证签名密钥未配置或长度不足"); return Keys.hmacShaKeyFor(secret.getBytes(StandardCharsets.UTF_8)); }
}
backend/src/main/java/com/xyw/console/auth/PagePermissionService.java 0 → 100644
package com.xyw.console.auth;
import com.fasterxml.jackson.core.type.TypeReference;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.xyw.console.asset.entity.SystemUserEntity;
import java.util.LinkedHashMap;
import java.util.Map;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Service;
@Service
public class PagePermissionService {
public static final String OVERVIEW = "overview";
public static final String DOMAIN = "domain";
public static final String WECOM = "reference-wecom";
public static final String PHONE = "phone-assets";
public static final String ALERTS = "alerts";
private static final Map<String, String> PAGES = Map.of(OVERVIEW, "总览", DOMAIN, "域名资料", WECOM, "企微资料", PHONE, "手机号资产", ALERTS, "提醒中心");
private final ObjectMapper objectMapper;
/** 代码作用（白话）：接收 JSON 工具以读取数据库权限映射；关联文件：SystemUserEntity.java。关联逻辑（调用链/数据流）：page_permissions JSON -> 权限 Map -> Controller 判定。 */
public PagePermissionService(ObjectMapper objectMapper) { this.objectMapper = objectMapper; }
/** 代码作用（白话）：生成当前账号的有效五页权限，开发者和超级管理员固定全编辑；关联文件：AuthService.java、App.js。关联逻辑（调用链/数据流）：用户表 -> 有效权限 -> /api/auth/me -> 菜单和路由。 */
public Map<String, String> effectivePermissions(SystemUserEntity user) {
Map<String, String> result = new LinkedHashMap<>();
PAGES.keySet().forEach(key -> result.put(key, isAdministrator(user.getRoleCode()) ? "EDIT" : "NONE"));
if (!isAdministrator(user.getRoleCode()) && user.getPagePermissions() != null) try { Map<String, String> saved = objectMapper.readValue(user.getPagePermissions(), new TypeReference<>() {}); saved.forEach((key, value) -> { if (PAGES.containsKey(key) && validLevel(value)) result.put(key, value); }); } catch (Exception ignored) { }
return result;
}
/** 代码作用（白话）：校验权限面板提交内容，只接受已注册页面和三档权限；关联文件：SystemUserAdminService.java。关联逻辑（调用链/数据流）：表单 Map -> 校验/标准化 -> JSON 入库。 */
public String validatePermissions(Map<String, String> input) {
Map<String, String> normalized = new LinkedHashMap<>();
if (input != null) input.forEach((key, value) -> { if (!PAGES.containsKey(key) || !validLevel(value)) throw new IllegalArgumentException("页面权限配置无效"); normalized.put(key, value); });
try { return objectMapper.writeValueAsString(normalized); } catch (Exception error) { throw new IllegalStateException("页面权限无法保存", error); }
}
/** Plain purpose: convert a saved permission JSON value into the same validated form used for a new account request. Related files: SystemUserAdminService.java, SystemUserEntity.java. Flow: stored permission JSON -> normalized map -> role-change comparison -> auth-version decision. */
public String normalizeStoredPermissions(String storedPermissions) {
if (storedPermissions == null || storedPermissions.isBlank()) return validatePermissions(Map.of());
try { return validatePermissions(objectMapper.readValue(storedPermissions, new TypeReference<>() {})); }
catch (Exception ignored) { return validatePermissions(Map.of()); }
}
/** 代码作用（白话）：在资产接口执行服务端最低权限检查；关联文件：PhoneAssetController.java、WecomAccountController.java。关联逻辑（调用链/数据流）：Controller -> 当前认证身份 -> READ/EDIT 决定 403 或继续业务服务。 */
public void require(String pageKey, String minimum) {
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
if (authentication == null || !(authentication.getPrincipal() instanceof AuthPrincipal principal)) throw new AccessDeniedException("没有页面权限");
String permission = authentication.getDetails() instanceof Map<?, ?> map ? String.valueOf(map.get(pageKey)) : "NONE";
if (!("EDIT".equals(permission) || ("READ".equals(permission) && "READ".equals(minimum)))) throw new AccessDeniedException("没有页面权限");
}
/** Plain purpose: stop non-administrators before an administrator-only controller reaches business data. Related files: DeviceAssetController.java, AuthTokenFilter.java. Flow: authenticated token principal -> administrator role check -> device controller or 403 response. */
public void requireAdministrator() {
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
if (authentication == null || !(authentication.getPrincipal() instanceof AuthPrincipal principal) || !isAdministrator(principal.roleCode())) throw new AccessDeniedException("没有权限");
}
/** 代码作用（白话）：判断角色是否固定拥有全部编辑权限；关联文件：SystemUserAdminService.java。关联逻辑（调用链/数据流）：role_code -> 全量权限或逐页权限。 */
public boolean isAdministrator(String roleCode) { return "DEVELOPER".equals(roleCode) || "SUPER_ADMIN".equals(roleCode); }
/** 代码作用（白话）：限制权限值为三档，避免未知值意外放行；关联文件：UserPermissionView.js。关联逻辑（调用链/数据流）：前端单选值 -> 后端验证 -> 持久化。 */
private boolean validLevel(String value) { return "NONE".equals(value) || "READ".equals(value) || "EDIT".equals(value); }
}
backend/src/main/java/com/xyw/console/auth/SystemUserAdminController.java 0 → 100644
package com.xyw.console.auth;
import com.xyw.console.auth.dto.PasswordResetRequest;
import com.xyw.console.auth.dto.SystemUserCreateRequest;
import com.xyw.console.auth.dto.SystemUserResponse;
import com.xyw.console.auth.dto.SystemUserUpdateRequest;
import com.xyw.console.common.ApiResponse;
import jakarta.validation.Valid;
import java.util.List;
import org.springframework.web.bind.annotation.*;
@RestController
@RequestMapping("/api/system-users")
public class SystemUserAdminController {
private final SystemUserAdminService service;
/** 代码作用（白话）：接收账号管理业务服务；关联文件：SystemUserAdminService.java。关联逻辑（调用链/数据流）：管理页面请求 -> Controller -> 角色边界/用户表。 */
public SystemUserAdminController(SystemUserAdminService service) { this.service = service; }
/** 代码作用（白话）：返回隐藏 Jeddy 后的账号列表；关联文件：SystemUserAdminService.java、UserPermissionView.js。关联逻辑（调用链/数据流）：设置页面 -> GET -> Service 查询 -> 安全列表。 */
@GetMapping public ApiResponse<List<SystemUserResponse>> list() { return ApiResponse.success(service.listVisibleUsers()); }
/** 代码作用（白话）：创建账号并由服务端执行创建者角色规则；关联文件：SystemUserCreateRequest.java、SystemUserAdminService.java。关联逻辑（调用链/数据流）：创建表单 -> POST -> 账号表。 */
@PostMapping public ApiResponse<SystemUserResponse> create(@Valid @RequestBody SystemUserCreateRequest request) { return ApiResponse.success(service.createUser(request)); }
/** 代码作用（白话）：编辑账号资料和页面权限；关联文件：SystemUserUpdateRequest.java、PagePermissionService.java。关联逻辑（调用链/数据流）：权限面板 -> PUT -> 用户表。 */
@PutMapping("/{id}") public ApiResponse<SystemUserResponse> update(@PathVariable Long id, @Valid @RequestBody SystemUserUpdateRequest request) { return ApiResponse.success(service.updateUser(id, request)); }
/** 代码作用（白话）：仅开发者可重置非开发者密码；关联文件：PasswordResetRequest.java、V1__system_user_auth_permissions.sql。关联逻辑（调用链/数据流）：开发者表单 -> PUT password -> BCrypt/触发器。 */
@PutMapping("/{id}/password") public ApiResponse<Void> resetPassword(@PathVariable Long id, @Valid @RequestBody PasswordResetRequest request) { service.resetPassword(id, request); return ApiResponse.success(null); }
}
backend/src/main/java/com/xyw/console/auth/SystemUserAdminService.java 0 → 100644
package com.xyw.console.auth;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.xyw.console.asset.entity.SystemUserEntity;
import com.xyw.console.asset.mapper.SystemUserMapper;
import com.xyw.console.auth.dto.PasswordResetRequest;
import com.xyw.console.auth.dto.SystemUserCreateRequest;
import com.xyw.console.auth.dto.SystemUserResponse;
import com.xyw.console.auth.dto.SystemUserUpdateRequest;
import java.time.LocalDateTime;
import java.util.List;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;
@Service
public class SystemUserAdminService {
private final SystemUserMapper users; private final PagePermissionService permissions; private final PasswordEncoder encoder;
/** 代码作用（白话）：接收账号表、页面权限和密码哈希依赖；关联文件：SystemUserAdminController.java、SystemUserMapper.java。关联逻辑（调用链/数据流）：管理接口 -> 本服务 -> 用户表/权限 JSON/BCrypt。 */
public SystemUserAdminService(SystemUserMapper users, PagePermissionService permissions, PasswordEncoder encoder) { this.users = users; this.permissions = permissions; this.encoder = encoder; }
/** 代码作用（白话）：查询管理者可见的非开发者账号，任何响应都不返回哈希；关联文件：SystemUserAdminController.java、UserPermissionView.js。关联逻辑（调用链/数据流）：账号页面 -> GET users -> as_system_user(role != DEVELOPER) -> 列表。 */
public List<SystemUserResponse> listVisibleUsers() { assertAdministrator(); return users.selectList(new LambdaQueryWrapper<SystemUserEntity>().ne(SystemUserEntity::getRoleCode, "DEVELOPER").eq(SystemUserEntity::getDeleteTime, 0L).orderByDesc(SystemUserEntity::getId)).stream().map(this::responseOf).toList(); }
/** 代码作用（白话）：按当前创建者的角色边界新增非开发者账号；关联文件：SystemUserCreateRequest.java、SystemUserAdminController.java。关联逻辑（调用链/数据流）：创建表单 -> 创建者校验 -> 密码/禁用规则 -> as_system_user。 */
public SystemUserResponse createUser(SystemUserCreateRequest request) { String actor = currentRole(); assertCreatableRole(actor, request.roleCode()); if (users.selectCount(new LambdaQueryWrapper<SystemUserEntity>().eq(SystemUserEntity::getUsername, request.username()).eq(SystemUserEntity::getDeleteTime, 0L)) > 0) throw new IllegalArgumentException("用户名已存在"); SystemUserEntity user = new SystemUserEntity(); user.setUsername(request.username()); user.setRoleCode(request.roleCode()); user.setPagePermissions(permissions.validatePermissions(request.pagePermissions())); user.setDeleteTime(0L); user.setCreateTime(LocalDateTime.now()); user.setUpdateTime(LocalDateTime.now()); user.setAuthVersion(1); if ("SUPER_ADMIN".equals(actor)) { user.setStatus("DISABLED"); user.setPasswordHash(null); } else { requireValidPassword(request.password(), request.username()); user.setStatus("ACTIVE"); user.setPasswordHash(encoder.encode(request.password())); } users.insert(user); return responseOf(user); }
/** 代码作用（白话）：更新非开发者账号的角色、启停和逐页权限，禁止绕过 Jeddy；关联文件：SystemUserUpdateRequest.java、PagePermissionService.java。关联逻辑（调用链/数据流）：编辑面板 -> 角色边界 -> 用户表更新 -> 下次请求按新权限判定。 */
public SystemUserResponse updateUser(Long id, SystemUserUpdateRequest request) { String actor = currentRole(); assertCreatableRole(actor, request.roleCode()); SystemUserEntity user = findManageableUser(id); validateRequestedStatus(request.status(), user); String normalizedPermissions = permissions.validatePermissions(request.pagePermissions()); boolean authorizationChanged = authorizationStateChanged(user, request, normalizedPermissions); user.setRoleCode(request.roleCode()); user.setStatus(request.status()); user.setPagePermissions(normalizedPermissions); if (authorizationChanged) user.setAuthVersion(nextAuthVersion(user.getAuthVersion())); user.setUpdateTime(LocalDateTime.now()); users.updateById(user); return responseOf(user); }
/** Plain purpose: decide whether an account edit changes authorization facts embedded in its existing login token. Related files: PagePermissionService.java, AuthTokenFilter.java. Flow: saved account/request -> normalized authorization comparison -> auth-version increment or session retention. */
private boolean authorizationStateChanged(SystemUserEntity user, SystemUserUpdateRequest request, String normalizedPermissions) { return !java.util.Objects.equals(user.getRoleCode(), request.roleCode()) || !java.util.Objects.equals(user.getStatus(), request.status()) || !java.util.Objects.equals(permissions.normalizeStoredPermissions(user.getPagePermissions()), normalizedPermissions); }
/** Plain purpose: return the next usable login-ticket version even for a historical row with a null version. Related files: SystemUserEntity.java, AuthTokenFilter.java. Flow: authorization change -> incremented authVersion -> old JWT rejected on next request. */
private int nextAuthVersion(Integer currentVersion) { return (currentVersion == null ? 1 : currentVersion) + 1; }
/** Plain purpose: reject invalid status transitions before changing an account entity. Related files: SystemUserUpdateRequest.java, SystemUserAdminService.java. Flow: update request -> status validation -> safe entity update or readable failure. */
private void validateRequestedStatus(String status, SystemUserEntity user) { if (!("ACTIVE".equals(status) || "DISABLED".equals(status))) throw new IllegalArgumentException("账号状态无效"); if ("ACTIVE".equals(status) && user.getPasswordHash() == null) throw new IllegalArgumentException("请由开发者先设置密码后再启用账号"); }
/** 代码作用（白话）：仅允许开发者为非开发者账号设置密码，并交给数据库触发器记录时间及失效旧会话；关联文件：PasswordResetRequest.java、V1__system_user_auth_permissions.sql。关联逻辑（调用链/数据流）：开发者表单 -> BCrypt hash -> UPDATE password_hash -> trigger(auth_version)。 */
public void resetPassword(Long id, PasswordResetRequest request) { if (!"DEVELOPER".equals(currentRole())) throw new AccessDeniedException("只有开发者可以修改密码"); SystemUserEntity user = findManageableUser(id); requireValidPassword(request.password(), user.getUsername()); user.setPasswordHash(encoder.encode(request.password())); user.setUpdateTime(LocalDateTime.now()); users.updateById(user); }
/** 代码作用（白话）：确认当前会话属于开发者或超级管理员；关联文件：AuthTokenFilter.java、SystemUserAdminController.java。关联逻辑（调用链/数据流）：Cookie 身份 -> SecurityContext -> 管理接口准入。 */
private void assertAdministrator() { if (!permissions.isAdministrator(currentRole())) throw new AccessDeniedException("没有账号管理权限"); }
/** 代码作用（白话）：读取过滤器已经核验过的当前角色；关联文件：AuthPrincipal.java、AuthTokenFilter.java。关联逻辑（调用链/数据流）：JWT -> SecurityContext principal -> 创建/修改边界。 */
private String currentRole() { Object principal = SecurityContextHolder.getContext().getAuthentication() == null ? null : SecurityContextHolder.getContext().getAuthentication().getPrincipal(); if (!(principal instanceof AuthPrincipal user)) throw new AccessDeniedException("没有账号管理权限"); return user.roleCode(); }
/** 代码作用（白话）：按角色边界阻止创建开发者以及普通角色创建账号；关联文件：SystemUserCreateRequest.java、SystemUserUpdateRequest.java。关联逻辑（调用链/数据流）：当前角色 + 目标角色 -> 允许或 403。 */
private void assertCreatableRole(String actor, String roleCode) { if ("DEVELOPER".equals(roleCode)) throw new AccessDeniedException("开发者账号仅允许固定账号 Jeddy"); if (!("SUPER_ADMIN".equals(roleCode) || "FINANCE".equals(roleCode) || "HR".equals(roleCode) || "OPERATIONS".equals(roleCode))) throw new IllegalArgumentException("角色无效"); if ("DEVELOPER".equals(actor) || "SUPER_ADMIN".equals(actor)) return; throw new AccessDeniedException("没有账号管理权限"); }
/** 代码作用（白话）：按固定查询条件取得可管理账号，避免 Jeddy 通过 URL 或接口细节泄露；关联文件：SystemUserMapper.java、SystemUserResponse.java。关联逻辑（调用链/数据流）：账号 id -> 非 DEVELOPER 查询 -> 编辑/重置。 */
private SystemUserEntity findManageableUser(Long id) { SystemUserEntity user = users.selectOne(new LambdaQueryWrapper<SystemUserEntity>().eq(SystemUserEntity::getId, id).ne(SystemUserEntity::getRoleCode, "DEVELOPER").eq(SystemUserEntity::getDeleteTime, 0L)); if (user == null) throw new IllegalArgumentException("账号不存在"); return user; }
/** 代码作用（白话）：验证密码长度和用户名相似度，避免弱密码直接进入数据库；关联文件：PasswordResetRequest.java、SystemUserCreateRequest.java。关联逻辑（调用链/数据流）：密码输入 -> 规则校验 -> BCrypt 哈希。 */
private void requireValidPassword(String password, String username) { if (password == null || password.length() < 12 || password.length() > 72 || password.toLowerCase().contains(username.toLowerCase())) throw new IllegalArgumentException("密码需为 12-72 位且不能包含用户名"); }
/** 代码作用（白话）：将实体转为安全响应，并统一展开固定管理员的有效权限；关联文件：SystemUserResponse.java、PagePermissionService.java。关联逻辑（调用链/数据流）：实体 -> 权限计算 -> 前端列表。 */
private SystemUserResponse responseOf(SystemUserEntity user) { return new SystemUserResponse(user.getId(), user.getUsername(), user.getRoleCode(), user.getStatus(), permissions.effectivePermissions(user), user.getPasswordUpdatedAt()); }
}
backend/src/main/java/com/xyw/console/auth/dto/CurrentUserResponse.java 0 → 100644
package com.xyw.console.auth.dto;
import java.util.Map;
/** 代码作用（白话）：返回前端菜单所需的安全身份，不返回密码或哈希；关联文件：AuthService.java、auth-store.js。关联逻辑（调用链/数据流）：用户表 -> 安全响应 -> 菜单/路由。 */
public record CurrentUserResponse(Long id, String username, String roleCode, Map<String, String> pagePermissions) {}
backend/src/main/java/com/xyw/console/auth/dto/LoginRequest.java 0 → 100644
package com.xyw.console.auth.dto;
import jakarta.validation.constraints.NotBlank;
import jakarta.validation.constraints.Pattern;
/** 代码作用（白话）：限定登录请求只接收合法账号名和暂存密码；关联文件：AuthController.java。关联逻辑（调用链/数据流）：登录表单 -> DTO 校验 -> AuthService。 */
public record LoginRequest(@NotBlank @Pattern(regexp = "[A-Za-z0-9_]{3,64}") String username, @NotBlank String password) {}
backend/src/main/java/com/xyw/console/auth/dto/PasswordResetRequest.java 0 → 100644
package com.xyw.console.auth.dto;
import jakarta.validation.constraints.NotBlank;
/** 代码作用（白话）：只接收开发者为他人设置的新密码，密码仅在本次请求中使用；关联文件：SystemUserAdminController.java、SystemUserAdminService.java。关联逻辑（调用链/数据流）：重置密码表单 -> DTO -> BCrypt 哈希 -> 数据库触发器失效旧会话。 */
public record PasswordResetRequest(@NotBlank String password) {}
backend/src/main/java/com/xyw/console/auth/dto/SystemUserCreateRequest.java 0 → 100644
package com.xyw.console.auth.dto;
import jakarta.validation.constraints.NotBlank;
import jakarta.validation.constraints.Pattern;
import java.util.Map;
/** 代码作用（白话）：接收新账号的基础信息，不把密码哈希暴露给浏览器；关联文件：SystemUserAdminController.java、SystemUserAdminService.java。关联逻辑（调用链/数据流）：账号创建表单 -> DTO 校验 -> 管理服务 -> as_system_user。 */
public record SystemUserCreateRequest(
@NotBlank @Pattern(regexp = "[A-Za-z0-9_]{3,64}") String username,
@NotBlank String roleCode,
String password,
Map<String, String> pagePermissions) {}
backend/src/main/java/com/xyw/console/auth/dto/SystemUserResponse.java 0 → 100644
package com.xyw.console.auth.dto;
import java.time.LocalDateTime;
import java.util.Map;
/** 代码作用（白话）：向管理页面返回可展示的账号资料，明确不含 password_hash；关联文件：SystemUserAdminService.java、UserPermissionView.js。关联逻辑（调用链/数据流）：用户表实体 -> 安全响应 DTO -> 账号列表/编辑面板。 */
public record SystemUserResponse(Long id, String username, String roleCode, String status, Map<String, String> pagePermissions, LocalDateTime passwordUpdatedAt) {}
backend/src/main/java/com/xyw/console/auth/dto/SystemUserUpdateRequest.java 0 → 100644
package com.xyw.console.auth.dto;
import jakarta.validation.constraints.NotBlank;
import java.util.Map;
/** 代码作用（白话）：接收非开发者账号的角色、启停和页面权限编辑结果；关联文件：SystemUserAdminController.java、SystemUserAdminService.java。关联逻辑（调用链/数据流）：权限面板 -> DTO -> 管理服务 -> 用户表。 */
public record SystemUserUpdateRequest(@NotBlank String roleCode, @NotBlank String status, Map<String, String> pagePermissions) {}
backend/src/main/java/com/xyw/console/config/SecurityConfig.java 0 → 100644
package com.xyw.console.config;
import com.fasterxml.jackson.databind.ObjectMapper; import com.xyw.console.auth.AuthTokenFilter; import com.xyw.console.common.ApiResponse;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.http.HttpMethod; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; import org.springframework.security.config.http.SessionCreationPolicy; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; import org.springframework.security.web.csrf.CookieCsrfTokenRepository; import org.springframework.security.web.csrf.CsrfException;
@Configuration @EnableWebSecurity
public class SecurityConfig {
/** 代码作用（白话）：配置无状态认证、CSRF 和统一 401/403 响应；关联文件：AuthTokenFilter.java、WebConfig.java。关联逻辑（调用链/数据流）：浏览器请求 -> Security Filter Chain -> Cookie 验签 -> Controller。 */
@Bean SecurityFilterChain securityFilterChain(HttpSecurity http, AuthTokenFilter filter, ObjectMapper mapper) throws Exception { return http.httpBasic(AbstractHttpConfigurer::disable).formLogin(AbstractHttpConfigurer::disable).csrf(csrf -> csrf.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()).ignoringRequestMatchers("/api/auth/login")).cors(cors -> {}).sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)).authorizeHttpRequests(auth -> auth.requestMatchers(HttpMethod.OPTIONS,"/**").permitAll().requestMatchers("/api/auth/login", "/api/auth/csrf").permitAll().anyRequest().authenticated()).addFilterBefore(filter, UsernamePasswordAuthenticationFilter.class).exceptionHandling(errors -> errors.authenticationEntryPoint((request,response,error)->write(mapper,response,401,"请先登录")).accessDeniedHandler((request,response,error)->write(mapper,response,403,accessDeniedMessage(error)))).build(); }
/** Plain purpose: choose a safe client action for CSRF failures without exposing account or token details. Related files: auth-api-client.js, SecurityConfigTest.java. Flow: Spring access denial -> safe message -> JSON response -> browser refresh/retry guidance. */
String accessDeniedMessage(Exception error) { return error instanceof CsrfException ? "安全校验已失效，请刷新页面后重试" : "没有权限"; }
/** 代码作用（白话）：生成 BCrypt 编码器，确保密码只存不可逆哈希；关联文件：AuthService.java。关联逻辑（调用链/数据流）：开发者设密码/登录验证 -> BCrypt。 */
@Bean PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(12); }
/** 代码作用（白话）：把安全层错误也保持为现有 code/message/data 格式；关联文件：ApiResponse.java、前端 API 客户端。关联逻辑（调用链/数据流）：安全拒绝 -> JSON 响应 -> 页面错误提示。 */
private void write(ObjectMapper mapper, HttpServletResponse response, int status, String message) throws java.io.IOException { response.setStatus(status); response.setContentType("application/json;charset=UTF-8"); mapper.writeValue(response.getWriter(), ApiResponse.error(status,message)); }
}
backend/src/main/java/com/xyw/console/config/WebConfig.java
......@@ -13,10 +13,12 @@ public class WebConfig implements WebMvcConfigurer {
* 关联逻辑（调用链/消息链/数据流）：浏览器 fetch -> /api/** -> addCorsMappings() -> 后端控制器正常返回 JSON。
*/
@Override
/** 代码作用（白话）：允许指定本地前端端口调用后端接口。CORS（浏览器限制不同端口互访的安全规则）需要列出 5175；否则浏览器会在密码校验前以 403 拒绝登录。关联文件：frontend/vite.config.js、SecurityConfig.java。关联逻辑（调用链/消息链/数据流）：浏览器 5173/5175 -> /api/** -> addCorsMappings() -> 后端控制器。 */
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/api/**")
.allowedOrigins("http://localhost:8000", "http://127.0.0.1:8000", "http://localhost:5173", "http://127.0.0.1:5173")
.allowedOrigins("http://localhost:8000", "http://127.0.0.1:8000", "http://localhost:5173", "http://127.0.0.1:5173", "http://localhost:5175", "http://127.0.0.1:5175")
.allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
.allowedHeaders("*");
.allowedHeaders("*")
.allowCredentials(true);
}
}
backend/src/main/resources/db/migration/V1__system_user_auth_permissions.sql 0 → 100644
-- 代码作用（白话）：在不写入任何账号密码或 Jeddy 哈希的前提下，为现有账号表补齐页面权限和会话失效字段。
-- 关联文件：SystemUserEntity.java、AuthTokenFilter.java、SystemUserAdminService.java。
-- 关联逻辑（调用链/数据流）：数据库字段/触发器 -> 认证过滤器校验 auth_version -> 登录 Cookie 立即失效。
-- 本脚本在部署前的只读核对确认字段不存在后执行一次；MySQL 不支持 ADD COLUMN IF NOT EXISTS。
ALTER TABLE as_system_user
ADD COLUMN page_permissions JSON NULL COMMENT '页面权限映射：NONE/READ/EDIT',
ADD COLUMN password_updated_at DATETIME NULL COMMENT '密码哈希最后更新时间',
ADD COLUMN auth_version INT NOT NULL DEFAULT 1 COMMENT '登录凭证版本号';
CREATE UNIQUE INDEX uk_as_system_user_username ON as_system_user (username);
DROP TRIGGER IF EXISTS trg_as_system_user_password_changed;
DELIMITER $$
CREATE TRIGGER trg_as_system_user_password_changed
BEFORE UPDATE ON as_system_user
FOR EACH ROW
BEGIN
IF NOT (NEW.password_hash <=> OLD.password_hash) THEN
SET NEW.password_updated_at = CURRENT_TIMESTAMP;
SET NEW.auth_version = COALESCE(OLD.auth_version, 1) + 1;
END IF;
END$$
DELIMITER ;
-- 回滚说明：仅在确认没有依赖新字段和唯一索引后，先 DROP TRIGGER，再 DROP INDEX，最后 DROP COLUMN；
-- 绝不可在未备份 as_system_user 或存在新账号数据时直接执行回滚，也不得在此脚本写入 Jeddy 哈希。
backend/src/test/java/com/xyw/console/asset/controller/DeviceAssetControllerTest.java 0 → 100644
package com.xyw.console.asset.controller;
import static org.mockito.ArgumentMatchers.any;
import static org.mockito.Mockito.doThrow;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;
import static org.mockito.Mockito.verifyNoInteractions;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.delete;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.multipart;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
import com.xyw.console.asset.dto.DeviceAssetPageResponse;
import com.xyw.console.asset.dto.DeviceAssetResponse;
import com.xyw.console.asset.exception.DeviceAssetValidationException;
import com.xyw.console.asset.service.DeviceAssetService;
import com.xyw.console.asset.dto.DeviceAssetPageQuery;
import com.xyw.console.asset.dto.DeviceAssetSaveRequest;
import com.xyw.console.auth.AuthPrincipal;
import com.xyw.console.auth.PagePermissionService;
import java.util.List;
import org.junit.jupiter.api.Test;
import org.springframework.core.io.ByteArrayResource;
import org.springframework.http.HttpMethod;
import org.springframework.mock.web.MockMultipartFile;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.test.web.servlet.MockMvc;
import org.springframework.test.web.servlet.setup.MockMvcBuilders;
/** 文件用途注释：验证设备资产 HTTP 接口可正确绑定查询、multipart 表单和删除异常，不依赖真实数据库或文件目录。*/
class DeviceAssetControllerTest {
/** 代码作用（白话）：验证列表接口将服务层的设备与人员名称数据按统一 JSON 返回。关联文件：DeviceAssetController.java、DeviceAssetService.java。关联逻辑（调用链/数据流）：GET -> Controller.page -> Service.page -> ApiResponse -> 前端表格。*/
@Test void returnsPagedDeviceAssets() throws Exception {
DeviceAssetService service=mock(DeviceAssetService.class);when(service.page(any())).thenReturn(new DeviceAssetPageResponse(List.of(response()),1,1,20));
mockMvc(service).perform(get("/api/device-assets")).andExpect(status().isOk()).andExpect(jsonPath("$.code").value(200)).andExpect(jsonPath("$.data.records[0].deviceName").value("测试电脑")).andExpect(jsonPath("$.data.records[0].userPersonName").value("张三"));
}
/** 代码作用（白话）：验证新增接口接收 multipart 字段和图片并把保存请求交给服务层。关联文件：DeviceAssetController.java、DeviceAssetSaveRequest.java。关联逻辑（调用链/数据流）：表单/图片 -> @ModelAttribute -> Service.create -> 成功 JSON。*/
@Test void createsDeviceAssetThroughMultipartEndpoint() throws Exception {
DeviceAssetService service=mock(DeviceAssetService.class);when(service.create(any())).thenReturn(response());MockMultipartFile image=new MockMultipartFile("imageAttachment1","device.png","image/png",new byte[]{1,2,3});
mockMvc(service).perform(multipart("/api/device-assets").file(image).param("deviceName","测试电脑").param("userUsageStatus","使用中").param("assetRelationStatus","未关联"))
.andExpect(status().isOk()).andExpect(jsonPath("$.code").value(200)).andExpect(jsonPath("$.data.id").value(1));verify(service).create(any());
}
/** 代码作用（白话）：验证删除被关联资产阻断时，接口返回 400 和可读错误信息。关联文件：DeviceAssetController.java、DeviceAssetExceptionHandler.java。关联逻辑（调用链/数据流）：DELETE -> Service.softDelete 异常 -> Advice -> 400 JSON。*/
@Test void returnsBadRequestWhenDeleteIsBlocked() throws Exception {
DeviceAssetService service=mock(DeviceAssetService.class);doThrow(new DeviceAssetValidationException("设备仍被手机号码资产引用，不能删除")).when(service).softDelete(1L);
mockMvc(service).perform(delete("/api/device-assets/1")).andExpect(status().isBadRequest()).andExpect(jsonPath("$.code").value(400));
}
/** Plain purpose: verify the edit endpoint binds multipart fields and delegates to the update service. Related files: DeviceAssetController.java, DeviceAssetSaveRequest.java. Flow: multipart PUT -> model binding -> service.update -> success JSON. */
@Test void updatesDeviceAssetThroughMultipartEndpoint() throws Exception {
DeviceAssetService service=mock(DeviceAssetService.class);when(service.update(any(),any())).thenReturn(response());MockMultipartFile image=new MockMultipartFile("imageAttachment2","edited.png","image/png",new byte[]{1,2,3});
mockMvc(service).perform(multipart(HttpMethod.PUT,"/api/device-assets/{id}",1L).file(image).param("deviceName","\u6d4b\u8bd5\u7535\u8111").param("userUsageStatus","\u4f7f\u7528\u4e2d").param("assetRelationStatus","\u672a\u5173\u8054"))
.andExpect(status().isOk()).andExpect(jsonPath("$.data.imageAttachment1Url").value("/api/device-assets/files/image.png"));verify(service).update(org.mockito.ArgumentMatchers.eq(1L),any());
}
/** Plain purpose: verify image bytes are served only through the controlled opaque identifier endpoint. Related files: DeviceAssetController.java, DeviceAssetFileStorageService.java. Flow: GET file identifier -> service resource -> response bytes. */
@Test void readsImageThroughControlledEndpoint() throws Exception {
DeviceAssetService service=mock(DeviceAssetService.class);when(service.findImage("opaque.png")).thenReturn(new ByteArrayResource(new byte[]{7,8}) { @Override public String getFilename(){return "opaque.png";} });
mockMvc(service).perform(get("/api/device-assets/files/opaque.png")).andExpect(status().isOk()).andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content().bytes(new byte[]{7,8}));
}
/** Plain purpose: assert the public list response has URLs but never deleteTime or a disk path field. Related files: DeviceAssetResponse.java, DeviceAssetController.java. Flow: service response -> ApiResponse JSON -> browser. */
@Test void hidesDeleteTimeAndPhysicalImagePath() throws Exception {
DeviceAssetService service=mock(DeviceAssetService.class);when(service.page(any())).thenReturn(new DeviceAssetPageResponse(List.of(response()),1,1,20));
mockMvc(service).perform(get("/api/device-assets")).andExpect(status().isOk()).andExpect(jsonPath("$.data.records[0].deleteTime").doesNotExist()).andExpect(jsonPath("$.data.records[0].imageAttachment1Url").value("/api/device-assets/files/image.png")).andExpect(jsonPath("$.data.records[0].imageAttachment1").doesNotExist());
}
/** Plain purpose: prove a logged-in ordinary role cannot bypass the sidebar and call any device endpoint directly. Related files: DeviceAssetController.java, PagePermissionService.java. Flow: finance principal -> controller administrator check -> access denial before device service or image read. */
@Test void blocksNonAdministratorsFromEveryDeviceEndpoint() {
DeviceAssetService service = mock(DeviceAssetService.class); PagePermissionService permissions = new PagePermissionService(new com.fasterxml.jackson.databind.ObjectMapper()); DeviceAssetController controller = new DeviceAssetController(service, permissions);
SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(new AuthPrincipal(3L, "finance", "FINANCE", 1), null));
try {
assertThrows(AccessDeniedException.class, () -> controller.page(new DeviceAssetPageQuery(1, 20, null, null, null, null)));
assertThrows(AccessDeniedException.class, () -> controller.create(new DeviceAssetSaveRequest()));
assertThrows(AccessDeniedException.class, () -> controller.update(1L, new DeviceAssetSaveRequest()));
assertThrows(AccessDeniedException.class, () -> controller.delete(1L));
assertThrows(AccessDeniedException.class, () -> controller.companyPersons("name"));
assertThrows(AccessDeniedException.class, () -> controller.file("opaque.png"));
verifyNoInteractions(service);
} finally { SecurityContextHolder.clearContext(); }
}
/** 代码作用（白话）：集中创建带设备异常转换器的 MockMvc，保证控制器返回契约可被测试。关联文件：DeviceAssetController.java、DeviceAssetExceptionHandler.java。关联逻辑（调用链/数据流）：HTTP 模拟请求 -> Controller -> Advice -> JSON 响应。*/
/** Plain purpose: create an administrator-authorized controller test harness without a live Spring Security filter chain. Related files: DeviceAssetController.java, PagePermissionService.java. Flow: mock permission check -> controller endpoint -> mocked device service -> HTTP assertion. */
private MockMvc mockMvc(DeviceAssetService service){return MockMvcBuilders.standaloneSetup(new DeviceAssetController(service,mock(PagePermissionService.class))).setControllerAdvice(new DeviceAssetExceptionHandler()).build();}
/** 代码作用（白话）：生成一条不含服务器文件真实路径的安全设备响应。关联文件：DeviceAssetResponse.java、DeviceAssetController.java。关联逻辑（调用链/数据流）：服务层响应 -> ApiResponse -> 页面展示。*/
private DeviceAssetResponse response(){return new DeviceAssetResponse(1L,"测试电脑","/api/device-assets/files/image.png",null,9L,"张三","使用中","未关联",null,null);}
}
backend/src/test/java/com/xyw/console/asset/controller/PhoneAssetControllerTest.java
......@@ -11,6 +11,7 @@ import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.
import com.xyw.console.asset.entity.PhoneAssetEntity;
import com.xyw.console.asset.mapper.PhoneAssetMapper;
import com.xyw.console.asset.service.PhoneAssetService;
import com.xyw.console.auth.PagePermissionService;
import org.junit.jupiter.api.Test;
import org.springframework.http.MediaType;
import org.springframework.test.web.servlet.MockMvc;
......@@ -27,7 +28,7 @@ class PhoneAssetControllerTest {
PhoneAssetMapper mapper = mock(PhoneAssetMapper.class);
when(mapper.selectCount(any())).thenReturn(0L);
when(mapper.insert(any(PhoneAssetEntity.class))).thenReturn(1);
MockMvc mockMvc = MockMvcBuilders.standaloneSetup(new PhoneAssetController(new PhoneAssetService(mapper))).build();
MockMvc mockMvc = MockMvcBuilders.standaloneSetup(new PhoneAssetController(new PhoneAssetService(mapper), mock(PagePermissionService.class))).build();
mockMvc.perform(post("/api/phone-assets").contentType(MediaType.APPLICATION_JSON)
.content("{\"phoneNumber\":\"13812345678\",\"realNameOwner\":\"张三\"}"))
......@@ -46,7 +47,7 @@ class PhoneAssetControllerTest {
when(mapper.selectOne(any())).thenReturn(entity);
when(mapper.selectCount(any())).thenReturn(0L);
when(mapper.updateById(any(PhoneAssetEntity.class))).thenReturn(1);
MockMvc mockMvc = MockMvcBuilders.standaloneSetup(new PhoneAssetController(new PhoneAssetService(mapper))).build();
MockMvc mockMvc = MockMvcBuilders.standaloneSetup(new PhoneAssetController(new PhoneAssetService(mapper), mock(PagePermissionService.class))).build();
mockMvc.perform(put("/api/phone-assets/1").contentType(MediaType.APPLICATION_JSON)
.content("{\"phoneNumber\":\"13912345678\",\"realNameOwner\":\"李四\"}"))
......@@ -63,7 +64,7 @@ class PhoneAssetControllerTest {
PhoneAssetMapper mapper = mock(PhoneAssetMapper.class);
when(mapper.selectOne(any())).thenReturn(activeEntity());
when(mapper.updateById(any(PhoneAssetEntity.class))).thenReturn(1);
MockMvc mockMvc = MockMvcBuilders.standaloneSetup(new PhoneAssetController(new PhoneAssetService(mapper))).build();
MockMvc mockMvc = MockMvcBuilders.standaloneSetup(new PhoneAssetController(new PhoneAssetService(mapper), mock(PagePermissionService.class))).build();
mockMvc.perform(delete("/api/phone-assets/1"))
.andExpect(status().isOk());
......
backend/src/test/java/com/xyw/console/asset/controller/WecomAccountControllerTest.java
......@@ -17,6 +17,7 @@ import com.xyw.console.asset.mapper.CompanyProfileMapper;
import com.xyw.console.asset.mapper.PhoneAssetMapper;
import com.xyw.console.asset.mapper.WecomAccountMapper;
import com.xyw.console.asset.service.WecomAccountService;
import com.xyw.console.auth.PagePermissionService;
import java.time.LocalDateTime;
import java.util.List;
import org.junit.jupiter.api.Test;
......@@ -66,7 +67,7 @@ class WecomAccountControllerTest {
org.mockito.Mockito.when(assetDeviceMapper.selectList(org.mockito.ArgumentMatchers.any())).thenReturn(List.of(device()));
org.mockito.Mockito.when(companyPersonMapper.selectList(org.mockito.ArgumentMatchers.any())).thenReturn(List.of(operatorPerson()));
return new WecomAccountController(new WecomAccountService(
wecomMapper, companyProfileMapper, phoneAssetMapper, assetDeviceMapper, companyPersonMapper));
wecomMapper, companyProfileMapper, phoneAssetMapper, assetDeviceMapper, companyPersonMapper), org.mockito.Mockito.mock(PagePermissionService.class));
}
/**
......
backend/src/test/java/com/xyw/console/asset/service/DeviceAssetFileStorageServiceTest.java 0 → 100644
package com.xyw.console.asset.service;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;
import com.xyw.console.asset.exception.DeviceAssetValidationException;
import java.awt.image.BufferedImage;
import java.io.ByteArrayOutputStream;
import java.nio.file.Files;
import java.nio.file.Path;
import javax.imageio.ImageIO;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.io.TempDir;
import org.springframework.mock.web.MockMultipartFile;
/** 文件用途（白话）：验证设备图片的格式、大小、路径约束和失败清理，不依赖真实上传目录。 */
class DeviceAssetFileStorageServiceTest {
/** 代码作用（白话）：验证合法 PNG 会存为不透明标识，且失败清理后不能再次读取。关联文件：DeviceAssetFileStorageService.java。关联逻辑（调用链/数据流）：图片 -> store -> 标识 -> cleanupNewFile -> 受控读取失败。 */
@Test void storesAndCleansOnlyNewImage(@TempDir Path directory) throws Exception {
DeviceAssetFileStorageService storage=new DeviceAssetFileStorageService(directory.toString());String identifier=storage.store(new MockMultipartFile("image","one.png","image/png",png()));
assertTrue(Files.exists(directory.resolve(identifier)));storage.cleanupNewFile(identifier);assertThrows(DeviceAssetValidationException.class,()->storage.resolve(identifier));
}
/** 代码作用（白话）：验证允许的 JPG、PNG、GIF 都会经过真实图片解码后保存。关联文件：DeviceAssetFileStorageService.java。关联逻辑（调用链/数据流）：三种 MultipartFile -> validateImage -> store -> 受控文件目录。*/
@Test void storesEverySupportedImageFormat(@TempDir Path directory) throws Exception {
DeviceAssetFileStorageService storage=new DeviceAssetFileStorageService(directory.toString());
assertTrue(Files.exists(directory.resolve(storage.store(new MockMultipartFile("image","one.jpg","image/jpeg",image("jpg"))))));
assertTrue(Files.exists(directory.resolve(storage.store(new MockMultipartFile("image","two.png","image/png",image("png"))))));
assertTrue(Files.exists(directory.resolve(storage.store(new MockMultipartFile("image","three.gif","image/gif",image("gif"))))));
}
/** 代码作用（白话）：验证损坏、超限和不支持类型会在保存前被拒绝。关联文件：DeviceAssetFileStorageService.java。关联逻辑（调用链/数据流）：multipart 文件 -> validateImage -> 400 业务异常。 */
@Test void rejectsCorruptedOversizedAndUnsupportedImages(@TempDir Path directory) {
DeviceAssetFileStorageService storage=new DeviceAssetFileStorageService(directory.toString());assertThrows(DeviceAssetValidationException.class,()->storage.store(new MockMultipartFile("image","bad.png","image/png",new byte[]{1,2,3})));assertThrows(DeviceAssetValidationException.class,()->storage.store(new MockMultipartFile("image","bad.txt","text/plain",png())));assertThrows(DeviceAssetValidationException.class,()->storage.store(new MockMultipartFile("image","large.png","image/png",new byte[20*1024*1024+1])));
}
/** 代码作用（白话）：验证文件标识不能离开设备图片根目录。关联文件：DeviceAssetFileStorageService.java、DeviceAssetController.java。关联逻辑（调用链/数据流）：图片 URL 标识 -> resolve -> 根目录校验。 */
@Test void rejectsPathTraversalIdentifier(@TempDir Path directory) { DeviceAssetFileStorageService storage=new DeviceAssetFileStorageService(directory.toString());assertThrows(DeviceAssetValidationException.class,()->storage.resolve("../secret.png")); }
/** 代码作用（白话）：在测试中生成 ImageIO 必然可解码的 PNG 字节。关联文件：DeviceAssetFileStorageService.java。关联逻辑（调用链/数据流）：BufferedImage -> PNG 字节 -> MockMultipartFile -> 服务校验。 */
private byte[] png() { try { ByteArrayOutputStream output=new ByteArrayOutputStream();ImageIO.write(new BufferedImage(1,1,BufferedImage.TYPE_INT_ARGB),"png",output);return output.toByteArray(); } catch(Exception exception) { throw new IllegalStateException(exception); } }
/** 代码作用（白话）：按指定格式生成可被 ImageIO 解码的小图片，避免测试数据本身失真。关联文件：DeviceAssetFileStorageService.java。关联逻辑（调用链/数据流）：BufferedImage -> 指定格式字节 -> MockMultipartFile -> 上传格式校验。*/
private byte[] image(String format) { try { ByteArrayOutputStream output=new ByteArrayOutputStream();if(!ImageIO.write(new BufferedImage(1,1,BufferedImage.TYPE_INT_RGB),format,output)){throw new IllegalStateException("测试运行环境不支持图片格式："+format);}return output.toByteArray(); } catch(Exception exception) { throw new IllegalStateException(exception); } }
}
backend/src/test/java/com/xyw/console/asset/service/DeviceAssetServiceTest.java
......@@ -2,8 +2,10 @@ package com.xyw.console.asset.service;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.mockito.ArgumentMatchers.any;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;
import com.baomidou.mybatisplus.core.conditions.Wrapper;
......@@ -15,8 +17,16 @@ import com.xyw.console.asset.entity.AssetDeviceEntity;
import com.xyw.console.asset.entity.CompanyPersonEntity;
import com.xyw.console.asset.exception.DeviceAssetValidationException;
import com.xyw.console.asset.mapper.*;
import java.awt.image.BufferedImage;
import java.io.ByteArrayOutputStream;
import java.nio.file.Files;
import java.nio.file.Path;
import java.util.List;
import javax.imageio.ImageIO;
import org.mockito.ArgumentCaptor;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.io.TempDir;
import org.springframework.mock.web.MockMultipartFile;
/** 文件用途（白话）：以 Mock Mapper 验证设备列表名称解析和关键校验规则，不访问真实数据库。 */
class DeviceAssetServiceTest {
......@@ -32,6 +42,84 @@ class DeviceAssetServiceTest {
DeviceAssetService service=service(mock(AssetDeviceMapper.class),mock(CompanyPersonMapper.class));DeviceAssetSaveRequest request=new DeviceAssetSaveRequest();request.setDeviceName("测试机");request.setUserUsageStatus("未知");request.setAssetRelationStatus("已关联");
assertThrows(DeviceAssetValidationException.class,()->service.create(request));
}
/** 代码作用（白话）：验证重名的有效设备不能再次创建，防止列表出现无法区分的资产。关联文件：DeviceAssetService.java、AssetDeviceMapper.java。关联逻辑（调用链/数据流）：POST 表单 -> validateSaveRequest -> selectCount -> 400 业务异常。*/
@Test void rejectsDuplicateActiveDeviceName() {
AssetDeviceMapper devices=mock(AssetDeviceMapper.class);when(devices.selectCount(any(Wrapper.class))).thenReturn(1L);
assertThrows(DeviceAssetValidationException.class,()->service(devices,mock(CompanyPersonMapper.class)).create(validRequest("重复设备")));
}
/** 代码作用（白话）：验证手机号码资产仍关联设备时，删除请求会被阻断，且不更新设备删除时间。关联文件：DeviceAssetService.java、PhoneAssetMapper.java。关联逻辑（调用链/数据流）：DELETE -> 查询设备 -> 手机号码引用计数 -> 400 业务异常。*/
@Test void blocksDeleteWhenPhoneAssetStillReferencesDevice() {
AssetDeviceMapper devices=mock(AssetDeviceMapper.class);PhoneAssetMapper phones=mock(PhoneAssetMapper.class);when(devices.selectOne(any(Wrapper.class))).thenReturn(activeDevice(1L));when(phones.selectCount(any(Wrapper.class))).thenReturn(1L);
assertThrows(DeviceAssetValidationException.class,()->service(devices,mock(CompanyPersonMapper.class),phones,new DeviceAssetFileStorageService(System.getProperty("java.io.tmpdir")+"/device-test-images")).softDelete(1L));
}
/** 代码作用（白话）：验证软删除只隐藏数据库记录，不物理删除原图，保留审计和后续恢复的可能。关联文件：DeviceAssetService.java、DeviceAssetFileStorageService.java。关联逻辑（调用链/数据流）：DELETE -> 关联检查 -> updateById(deleteTime)；图片文件继续留在受控目录。*/
@Test void softDeleteKeepsExistingImageFile(@TempDir Path directory) throws Exception {
DeviceAssetFileStorageService storage=new DeviceAssetFileStorageService(directory.toString());String identifier=storage.store(new MockMultipartFile("image","retained.png","image/png",png()));AssetDeviceMapper devices=mock(AssetDeviceMapper.class);AssetDeviceEntity device=activeDevice(2L);device.setImageAttachment1(identifier);when(devices.selectOne(any(Wrapper.class))).thenReturn(device);when(devices.updateById(any(AssetDeviceEntity.class))).thenReturn(1);
service(devices,mock(CompanyPersonMapper.class),mock(PhoneAssetMapper.class),storage).softDelete(2L);
assertTrue(Files.exists(directory.resolve(identifier)));
}
/** 代码作用（白话）：验证图片先保存但数据库新增失败时，刚上传的新图片会立即清理，避免留下孤儿文件。关联文件：DeviceAssetService.java、DeviceAssetFileStorageService.java。关联逻辑（调用链/数据流）：POST 图片 -> store -> Mapper.insert 失败 -> cleanupNewFile。*/
@Test void createFailureCleansNewImageFile(@TempDir Path directory) {
AssetDeviceMapper devices=mock(AssetDeviceMapper.class);DeviceAssetSaveRequest request=validRequest("保存失败设备");request.setImageAttachment1(new MockMultipartFile("image","failed.png","image/png",png()));
assertThrows(IllegalStateException.class,()->service(devices,mock(CompanyPersonMapper.class),mock(PhoneAssetMapper.class),new DeviceAssetFileStorageService(directory.toString())).create(request));
try(var files=Files.list(directory)){assertEquals(0,files.count());}catch(Exception exception){throw new IllegalStateException(exception);}
}
/** 代码作用（白话）：构造只含当前测试所需 Mock 的设备服务。关联文件：DeviceAssetService.java、DeviceAssetFileStorageService.java。关联逻辑（调用链/数据流）：测试 -> Mock Mapper/文件服务 -> Service 规则。 */
/** Plain purpose: prove a failed update removes only the new replacement file and retains the pre-existing original. Related files: DeviceAssetService.java, DeviceAssetFileStorageService.java. Flow: PUT image -> store replacement -> mapper failure -> cleanup replacement; original stays. */
@Test void updateFailureCleansReplacementButRetainsOriginal(@TempDir Path directory) throws Exception {
DeviceAssetFileStorageService storage=new DeviceAssetFileStorageService(directory.toString());String original=storage.store(new MockMultipartFile("image","original.png","image/png",png()));AssetDeviceMapper devices=mock(AssetDeviceMapper.class);AssetDeviceEntity device=activeDevice(3L);device.setImageAttachment1(original);when(devices.selectOne(any(Wrapper.class))).thenReturn(device);
DeviceAssetSaveRequest request=validRequest("update-failure");request.setImageAttachment1(new MockMultipartFile("image","replacement.png","image/png",png()));
assertThrows(com.xyw.console.asset.exception.DeviceAssetNotFoundException.class,()->service(devices,mock(CompanyPersonMapper.class),mock(PhoneAssetMapper.class),storage).update(3L,request));
try(var files=Files.list(directory)){assertEquals(1,files.count());}assertTrue(Files.exists(directory.resolve(original)));
}
/** Plain purpose: reject a supplied company-person ID when that person is no longer active. Related files: DeviceAssetService.java, CompanyPersonMapper.java. Flow: POST userPersonId -> active-person count -> validation error before insert. */
@Test void rejectsDeletedUserPersonBeforeCreate() {
CompanyPersonMapper people=mock(CompanyPersonMapper.class);when(people.selectCount(any(Wrapper.class))).thenReturn(0L);DeviceAssetSaveRequest request=validRequest("inactive-person");request.setUserPersonId(9L);
assertThrows(DeviceAssetValidationException.class,()->service(mock(AssetDeviceMapper.class),people).create(request));
}
/** Plain purpose: reject deletion when an enterprise-WeChat record references the device. Related files: DeviceAssetService.java, WecomAccountMapper.java. Flow: DELETE -> Wecom reference count -> validation error. */
@Test void blocksDeleteWhenWecomAccountReferencesDevice() { assertReferenceBlocksDelete(ReferenceType.WECOM); }
/** Plain purpose: reject deletion when a WeChat record references the device. Related files: DeviceAssetService.java, WechatAccountMapper.java. Flow: DELETE -> WeChat reference count -> validation error. */
@Test void blocksDeleteWhenWechatAccountReferencesDevice() { assertReferenceBlocksDelete(ReferenceType.WECHAT); }
/** Plain purpose: reject deletion when a Douyin record references the device. Related files: DeviceAssetService.java, DouyinAccountMapper.java. Flow: DELETE -> Douyin reference count -> validation error. */
@Test void blocksDeleteWhenDouyinAccountReferencesDevice() { assertReferenceBlocksDelete(ReferenceType.DOUYIN); }
/** Plain purpose: verify omitted page values become page 1 with twenty rows. Related files: DeviceAssetPageQuery.java, DeviceAssetService.java. Flow: GET without page/size -> resolved defaults -> MyBatis page. */
@Test void usesDefaultPaginationForDevicePage() {
AssetDeviceMapper devices=mock(AssetDeviceMapper.class);Page<AssetDeviceEntity> result=new Page<>(1,20);result.setRecords(List.of());when(devices.selectPage(any(Page.class),any(Wrapper.class))).thenReturn(result);
service(devices,mock(CompanyPersonMapper.class)).page(new DeviceAssetPageQuery(null,null,null,null,null,null));ArgumentCaptor<Page<AssetDeviceEntity>> page=ArgumentCaptor.forClass(Page.class);verify(devices).selectPage(page.capture(),any(Wrapper.class));assertEquals(1,page.getValue().getCurrent());assertEquals(20,page.getValue().getSize());
}
/** Plain purpose: verify every supported list filter contributes a database predicate. Related files: DeviceAssetPageQuery.java, DeviceAssetService.java. Flow: GET filter values -> LambdaQueryWrapper -> Mapper page query. */
@Test void appliesEverySupportedDevicePageFilter() {
AssetDeviceMapper devices=mock(AssetDeviceMapper.class);Page<AssetDeviceEntity> result=new Page<>(2,5);result.setRecords(List.of());when(devices.selectPage(any(Page.class),any(Wrapper.class))).thenReturn(result);
service(devices,mock(CompanyPersonMapper.class)).page(new DeviceAssetPageQuery(2,5,"filter-name",9L,"\u4f7f\u7528\u4e2d","\u672a\u5173\u8054"));ArgumentCaptor<Page<AssetDeviceEntity>> page=ArgumentCaptor.forClass(Page.class);ArgumentCaptor<Wrapper<AssetDeviceEntity>> filter=ArgumentCaptor.forClass(Wrapper.class);verify(devices).selectPage(page.capture(),filter.capture());
assertEquals(2,page.getValue().getCurrent());assertEquals(5,page.getValue().getSize());assertTrue(filter.getValue()!=null);
}
/** Plain purpose: verify a successful replacement changes the stored identifier but retains the historical original file. Related files: DeviceAssetService.java, DeviceAssetFileStorageService.java. Flow: PUT replacement -> new store -> mapper update -> new URL; old file remains. */
@Test void updateReplacesImageWithoutDeletingOriginal(@TempDir Path directory) throws Exception {
DeviceAssetFileStorageService storage=new DeviceAssetFileStorageService(directory.toString());String original=storage.store(new MockMultipartFile("image","original.png","image/png",png()));AssetDeviceMapper devices=mock(AssetDeviceMapper.class);AssetDeviceEntity device=activeDevice(5L);device.setImageAttachment1(original);when(devices.selectOne(any(Wrapper.class))).thenReturn(device);when(devices.updateById(any(AssetDeviceEntity.class))).thenReturn(1);
DeviceAssetSaveRequest request=validRequest("replace-image");request.setImageAttachment1(new MockMultipartFile("image","replacement.png","image/png",png()));String responseUrl=service(devices,mock(CompanyPersonMapper.class),mock(PhoneAssetMapper.class),storage).update(5L,request).imageAttachment1Url();
assertTrue(Files.exists(directory.resolve(original)));assertTrue(!responseUrl.endsWith(original));try(var files=Files.list(directory)){assertEquals(2,files.count());}
}
/** Plain purpose: verify explicit removal clears the database-facing URL but retains the original physical file for recovery. Related files: DeviceAssetService.java, DeviceAssetFileStorageService.java. Flow: PUT remove flag -> null reference -> mapper update; source file stays. */
@Test void updateRemovalClearsImageReferenceButRetainsFile(@TempDir Path directory) throws Exception {
DeviceAssetFileStorageService storage=new DeviceAssetFileStorageService(directory.toString());String original=storage.store(new MockMultipartFile("image","original.png","image/png",png()));AssetDeviceMapper devices=mock(AssetDeviceMapper.class);AssetDeviceEntity device=activeDevice(6L);device.setImageAttachment1(original);when(devices.selectOne(any(Wrapper.class))).thenReturn(device);when(devices.updateById(any(AssetDeviceEntity.class))).thenReturn(1);
DeviceAssetSaveRequest request=validRequest("remove-image");request.setRemoveImageAttachment1(true);assertEquals(null,service(devices,mock(CompanyPersonMapper.class),mock(PhoneAssetMapper.class),storage).update(6L,request).imageAttachment1Url());assertTrue(Files.exists(directory.resolve(original)));
}
/** Plain purpose: exercise the three account-reference variants through their actual mapper count boundary. Related files: DeviceAssetService.java, account mappers. Flow: selected mapper count=1 -> softDelete -> validation error. */
private void assertReferenceBlocksDelete(ReferenceType type) {
AssetDeviceMapper devices=mock(AssetDeviceMapper.class);PhoneAssetMapper phones=mock(PhoneAssetMapper.class);WecomAccountMapper wecom=mock(WecomAccountMapper.class);WechatAccountMapper wechat=mock(WechatAccountMapper.class);DouyinAccountMapper douyin=mock(DouyinAccountMapper.class);when(devices.selectOne(any(Wrapper.class))).thenReturn(activeDevice(4L));
if(type==ReferenceType.WECOM)when(wecom.selectCount(any(Wrapper.class))).thenReturn(1L);if(type==ReferenceType.WECHAT)when(wechat.selectCount(any(Wrapper.class))).thenReturn(1L);if(type==ReferenceType.DOUYIN)when(douyin.selectCount(any(Wrapper.class))).thenReturn(1L);
assertThrows(DeviceAssetValidationException.class,()->new DeviceAssetService(devices,mock(CompanyPersonMapper.class),phones,wecom,wechat,douyin,new DeviceAssetFileStorageService(System.getProperty("java.io.tmpdir")+"/device-test-images")).softDelete(4L));
}
/** Plain purpose: name the account-mapper variant used by the shared reference-protection test. Related files: DeviceAssetService.java, account mappers. Flow: test case -> one mapper count -> delete protection. */
private enum ReferenceType { WECOM, WECHAT, DOUYIN }
private DeviceAssetService service(AssetDeviceMapper devices,CompanyPersonMapper people){return new DeviceAssetService(devices,people,mock(PhoneAssetMapper.class),mock(WecomAccountMapper.class),mock(WechatAccountMapper.class),mock(DouyinAccountMapper.class),new DeviceAssetFileStorageService(System.getProperty("java.io.tmpdir")+"/device-test-images"));}
/** 代码作用（白话）：构造可替换手机引用和图片目录的设备服务，供删除与失败清理场景使用。关联文件：DeviceAssetService.java、PhoneAssetMapper.java。关联逻辑（调用链/数据流）：测试用例 -> 特定 Mock Mapper/文件服务 -> Service 业务规则。*/
private DeviceAssetService service(AssetDeviceMapper devices,CompanyPersonMapper people,PhoneAssetMapper phones,DeviceAssetFileStorageService storage){return new DeviceAssetService(devices,people,phones,mock(WecomAccountMapper.class),mock(WechatAccountMapper.class),mock(DouyinAccountMapper.class),storage);}
/** 代码作用（白话）：生成符合下拉选项约束的最小新增表单。关联文件：DeviceAssetSaveRequest.java、DeviceAssetService.java。关联逻辑（调用链/数据流）：测试输入 -> 服务端状态校验 -> 创建或校验异常。*/
private DeviceAssetSaveRequest validRequest(String name){DeviceAssetSaveRequest request=new DeviceAssetSaveRequest();request.setDeviceName(name);request.setUserUsageStatus("使用中");request.setAssetRelationStatus("未关联");return request;}
/** 代码作用（白话）：生成一条仍有效的设备记录，供删除前读取流程使用。关联文件：AssetDeviceEntity.java、DeviceAssetService.java。关联逻辑（调用链/数据流）：Mapper.selectOne -> requireActiveDevice -> 删除关联检查。*/
private AssetDeviceEntity activeDevice(Long id){AssetDeviceEntity device=new AssetDeviceEntity();device.setId(id);device.setDeviceName("删除测试设备");device.setUserUsageStatus("使用中");device.setAssetRelationStatus("未关联");device.setDeleteTime(0L);return device;}
/** 代码作用（白话）：生成 ImageIO 可解码的 PNG 字节，确保失败清理测试验证的是业务流程。关联文件：DeviceAssetFileStorageService.java。关联逻辑（调用链/数据流）：BufferedImage -> MultipartFile -> 文件保存 -> 异常清理。*/
private byte[] png(){try{ByteArrayOutputStream output=new ByteArrayOutputStream();ImageIO.write(new BufferedImage(1,1,BufferedImage.TYPE_INT_ARGB),"png",output);return output.toByteArray();}catch(Exception exception){throw new IllegalStateException(exception);}}
}
backend/src/test/java/com/xyw/console/auth/SystemUserAdminServiceTest.java 0 → 100644
package com.xyw.console.auth;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.mockito.ArgumentMatchers.any;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.verifyNoInteractions;
import static org.mockito.Mockito.when;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.xyw.console.asset.entity.SystemUserEntity;
import com.xyw.console.asset.mapper.SystemUserMapper;
import com.xyw.console.auth.dto.SystemUserCreateRequest;
import com.xyw.console.auth.dto.SystemUserUpdateRequest;
import java.util.Map;
import org.junit.jupiter.api.AfterEach;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.crypto.password.PasswordEncoder;
/** File purpose (plain language): verifies that account authorization changes revoke old login versions while existing role boundaries remain enforced. */
class SystemUserAdminServiceTest {
private SystemUserMapper users;
private SystemUserAdminService service;
/** Plain purpose: build a developer-authenticated service fixture before each account-security test. Related files: SystemUserAdminService.java, AuthTokenFilter.java. Flow: developer principal -> SecurityContext -> service role boundary -> mocked user update. */
@BeforeEach void setUp() {
users = mock(SystemUserMapper.class);
service = new SystemUserAdminService(users, new PagePermissionService(new ObjectMapper()), mock(PasswordEncoder.class));
authenticate("DEVELOPER");
}
/** Plain purpose: remove the test principal so it cannot influence the next security test. Related files: AuthTokenFilter.java, SystemUserAdminService.java. Flow: test completion -> SecurityContext clear -> isolated next request. */
@AfterEach void tearDown() { SecurityContextHolder.clearContext(); }
/** Plain purpose: prove that promotion changes the account version used to reject its old token. Related files: SystemUserAdminService.java, AuthTokenFilter.java. Flow: role edit -> authVersion increment -> next old-token request rejected. */
@Test void promotionIncrementsAuthVersion() {
SystemUserEntity user = activeUser("FINANCE", 4, Map.of("phone-assets", "READ"));
when(users.selectOne(any())).thenReturn(user);
service.updateUser(9L, new SystemUserUpdateRequest("SUPER_ADMIN", "ACTIVE", Map.of("phone-assets", "READ")));
assertEquals(5, user.getAuthVersion());
verify(users).updateById(user);
}
/** Plain purpose: prove that disabling an account revokes its prior session even when the role stays the same. Related files: SystemUserAdminService.java, AuthTokenFilter.java. Flow: status edit -> authVersion increment -> disabled account cannot keep old session. */
@Test void statusChangeIncrementsAuthVersion() {
SystemUserEntity user = activeUser("FINANCE", 4, Map.of());
when(users.selectOne(any())).thenReturn(user);
service.updateUser(9L, new SystemUserUpdateRequest("FINANCE", "DISABLED", Map.of()));
assertEquals(5, user.getAuthVersion());
}
/** Plain purpose: prove that changed page permissions invalidate a token that still carries the previous authorization state. Related files: PagePermissionService.java, SystemUserAdminService.java. Flow: permission edit -> normalized comparison -> authVersion increment. */
@Test void permissionChangeIncrementsAuthVersion() {
SystemUserEntity user = activeUser("FINANCE", 4, Map.of("phone-assets", "READ"));
when(users.selectOne(any())).thenReturn(user);
service.updateUser(9L, new SystemUserUpdateRequest("FINANCE", "ACTIVE", Map.of("phone-assets", "EDIT")));
assertEquals(5, user.getAuthVersion());
}
/** Plain purpose: prove that saving unchanged authorization facts does not unnecessarily sign the account out. Related files: SystemUserAdminService.java, PagePermissionService.java. Flow: no-op edit -> equal normalized values -> retained authVersion. */
@Test void noOpUpdateRetainsAuthVersion() {
SystemUserEntity user = activeUser("FINANCE", 4, Map.of("phone-assets", "READ"));
when(users.selectOne(any())).thenReturn(user);
service.updateUser(9L, new SystemUserUpdateRequest("FINANCE", "ACTIVE", Map.of("phone-assets", "READ")));
assertEquals(4, user.getAuthVersion());
}
/** Plain purpose: prove that a fresh developer principal can still create an allowed non-developer account. Related files: SystemUserAdminService.java, SystemUserCreateRequest.java. Flow: developer principal -> create boundary -> mapper insert -> safe response. */
@Test void developerCanCreateSuperAdministrator() {
when(users.selectCount(any())).thenReturn(0L);
PasswordEncoder encoder = mock(PasswordEncoder.class);
when(encoder.encode(any())).thenReturn("hash");
service = new SystemUserAdminService(users, new PagePermissionService(new ObjectMapper()), encoder);
service.createUser(new SystemUserCreateRequest("admin_two", "SUPER_ADMIN", "strong-password-123", Map.of()));
verify(users).insert(any(SystemUserEntity.class));
}
/** Plain purpose: prove that an ordinary role cannot manage accounts even if it calls the service directly. Related files: SystemUserAdminService.java, SystemUserAdminController.java. Flow: finance principal -> role boundary -> access denial -> no mapper write. */
@Test void nonAdministratorCannotCreateAccounts() {
authenticate("FINANCE");
assertThrows(AccessDeniedException.class, () -> service.createUser(new SystemUserCreateRequest("admin_two", "SUPER_ADMIN", "strong-password-123", Map.of())));
verifyNoInteractions(users);
}
/** Plain purpose: install a minimal signed-token equivalent principal for one service test. Related files: AuthPrincipal.java, AuthTokenFilter.java. Flow: role code -> SecurityContext principal -> SystemUserAdminService authorization branch. */
private void authenticate(String roleCode) { SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(new AuthPrincipal(1L, "tester", roleCode, 1), null)); }
/** Plain purpose: create a persisted account shape with a validated permission map and active credentials. Related files: SystemUserEntity.java, PagePermissionService.java. Flow: test fixture -> mapper select result -> authorization-state comparison. */
private SystemUserEntity activeUser(String roleCode, int authVersion, Map<String, String> permissions) {
SystemUserEntity user = new SystemUserEntity();
user.setId(9L); user.setUsername("managed_user"); user.setRoleCode(roleCode); user.setStatus("ACTIVE"); user.setPasswordHash("hash"); user.setDeleteTime(0L); user.setAuthVersion(authVersion);
user.setPagePermissions(new PagePermissionService(new ObjectMapper()).validatePermissions(permissions));
return user;
}
}
backend/src/test/java/com/xyw/console/config/SecurityConfigTest.java 0 → 100644
package com.xyw.console.config;
import static org.junit.jupiter.api.Assertions.assertEquals;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.junit.jupiter.api.Test;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.web.csrf.DefaultCsrfToken;
import org.springframework.security.web.csrf.InvalidCsrfTokenException;
/** File purpose (plain language): verifies that security rejections provide safe browser actions without leaking account or token details. */
class SecurityConfigTest {
/** Plain purpose: verify a missing or invalid CSRF token receives refresh-and-retry guidance rather than an indistinguishable role error. Related files: SecurityConfig.java, auth-api-client.js. Flow: CSRF filter denial -> safe message -> browser refresh/retry. */
@Test void csrfFailureUsesRefreshAndRetryMessage() {
SecurityConfig config = new SecurityConfig();
assertEquals("安全校验已失效，请刷新页面后重试", config.accessDeniedMessage(new InvalidCsrfTokenException(new DefaultCsrfToken("X-XSRF-TOKEN", "_csrf", "expected"), "actual")));
}
/** Plain purpose: verify a valid session without an allowed role keeps the generic denial message. Related files: SecurityConfig.java, PagePermissionService.java. Flow: controller role check -> access denial -> safe 403 response. */
@Test void authorizationFailureKeepsGenericMessage() {
SecurityConfig config = new SecurityConfig();
assertEquals("没有权限", config.accessDeniedMessage(new AccessDeniedException("internal detail")));
}
}
backend/src/test/java/com/xyw/console/config/WebConfigTest.java 0 → 100644
package com.xyw.console.config;
import static org.junit.jupiter.api.Assertions.assertTrue;
import org.junit.jupiter.api.Test;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.servlet.config.annotation.CorsRegistry;
/** File purpose (plain language): verifies local development frontends that use an approved port can call the backend API. */
class WebConfigTest {
/** Plain purpose: ensure the separate 5175 integration frontend is allowed to send login requests to the local backend. Related files: WebConfig.java, frontend/vite.config.js. Flow: browser origin -> CORS allowlist -> /api/auth/login -> authentication controller. */
@Test void allowsIntegrationFrontendOnPort5175() {
InspectableCorsRegistry registry = new InspectableCorsRegistry();
new WebConfig().addCorsMappings(registry);
CorsConfiguration configuration = registry.configurations().get("/api/**");
assertTrue(configuration.getAllowedOrigins().contains("http://127.0.0.1:5175"));
}
/** Plain purpose: expose Spring's protected test-only CORS mapping view without changing production configuration. Related files: WebConfig.java. Flow: WebConfig registration -> registry map -> assertion. */
private static final class InspectableCorsRegistry extends CorsRegistry {
/** Plain purpose: return the mappings registered by WebConfig for a direct allowlist assertion. Related files: WebConfigTest.java. Flow: addCorsMappings -> configurations -> expected local origin. */
java.util.Map<String, CorsConfiguration> configurations() { return getCorsConfigurations(); }
}
}
frontend/index.html
......@@ -4,9 +4,18 @@
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>学有为资产管理台</title>
<style>
html, body, #app { min-height: 100%; margin: 0; }
.app-boot-splash { display: grid; min-height: 100vh; place-items: center; overflow: hidden; background: radial-gradient(circle at 20% 15%, rgba(92, 118, 173, .2), transparent 32%), radial-gradient(circle at 82% 78%, rgba(98, 77, 148, .18), transparent 28%), #0d1524; }
.app-boot-splash__mark { width: 72px; height: 72px; border: 1px solid rgba(226, 232, 240, .16); border-radius: 50%; box-shadow: 0 0 0 12px rgba(226, 232, 240, .025), 0 0 72px rgba(130, 150, 210, .16); }
</style>
</head>
<body>
<div id="app"></div>
<div id="app">
<main class="app-boot-splash" aria-label="正在打开应用">
<div class="app-boot-splash__mark" aria-hidden="true"></div>
</main>
</div>
<script type="module" src="/src/main.js"></script>
</body>
</html>
frontend/src/App.js
/** 代码作用（白话）：提供前端外壳和中文导航。关联文件：router/index.js、WecomAccountView.js、DeviceAssetView.js。关联逻辑（调用链/数据流）：导航点击 -> RouterLink -> RouterView 渲染目标页面。 */
export default { template: `<div class="app-shell"><aside class="sidebar"><p class="eyebrow">学有为资产</p><h1>学有为资产后台</h1><nav aria-label="主导航"><RouterLink to="/overview">总览</RouterLink><RouterLink to="/domain">域名资料</RouterLink><RouterLink to="/reference/wecom">企微资料</RouterLink><RouterLink to="/phone-assets">手机号资产</RouterLink><RouterLink to="/device-assets">设备资产管理</RouterLink><RouterLink to="/alerts">提醒中心</RouterLink></nav></aside><main class="content"><RouterView /></main></div>` };
import { authState, signOut } from './modules/auth/auth-store.js';
/** 文件用途（白话）：根据认证状态决定渲染登录页、网络重试页或已登录后台外壳。 */
export default {
/** 代码作用（白话）：向页面模板提供认证状态、退出动作、网络重试和菜单权限判断。关联文件：auth-store.js、router/index.js。关联逻辑（调用链/数据流）：路由守卫恢复身份 -> authState -> 此组件决定网络提示、登录页或后台外壳。 */
setup() {
/** 代码作用（白话）：退出当前会话并无论后端 Cookie 清理是否报错都跳回登录路由。关联文件：auth-store.js、AuthController.java。关联逻辑（调用链/数据流）：退出按钮 -> POST logout -> 清空前端身份 -> finally 跳转 /login。 */
async function logout() {
try {
await signOut();
} finally {
window.location.hash = '#/login';
}
}
/** 代码作用（白话）：判断当前用户能否看见某个受控菜单，编辑权限自然包含只读菜单。关联文件：router/index.js、PagePermissionService.java。关联逻辑（调用链/数据流）：/api/auth/me 权限 -> 侧栏菜单 -> 路由守卫。 */
function canVisit(page) {
return authState.user?.pagePermissions?.[page] && authState.user.pagePermissions[page] !== 'NONE';
}
/** 代码作用（白话）：判断当前用户是否可以使用设置下的账号与权限功能。关联文件：UserPermissionView.js、SystemUserAdminService.java。关联逻辑（调用链/数据流）：角色码 -> 菜单展示 -> 后端二次授权。 */
function isAdministrator() {
return ['DEVELOPER', 'SUPER_ADMIN'].includes(authState.user?.roleCode);
}
/** 代码作用（白话）：在会话检查遇到网络问题时重新加载当前地址，让路由守卫重新请求当前用户而不先跳登录页。关联文件：auth-store.js、router/index.js。关联逻辑（调用链/数据流）：网络错误提示按钮 -> retryConnection() -> 浏览器刷新当前 Hash 地址 -> bootstrapAuth() -> 后台、登录页或再次提示。 */
function retryConnection() {
window.location.reload();
}
return { authState, logout, canVisit, isAdministrator, retryConnection };
},
template: `<main v-if="authState.connectionError" class="auth-network-error" role="alert"><section class="auth-network-error__panel"><h1>网络连接异常</h1><p>暂时无法确认登录状态，请检查网络后重试。</p><button type="button" @click="retryConnection">重新连接</button></section></main><main v-else-if="!authState.ready" class="auth-loading" role="status" aria-live="polite">正在验证登录状态…</main><RouterView v-else-if="$route.path === '/login'" /><div v-else class="app-shell"><aside class="sidebar"><p class="eyebrow">学有为资产</p><h1>学有为资产后台</h1><nav aria-label="主导航"><RouterLink v-if="canVisit('overview')" to="/overview">总览</RouterLink><RouterLink v-if="canVisit('domain')" to="/domain">域名资料</RouterLink><RouterLink v-if="canVisit('reference-wecom')" to="/reference/wecom">企微资料</RouterLink><RouterLink v-if="canVisit('phone-assets')" to="/phone-assets">手机号资产</RouterLink><RouterLink v-if="isAdministrator()" to="/device-assets">设备资产管理</RouterLink><RouterLink v-if="canVisit('alerts')" to="/alerts">提醒中心</RouterLink><RouterLink v-if="isAdministrator()" class="settings-link" to="/settings/users-permissions"><span aria-hidden="true">⚙</span> 账号与权限</RouterLink></nav><button class="logout-button" @click="logout">退出登录</button></aside><main class="content"><RouterView /></main></div>`
};
frontend/src/main.js
......@@ -4,10 +4,13 @@ import 'element-plus/dist/index.css';
import App from './App.js';
import router from './router/index.js';
import './styles/app.css';
import './styles/auth-state.css';
/**
* 代码作用（白话）：创建重构后的唯一 Vue 应用入口，把路由和界面组件挂到页面根节点。
* 关联文件：frontend/index.html、frontend/src/App.js、frontend/src/router/index.js。
* 关联逻辑（调用链/数据流）：index.html -> main.js -> createApp() -> router -> 静态参考页或重构占位页。
*/
createApp(App).use(router).use(ElementPlus).mount('#app');
const application = createApp(App).use(router).use(ElementPlus);
await router.isReady();
application.mount('#app');
frontend/src/modules/auth/LoginView.js 0 → 100644
import { reactive, ref } from 'vue/dist/vue.esm-bundler.js';
import { ElMessage } from 'element-plus';
import { signIn } from './auth-store.js';
import blackHoleImage from '../../../img/black_hole.png';
const REMEMBERED_USERNAME_STORAGE_KEY = 'xyw-asset-console.remembered-username';
/** 代码作用（白话）：提供唯一的账号密码登录界面，并只在 Jeddy 成功登录的当次显示专属欢迎提示。关联文件：auth-store.js、AuthController.java、app.css。关联逻辑（调用链/数据流）：登录表单 -> Auth API -> Cookie/用户状态 -> 路由跳转。 */
export default {
/** 代码作用（白话）：准备登录表单状态，并从浏览器中读取此前选择记住的账号。关联文件：app.css、auth-store.js。关联逻辑（调用链/数据流）：浏览器本地存储 -> 表单账号 -> 用户提交登录。 */
setup() {
/** 代码作用（白话）：安全读取浏览器本地保存的账号；浏览器禁用本地存储时不影响登录。关联文件：LoginView.js。关联逻辑（调用链/数据流）：localStorage -> form.username -> 登录表单。 */
function getRememberedUsername() {
try {
return window.localStorage.getItem(REMEMBERED_USERNAME_STORAGE_KEY) || '';
} catch (_) {
return '';
}
}
const form = reactive({ username: getRememberedUsername(), password: '' });
const rememberUsername = ref(Boolean(form.username));
const submitting = ref(false);
/** 代码作用（白话）：按复选框状态仅保存或删除账号名，绝不保存密码和 Token。关联文件：LoginView.js。关联逻辑（调用链/数据流）：复选框/登录成功 -> localStorage -> 下次打开表单自动回填。 */
function syncRememberedUsername() {
try {
if (rememberUsername.value && form.username.trim()) {
window.localStorage.setItem(REMEMBERED_USERNAME_STORAGE_KEY, form.username.trim());
return;
}
window.localStorage.removeItem(REMEMBERED_USERNAME_STORAGE_KEY);
} catch (_) {
// 浏览器禁用本地存储时，登录主流程仍可继续。
}
}
/** 代码作用（白话）：提交现有账号密码数据、按需记住账号，并在完成后清除页面内存中的密码。关联文件：auth-store.js、router/index.js。关联逻辑（调用链/数据流）：表单 submit -> signIn -> 账号本地存储/Jeddy 欢迎提示或通用错误 -> 资产总览。 */
async function submit() {
submitting.value = true;
try {
const user = await signIn(form);
syncRememberedUsername();
form.password = '';
if (user.username === 'Jeddy' && user.roleCode === 'DEVELOPER') ElMessage.success('🎉 欢迎系统开发者-BOSS：Jeddy 上线');
window.location.hash = '#/overview';
} catch (_) {
ElMessage.error('账号或密码错误，请重试');
} finally {
submitting.value = false;
}
}
return { blackHoleImage, form, rememberUsername, submitting, submit, syncRememberedUsername };
},
template: `
<main class="login-page" :style="{ '--login-background-image': 'url(' + blackHoleImage + ')' }">
<div class="login-page__atmosphere" aria-hidden="true"></div>
<section class="login-panel" aria-labelledby="login-title">
<header class="login-brand">
<div class="login-brand__mark" aria-hidden="true"><span></span><span></span><span></span></div>
<div>
<h1 id="login-title">学有为资产管理系统</h1>
</div>
</header>
<el-form class="login-form" @submit.prevent="submit">
<el-form-item class="login-form__item">
<el-input v-model="form.username" class="login-form__input" placeholder="请输入账号" autocomplete="username" aria-label="账号" />
</el-form-item>
<el-form-item class="login-form__item">
<div class="login-password-field">
<el-input v-model="form.password" class="login-form__input" placeholder="请输入密码" type="password" show-password autocomplete="current-password" aria-label="密码" @keyup.enter="submit" />
</div>
</el-form-item>
<el-checkbox v-model="rememberUsername" class="login-form__remember" @change="syncRememberedUsername">记住我的账号</el-checkbox>
<el-button type="primary" native-type="submit" :loading="submitting" class="login-submit">{{ submitting ? '正在登录' : '登录' }}</el-button>
</el-form>
</section>
</main>
`
};
frontend/src/modules/auth/auth-api-client.js 0 → 100644
/** 代码作用（白话）：读取同站 Cookie 中的 CSRF 值，供会改变数据的请求放入校验头；关联文件：AuthController.java、SecurityConfig.java。关联逻辑（调用链/数据流）：csrf 接口写 Cookie -> 此方法读取 Cookie -> POST/PUT/DELETE 请求头。 */
function csrfHeader() { const match = document.cookie.match(/(?:^|; )XSRF-TOKEN=([^;]+)/); return match ? { 'X-XSRF-TOKEN': decodeURIComponent(match[1]) } : {}; }
/** Plain purpose: detect multipart form data so the browser can create its required boundary header. Related files: device-api-client.js, DeviceAssetController.java. Flow: device form -> FormData -> shared request -> browser multipart header -> controller binding. */
function isFormDataBody(body) { return typeof FormData !== 'undefined' && body instanceof FormData; }
/** 代码作用（白话）：把请求失败原因和 HTTP 状态一起交给调用方，便于首次会话检查区分未登录和网络异常。关联文件：auth-store.js、router/index.js。关联逻辑（调用链/数据流）：fetch 失败响应 -> createRequestError() -> bootstrapAuth() -> 登录重定向或网络提示。 */
function createRequestError(message, status) { const error = new Error(message); error.status = status; return error; }
/** Plain purpose: notify the application that the server rejected the current session and it must return to login. Related files: auth-store.js, router/index.js. Flow: protected API 401 -> browser event -> cleared auth state -> login route. */
function notifyExpiredSession() { if (typeof window !== 'undefined') window.dispatchEvent(new Event('xyw-auth-expired')); }
/** 代码作用（白话）：首次写操作前请求 CSRF Cookie，登录接口已由后端单独豁免。关联文件：AuthController.java、SecurityConfig.java。关联逻辑（调用链/数据流）：前端写请求 -> /api/auth/csrf -> XSRF-TOKEN Cookie -> 安全层校验。 */
export async function csrfHeadersFor(path, method) { if (method === 'GET' || path === '/api/auth/login') return csrfHeader(); const existing = csrfHeader(); if (Object.keys(existing).length) return existing; const response = await fetch('/api/auth/csrf', { credentials: 'include' }); if (!response.ok) throw new Error('安全校验初始化失败'); const refreshed = csrfHeader(); if (!Object.keys(refreshed).length) throw new Error('安全校验初始化失败'); return refreshed; }
/** 代码作用（白话）：统一发送认证请求并让浏览器自动携带 HttpOnly 会话 Cookie。关联文件：AuthController.java、auth-store.js。关联逻辑（调用链/数据流）：登录页/路由守卫 -> fetch -> AuthController -> Cookie/当前用户。 */
export async function request(path, options = {}) { const { headers: suppliedHeaders = {}, body, ...requestOptions } = options; const method = (requestOptions.method || 'GET').toUpperCase(); const csrf = await csrfHeadersFor(path, method); const headers = { ...csrf, ...suppliedHeaders }; if (!isFormDataBody(body) && !headers['Content-Type']) headers['Content-Type'] = 'application/json'; const response = await fetch(path, { ...requestOptions, body, credentials: 'include', headers }); const payload = await response.json().catch(() => ({})); if (response.status === 401 && path !== '/api/auth/login' && path !== '/api/auth/me') notifyExpiredSession(); if (!response.ok || payload.code !== 200) throw createRequestError(payload.message || '请求失败', response.ok ? payload.code : response.status); return payload.data; }
/** 代码作用（白话）：提交账号密码以建立 HttpOnly 会话。关联文件：LoginView.js、AuthController.java。关联逻辑（调用链/数据流）：登录表单 -> POST login -> Set-Cookie -> 当前用户。 */
export function login(credentials) { return request('/api/auth/login', { method: 'POST', body: JSON.stringify(credentials) }); }
/** 代码作用（白话）：恢复浏览器已有会话并获取菜单权限。关联文件：auth-store.js、AuthController.java。关联逻辑（调用链/数据流）：应用启动 -> GET me -> 路由/菜单状态。 */
export function getCurrentUser() { return request('/api/auth/me'); }
/** 代码作用（白话）：请求后端清除当前浏览器的登录会话。关联文件：App.js、AuthController.java。关联逻辑（调用链/数据流）：登出按钮 -> POST logout -> Cookie 过期 -> 登录页。 */
export function logout() { return request('/api/auth/logout', { method: 'POST' }); }
frontend/src/modules/auth/auth-store.js 0 → 100644
import { reactive } from 'vue/dist/vue.esm-bundler.js';
import { getCurrentUser, login, logout } from './auth-api-client.js';
/** 代码作用（白话）：保存内存中的安全用户资料，页面刷新后只从后端 Cookie 恢复而不写入浏览器存储。关联文件：router/index.js、App.js。关联逻辑（调用链/数据流）：Auth API -> authState -> 路由守卫/菜单。 */
export const authState = reactive({ ready: false, user: null, connectionError: false });
/** Plain purpose: remove a browser identity whose server-side session is no longer valid and return to the public login route. Related files: auth-api-client.js, router/index.js. Flow: protected API 401 -> browser event -> authState clear -> login route. */
export function expireSession() { authState.user = null; authState.connectionError = false; authState.ready = true; if (typeof window !== 'undefined') window.location.hash = '#/login'; }
/** Plain purpose: receive a shared API-session-expired event without making auth-api-client and auth-store import each other. Related files: auth-api-client.js, auth-store.js. Flow: request helper -> browser event -> expireSession -> login route. */
if (typeof window !== 'undefined') window.addEventListener('xyw-auth-expired', expireSession);
/** 代码作用（白话）：向后端恢复一次当前会话，并区分未登录和网络无法连接两种结果。关联文件：auth-api-client.js、router/index.js、App.js。关联逻辑（调用链/数据流）：路由守卫 -> /api/auth/me -> 401 交给路由跳登录，网络错误写入 connectionError -> App 显示重试页。 */
export async function bootstrapAuth() { const timeoutMs = typeof window !== 'undefined' && window.__XYW_AUTH_CHECK_TIMEOUT_MS ? window.__XYW_AUTH_CHECK_TIMEOUT_MS : 8000; let timeoutId; authState.connectionError = false; try { authState.user = await Promise.race([getCurrentUser(), new Promise((_, reject) => { timeoutId = window.setTimeout(() => reject(new Error('SESSION_CHECK_TIMEOUT')), timeoutMs); })]); } catch (error) { authState.user = null; authState.connectionError = error.status !== 401; } finally { if (timeoutId) window.clearTimeout(timeoutId); authState.ready = true; } return authState.user; }
/** 代码作用（白话）：完成登录并保存安全用户资料供当前页面使用。关联文件：LoginView.js。关联逻辑（调用链/数据流）：表单 -> login API -> authState -> 跳转。 */
export async function signIn(credentials) { authState.connectionError = false; authState.user = await login(credentials); authState.ready = true; return authState.user; }
/** 代码作用（白话）：尝试登出并无论结果都清空本地身份。关联文件：App.js。关联逻辑（调用链/数据流）：登出 -> API -> authState 清空 -> 登录路由。 */
export async function signOut() { try { await logout(); } finally { authState.user = null; authState.connectionError = false; authState.ready = true; } }
frontend/src/modules/device/DeviceAssetView.js
......@@ -3,52 +3,56 @@ import { ElMessage, ElMessageBox } from 'element-plus';
import { createDeviceAsset, deleteDeviceAsset, listDeviceAssets, searchDeviceCompanyPersons, updateDeviceAsset } from './device-api-client.js';
import './device-asset.css';
/** 文件用途（白话）：渲染设备资产管理列表、表单、图片原图缩略预览和受保护删除操作。 */
/** File purpose: render device asset list, CRUD dialog, image thumbnail/original preview, and guarded deletion. */
export default {
/** 代码作用（白话）：创建页面响应式数据与业务动作。关联文件：device-api-client.js、DeviceAssetController.java。关联逻辑（调用链/数据流）：路由进入 -> setup -> API 请求/表单状态 -> Element Plus 页面。 */
/** Plain purpose: create page state and all UI actions. Related files: device-api-client.js, DeviceAssetController.java. Flow: route -> setup -> API/form state -> Element Plus view. */
setup() {
const loading=ref(false), saving=ref(false), dialogVisible=ref(false), editingId=ref(null), records=ref([]), total=ref(0), personOptions=ref([]), imageViewerVisible=ref(false), imageViewerUrl=ref('');
const usageStatuses=['\u4f7f\u7528\u4e2d','\u95f2\u7f6e','\u7ef4\u4fee\u4e2d','\u505c\u7528'];
const relationStatuses=['\u5df2\u5173\u8054','\u672a\u5173\u8054','\u5f85\u786e\u8ba4'];
const loading=ref(false),saving=ref(false),dialogVisible=ref(false),editingId=ref(null),records=ref([]),total=ref(0),personOptions=ref([]),imageViewerVisible=ref(false),imageViewerUrl=ref('');
const filters=reactive({page:1,size:20,deviceName:'',userPersonId:null,userUsageStatus:'',assetRelationStatus:''});
const form=reactive({deviceName:'',userPersonId:null,userUsageStatus:'使用中',assetRelationStatus:'待确认',imageAttachment1:null,imageAttachment2:null,removeImageAttachment1:false,removeImageAttachment2:false,imageAttachment1Url:'',imageAttachment2Url:''});
const form=reactive(emptyForm());
let searchTimer=null;
/** 代码作用（白话）：读取当前筛选条件下的设备分页数据。关联文件：device-api-client.js、DeviceAssetService.java。关联逻辑（调用链/数据流）：页面加载/筛选 -> GET -> records/total -> 表格。 */
/** Plain purpose: fetch the currently filtered device page. Related files: device-api-client.js, DeviceAssetService.java. Flow: page/filter event -> GET -> records/total -> table. */
async function loadPage(){loading.value=true;try{const result=await listDeviceAssets(filters);records.value=result.records;total.value=result.total;}catch(error){ElMessage.error(error.message);}finally{loading.value=false;}}
/** 代码作用（白话）：恢复新增设备的默认表单。关联文件：DeviceAssetSaveRequest.java、DeviceAssetView.js。关联逻辑（调用链/数据流）：新增/保存完成 -> resetForm -> 空表单。 */
function resetForm(){clearPreview('imageAttachment1');clearPreview('imageAttachment2');Object.assign(form,{deviceName:'',userPersonId:null,userUsageStatus:'使用中',assetRelationStatus:'待确认',imageAttachment1:null,imageAttachment2:null,removeImageAttachment1:false,removeImageAttachment2:false,imageAttachment1Url:'',imageAttachment2Url:''});personOptions.value=[];}
/** 代码作用（白话）：打开空白新增弹窗。关联文件：DeviceAssetView.js、device-api-client.js。关联逻辑（调用链/数据流）：新增按钮 -> resetForm -> dialogVisible=true。 */
/** Plain purpose: return the create-form defaults that obey both dropdown rules. Related files: DeviceAssetSaveRequest.java, DeviceAssetView.js. Flow: create/reset -> defaults -> multipart POST. */
function emptyForm(){return {deviceName:'',userPersonId:null,userUsageStatus:'\u4f7f\u7528\u4e2d',assetRelationStatus:'\u5f85\u786e\u8ba4',imageAttachment1:null,imageAttachment2:null,removeImageAttachment1:false,removeImageAttachment2:false,imageAttachment1Url:'',imageAttachment2Url:''};}
/** Plain purpose: clear temporary preview URLs and restore a new-device form. Related files: DeviceAssetView.js, DeviceAssetFileStorageService.java. Flow: open create/save -> reset -> safe empty dialog. */
function resetForm(){clearPreview('imageAttachment1');clearPreview('imageAttachment2');Object.assign(form,emptyForm());personOptions.value=[];}
/** Plain purpose: show a fresh create dialog. Related files: DeviceAssetView.js, device-api-client.js. Flow: add button -> resetForm -> dialog. */
function openCreate(){editingId.value=null;resetForm();dialogVisible.value=true;}
/** 代码作用（白话）：把列表设备回填到编辑弹窗。关联文件：DeviceAssetResponse.java、DeviceAssetView.js。关联逻辑（调用链/数据流）：编辑按钮 -> row -> form -> PUT 保存。 */
function openEdit(row){editingId.value=row.id;clearPreview('imageAttachment1');clearPreview('imageAttachment2');Object.assign(form,{deviceName:row.deviceName,userPersonId:row.userPersonId,userUsageStatus:row.userUsageStatus,assetRelationStatus:row.assetRelationStatus,imageAttachment1:null,imageAttachment2:null,removeImageAttachment1:false,removeImageAttachment2:false,imageAttachment1Url:row.imageAttachment1Url||'',imageAttachment2Url:row.imageAttachment2Url||''});personOptions.value=row.userPersonId?[{id:row.userPersonId,personName:row.userPersonName||`人员 ${row.userPersonId}`}]:[];dialogVisible.value=true;}
/** 代码作用（白话）：把表单转换成 multipart 数据并提交。关联文件：device-api-client.js、DeviceAssetController.java。关联逻辑（调用链/数据流）：保存按钮 -> FormData -> POST/PUT -> 成功刷新表格。 */
async function submitForm(){if(!form.deviceName.trim()){ElMessage.error('请输入设备名称');return;}saving.value=true;try{const payload=new FormData();['deviceName','userPersonId','userUsageStatus','assetRelationStatus','removeImageAttachment1','removeImageAttachment2'].forEach(key=>{const value=form[key];if(value!==null&&value!==undefined&&value!=='')payload.append(key,value);});if(form.imageAttachment1)payload.append('imageAttachment1',form.imageAttachment1);if(form.imageAttachment2)payload.append('imageAttachment2',form.imageAttachment2);if(editingId.value===null)await createDeviceAsset(payload);else await updateDeviceAsset(editingId.value,payload);ElMessage.success(editingId.value===null?'新增成功':'编辑成功');dialogVisible.value=false;filters.page=1;await loadPage();}catch(error){ElMessage.error(error.message);}finally{saving.value=false;}}
/** 代码作用（白话）：确认后请求软删除，并显示后端返回的关联保护原因。关联文件：device-api-client.js、DeviceAssetService.java。关联逻辑（调用链/数据流）：删除按钮 -> 确认框 -> DELETE -> 列表刷新或错误提示。 */
async function confirmDelete(row){try{await ElMessageBox.confirm(`确认删除设备“${row.deviceName}”吗？`,'删除确认',{type:'warning'});await deleteDeviceAsset(row.id);ElMessage.success('删除成功');if(records.value.length===1&&filters.page>1)filters.page-=1;await loadPage();}catch(error){if(error!=='cancel'&&error!=='close')ElMessage.error(error.message);}}
/** 代码作用（白话）：根据关键字远程加载可选择的公司人员。关联文件：device-api-client.js、DeviceAssetController.java。关联逻辑（调用链/数据流）：人员选择器输入 -> lookup API -> personOptions -> 下拉项。 */
/** Plain purpose: populate the dialog from one table row for editing. Related files: DeviceAssetResponse.java, DeviceAssetView.js. Flow: edit button -> row -> form -> PUT. */
function openEdit(row){editingId.value=row.id;clearPreview('imageAttachment1');clearPreview('imageAttachment2');Object.assign(form,{...emptyForm(),deviceName:row.deviceName,userPersonId:row.userPersonId,userUsageStatus:row.userUsageStatus,assetRelationStatus:row.assetRelationStatus,imageAttachment1Url:row.imageAttachment1Url||'',imageAttachment2Url:row.imageAttachment2Url||''});personOptions.value=row.userPersonId?[{id:row.userPersonId,personName:row.userPersonName||`${'\u4eba\u5458'} ${row.userPersonId}`}]:[];dialogVisible.value=true;}
/** Plain purpose: serialize form values and optional files to a multipart create/update request. Related files: device-api-client.js, DeviceAssetController.java. Flow: save -> FormData -> POST/PUT -> refresh table. */
async function submitForm(){if(!form.deviceName.trim()){ElMessage.error('\u8bf7\u8f93\u5165\u8bbe\u5907\u540d\u79f0');return;}saving.value=true;try{const payload=new FormData();['deviceName','userPersonId','userUsageStatus','assetRelationStatus','removeImageAttachment1','removeImageAttachment2'].forEach(key=>{const value=form[key];if(value!==null&&value!==undefined&&value!=='')payload.append(key,value);});if(form.imageAttachment1)payload.append('imageAttachment1',form.imageAttachment1);if(form.imageAttachment2)payload.append('imageAttachment2',form.imageAttachment2);if(editingId.value===null)await createDeviceAsset(payload);else await updateDeviceAsset(editingId.value,payload);ElMessage.success(editingId.value===null?'\u65b0\u589e\u6210\u529f':'\u7f16\u8f91\u6210\u529f');dialogVisible.value=false;filters.page=1;await loadPage();}catch(error){ElMessage.error(error.message);}finally{saving.value=false;}}
/** Plain purpose: ask for confirmation then request a reference-protected soft delete. Related files: device-api-client.js, DeviceAssetService.java. Flow: delete click -> confirm -> DELETE -> refresh or show error. */
async function confirmDelete(row){try{await ElMessageBox.confirm(`\u786e\u8ba4\u5220\u9664\u8bbe\u5907\u201c${row.deviceName}\u201d\u5417\uff1f`,'\u5220\u9664\u786e\u8ba4',{type:'warning'});await deleteDeviceAsset(row.id);ElMessage.success('\u5220\u9664\u6210\u529f');if(records.value.length===1&&filters.page>1)filters.page-=1;await loadPage();}catch(error){if(error!=='cancel'&&error!=='close')ElMessage.error(error.message);}}
/** Plain purpose: load active company people for the remote selector. Related files: device-api-client.js, DeviceAssetController.java. Flow: selector input -> lookup API -> dropdown options. */
async function fetchPersonSuggestions(keyword){try{personOptions.value=await searchDeviceCompanyPersons(keyword);}catch(error){ElMessage.error(error.message);}}
/** 代码作用（白话）：在浏览器端先限制图片类型和单张 20MB，减少无效上传。关联文件：DeviceAssetFileStorageService.java、DeviceAssetView.js。关联逻辑（调用链/数据流）：选择文件 -> validateImageBeforeSelect -> FormData 或错误提示。 */
function validateImageBeforeSelect(file){const raw=file.raw||file;const allowed=['image/jpeg','image/png','image/gif'];if(!allowed.includes(raw.type)){ElMessage.error('仅支持 JPG、PNG、GIF 图片');return false;}if(raw.size>20*1024*1024){ElMessage.error('每张图片不能超过 20MB');return false;}return true;}
/** 代码作用（白话）：接收某个图片槽选择的新原图并生成浏览器预览地址。关联文件：DeviceAssetFileStorageService.java、DeviceAssetView.js。关联逻辑（调用链/数据流）：上传组件 -> chooseImage -> form File/URL -> 缩略预览与保存。 */
/** Plain purpose: reject unsupported or over-20MB files before uploading. Related files: DeviceAssetFileStorageService.java, DeviceAssetView.js. Flow: file choose -> local validation -> FormData or message. */
function validateImageBeforeSelect(file){const raw=file.raw||file;if(!['image/jpeg','image/png','image/gif'].includes(raw.type)){ElMessage.error('\u4ec5\u652f\u6301 JPG\u3001PNG\u3001GIF \u56fe\u7247');return false;}if(raw.size>20*1024*1024){ElMessage.error('\u6bcf\u5f20\u56fe\u7247\u4e0d\u80fd\u8d85\u8fc7 20MB');return false;}return true;}
/** Plain purpose: keep the selected original file and use a browser object URL for a scaled thumbnail preview. Related files: DeviceAssetFileStorageService.java, DeviceAssetView.js. Flow: upload component -> file/object URL -> preview and save. */
function chooseImage(slot,file){if(!validateImageBeforeSelect(file))return false;clearPreview(slot);form[slot]=file.raw||file;form[`${slot}Url`]=URL.createObjectURL(form[slot]);form[`remove${slot.charAt(0).toUpperCase()+slot.slice(1)}`]=false;return false;}
/** 代码作用（白话）：清理浏览器本地创建的预览 URL，避免重复编辑占用内存。关联文件：DeviceAssetView.js。关联逻辑（调用链/数据流）：替换/关闭弹窗 -> clearPreview -> revokeObjectURL。 */
/** Plain purpose: release temporary object URLs so repeated edits do not retain browser memory. Related files: DeviceAssetView.js. Flow: replace/reset/remove -> clearPreview -> revokeObjectURL. */
function clearPreview(slot){const url=form[`${slot}Url`];if(url&&url.startsWith('blob:'))URL.revokeObjectURL(url);}
/** 代码作用（白话）：标记一个图片槽在保存时清空，同时隐藏其预览。关联文件：DeviceAssetSaveRequest.java、DeviceAssetService.java。关联逻辑（调用链/数据流）：移除按钮 -> removeImage -> multipart flag -> 数据库附件字段置空。 */
/** Plain purpose: mark an existing image reference for removal while preserving the historical original file on the server. Related files: DeviceAssetSaveRequest.java, DeviceAssetService.java. Flow: remove click -> multipart flag -> DB reference cleared. */
function removeImage(slot){clearPreview(slot);form[slot]=null;form[`${slot}Url`]='';form[`remove${slot.charAt(0).toUpperCase()+slot.slice(1)}`]=true;}
/** 代码作用（白话）：打开原图查看器而非生成另一份缩略图文件。关联文件：DeviceAssetResponse.java、DeviceAssetFileStorageService.java。关联逻辑（调用链/数据流）：缩略图点击 -> previewImage -> 受控图片 URL -> 查看器。 */
function previewImage(url){if(!url)return;imageViewerUrl.value=url;imageViewerVisible.value=true;}
/** 代码作用（白话）：延迟执行文本筛选，避免用户每输入一个字都请求接口。关联文件：device-api-client.js、DeviceAssetView.js。关联逻辑（调用链/数据流）：输入事件 -> 定时器 -> loadPage -> 表格。 */
/** Plain purpose: open the original image in the viewer instead of generating a second thumbnail file. Related files: DeviceAssetResponse.java, DeviceAssetFileStorageService.java. Flow: thumbnail click -> controlled URL -> viewer. */
function previewImage(url){if(url){imageViewerUrl.value=url;imageViewerVisible.value=true;}}
/** Plain purpose: delay text filtering to avoid a request for every keystroke. Related files: DeviceAssetView.js, device-api-client.js. Flow: text input -> timer -> page reload. */
function scheduleSearch(){window.clearTimeout(searchTimer);searchTimer=window.setTimeout(()=>{filters.page=1;loadPage();},300);}
/** 代码作用（白话）：立即按当前筛选条件查询第一页。关联文件：DeviceAssetView.js、device-api-client.js。关联逻辑（调用链/数据流）：筛选提交 -> page=1 -> GET -> 表格。 */
/** Plain purpose: apply the selected filters immediately from the first page. Related files: DeviceAssetPageQuery.java, DeviceAssetView.js. Flow: filter change -> page=1 -> GET -> table. */
function submitSearch(){window.clearTimeout(searchTimer);filters.page=1;loadPage();}
/** 代码作用（白话）：清空所有筛选条件并重新加载第一页。关联文件：DeviceAssetView.js、DeviceAssetPageQuery.java。关联逻辑（调用链/数据流）：重置按钮 -> 默认 filters -> GET -> 表格。 */
/** Plain purpose: remove every filter and reload the first page. Related files: DeviceAssetPageQuery.java, DeviceAssetView.js. Flow: reset -> default filters -> GET -> table. */
function resetSearch(){window.clearTimeout(searchTimer);Object.assign(filters,{page:1,size:20,deviceName:'',userPersonId:null,userUsageStatus:'',assetRelationStatus:''});loadPage();}
/** 代码作用（白话）：切换页码并读取对应设备数据。关联文件：DeviceAssetView.js、DeviceAssetPageQuery.java。关联逻辑（调用链/数据流）：分页器 -> page -> GET -> 表格。 */
/** Plain purpose: switch to a requested page. Related files: DeviceAssetPageQuery.java, DeviceAssetView.js. Flow: pagination -> page -> GET. */
function changePage(page){filters.page=page;loadPage();}
/** 代码作用（白话）：切换每页条数后回到第一页。关联文件：DeviceAssetView.js、DeviceAssetPageQuery.java。关联逻辑（调用链/数据流）：分页器 -> size/page -> GET -> 表格。 */
/** Plain purpose: apply a new page size and return to page one. Related files: DeviceAssetPageQuery.java, DeviceAssetView.js. Flow: pagination -> size/page -> GET. */
function changePageSize(size){filters.size=size;filters.page=1;loadPage();}
/** 代码作用（白话）：页面首次显示时加载设备列表。关联文件：DeviceAssetView.js、device-api-client.js。关联逻辑（调用链/数据流）：组件挂载 -> loadPage -> 表格初始数据。 */
/** Plain purpose: load the initial page when the routed component appears. Related files: DeviceAssetView.js, device-api-client.js. Flow: mount -> loadPage -> table. */
onMounted(loadPage);
return {loading,saving,dialogVisible,editingId,records,total,filters,form,personOptions,imageViewerVisible,imageViewerUrl,loadPage,openCreate,openEdit,submitForm,confirmDelete,fetchPersonSuggestions,chooseImage,removeImage,previewImage,scheduleSearch,submitSearch,resetSearch,changePage,changePageSize};
return {usageStatuses,relationStatuses,loading,saving,dialogVisible,editingId,records,total,filters,form,personOptions,imageViewerVisible,imageViewerUrl,loadPage,openCreate,openEdit,submitForm,confirmDelete,fetchPersonSuggestions,chooseImage,removeImage,previewImage,scheduleSearch,submitSearch,resetSearch,changePage,changePageSize};
},
template:`<section class="device-asset-page"><header class="device-asset-page__header"><div><h2>设备资产管理</h2><p>DEVICE ASSETS</p></div><el-button type="primary" @click="openCreate">新增设备</el-button></header><section class="device-asset-page__panel"><el-form class="device-asset-page__filters" @submit.prevent="submitSearch"><el-input v-model="filters.deviceName" placeholder="设备名称" @input="scheduleSearch"/><el-select v-model="filters.userPersonId" filterable remote clearable placeholder="使用人" :remote-method="fetchPersonSuggestions" @change="submitSearch"><el-option v-for="item in personOptions" :key="item.id" :label="item.personName" :value="item.id"/></el-select><el-select v-model="filters.userUsageStatus" clearable placeholder="使用状态" @change="submitSearch"><el-option label="使用中" value="使用中"/><el-option label="闲置" value="闲置"/><el-option label="维修中" value="维修中"/><el-option label="停用" value="停用"/></el-select><el-select v-model="filters.assetRelationStatus" clearable placeholder="资产关联状态" @change="submitSearch"><el-option label="已关联" value="已关联"/><el-option label="未关联" value="未关联"/><el-option label="待确认" value="待确认"/></el-select><el-button @click="resetSearch">重置</el-button></el-form></section><section class="device-asset-page__panel"><el-table :data="records" v-loading="loading" empty-text="暂无匹配数据"><el-table-column prop="id" label="ID" width="90"/><el-table-column prop="deviceName" label="设备名称" min-width="180"/><el-table-column label="图片" width="90"><template #default="{row}"><span v-if="!row.imageAttachment1Url">—</span><span v-else class="device-asset-page__image-cell"><img :src="row.imageAttachment1Url" @click="previewImage(row.imageAttachment1Url)"/></span></template></el-table-column><el-table-column label="使用人" min-width="160"><template #default="{row}">{{row.userPersonName?row.userPersonName+'（'+row.userPersonId+'）':(row.userPersonId?'—（'+row.userPersonId+'）':'—')}}</template></el-table-column><el-table-column prop="userUsageStatus" label="使用状态" min-width="120"/><el-table-column prop="assetRelationStatus" label="资产关联状态" min-width="130"/><el-table-column prop="updateTime" label="更新时间" min-width="180"/><el-table-column label="操作" width="150"><template #default="{row}"><el-button link @click="openEdit(row)">编辑</el-button><el-button link type="danger" @click="confirmDelete(row)">删除</el-button></template></el-table-column></el-table><footer v-if="total" class="device-asset-page__pagination"><span>共 {{total}} 条</span><el-pagination layout="sizes, prev, pager, next" :current-page="filters.page" :page-size="filters.size" :page-sizes="[5,10,20,50]" :total="total" @current-change="changePage" @size-change="changePageSize"/></footer></section><el-dialog v-model="dialogVisible" :title="editingId===null?'新增设备':'编辑设备'" width="640px"><el-form label-position="top" @submit.prevent="submitForm"><el-row :gutter="16"><el-col :span="12"><el-form-item label="设备名称" required><el-input v-model="form.deviceName"/></el-form-item></el-col><el-col :span="12"><el-form-item label="使用人"><el-select v-model="form.userPersonId" filterable remote clearable :remote-method="fetchPersonSuggestions" placeholder="输入人员姓名" style="width:100%"><el-option v-for="item in personOptions" :key="item.id" :label="item.personName" :value="item.id"/></el-select></el-form-item></el-col><el-col :span="12"><el-form-item label="使用状态" required><el-select v-model="form.userUsageStatus" style="width:100%"><el-option label="使用中" value="使用中"/><el-option label="闲置" value="闲置"/><el-option label="维修中" value="维修中"/><el-option label="停用" value="停用"/></el-select></el-form-item></el-col><el-col :span="12"><el-form-item label="资产关联状态" required><el-select v-model="form.assetRelationStatus" style="width:100%"><el-option label="已关联" value="已关联"/><el-option label="未关联" value="未关联"/><el-option label="待确认" value="待确认"/></el-select></el-form-item></el-col></el-row><div class="device-asset-page__images"><div v-for="slot in ['imageAttachment1','imageAttachment2']" :key="slot" class="device-asset-page__image-slot"><strong>{{slot==='imageAttachment1'?'图片附件 1':'图片附件 2'}}</strong><div class="device-asset-page__preview"><img v-if="form[slot+'Url']" :src="form[slot+'Url']" @click="previewImage(form[slot+'Url'])"/><span v-else>暂无图片</span></div><el-upload :auto-upload="false" :show-file-list="false" :on-change="file=>chooseImage(slot,file)"><el-button size="small">选择图片</el-button></el-upload><el-button v-if="form[slot+'Url']" size="small" link type="danger" @click="removeImage(slot)">移除</el-button></div></div></el-form><template #footer><el-button @click="dialogVisible=false">取消</el-button><el-button type="primary" :loading="saving" @click="submitForm">保存</el-button></template></el-dialog><el-image-viewer v-if="imageViewerVisible" :url-list="[imageViewerUrl]" @close="imageViewerVisible=false"/></section>`
template:`<section class="device-asset-page"><header class="device-asset-page__header"><div><h2>&#x8bbe;&#x5907;&#x8d44;&#x4ea7;&#x7ba1;&#x7406;</h2><p>DEVICE ASSETS</p></div><el-button type="primary" @click="openCreate">&#x65b0;&#x589e;&#x8bbe;&#x5907;</el-button></header><section class="device-asset-page__panel"><el-form class="device-asset-page__filters" @submit.prevent="submitSearch"><el-input v-model="filters.deviceName" placeholder="&#x8bbe;&#x5907;&#x540d;&#x79f0;" @input="scheduleSearch"/><el-select v-model="filters.userPersonId" filterable remote clearable placeholder="&#x4f7f;&#x7528;&#x4eba;" :remote-method="fetchPersonSuggestions" @change="submitSearch"><el-option v-for="item in personOptions" :key="item.id" :label="item.personName" :value="item.id"/></el-select><el-select v-model="filters.userUsageStatus" clearable placeholder="&#x4f7f;&#x7528;&#x72b6;&#x6001;" @change="submitSearch"><el-option v-for="item in usageStatuses" :key="item" :label="item" :value="item"/></el-select><el-select v-model="filters.assetRelationStatus" clearable placeholder="&#x8d44;&#x4ea7;&#x5173;&#x8054;&#x72b6;&#x6001;" @change="submitSearch"><el-option v-for="item in relationStatuses" :key="item" :label="item" :value="item"/></el-select><el-button @click="resetSearch">&#x91cd;&#x7f6e;</el-button></el-form></section><section class="device-asset-page__panel"><el-table :data="records" v-loading="loading" empty-text="&#x6682;&#x65e0;&#x5339;&#x914d;&#x6570;&#x636e;"><el-table-column prop="id" label="ID" width="90"/><el-table-column prop="deviceName" label="&#x8bbe;&#x5907;&#x540d;&#x79f0;" min-width="180"/><el-table-column label="&#x56fe;&#x7247;" width="90"><template #default="{row}"><span v-if="!row.imageAttachment1Url">-</span><span v-else class="device-asset-page__image-cell"><img :src="row.imageAttachment1Url" @click="previewImage(row.imageAttachment1Url)"/></span></template></el-table-column><el-table-column label="&#x4f7f;&#x7528;&#x4eba;" min-width="160"><template #default="{row}">{{row.userPersonName?row.userPersonName+'('+row.userPersonId+')':(row.userPersonId?'--('+row.userPersonId+')':'-')}}</template></el-table-column><el-table-column prop="userUsageStatus" label="&#x4f7f;&#x7528;&#x72b6;&#x6001;" min-width="120"/><el-table-column prop="assetRelationStatus" label="&#x8d44;&#x4ea7;&#x5173;&#x8054;&#x72b6;&#x6001;" min-width="130"/><el-table-column prop="updateTime" label="&#x66f4;&#x65b0;&#x65f6;&#x95f4;" min-width="180"/><el-table-column label="&#x64cd;&#x4f5c;" width="150"><template #default="{row}"><el-button link @click="openEdit(row)">&#x7f16;&#x8f91;</el-button><el-button link type="danger" @click="confirmDelete(row)">&#x5220;&#x9664;</el-button></template></el-table-column></el-table><footer v-if="total" class="device-asset-page__pagination"><span>&#x5171; {{total}} &#x6761;</span><el-pagination layout="sizes, prev, pager, next" :current-page="filters.page" :page-size="filters.size" :page-sizes="[5,10,20,50]" :total="total" @current-change="changePage" @size-change="changePageSize"/></footer></section><el-dialog v-model="dialogVisible" :title="editingId===null?'\u65b0\u589e\u8bbe\u5907':'\u7f16\u8f91\u8bbe\u5907'" width="640px"><el-form label-position="top" @submit.prevent="submitForm"><el-row :gutter="16"><el-col :span="12"><el-form-item label="&#x8bbe;&#x5907;&#x540d;&#x79f0;" required><el-input v-model="form.deviceName"/></el-form-item></el-col><el-col :span="12"><el-form-item label="&#x4f7f;&#x7528;&#x4eba;"><el-select v-model="form.userPersonId" filterable remote clearable :remote-method="fetchPersonSuggestions" placeholder="&#x8f93;&#x5165;&#x4eba;&#x5458;&#x59d3;&#x540d;" style="width:100%"><el-option v-for="item in personOptions" :key="item.id" :label="item.personName" :value="item.id"/></el-select></el-form-item></el-col><el-col :span="12"><el-form-item label="&#x4f7f;&#x7528;&#x72b6;&#x6001;" required><el-select v-model="form.userUsageStatus" style="width:100%"><el-option v-for="item in usageStatuses" :key="item" :label="item" :value="item"/></el-select></el-form-item></el-col><el-col :span="12"><el-form-item label="&#x8d44;&#x4ea7;&#x5173;&#x8054;&#x72b6;&#x6001;" required><el-select v-model="form.assetRelationStatus" style="width:100%"><el-option v-for="item in relationStatuses" :key="item" :label="item" :value="item"/></el-select></el-form-item></el-col></el-row><div class="device-asset-page__images"><div v-for="slot in ['imageAttachment1','imageAttachment2']" :key="slot" class="device-asset-page__image-slot"><strong>{{slot==='imageAttachment1'?'\u56fe\u7247\u9644\u4ef6 1':'\u56fe\u7247\u9644\u4ef6 2'}}</strong><div class="device-asset-page__preview"><img v-if="form[slot+'Url']" :src="form[slot+'Url']" @click="previewImage(form[slot+'Url'])"/><span v-else>&#x6682;&#x65e0;&#x56fe;&#x7247;</span></div><el-upload :auto-upload="false" :show-file-list="false" :on-change="file=>chooseImage(slot,file)"><el-button size="small">&#x9009;&#x62e9;&#x56fe;&#x7247;</el-button></el-upload><el-button v-if="form[slot+'Url']" size="small" link type="danger" @click="removeImage(slot)">&#x79fb;&#x9664;</el-button></div></div></el-form><template #footer><el-button @click="dialogVisible=false">&#x53d6;&#x6d88;</el-button><el-button type="primary" :loading="saving" @click="submitForm">&#x4fdd;&#x5b58;</el-button></template></el-dialog><el-image-viewer v-if="imageViewerVisible" :url-list="[imageViewerUrl]" @close="imageViewerVisible=false"/></section>`
};
frontend/src/modules/device/device-api-client.js
/** 文件用途（白话）：统一调用设备资产接口，并将非成功响应变为页面可显示的错误。 */
async function request(path, options = {}) {
/** 代码作用（白话）：发送一次设备接口请求并提取统一响应数据。关联文件：DeviceAssetView.js、DeviceAssetController.java。关联逻辑（调用链/数据流）：页面动作 -> request -> ApiResponse -> 页面状态或错误提示。 */
const response = await fetch(path, options);
const payload = await response.json().catch(() => ({}));
if (!response.ok || payload.code !== 200) throw new Error(payload.message || '设备资产请求失败');
return payload.data;
}
import { request } from '../auth/auth-api-client.js';
/** File purpose (plain language): sends device requests through the shared cookie and CSRF-safe authentication helper. */
/** 代码作用（白话）：按筛选条件读取设备列表。关联文件：DeviceAssetView.js、DeviceAssetController.java。关联逻辑（调用链/数据流）：筛选器 -> GET -> 分页响应 -> 表格。 */
export function listDeviceAssets(query) { const params = new URLSearchParams(); Object.entries(query).forEach(([key,value]) => { if (value !== '' && value !== null && value !== undefined) params.set(key,value); }); return request('/api/device-assets?' + params); }
/** 代码作用（白话）：用 multipart 表单新建设备。关联文件：DeviceAssetView.js、DeviceAssetController.java。关联逻辑（调用链/数据流）：新增弹窗 -> POST -> 文件/设备写入 -> 响应。 */
......
frontend/src/modules/phone/PhoneAssetView.js
import { nextTick, onMounted, reactive, ref } from 'vue/dist/vue.esm-bundler.js';
import { computed, nextTick, onMounted, reactive, ref } from 'vue/dist/vue.esm-bundler.js';
import { ElMessage, ElMessageBox } from 'element-plus';
import zhCn from 'element-plus/es/locale/lang/zh-cn.mjs';
import { authState } from '../auth/auth-store.js';
import { createPhoneAsset, deletePhoneAsset, listPhoneAssets, updatePhoneAsset } from './phone-api-client.js';
/**
......@@ -22,6 +23,8 @@ export default {
const total = ref(0);
const dialogVisible = ref(false);
const editingId = ref(null);
/** 代码作用（白话）：把当前手机号资产权限转换为是否展示写操作；关联文件：auth-store.js、PhoneAssetController.java。关联逻辑（调用链/数据流）：/api/auth/me -> EDIT 判断 -> 新增/编辑/删除控件 -> 后端二次校验。 */
const canEdit = computed(() => authState.user?.pagePermissions?.['phone-assets'] === 'EDIT');
const filters = reactive({ page: 1, size: 20, phoneNumber: '', iccid: '', realNameOwner: '', disposalStatus: 'ALL' });
let searchTimer = null;
let latestRequest = 0;
......@@ -257,6 +260,7 @@ export default {
changePage,
changePageSize,
changeStatus,
canEdit,
confirmDelete,
dialogVisible,
editingId,
......@@ -285,9 +289,9 @@ export default {
},
template: `
<el-config-provider :locale="elementLocale"><section class="phone-asset-page phone-asset-list-page">
<header class="phone-asset-list-page__header"><h2>手机号资产</h2><el-button class="phone-asset-list-page__add" type="primary" @click="openCreate">新增手机号资产</el-button></header>
<header class="phone-asset-list-page__header"><h2>手机号资产</h2><el-button v-if="canEdit" class="phone-asset-list-page__add" type="primary" @click="openCreate">新增手机号资产</el-button></header>
<section class="phone-asset-list-page__panel phone-asset-list-page__search" aria-label="筛选手机号资产"><el-form class="phone-asset-list-page__filters" @submit.prevent="submitSearch"><el-input v-model="filters.phoneNumber" maxlength="11" inputmode="numeric" placeholder="手机号前3位、后4位或完整号码" @input="limitSearchPhone" @keydown.enter.prevent="submitSearch" /><el-input v-model="filters.iccid" maxlength="20" placeholder="请输入 ICCID" @input="scheduleSearch" @keydown.enter.prevent="submitSearch" /><el-input v-model="filters.realNameOwner" placeholder="请输入实名人" @input="scheduleSearch" @keydown.enter.prevent="submitSearch" /><el-select v-model="filters.disposalStatus" placeholder="使用状态：" clearable @change="changeStatus" @clear="restoreAllDisposalStatuses"><template #prefix>使用状态：</template><el-option label="全部" value="ALL" /><el-option label="正常" value="正常使用" /><el-option label="闲置" value="闲置" /><el-option label="停机" value="停机" /><el-option label="注销" value="已注销" /></el-select><el-button @click="resetSearch">重置</el-button></el-form></section>
<section class="phone-asset-list-page__panel phone-asset-list-page__table"><header class="phone-asset-list-page__table-header"><h3>资产列表</h3><span>共 {{ total }} 条</span></header><el-table v-loading="loading" :data="records" empty-text="暂无匹配数据" class="phone-asset-list-page__grid"><el-table-column prop="phoneNumber" label="手机号" min-width="150" show-overflow-tooltip /><el-table-column label="号码类型" min-width="120"><template #default="{ row }"><a v-if="row.numberType === 'EXTERNAL' && row.sourceAssetType === 'WECOM'" class="phone-asset-list-page__external-link" :href="'#/reference/wecom?phoneAssetId=' + row.id">外部号码</a><span v-else>{{ row.numberType === 'EXTERNAL' ? '外部号码' : '自有号码' }}</span></template></el-table-column><el-table-column prop="cardType" label="运营商" min-width="110" show-overflow-tooltip /><el-table-column prop="iccid" label="ICCID" min-width="220" show-overflow-tooltip /><el-table-column prop="realNameOwner" label="实名人" min-width="150" show-overflow-tooltip /><el-table-column prop="managementType" label="管理模式" min-width="120" show-overflow-tooltip /><el-table-column label="使用状态" min-width="130"><template #default="{ row }"><span class="phone-asset-list-page__status"><i :class="['phone-asset-list-page__status-dot', row.disposalStatus]"></i>{{ formatDisposalStatus(row.disposalStatus) }}</span></template></el-table-column><el-table-column prop="deviceId" label="关联设备（ID）" min-width="150" show-overflow-tooltip /><el-table-column label="操作" width="120"><template #default="{ row }"><span class="phone-asset-list-page__actions"><el-button link @click="openEdit(row)">编辑</el-button><el-button link type="danger" @click="confirmDelete(row)">删除</el-button></span></template></el-table-column></el-table><footer v-if="total" class="phone-asset-list-page__pagination"><span>共 {{ total }} 条</span><el-pagination layout="sizes, prev, pager, next, jumper" :current-page="filters.page" :page-size="filters.size" :page-sizes="[5,10,20,50]" :total="total" @current-change="changePage" @size-change="changePageSize" /></footer></section>
<section class="phone-asset-list-page__panel phone-asset-list-page__table"><header class="phone-asset-list-page__table-header"><h3>资产列表</h3><span>共 {{ total }} 条</span></header><el-table v-loading="loading" :data="records" empty-text="暂无匹配数据" class="phone-asset-list-page__grid"><el-table-column prop="phoneNumber" label="手机号" min-width="150" show-overflow-tooltip /><el-table-column label="号码类型" min-width="120"><template #default="{ row }"><a v-if="row.numberType === 'EXTERNAL' && row.sourceAssetType === 'WECOM'" class="phone-asset-list-page__external-link" :href="'#/reference/wecom?phoneAssetId=' + row.id">外部号码</a><span v-else>{{ row.numberType === 'EXTERNAL' ? '外部号码' : '自有号码' }}</span></template></el-table-column><el-table-column prop="cardType" label="运营商" min-width="110" show-overflow-tooltip /><el-table-column prop="iccid" label="ICCID" min-width="220" show-overflow-tooltip /><el-table-column prop="realNameOwner" label="实名人" min-width="150" show-overflow-tooltip /><el-table-column prop="managementType" label="管理模式" min-width="120" show-overflow-tooltip /><el-table-column label="使用状态" min-width="130"><template #default="{ row }"><span class="phone-asset-list-page__status"><i :class="['phone-asset-list-page__status-dot', row.disposalStatus]"></i>{{ formatDisposalStatus(row.disposalStatus) }}</span></template></el-table-column><el-table-column prop="deviceId" label="关联设备（ID）" min-width="150" show-overflow-tooltip /><el-table-column v-if="canEdit" label="操作" width="120"><template #default="{ row }"><span class="phone-asset-list-page__actions"><el-button link @click="openEdit(row)">编辑</el-button><el-button link type="danger" @click="confirmDelete(row)">删除</el-button></span></template></el-table-column></el-table><footer v-if="total" class="phone-asset-list-page__pagination"><span>共 {{ total }} 条</span><el-pagination layout="sizes, prev, pager, next, jumper" :current-page="filters.page" :page-size="filters.size" :page-sizes="[5,10,20,50]" :total="total" @current-change="changePage" @size-change="changePageSize" /></footer></section>
<el-dialog v-model="dialogVisible" class="phone-asset-modal" modal-class="phone-asset-modal-mask" :title="editingId === null ? '新增手机号资产' : '编辑手机号资产'" width="560px" @opened="resetDialogScroll">
<el-form class="phone-asset-modal__form" label-width="96px">
<el-form-item class="phone-asset-modal__form-row" label="手机号" required>
......
frontend/src/modules/phone/phone-api-client.js
import { csrfHeadersFor } from '../auth/auth-api-client.js';
/**
* 代码作用（白话）：统一发送手机号资产请求并把后端错误转换为页面可提示的文字。
* 关联文件：PhoneAssetView.js、PhoneAssetController.java。
* 关联逻辑（调用链/数据流）：页面事件 -> fetch -> ApiResponse -> 成功数据或 ElMessage 错误。
*/
async function request(path, options = {}) {
const response = await fetch(path, { headers: { 'Content-Type': 'application/json' }, ...options });
const headers = await csrfHeadersFor(path, (options.method || 'GET').toUpperCase());
const response = await fetch(path, { credentials: 'include', headers: { 'Content-Type': 'application/json', ...headers }, ...options });
const payload = await response.json();
if (!response.ok || payload.code !== 200) throw new Error(payload.message || '手机号资产请求失败');
return payload.data;
......
frontend/src/modules/system-user/UserPermissionView.js 0 → 100644
import { computed, reactive, ref } from 'vue/dist/vue.esm-bundler.js';
import { ElMessage } from 'element-plus';
import { authState } from '../auth/auth-store.js';
import { createSystemUser, listSystemUsers, resetSystemUserPassword, updateSystemUser } from './system-user-api-client.js';
const pages = [{ key: 'overview', label: '总览' }, { key: 'domain', label: '域名资料' }, { key: 'reference-wecom', label: '企微资料' }, { key: 'phone-assets', label: '手机号资产' }, { key: 'alerts', label: '提醒中心' }];
const roles = [{ value: 'SUPER_ADMIN', label: '超级管理员' }, { value: 'FINANCE', label: '财务' }, { value: 'HR', label: '人事' }, { value: 'OPERATIONS', label: '运营' }];
/** 代码作用（白话）：创建五页均无权限的编辑表单初始值；关联文件：PagePermissionService.java、UserPermissionView.js。关联逻辑（调用链/数据流）：新增/编辑打开 -> 本函数 -> 表单权限单选 -> JSON 提交。 */
function blankForm() { return { username: '', roleCode: 'FINANCE', status: 'ACTIVE', password: '', pagePermissions: Object.fromEntries(pages.map(page => [page.key, 'NONE'])) }; }
/** 代码作用（白话）：提供账号创建、角色编辑、密码重置和逐页权限面板；关联文件：system-user-api-client.js、SystemUserAdminController.java。关联逻辑（调用链/数据流）：设置路由 -> 页面操作 -> 管理 API -> 刷新列表。 */
export default { setup() { const users = ref([]); const loading = ref(false); const dialogOpen = ref(false); const passwordOpen = ref(false); const editingId = ref(null); const target = ref(null); const form = reactive(blankForm()); const password = ref(''); const isDeveloper = computed(() => authState.user?.roleCode === 'DEVELOPER'); const isAdministratorRole = computed(() => form.roleCode === 'SUPER_ADMIN');
/** 代码作用（白话）：读取当前可管理账号列表，后端已过滤固定开发者 Jeddy；关联文件：system-user-api-client.js、SystemUserAdminService.java。关联逻辑（调用链/数据流）：页面进入/保存后 -> GET users -> 表格。 */
async function load() { loading.value = true; try { users.value = await listSystemUsers(); } catch (error) { ElMessage.error(error.message || '账号列表加载失败'); } finally { loading.value = false; } }
/** 代码作用（白话）：打开新增账号面板，超级管理员不会看到密码输入；关联文件：SystemUserAdminService.java。关联逻辑（调用链/数据流）：新增按钮 -> 空表单 -> 创建提交。 */
function openCreate() { Object.assign(form, blankForm()); editingId.value = null; dialogOpen.value = true; }
/** 代码作用（白话）：把选中账号复制到编辑面板，避免直接改动表格对象；关联文件：SystemUserResponse.java、SystemUserAdminController.java。关联逻辑（调用链/数据流）：编辑按钮 -> 本地副本 -> PUT 更新。 */
function openEdit(user) { Object.assign(form, blankForm(), { username: user.username, roleCode: user.roleCode, status: user.status, pagePermissions: { ...user.pagePermissions } }); editingId.value = user.id; dialogOpen.value = true; }
/** 代码作用（白话）：创建或更新账号，并把超级管理员创建的账号交给后端固定为禁用无密码；关联文件：SystemUserAdminService.java、system-user-api-client.js。关联逻辑（调用链/数据流）：表单 -> POST/PUT -> 用户表 -> 列表刷新。 */
async function save() { try { if (editingId.value) await updateSystemUser(editingId.value, { roleCode: form.roleCode, status: form.status, pagePermissions: form.pagePermissions }); else await createSystemUser({ username: form.username, roleCode: form.roleCode, password: isDeveloper.value ? form.password : null, pagePermissions: form.pagePermissions }); ElMessage.success(editingId.value ? '账号已更新' : '账号已创建'); dialogOpen.value = false; await load(); } catch (error) { ElMessage.error(error.message || '保存失败'); } }
/** 代码作用（白话）：打开仅开发者可见的密码设置面板；关联文件：SystemUserAdminController.java、PasswordResetRequest.java。关联逻辑（调用链/数据流）：开发者点击设置密码 -> 输入暂存 -> 安全接口。 */
function openPassword(user) { target.value = user; password.value = ''; passwordOpen.value = true; }
/** 代码作用（白话）：把新密码提交给后端并立即从页面内存清除；关联文件：system-user-api-client.js、V1__system_user_auth_permissions.sql。关联逻辑（调用链/数据流）：新密码 -> BCrypt -> 数据库触发器 -> 旧会话失效。 */
async function savePassword() { try { await resetSystemUserPassword(target.value.id, password.value); password.value = ''; passwordOpen.value = false; ElMessage.success('密码已更新，旧会话已失效'); await load(); } catch (error) { ElMessage.error(error.message || '密码更新失败'); } }
load(); return { users, loading, dialogOpen, passwordOpen, form, pages, roles, editingId, isDeveloper, isAdministratorRole, target, password, load, openCreate, openEdit, save, openPassword, savePassword }; }, template: `<section class="user-permission-page"><header class="page-header"><div><p class="eyebrow">设置 / 账号与权限</p><h2>账号与权限</h2><p>开发者账号 Jeddy 不会在此页面显示；逐页权限由此面板独立配置。</p></div><el-button type="primary" @click="openCreate">新增账号</el-button></header><section class="reference-card"><el-table :data="users" v-loading="loading"><el-table-column prop="username" label="用户名" /><el-table-column prop="roleCode" label="角色" /><el-table-column prop="status" label="状态" /><el-table-column label="操作" width="210"><template #default="scope"><el-button link @click="openEdit(scope.row)">编辑权限</el-button><el-button v-if="isDeveloper" link type="primary" @click="openPassword(scope.row)">设置密码</el-button></template></el-table-column></el-table></section><el-dialog v-model="dialogOpen" :title="editingId ? '编辑账号与权限' : '新增账号'" width="680px"><el-form label-width="112px"><el-form-item label="用户名" v-if="!editingId"><el-input v-model="form.username" /></el-form-item><el-form-item label="角色"><el-select v-model="form.roleCode"><el-option v-for="role in roles" :key="role.value" :label="role.label" :value="role.value" /></el-select></el-form-item><el-form-item label="账号状态" v-if="editingId"><el-select v-model="form.status"><el-option label="启用" value="ACTIVE" /><el-option label="禁用" value="DISABLED" /></el-select></el-form-item><el-form-item label="初始密码" v-if="!editingId && isDeveloper"><el-input v-model="form.password" type="password" show-password /><small>12-72 位，且不能包含用户名。</small></el-form-item><el-alert v-if="!editingId && !isDeveloper" title="超级管理员创建的账号会保持禁用且不设密码，需由开发者设置密码后再启用。" type="info" :closable="false" /><el-divider>页面权限</el-divider><div v-if="isAdministratorRole" class="permission-hint">超级管理员固定拥有全部页面的编辑权限。</div><el-form-item v-for="page in pages" :key="page.key" :label="page.label"><el-radio-group v-model="form.pagePermissions[page.key]" :disabled="isAdministratorRole"><el-radio value="NONE">无权限</el-radio><el-radio value="READ">只读</el-radio><el-radio value="EDIT">编辑</el-radio></el-radio-group></el-form-item></el-form><template #footer><el-button @click="dialogOpen=false">取消</el-button><el-button type="primary" @click="save">保存</el-button></template></el-dialog><el-dialog v-model="passwordOpen" title="设置账号密码" width="420px"><p>仅开发者可以设置密码：{{ target?.username }}</p><el-input v-model="password" type="password" show-password placeholder="12-72 位且不含用户名" /><template #footer><el-button @click="passwordOpen=false">取消</el-button><el-button type="primary" @click="savePassword">确认设置</el-button></template></el-dialog></section>` };
frontend/src/modules/system-user/system-user-api-client.js 0 → 100644
import { request } from '../auth/auth-api-client.js';
/** 代码作用（白话）：集中发送账号管理请求，并复用认证模块的 Cookie 与 CSRF 保护；关联文件：UserPermissionView.js、SystemUserAdminController.java。关联逻辑（调用链/数据流）：设置页面操作 -> request -> 账号管理 API -> 安全响应。 */
export function listSystemUsers() { return request('/api/system-users'); }
/** 代码作用（白话）：提交创建账号资料；关联文件：UserPermissionView.js、SystemUserAdminController.java。关联逻辑（调用链/数据流）：新增账号面板 -> POST -> as_system_user。 */
export function createSystemUser(form) { return request('/api/system-users', { method: 'POST', body: JSON.stringify(form) }); }
/** 代码作用（白话）：提交角色、启停和逐页权限修改；关联文件：UserPermissionView.js、SystemUserAdminController.java。关联逻辑（调用链/数据流）：编辑面板 -> PUT -> as_system_user。 */
export function updateSystemUser(id, form) { return request(`/api/system-users/${id}`, { method: 'PUT', body: JSON.stringify(form) }); }
/** 代码作用（白话）：仅供开发者提交非开发者账号的新密码；关联文件：UserPermissionView.js、SystemUserAdminController.java。关联逻辑（调用链/数据流）：密码面板 -> PUT password -> BCrypt/数据库触发器。 */
export function resetSystemUserPassword(id, password) { return request(`/api/system-users/${id}/password`, { method: 'PUT', body: JSON.stringify({ password }) }); }
frontend/src/modules/wecom/WecomAccountView.js
import { onMounted, reactive, ref } from 'vue/dist/vue.esm-bundler.js';
import { computed, onMounted, reactive, ref } from 'vue/dist/vue.esm-bundler.js';
import { ElMessage } from 'element-plus';
import { authState } from '../auth/auth-store.js';
import { createWecomAccount, listWecomAccounts, searchCompanyPersons, searchCompanyProfiles, searchPhoneAssets } from './wecom-api-client.js';
/** File purpose (plain language): renders the enterprise WeChat asset list and its creation dialog with reusable asset searches. */
......@@ -13,6 +14,8 @@ export default {
const total = ref(0);
const companyOptions = ref([]);
const ownerOptions = ref([]);
/** 代码作用（白话）：把企微页面的有效权限转换为新增按钮和弹窗是否可用；关联文件：auth-store.js、WecomAccountController.java。关联逻辑（调用链/数据流）：认证资料 -> EDIT 判断 -> 写操作控件 -> 后端 EDIT 校验。 */
const canEdit = computed(() => authState.user?.pagePermissions?.['reference-wecom'] === 'EDIT');
let searchTimer;
const filters = reactive({ page: 1, size: 20, keyword: '', wecomAccount: '', phoneAssetId: new URLSearchParams(window.location.hash.split('?')[1] || '').get('phoneAssetId') || '', companyProfileId: 'ALL', realNameOwnerStatus: 'ALL' });
const form = reactive({ wecomName: '', wecomAlias: '记忆力梅老师-助教老师', wecomAccount: '', companyProfileId: null, phoneNumber: '', realNameOwner: '', realNameOwnerStatus: '在职', gender: '', operatorPersonId: null });
......@@ -69,11 +72,11 @@ export default {
function formatRelation(name, id) { return id === null || id === undefined ? '—' : `${name || '—'}（ID：${id}）`; }
onMounted(loadPage);
return { changePage, companyOptions, dialogVisible, fetchPhoneSuggestions, filters, form, formatRelation, loadCompanies, loadOwners, loading, openCreate, ownerOptions, records, resetSearch, restoreAllCompanyProfiles, restoreAllRealNameStatuses, saving, scheduleSearch, submitCreate, submitSearch, total };
return { canEdit, changePage, companyOptions, dialogVisible, fetchPhoneSuggestions, filters, form, formatRelation, loadCompanies, loadOwners, loading, openCreate, ownerOptions, records, resetSearch, restoreAllCompanyProfiles, restoreAllRealNameStatuses, saving, scheduleSearch, submitCreate, submitSearch, total };
},
template: `
<section class="phone-asset-list-page wecom-account-page">
<header class="phone-asset-list-page__header"><div><h2>企业微信资产</h2><p class="wecom-account-page__eyebrow">WECOM ACCOUNTS</p></div><el-button class="phone-asset-list-page__add" type="primary" @click="openCreate">新增企业微信资产</el-button></header>
<header class="phone-asset-list-page__header"><div><h2>企业微信资产</h2><p class="wecom-account-page__eyebrow">WECOM ACCOUNTS</p></div><el-button v-if="canEdit" class="phone-asset-list-page__add" type="primary" @click="openCreate">新增企业微信资产</el-button></header>
<section class="phone-asset-list-page__panel phone-asset-list-page__search"><el-form class="phone-asset-list-page__filters" @submit.prevent="submitSearch"><el-input v-model="filters.keyword" placeholder="企微名称或手机号" clearable @input="scheduleSearch" @clear="scheduleSearch" /><el-select v-model="filters.companyProfileId" filterable remote clearable :remote-method="loadCompanies" placeholder="注册主体：" @change="submitSearch" @clear="restoreAllCompanyProfiles"><template #prefix>注册主体：</template><el-option label="全部" value="ALL" /><el-option v-for="item in companyOptions" :key="item.id" :label="item.shortName || item.companyName" :value="item.id" /></el-select><el-select v-model="filters.realNameOwnerStatus" clearable placeholder="实名状态：" @change="submitSearch" @clear="restoreAllRealNameStatuses"><template #prefix>实名状态：</template><el-option label="全部" value="ALL" /><el-option label="在职" value="在职" /><el-option label="离职" value="离职" /></el-select><el-button @click="resetSearch">重置</el-button></el-form></section>
<section class="phone-asset-list-page__panel phone-asset-list-page__table"><header class="phone-asset-list-page__table-header"><h3>资产列表</h3><span>共 {{ total }} 条</span></header><el-table v-loading="loading" :data="records" empty-text="暂无匹配数据" class="phone-asset-list-page__grid wecom-account-page__grid"><el-table-column prop="id" label="企业微信资产 ID" min-width="140" /><el-table-column prop="wecomName" label="企微名称" min-width="150" show-overflow-tooltip /><el-table-column prop="wecomAlias" label="企微别名" min-width="180" show-overflow-tooltip /><el-table-column prop="wecomAccount" label="企微账号" min-width="160" show-overflow-tooltip /><el-table-column label="注册主体" min-width="180"><template #default="{ row }">{{ formatRelation(row.companyProfileName, row.companyProfileId) }}</template></el-table-column><el-table-column label="注册手机号" min-width="180"><template #default="{ row }">{{ formatRelation(row.phoneNumber, row.phoneAssetId) }}</template></el-table-column><el-table-column label="关联方式" min-width="120"><template #default="{ row }">{{ row.phoneLinkMode === 'CREATED' ? '新建号码' : '已有号码' }}</template></el-table-column><el-table-column prop="realNameOwner" label="实名人" min-width="120" /><el-table-column prop="realNameOwnerStatus" label="实名状态" min-width="110" /><el-table-column prop="gender" label="性别" min-width="90" /><el-table-column label="企微号归属人" min-width="180"><template #default="{ row }">{{ formatRelation(row.operatorPersonName, row.operatorPersonId) }}</template></el-table-column><el-table-column prop="createTime" label="创建时间" min-width="180" /></el-table><footer v-if="total" class="phone-asset-list-page__pagination"><span>共 {{ total }} 条</span><el-pagination layout="prev, pager, next" :current-page="filters.page" :page-size="filters.size" :total="total" @current-change="changePage" /></footer></section>
<el-dialog v-model="dialogVisible" title="新增企业微信资产" width="640px" :close-on-click-modal="false"><el-form label-position="top" @submit.prevent="submitCreate"><el-row :gutter="16"><el-col :span="12"><el-form-item label="企微名称" required><el-input v-model="form.wecomName" /></el-form-item></el-col><el-col :span="12"><el-form-item label="企微别名"><el-input v-model="form.wecomAlias" /></el-form-item></el-col><el-col :span="12"><el-form-item label="企微账号"><el-input v-model="form.wecomAccount" /></el-form-item></el-col><el-col :span="12"><el-form-item label="注册手机号" required><el-autocomplete v-model="form.phoneNumber" :fetch-suggestions="fetchPhoneSuggestions" placeholder="输入或选择手机号" style="width:100%" /></el-form-item></el-col><el-col :span="12"><el-form-item label="注册主体"><el-select v-model="form.companyProfileId" filterable remote clearable :remote-method="loadCompanies" placeholder="输入公司名称或简称" style="width:100%"><el-option v-for="item in companyOptions" :key="item.id" :label="item.shortName || item.companyName" :value="item.id" /></el-select></el-form-item></el-col><el-col :span="12"><el-form-item label="企微号归属人"><el-select v-model="form.operatorPersonId" filterable remote clearable :remote-method="loadOwners" placeholder="输入人员姓名" style="width:100%"><el-option v-for="item in ownerOptions" :key="item.id" :label="item.personName" :value="item.id" /></el-select></el-form-item></el-col><el-col :span="12"><el-form-item label="实名人"><el-input v-model="form.realNameOwner" /></el-form-item></el-col><el-col :span="12"><el-form-item label="实名状态"><el-radio-group v-model="form.realNameOwnerStatus"><el-radio value="在职">在职</el-radio><el-radio value="离职">离职</el-radio></el-radio-group></el-form-item></el-col><el-col :span="12"><el-form-item label="性别"><el-radio-group v-model="form.gender"><el-radio value="男">男</el-radio><el-radio value="女">女</el-radio></el-radio-group></el-form-item></el-col></el-row></el-form><template #footer><el-button @click="dialogVisible = false">取消</el-button><el-button type="primary" :loading="saving" @click="submitCreate">保存</el-button></template></el-dialog>
......
frontend/src/modules/wecom/wecom-api-client.js
import { csrfHeadersFor } from '../auth/auth-api-client.js';
/** File purpose (plain language): centralizes enterprise WeChat asset requests and turns API envelopes into usable data. */
/** Code purpose (plain language): sends an API request and exposes either its data or readable error. Related files: WecomAccountView.js, WecomAccountController.java. Data flow: view action -> request -> ApiResponse -> view state. */
async function request(path, options = {}) {
const response = await fetch(path, { headers: { 'Content-Type': 'application/json' }, ...options });
const headers = await csrfHeadersFor(path, (options.method || 'GET').toUpperCase());
const response = await fetch(path, { credentials: 'include', headers: { 'Content-Type': 'application/json', ...headers }, ...options });
const payload = await response.json();
if (!response.ok || payload.code !== 200) throw new Error(payload.message || '企业微信资产请求失败');
return payload.data;
......
frontend/src/router/index.js
......@@ -3,6 +3,9 @@ import LegacyReferenceView from '../reference/LegacyReferenceView.js';
import PhoneAssetView from '../modules/phone/PhoneAssetView.js';
import WecomAccountView from '../modules/wecom/WecomAccountView.js';
import DeviceAssetView from '../modules/device/DeviceAssetView.js';
import LoginView from '../modules/auth/LoginView.js';
import UserPermissionView from '../modules/system-user/UserPermissionView.js';
import { authState, bootstrapAuth } from '../modules/auth/auth-store.js';
/**
* 代码作用（白话）：生成暂未重构完成的普通页面，避免旧业务模块被删除后导航落到空白或继续请求旧接口。
......@@ -22,14 +25,21 @@ const router = createRouter({
history: createWebHashHistory(),
routes: [
{ path: '/', redirect: '/overview' },
{ path: '/overview', component: createPlaceholderView('资产总览') },
{ path: '/phone-assets', component: PhoneAssetView },
{ path: '/device-assets', component: DeviceAssetView },
{ path: '/domain', component: createPlaceholderView('域名资料') },
{ path: '/alerts', component: createPlaceholderView('提醒中心') },
{ path: '/reference/wecom', component: WecomAccountView },
{ path: '/login', component: LoginView, meta: { public: true } },
{ path: '/overview', component: createPlaceholderView('资产总览'), meta: { page: 'overview' } },
{ path: '/phone-assets', component: PhoneAssetView, meta: { page: 'phone-assets' } },
{ path: '/device-assets', component: DeviceAssetView, meta: { administratorOnly: true } },
{ path: '/domain', component: createPlaceholderView('域名资料'), meta: { page: 'domain' } },
{ path: '/alerts', component: createPlaceholderView('提醒中心'), meta: { page: 'alerts' } },
{ path: '/reference/wecom', component: WecomAccountView, meta: { page: 'reference-wecom' } },
{ path: '/settings/users-permissions', component: UserPermissionView, meta: { administratorOnly: true } },
{ path: '/reference/phone', component: LegacyReferenceView, props: { kind: 'phone' } }
]
});
/** 代码作用（白话）：在进入业务路由前恢复 Cookie 会话，未登录用户一律进入新建的登录路由。关联文件：auth-store.js、LoginView.js。关联逻辑（调用链/数据流）：Hash 地址 -> 路由守卫 -> /api/auth/me -> 业务页或 /login。 */
/** 代码作用（白话）：在已登录后继续按逐页权限和管理角色校验目标路由，避免只隐藏菜单就能手输地址绕过；关联文件：App.js、PagePermissionService.java。关联逻辑（调用链/数据流）：路由地址 -> authState 有效权限 -> 放行或返回总览。 */
/** 代码作用（白话）：集中决定首轮认证后的目标页面；网络异常时保留当前地址交给错误页，其他结果再执行公开页、登录页和权限判断。关联文件：auth-store.js、auth-api-client.js、App.js。关联逻辑（调用链/数据流）：Hash 地址 -> bootstrapAuth() -> connectionError 或 user -> 当前地址、/login、/overview 或业务页。 */
router.beforeEach(async to => { if (!authState.ready) await bootstrapAuth(); if (authState.connectionError) return true; if (to.meta.public) return authState.user ? '/overview' : true; if (!authState.user) return '/login'; const isAdministrator = ['DEVELOPER', 'SUPER_ADMIN'].includes(authState.user.roleCode); if (to.meta.administratorOnly && !isAdministrator) return '/overview'; if (to.meta.page && authState.user.pagePermissions?.[to.meta.page] === 'NONE' && to.path !== '/overview') return '/overview'; return true; });
export default router;
frontend/src/styles/app.css
:root { color: #1f2937; background: #f7f8fb; font-family: Inter, "Microsoft YaHei", sans-serif; }
* { box-sizing: border-box; }
body { margin: 0; }
/* 登录页：参考黑洞液态玻璃设计，但所有规则以 login- 前缀隔离，避免影响后台中的 Element Plus 表单。 */
.login-page { --login-glass-border: rgba(255, 255, 255, .038); --login-glass-bg-top: rgba(255, 255, 255, .012); --login-glass-bg-bottom: rgba(255, 255, 255, .0015); --login-text-primary: rgba(255, 255, 255, .96); --login-text-secondary: rgba(222, 230, 255, .74); --login-field-border: rgba(211, 225, 255, .055); --login-field-focus: rgba(176, 206, 255, .42); position: relative; display: flex; align-items: center; min-height: 100dvh; overflow: hidden; padding: clamp(24px, 6vw, 88px); color: var(--login-text-primary); background: linear-gradient(90deg, rgba(3, 6, 15, .84) 0%, rgba(3, 7, 18, .64) 38%, rgba(5, 8, 20, .20) 65%, rgba(4, 6, 16, .06) 100%), var(--login-background-image) 68% center / cover no-repeat, #04070e; font-family: "Microsoft YaHei", "PingFang SC", sans-serif; isolation: isolate; }
.login-page::before { position: absolute; inset: 0; z-index: -1; content: ""; pointer-events: none; background: radial-gradient(circle at 24% 18%, rgba(84, 120, 255, .13), transparent 26%), radial-gradient(circle at 30% 76%, rgba(137, 178, 255, .07), transparent 26%), radial-gradient(circle at 78% 24%, rgba(255, 195, 138, .08), transparent 22%); mix-blend-mode: screen; }
.login-page__atmosphere { position: absolute; inset: 0; z-index: -1; pointer-events: none; background: linear-gradient(112deg, rgba(5, 9, 23, .22), transparent 42%); }
.login-panel { position: relative; width: min(100%, 560px); padding: 34px 34px 32px; overflow: hidden; border: 1px solid var(--login-glass-border); border-radius: 32px; background: linear-gradient(145deg, var(--login-glass-bg-top), var(--login-glass-bg-bottom)); box-shadow: 0 20px 54px rgba(5, 9, 23, .09), inset 0 1px 0 rgba(255, 255, 255, .055), inset 0 -1px 0 rgba(255, 255, 255, .008); backdrop-filter: blur(10px) saturate(112%); -webkit-backdrop-filter: blur(10px) saturate(112%); }
.login-panel::before { position: absolute; inset: -1px; content: ""; pointer-events: none; border-radius: inherit; background: radial-gradient(circle at 18% 0%, rgba(255, 255, 255, .038), transparent 28%), radial-gradient(circle at 100% 100%, rgba(113, 164, 255, .022), transparent 22%), linear-gradient(135deg, rgba(255, 255, 255, .014), transparent); opacity: .48; }
.login-panel::after { position: absolute; top: 12px; right: 14px; left: 14px; height: 92px; content: ""; pointer-events: none; border-radius: 22px; background: linear-gradient(180deg, rgba(255, 255, 255, .012), transparent); opacity: .36; }
.login-brand, .login-panel__intro, .login-form { position: relative; z-index: 1; }
.login-brand { display: flex; align-items: center; justify-content: center; gap: 16px; margin: 0 auto 14px; }
.login-brand__mark { display: grid; grid-template-columns: repeat(3, 4px); gap: 3px; align-content: center; justify-content: center; width: 56px; height: 56px; overflow: hidden; border: 1px solid rgba(255, 255, 255, .18); border-radius: 18px; background: linear-gradient(145deg, rgba(170, 208, 255, .22), rgba(109, 146, 255, .10)); box-shadow: inset 0 1px 0 rgba(255, 255, 255, .30), 0 12px 30px rgba(68, 121, 255, .18); }
.login-brand__mark span { width: 4px; border-radius: 999px; background: rgba(255, 255, 255, .92); box-shadow: 0 0 8px rgba(187, 218, 255, .72); }.login-brand__mark span:nth-child(1) { height: 15px; }.login-brand__mark span:nth-child(2) { height: 25px; }.login-brand__mark span:nth-child(3) { height: 19px; }
.login-brand__eyebrow { margin: 0 0 5px; color: rgba(211, 226, 255, .66); font-size: 10px; font-weight: 600; letter-spacing: .16em; }.login-brand h1 { margin: 0; color: var(--login-text-primary); font-size: clamp(22px, 2vw, 28px); font-weight: 700; line-height: 1.25; letter-spacing: .04em; text-shadow: 0 4px 18px rgba(5, 12, 28, .25); white-space: nowrap; }
.login-panel__intro { margin: 0 0 26px; color: var(--login-text-secondary); font-size: 14px; text-align: center; }
.login-form__item.el-form-item { margin-bottom: 16px; }.login-form__input .el-input__wrapper { min-height: 60px; padding: 0 18px; border: 1px solid var(--login-field-border); border-radius: 18px; background: linear-gradient(160deg, rgba(255, 255, 255, .012), rgba(255, 255, 255, .003)); box-shadow: inset 0 1px 0 rgba(255, 255, 255, .035), inset 0 -1px 0 rgba(255, 255, 255, .008), 0 6px 18px rgba(5, 10, 22, .025); backdrop-filter: blur(8px); -webkit-backdrop-filter: blur(8px); transition: border-color .2s ease, box-shadow .2s ease, background .2s ease, transform .2s ease; }.login-form__input .el-input__wrapper:hover { border-color: rgba(211, 225, 255, .13); }.login-form__input.is-focus .el-input__wrapper { border-color: var(--login-field-focus); background: linear-gradient(160deg, rgba(255, 255, 255, .025), rgba(255, 255, 255, .007)); box-shadow: inset 0 1px 0 rgba(255, 255, 255, .055), 0 0 0 4px rgba(136, 182, 255, .055), 0 10px 24px rgba(4, 11, 24, .055); transform: translateY(-1px); }.login-form__input .el-input__inner { color: var(--login-text-primary); font-size: 17px; }.login-form__input .el-input__inner::placeholder { color: rgba(224, 231, 255, .58); }.login-form__input .el-input__password { color: rgba(229, 236, 255, .74); }.login-form__input .el-input__password:hover { color: rgba(255, 255, 255, .96); }
.login-submit.el-button { width: 100%; height: 60px; margin-top: 8px; border: 1px solid rgba(205, 224, 255, .18); border-radius: 18px; background: linear-gradient(135deg, rgba(194, 223, 255, .46) 0%, rgba(120, 168, 255, .46) 40%, rgba(84, 127, 255, .50) 100%); color: #fff; font-size: 17px; font-weight: 700; letter-spacing: .08em; box-shadow: inset 0 1px 0 rgba(255, 255, 255, .35), 0 18px 30px rgba(60, 103, 207, .18), 0 4px 10px rgba(4, 9, 18, .16); backdrop-filter: blur(16px); -webkit-backdrop-filter: blur(16px); transition: transform .2s ease, box-shadow .2s ease, opacity .2s ease, background .2s ease; }.login-submit.el-button:hover { transform: translateY(-1px); background: linear-gradient(135deg, rgba(194, 223, 255, .56), rgba(120, 168, 255, .56) 40%, rgba(84, 127, 255, .60)); box-shadow: inset 0 1px 0 rgba(255, 255, 255, .42), 0 22px 36px rgba(60, 103, 207, .22), 0 6px 14px rgba(4, 9, 18, .22); }.login-submit.el-button:active { transform: translateY(1px) scale(.99); }.login-submit.el-button.is-loading, .login-submit.el-button.is-disabled { opacity: .76; transform: none; }
@supports not ((backdrop-filter: blur(1px)) or (-webkit-backdrop-filter: blur(1px))) { .login-panel { background: linear-gradient(145deg, rgba(10, 18, 37, .72), rgba(4, 8, 19, .62)); }.login-form__input .el-input__wrapper { background: rgba(7, 15, 32, .72); } }
@media (max-width: 980px) { .login-page { justify-content: center; padding-right: 24px; padding-left: 24px; background-position: 64% center; }.login-panel { margin: 0 auto; } }
@media (max-width: 640px) { .login-page { align-items: center; min-height: 100dvh; padding: 18px; background-position: 63% center; }.login-panel { padding: 26px 22px 24px; border-radius: 26px; }.login-brand { gap: 12px; justify-content: flex-start; }.login-brand__mark { width: 48px; height: 48px; border-radius: 16px; }.login-brand h1 { font-size: clamp(19px, 5.6vw, 22px); letter-spacing: .02em; }.login-brand__eyebrow { font-size: 9px; }.login-panel__intro { margin-bottom: 22px; text-align: left; }.login-form__input .el-input__wrapper, .login-submit.el-button { min-height: 56px; height: 56px; font-size: 16px; }.login-form__input .el-input__inner { font-size: 16px; } }
.logout-button { width: 100%; margin-top: 24px; padding: 10px 12px; border: 1px solid #496b8c; border-radius: 8px; color: #cbd5e1; background: transparent; cursor: pointer; }.logout-button:hover { color:#fff; background:#1f3b59; }
.app-shell { min-height: 100vh; display: grid; grid-template-columns: 232px minmax(0, 1fr); }
.sidebar { padding: 28px 20px; background: #132338; color: #f8fafc; }
.sidebar h1 { margin: 0 0 32px; font-size: 20px; }
.sidebar nav { display: grid; gap: 8px; }
.sidebar a { border-radius: 8px; color: #cbd5e1; padding: 10px 12px; text-decoration: none; }
.sidebar a.router-link-active, .sidebar a:hover { background: #1f3b59; color: white; }
.sidebar .settings-link { margin-top: 16px; border-top: 1px solid #385673; border-radius: 0; padding-top: 18px; }
.content { min-width: 0; padding: 40px; }
.user-permission-page { max-width: 1180px; margin: 0 auto; }.user-permission-page small { display:block; margin-top:6px; color:#64748b; }.permission-hint { margin:-4px 0 16px; color:#64748b; font-size:13px; }
.eyebrow { margin: 0 0 8px; color: #5f8fcb; font-size: 12px; font-weight: 700; letter-spacing: .08em; }
.reference-page, .placeholder { max-width: 1180px; margin: 0 auto; }
.page-header { display: flex; align-items: flex-start; justify-content: space-between; gap: 24px; margin-bottom: 28px; }
......@@ -274,3 +295,256 @@ body { margin: 0; }
@media(max-width:900px){.phone-asset-list-page{padding:26px 0 40px}.phone-asset-list-page__pagination{align-items:flex-start;flex-direction:column}.phone-asset-list-page__pagination .el-pagination{width:100%;justify-content:space-between}}
@media(max-width:640px){.phone-asset-list-page{padding:20px 0 32px}.phone-asset-list-page__header{align-items:stretch;flex-direction:column;margin-bottom:18px}.phone-asset-list-page__add.el-button{width:100%}.phone-asset-list-page__header h2{font-size:25px}.phone-asset-list-page__search{padding:18px}.phone-asset-list-page__filters,.phone-asset-list-page__filters .el-input,.phone-asset-list-page__filters .el-select,.phone-asset-list-page__filters .el-button{width:100%!important}.phone-asset-list-page__table-header,.phone-asset-list-page__pagination{padding-left:18px;padding-right:18px}.phone-asset-list-page__pagination .el-pagination__jump{display:none}}
.wecom-account-page{min-width:0;max-width:100%;overflow-x:hidden}.wecom-account-page__eyebrow{margin:7px 0 0;color:#71717a;font-size:12px;font-weight:700;letter-spacing:.12em}.wecom-account-page .phone-asset-list-page__table,.wecom-account-page__grid{min-width:0;max-width:100%}.wecom-account-page__grid .el-scrollbar__wrap{overflow-x:auto!important}.phone-asset-list-page__external-link{color:#409eff;text-decoration:none}.phone-asset-list-page__external-link:hover{color:#337ecc;text-decoration:none}
/* 登录页视觉微调：输入本体保持透明，玻璃质感由外层承载，避免影响其他业务表单。 */
.login-page {
--login-panel-offset: calc(clamp(100px, 9vw, 180px) + 20px);
background-position: 66% center;
}
.login-page::before {
background: linear-gradient(90deg, rgba(2, 8, 20, .74) 0%, rgba(2, 8, 20, .48) 32%, rgba(2, 8, 20, .16) 57%, rgba(2, 8, 20, .025) 100%);
}
.login-panel {
margin-left: var(--login-panel-offset);
padding: clamp(26px, 3vw, 34px);
background: linear-gradient(145deg, rgba(255, 255, 255, .011), rgba(255, 255, 255, .0012));
border-color: rgba(255, 255, 255, .042);
box-shadow: 0 18px 48px rgba(0, 6, 24, .10), inset 0 1px 0 rgba(255, 255, 255, .045);
backdrop-filter: blur(11px) saturate(113%);
-webkit-backdrop-filter: blur(11px) saturate(113%);
}
.login-brand {
justify-content: center;
gap: 14px;
margin-bottom: 30px;
text-align: center;
}
.login-brand h1 {
font-size: clamp(22px, 2vw, 28px);
white-space: nowrap;
}
.login-form__item.el-form-item {
margin-bottom: 12px;
}
.login-form__item.el-form-item:last-of-type {
margin-bottom: 0;
}
.login-form__input .el-input__wrapper {
background: linear-gradient(160deg, rgba(193, 212, 255, .011), rgba(193, 212, 255, .0015));
border-color: rgba(205, 222, 255, .12);
}
.login-form__input .el-input__wrapper:hover {
background: linear-gradient(160deg, rgba(193, 212, 255, .018), rgba(193, 212, 255, .003));
border-color: rgba(176, 205, 255, .23);
}
.login-form__input .el-input__inner,
.login-form__input .el-input__inner:focus {
color: var(--login-text-primary);
caret-color: var(--login-text-primary);
background: transparent !important;
box-shadow: none !important;
}
.login-form__input .el-input__inner::placeholder {
color: rgba(187, 204, 232, .54);
}
/* Chrome 自动填充会给 input 注入浅色底色；透明内阴影让它继续露出外层玻璃背景。 */
.login-form__input .el-input__inner:-webkit-autofill,
.login-form__input .el-input__inner:-webkit-autofill:hover,
.login-form__input .el-input__inner:-webkit-autofill:focus,
.login-form__input .el-input__inner:-webkit-autofill:active {
-webkit-text-fill-color: var(--login-text-primary) !important;
caret-color: var(--login-text-primary);
-webkit-box-shadow: 0 0 0 1000px transparent inset !important;
box-shadow: 0 0 0 1000px transparent inset !important;
background-color: transparent !important;
}
.login-form__input .el-input__suffix-inner {
display: flex;
align-items: center;
}
.login-form__input .el-input__password {
display: grid;
width: 36px;
height: 36px;
margin-right: -10px;
place-items: center;
color: rgba(202, 220, 250, .70);
font-size: 16px;
cursor: pointer;
transition: color .18s ease, background-color .18s ease;
}
.login-form__input .el-input__password svg {
width: 16px;
height: 16px;
}
.login-form__input .el-input__password:hover {
color: #e8f2ff;
background: rgba(139, 180, 255, .08);
border-radius: 50%;
}
.login-form__remember.el-checkbox {
display: inline-flex;
align-items: center;
height: 22px;
margin-top: 14px;
color: rgba(205, 220, 246, .76);
}
.login-form__remember .el-checkbox__inner {
width: 16px;
height: 16px;
border-color: rgba(205, 222, 255, .30);
border-radius: 5px;
background: rgba(193, 212, 255, .025);
}
.login-form__remember:hover .el-checkbox__inner {
border-color: rgba(177, 207, 255, .64);
background: rgba(139, 180, 255, .08);
}
.login-form__remember .el-checkbox__input.is-checked .el-checkbox__inner {
border-color: #83b4ff;
background: linear-gradient(135deg, #a9d4ff, #5d8df2);
}
.login-form__remember .el-checkbox__label {
padding-left: 8px;
color: inherit;
font-size: 13px;
}
.login-submit.el-button {
margin-top: 18px;
background: linear-gradient(135deg, rgba(57, 72, 109, .94) 0%, rgba(48, 59, 96, .95) 52%, rgba(65, 59, 112, .94) 100%);
border-color: rgba(163, 183, 241, .34);
color: #fff;
box-shadow: 0 10px 22px rgba(14, 20, 44, .26), inset 0 1px 0 rgba(218, 228, 255, .18);
}
.login-submit.el-button:hover:not(.is-disabled) {
background: linear-gradient(135deg, rgba(70, 88, 132, .96) 0%, rgba(57, 71, 113, .97) 52%, rgba(77, 69, 132, .96) 100%);
box-shadow: 0 12px 24px rgba(14, 20, 44, .30), inset 0 1px 0 rgba(218, 228, 255, .24);
}
.login-submit.el-button.is-disabled,
.login-submit.el-button.is-loading {
box-shadow: none;
}
@media (max-width: 980px) {
.login-page {
--login-panel-offset: 0px;
background-position: 61% center;
}
.login-panel {
margin-left: 0;
}
}
@media (max-width: 640px) {
.login-page {
background-position: 59% center;
}
.login-brand {
gap: 11px;
margin-bottom: 24px;
}
.login-brand h1 {
font-size: clamp(19px, 6vw, 23px);
}
.login-submit.el-button {
margin-top: 16px;
}
}
/* 登录面板使用视口宽度计算位置，避免桌面端贴近左边缘，同时保留小屏安全边距。 */
.login-page {
position: relative;
min-height: 100vh;
overflow: hidden;
}
.login-panel {
position: absolute;
top: 50%;
left: clamp(280px, 19.2vw, 368px);
width: min(560px, calc(100vw - 48px));
margin-left: 0;
transform: translateY(-50%);
}
/* 登录输入文字在初始、聚焦和浏览器自动填充时使用同一字号，避免点击后出现字号跳变。 */
.login-form__input .el-input__inner,
.login-form__input .el-input__inner:focus,
.login-form__input .el-input__inner:-webkit-autofill,
.login-form__input .el-input__inner:-webkit-autofill:hover,
.login-form__input .el-input__inner:-webkit-autofill:focus,
.login-form__input .el-input__inner:-webkit-autofill:active {
font-size: 16px !important;
line-height: 24px !important;
border: 0 !important;
outline: 0 !important;
-webkit-appearance: none;
appearance: none;
-webkit-text-size-adjust: 100%;
}
/* Chrome/Edge 自动填充时不在原生 input 内容区绘制背景，避免内阴影的矩形边缘形成横线。 */
.login-form__input .el-input__inner:-webkit-autofill,
.login-form__input .el-input__inner:-webkit-autofill:hover,
.login-form__input .el-input__inner:-webkit-autofill:focus,
.login-form__input .el-input__inner:-webkit-autofill:active {
-webkit-text-fill-color: var(--login-text-primary) !important;
caret-color: var(--login-text-primary);
background: transparent !important;
background-color: transparent !important;
-webkit-box-shadow: 0 0 0 1000px transparent inset !important;
box-shadow: 0 0 0 1000px transparent inset !important;
transition: none !important;
}
/* 代码作用（白话）：让密码框外层占满 Element Plus 表单项的可用宽度，保持它与账号框同宽。关联文件：LoginView.js、login-experience.spec.js。关联逻辑（调用链/数据流）：登录表单渲染 -> 密码外层宽度 -> 原生密码 input 宽度 -> 页面视觉一致。 */
.login-password-field {
width: 100%;
}
.login-password-field .el-input__inner[type="password"]::placeholder {
-webkit-text-fill-color: rgba(187, 204, 232, .54) !important;
}
@media (max-width: 1200px) {
.login-panel {
left: clamp(48px, 8vw, 96px);
}
}
@media (max-width: 768px) {
.login-panel {
top: 50%;
left: 50%;
width: calc(100vw - 32px);
margin: 0;
transform: translate(-50%, -50%);
}
}
frontend/src/styles/auth-state.css 0 → 100644
/* 文件用途（白话）：集中定义认证结果未确定或网络不可用时的独立页面外观，不与登录密码输入框样式混在一起。 */
/* 代码作用（白话）：在极少数应用已挂载但路由仍未完成的时序中，保持中性背景而不向视觉界面显示认证提示文字。关联文件：App.js、main.js、index.html。关联逻辑（调用链/数据流）：HTML 启动底图 -> Vue 挂载前等待路由 -> 此样式作为 App 认证分支的视觉兜底 -> 实际路由页面。 */
.auth-loading {
min-height: 100vh;
font-size: 0;
background: linear-gradient(180deg, #ffffff 0%, #f8fafc 100%);
}
/* 代码作用（白话）：在认证服务不可连接时展示独立的重试页面，避免错误地显示后台或跳转登录页。关联文件：App.js、auth-store.js、router/index.js。关联逻辑（调用链/数据流）：会话请求网络失败 -> connectionError=true -> App 网络异常分支 -> 用户重新连接。 */
.auth-network-error {
display: grid;
min-height: 100vh;
place-items: center;
padding: 24px;
color: #e8eefc;
background: radial-gradient(circle at 20% 15%, rgba(92, 118, 173, .2), transparent 32%), radial-gradient(circle at 82% 78%, rgba(98, 77, 148, .18), transparent 28%), #0d1524;
}
.auth-network-error__panel {
width: min(420px, 100%);
padding: 34px;
border: 1px solid rgba(226, 232, 240, .12);
border-radius: 16px;
text-align: center;
background: rgba(18, 28, 48, .72);
box-shadow: 0 22px 60px rgba(0, 0, 0, .22);
}
.auth-network-error__panel h1 { margin: 0; font-size: 22px; }
.auth-network-error__panel p { margin: 14px 0 24px; color: rgba(226, 232, 240, .72); line-height: 1.7; }
.auth-network-error__panel button { min-width: 112px; height: 38px; border: 0; border-radius: 7px; color: #fff; background: #5b7ed0; cursor: pointer; }
frontend/tests/authenticated-test.js 0 → 100644
import { expect, test as base } from '@playwright/test';
/** File purpose (plain language): supplies the same developer login fixture to every asset browser test without changing production authentication code. */
export const test = base;
/** Plain purpose: register deterministic authentication responses before a test opens a protected route. Related files: auth-store.js, router/index.js, and all files in frontend/tests. Data flow: test setup -> mocked current-user/CSRF requests -> route guard -> protected page. */
test.beforeEach(async ({ page }) => {
/** Plain purpose: add the browser-visible CSRF Cookie used by the shared request helper in either local Playwright port. Related files: auth-api-client.js, SecurityConfig.java. Flow: test context Cookie -> X-XSRF-TOKEN header -> protected request fixture. */
await page.context().addCookies([{ name: 'XSRF-TOKEN', value: 'playwright-csrf', domain: '127.0.0.1', path: '/' }]);
const user = {
id: 1,
username: 'playwright-asset-admin',
roleCode: 'DEVELOPER',
pagePermissions: {
overview: 'EDIT',
domain: 'EDIT',
'reference-wecom': 'EDIT',
'phone-assets': 'EDIT',
alerts: 'EDIT'
}
};
/** Plain purpose: return an administrator identity to the route guard. Related files: auth-store.js and router/index.js. Data flow: GET /api/auth/me -> mocked envelope -> auth state -> allowed route. */
await page.route('**/api/auth/me', async route => route.fulfill({
contentType: 'application/json',
body: JSON.stringify({ code: 200, message: 'success', data: user })
}));
/** Plain purpose: make protected test requests receive a successful CSRF preflight. Related files: api-client.js and all asset API clients. Data flow: API client -> CSRF request -> mocked success -> test-owned business request mock. */
await page.route('**/api/auth/csrf', async route => route.fulfill({
contentType: 'application/json',
body: JSON.stringify({ code: 200, message: 'success', data: null })
}));
});
export { expect };
frontend/tests/device-asset.spec.js
import { expect, test } from '@playwright/test';
import { expect, test } from './authenticated-test.js';
/** 文件用途（白话）：验证设备资产管理路由、列表数据和状态筛选控件，不依赖真实后端数据库。 */
/** File purpose: exercise the device route, readable rows, client image limit, and create/edit requests without a real database. */
test('shows the device management page and readable device row', async ({ page }) => {
/** 代码作用（白话）：为设备列表和人员搜索提供稳定模拟响应。关联文件：DeviceAssetView.js、device-api-client.js。关联逻辑（调用链/数据流）：浏览器请求 -> route.fulfill -> Vue 表格与下拉项。 */
/** Plain purpose: provide stable device-list and person-lookup responses. Related files: DeviceAssetView.js, device-api-client.js. Flow: browser request -> route.fulfill -> Vue table/dropdown. */
await page.route('**/api/device-assets**', async route => {
const url = route.request().url();
const data = url.includes('/lookups/company-persons') ? [{ id: 9, personName: '张三' }] : { records: [{ id: 1, deviceName: 'iPhone 15-01', imageAttachment1Url: null, imageAttachment2Url: null, userPersonId: 9, userPersonName: '张三', userUsageStatus: '使用中', assetRelationStatus: '已关联', createTime: '2026-08-01T10:00:00', updateTime: '2026-08-01T10:00:00' }], total: 1, page: 1, size: 20 };
await route.fulfill({ contentType: 'application/json', body: JSON.stringify({ code: 200, message: 'success', data }) });
const url=route.request().url();
const data=url.includes('/lookups/company-persons')?[{id:9,personName:'\u5f20\u4e09'}]:{records:[{id:1,deviceName:'iPhone 15-01',imageAttachment1Url:null,imageAttachment2Url:null,userPersonId:9,userPersonName:'\u5f20\u4e09',userUsageStatus:'\u4f7f\u7528\u4e2d',assetRelationStatus:'\u5df2\u5173\u8054',createTime:'2026-08-01T10:00:00',updateTime:'2026-08-01T10:00:00'}],total:1,page:1,size:20};
await route.fulfill({contentType:'application/json',body:JSON.stringify({code:200,message:'success',data})});
});
await page.goto('/asset/#/device-assets');
await expect(page.getByRole('heading', { name: '设备资产管理' })).toBeVisible();
await expect(page.getByRole('heading',{name:'\u8bbe\u5907\u8d44\u4ea7\u7ba1\u7406'})).toBeVisible();
await expect(page.getByText('iPhone 15-01')).toBeVisible();
await expect(page.getByText('张三（9）')).toBeVisible();
await expect(page.locator('.el-table').getByText('使用中', { exact: true })).toBeVisible();
await expect(page.locator('.el-table').getByText('已关联', { exact: true })).toBeVisible();
await expect(page.getByText('\u5f20\u4e09(9)')).toBeVisible();
await expect(page.locator('.el-table').getByText('\u4f7f\u7528\u4e2d',{exact:true})).toBeVisible();
await expect(page.locator('.el-table').getByText('\u5df2\u5173\u8054',{exact:true})).toBeVisible();
});
/** 文件用途（白话）：验证图片选择在浏览器端拒绝超过 20MB 的文件，避免无效请求发送到服务器。 */
/** Plain purpose: ensure an image over 20MB is rejected before a device save request. Related files: DeviceAssetView.js, DeviceAssetFileStorageService.java. Flow: choose file -> client validation -> message and no POST. */
test('rejects an oversized image before device save', async ({ page }) => {
/** 代码作用（白话）：模拟空设备列表，让测试直接打开新增弹窗。关联文件：DeviceAssetView.js、device-api-client.js。关联逻辑（调用链/数据流）：页面 GET -> route.fulfill -> 新增表单。 */
await page.route('**/api/device-assets**', async route => { await route.fulfill({ contentType: 'application/json', body: JSON.stringify({ code: 200, message: 'success', data: { records: [], total: 0, page: 1, size: 20 } }) }); });
/** Plain purpose: provide an empty device page so the create dialog can be opened. Related files: DeviceAssetView.js, device-api-client.js. Flow: GET -> route response -> add dialog. */
await page.route('**/api/device-assets**', async route=>route.fulfill({contentType:'application/json',body:JSON.stringify({code:200,message:'success',data:{records:[],total:0,page:1,size:20}})}));
await page.goto('/asset/#/device-assets');
await page.getByRole('button', { name: '新增设备' }).click();
const file = { name: 'too-large.png', mimeType: 'image/png', buffer: Buffer.alloc(20 * 1024 * 1024 + 1) };
await page.locator('input[type=file]').first().setInputFiles(file);
await expect(page.getByText('每张图片不能超过 20MB')).toBeVisible();
await page.getByRole('button',{name:'\u65b0\u589e\u8bbe\u5907'}).click();
await page.locator('input[type=file]').first().setInputFiles({name:'too-large.png',mimeType:'image/png',buffer:Buffer.alloc(20*1024*1024+1)});
await expect(page.getByText('\u6bcf\u5f20\u56fe\u7247\u4e0d\u80fd\u8d85\u8fc7 20MB')).toBeVisible();
});
/** Plain purpose: verify dialog save sends POST for new devices and PUT for edits. Related files: DeviceAssetView.js, device-api-client.js. Flow: dialog save -> fetch POST/PUT -> API response -> list refresh. */
test('creates and edits a device asset through the dialog', async ({ page }) => {
let createRequested=false,updateRequested=false,csrfRequested=false,createCsrfHeader='',createContentType='';
/** Plain purpose: simulate a missing browser CSRF Cookie and issue a replacement token before the device write. Related files: auth-api-client.js, SecurityConfig.java. Flow: missing Cookie -> GET csrf -> replacement Cookie -> protected multipart POST. */
await page.context().clearCookies();
await page.route('**/api/auth/csrf', async route=>{csrfRequested=true;await page.context().addCookies([{name:'XSRF-TOKEN',value:'refreshed-csrf',domain:'127.0.0.1',path:'/'}]);await route.fulfill({contentType:'application/json',body:JSON.stringify({code:200,message:'success',data:'refreshed-csrf'})});});
/** Plain purpose: return list data and record which save method was sent. Related files: DeviceAssetView.js, device-api-client.js. Flow: form submit -> route interception -> successful JSON -> refreshed table. */
await page.route('**/api/device-assets**', async route=>{const request=route.request();if(request.method()==='POST'){createRequested=true;createCsrfHeader=request.headers()['x-xsrf-token']||'';createContentType=request.headers()['content-type']||'';}if(request.method()==='PUT')updateRequested=true;const data=request.method()==='GET'?{records:[{id:1,deviceName:'iPhone 15-01',imageAttachment1Url:null,imageAttachment2Url:null,userPersonId:null,userPersonName:null,userUsageStatus:'\u4f7f\u7528\u4e2d',assetRelationStatus:'\u5f85\u786e\u8ba4',createTime:'',updateTime:''}],total:1,page:1,size:20}:{id:1,deviceName:'iPhone 15-01'};await route.fulfill({contentType:'application/json',body:JSON.stringify({code:200,message:'success',data})});});
await page.goto('/asset/#/device-assets');
await page.getByRole('button',{name:'\u65b0\u589e\u8bbe\u5907'}).click();
await page.getByRole('dialog').getByRole('textbox').first().fill('\u65b0\u589e\u6d4b\u8bd5\u8bbe\u5907');
await page.getByRole('dialog').getByRole('button',{name:'\u4fdd\u5b58'}).click();
await expect.poll(()=>createRequested).toBe(true);
await expect.poll(()=>csrfRequested).toBe(true);
expect(createCsrfHeader).toBe('refreshed-csrf');
expect(createContentType).toContain('multipart/form-data; boundary=');
await page.locator('.el-table').getByRole('button',{name:'\u7f16\u8f91'}).click();
await page.getByRole('dialog').getByRole('textbox').first().fill('\u7f16\u8f91\u540e\u7684\u8bbe\u5907');
await page.getByRole('dialog').getByRole('button',{name:'\u4fdd\u5b58'}).click();
await expect.poll(()=>updateRequested).toBe(true);
});
/** Plain purpose: verify an invalidated server session clears local identity and returns the browser to login without retrying the failed list request. Related files: auth-api-client.js, auth-store.js. Flow: device GET 401 -> auth-expired event -> auth state clear -> login route. */
test('redirects to login after an invalid device session', async ({ page }) => {
/** Plain purpose: return an expired-session response for the first device page request. Related files: SecurityConfig.java, auth-api-client.js. Flow: GET device list -> 401 envelope -> session-expired event. */
await page.route('**/api/device-assets**', async route=>route.fulfill({status:401,contentType:'application/json',body:JSON.stringify({code:401,message:'\u8bf7\u5148\u767b\u5f55',data:null})}));
await page.goto('/asset/#/device-assets');
await expect(page).toHaveURL(/#\/login$/);
});
/** Plain purpose: verify fixed status options are shown and an unsupported file never becomes an upload value. Related files: DeviceAssetView.js, DeviceAssetFileStorageService.java. Flow: open form -> status dropdown/file choose -> client validation message. */
test('shows fixed statuses and rejects an unsupported image type', async ({ page }) => {
/** Plain purpose: return an empty list to isolate the create dialog. Related files: DeviceAssetView.js, device-api-client.js. Flow: GET -> empty table -> create dialog. */
await page.route('**/api/device-assets**', async route=>route.fulfill({contentType:'application/json',body:JSON.stringify({code:200,message:'success',data:{records:[],total:0,page:1,size:20}})}));
await page.goto('/asset/#/device-assets');
await page.getByRole('button',{name:'\u65b0\u589e\u8bbe\u5907'}).click();
await page.getByRole('dialog').locator('.el-select').first().click();
expect(await page.getByText('\u4f7f\u7528\u4e2d',{exact:true}).allTextContents()).toContain('\u4f7f\u7528\u4e2d');
expect(await page.getByText('\u95f2\u7f6e',{exact:true}).allTextContents()).toContain('\u95f2\u7f6e');
expect(await page.getByText('\u7ef4\u4fee\u4e2d',{exact:true}).allTextContents()).toContain('\u7ef4\u4fee\u4e2d');
expect(await page.getByText('\u505c\u7528',{exact:true}).allTextContents()).toContain('\u505c\u7528');
await page.locator('input[type=file]').first().setInputFiles({name:'not-image.txt',mimeType:'text/plain',buffer:Buffer.from('not an image')});
await expect(page.getByText('\u4ec5\u652f\u6301 JPG\u3001PNG\u3001GIF \u56fe\u7247')).toBeVisible();
});
/** Plain purpose: verify a protected delete keeps the row visible and displays the API reason. Related files: DeviceAssetView.js, DeviceAssetService.java. Flow: delete confirmation -> DELETE 400 -> Element Plus message -> unchanged table row. */
test('keeps a referenced device visible after protected delete response', async ({ page }) => {
/** Plain purpose: simulate one active row and a server-side reference-protection error. Related files: device-api-client.js, DeviceAssetController.java. Flow: DELETE -> error envelope -> page message. */
await page.route('**/api/device-assets**', async route=>{const request=route.request();const data=request.method()==='GET'?{records:[{id:8,deviceName:'protected-device',imageAttachment1Url:null,imageAttachment2Url:null,userPersonId:null,userPersonName:null,userUsageStatus:'\u4f7f\u7528\u4e2d',assetRelationStatus:'\u5df2\u5173\u8054',createTime:'',updateTime:''}],total:1,page:1,size:20}:null;const response=request.method()==='DELETE'?{code:400,message:'\u8bbe\u5907\u4ecd\u88ab\u624b\u673a\u53f7\u8d44\u4ea7\u5f15\u7528\uff0c\u4e0d\u80fd\u5220\u9664',data:null}:{code:200,message:'success',data};await route.fulfill({contentType:'application/json',body:JSON.stringify(response)});});
await page.goto('/asset/#/device-assets');
await page.locator('.el-table').getByRole('button',{name:'\u5220\u9664'}).click();
await page.getByRole('button',{name:'OK'}).click();
await expect(page.getByText('\u8bbe\u5907\u4ecd\u88ab\u624b\u673a\u53f7\u8d44\u4ea7\u5f15\u7528\uff0c\u4e0d\u80fd\u5220\u9664')).toBeVisible();
await expect(page.locator('.el-table').getByText('protected-device',{exact:true})).toBeVisible();
});
frontend/tests/legacy-reference.spec.js
import { expect, test } from '@playwright/test';
import { expect, test } from './authenticated-test.js';
const referencePages = [
{ path: '#/reference/phone', title: '手机号卡旧界面参考' }
......
frontend/tests/login-experience.spec.js 0 → 100644
import { expect, test } from '@playwright/test';
const regularUser = { id: 8, username: 'demo_operator', roleCode: 'OPERATIONS', pagePermissions: { overview: 'EDIT' } };
const developerUser = { id: 1, username: 'Jeddy', roleCode: 'DEVELOPER', pagePermissions: { overview: 'EDIT' } };
/** Plain purpose: provide an API envelope matching the production backend without using any real credentials. Related files: auth-api-client.js, AuthController.java. Flow: Playwright route -> fetch response -> auth store/router. */
function envelope(data, message = 'success') { return JSON.stringify({ code: 200, message, data }); }
/** Plain purpose: provide the shared unauthenticated session response used before a login scenario begins. Related files: auth-store.js, router/index.js. Flow: protected route -> GET auth/me -> login route. */
async function mockUnauthenticatedSession(page) {
await page.route('**/api/auth/me', route => route.fulfill({ status: 401, contentType: 'application/json', body: JSON.stringify({ code: 401, message: '请先登录', data: null }) }));
await page.route('**/api/auth/csrf', route => route.fulfill({ contentType: 'application/json', body: envelope(null) }));
}
/** Plain purpose: submit one complete credential form so each scenario exercises the real login view bindings. Related files: LoginView.js, auth-store.js. Flow: input values -> submit -> auth API mock -> route/message. */
async function submitLogin(page, username = 'demo_operator', password = 'a-safe-test-password') {
await page.getByRole('textbox', { name: '账号' }).fill(username);
await page.getByRole('textbox', { name: '密码' }).fill(password);
await page.getByRole('button', { name: '登录' }).click();
}
/** Plain purpose: confirm a route guard protects business pages when no valid session exists. Related files: router/index.js, App.js. Flow: browser hash -> auth/me 401 -> login route -> no application shell. */
test('redirects an unauthenticated protected route to login without the sidebar', async ({ page }) => {
await mockUnauthenticatedSession(page);
await page.goto('/asset/#/overview');
await expect(page).toHaveURL(/#\/login$/);
await expect(page.locator('.sidebar')).toHaveCount(0);
});
/** Plain purpose: confirm an ordinary account reaches the overview without the developer-only greeting. Related files: LoginView.js, auth-store.js. Flow: login response -> user state -> overview route. */
test('logs in a regular account without the developer greeting', async ({ page }) => {
await mockUnauthenticatedSession(page);
await page.route('**/api/auth/login', route => route.fulfill({ contentType: 'application/json', body: envelope(regularUser) }));
await page.goto('/asset/#/login');
await submitLogin(page);
await expect(page).toHaveURL(/#\/overview$/);
await expect(page.getByText('欢迎系统开发者-BOSS：Jeddy 上线')).toHaveCount(0);
});
/** Plain purpose: confirm only the fixed developer identity receives its one-time welcome message. Related files: LoginView.js, auth-store.js. Flow: developer login response -> identity condition -> success message. */
test('shows the developer greeting after Jeddy logs in', async ({ page }) => {
await mockUnauthenticatedSession(page);
await page.route('**/api/auth/login', route => route.fulfill({ contentType: 'application/json', body: envelope(developerUser) }));
await page.goto('/asset/#/login');
await submitLogin(page, 'Jeddy');
await expect(page).toHaveURL(/#\/overview$/);
await expect(page.getByText('欢迎系统开发者-BOSS：Jeddy 上线')).toBeVisible();
});
/** Plain purpose: keep a rejected login distinct from an expired authenticated session. Related files: auth-api-client.js, auth-store.js. Flow: login 401 -> generic form error only -> no session-expired browser event. */
test('keeps a rejected login on the form without emitting a session-expired event', async ({ page }) => {
await mockUnauthenticatedSession(page);
await page.route('**/api/auth/login', route => route.fulfill({ status: 401, contentType: 'application/json', body: JSON.stringify({ code: 401, message: '账号或密码错误', data: null }) }));
await page.goto('/asset/#/login');
await page.evaluate(() => { window.__loginExpiredEvents = 0; window.addEventListener('xyw-auth-expired', () => { window.__loginExpiredEvents += 1; }); });
await submitLogin(page);
await expect(page).toHaveURL(/#\/login$/);
await expect(page.getByText('账号或密码错误，请重试')).toBeVisible();
await expect.poll(() => page.evaluate(() => window.__loginExpiredEvents)).toBe(0);
await expect(page.getByRole('button', { name: '登录' })).toBeEnabled();
});
/** Plain purpose: ensure the client always returns to the public login route even when server logout fails. Related files: App.js, auth-store.js. Flow: sidebar logout -> API failure -> finally route change -> login page. */
test('returns to login when the logout endpoint fails', async ({ page }) => {
await page.route('**/api/auth/me', route => route.fulfill({ contentType: 'application/json', body: envelope(developerUser) }));
await page.route('**/api/auth/logout', route => route.fulfill({ status: 500, contentType: 'application/json', body: JSON.stringify({ code: 500, message: 'logout failed', data: null }) }));
await page.goto('/asset/#/overview');
await page.getByRole('button', { name: '退出登录' }).click();
await expect(page).toHaveURL(/#\/login$/);
});
/** 代码作用（白话）：验证登录页恢复 Cookie 会话期间不抢先渲染后台外壳，避免未登录用户刷新时看见侧栏和业务页面闪屏。关联文件：App.js、router/index.js、auth-store.js。关联逻辑（调用链/数据流）：刷新登录路由 -> /api/auth/me 等待 -> 中性底图 -> 401 后显示登录页。 */
test('does not render the application shell while the login session check is pending', async ({ page }) => {
let releaseSessionResponse;
let markSessionRequested;
const sessionRequested = new Promise(resolve => { markSessionRequested = resolve; });
const sessionResponseReleased = new Promise(resolve => { releaseSessionResponse = resolve; });
/** 代码作用（白话）：把当前用户接口暂时挂起，稳定复现身份尚未恢复的页面时间窗口。关联文件：auth-api-client.js、auth-store.js。关联逻辑（调用链/数据流）：路由守卫 -> /api/auth/me 拦截 -> 等待断言 -> 返回未登录响应。 */
await page.route('**/api/auth/me', async route => { markSessionRequested(); await sessionResponseReleased; await route.fulfill({ status: 401, contentType: 'application/json', body: JSON.stringify({ code: 401, message: '请先登录', data: null }) }); });
const pageLoad = page.goto('/asset/#/login');
await sessionRequested;
await expect(page.locator('.app-shell')).toHaveCount(0);
releaseSessionResponse();
await pageLoad;
await expect(page.locator('.login-page')).toBeVisible();
});
/** 代码作用（白话）：验证未登录用户刷新受保护页面时，认证响应尚未返回也不会看见后台侧栏、卡片或登录表单。关联文件：index.html、main.js、router/index.js。关联逻辑（调用链/数据流）：浏览器刷新后台 Hash 路由 -> 中性启动底图 -> 路由守卫请求 /api/auth/me -> 401 后进入登录页。 */
test('does not show an admin interface before an unauthenticated protected refresh redirects', async ({ page }) => {
let releaseSessionResponse;
let markSessionRequested;
const sessionRequested = new Promise(resolve => { markSessionRequested = resolve; });
const sessionResponseReleased = new Promise(resolve => { releaseSessionResponse = resolve; });
/** 代码作用（白话）：暂停真实路由守卫发出的当前用户请求，制造刷新期间可观察的认证等待窗口。关联文件：auth-api-client.js、auth-store.js、router/index.js。关联逻辑（调用链/数据流）：受保护地址 -> 路由守卫 -> /api/auth/me 拦截 -> 中性底图断言 -> 返回未登录响应。 */
await page.route('**/api/auth/me', async route => { markSessionRequested(); await sessionResponseReleased; await route.fulfill({ status: 401, contentType: 'application/json', body: JSON.stringify({ code: 401, message: '请先登录', data: null }) }); });
const pageLoad = page.goto('/asset/#/overview');
await sessionRequested;
await expect(page.locator('.app-boot-splash')).toBeVisible();
await expect(page.locator('.login-page, .app-shell')).toHaveCount(0);
releaseSessionResponse();
await pageLoad;
await expect(page).toHaveURL(/#\/login$/);
await expect(page.locator('.login-page')).toBeVisible();
});
/** 代码作用（白话）：验证后端长时间无响应时，用户仍停留在原受保护地址并能看到网络重试入口，而不会被误跳到登录页。关联文件：auth-store.js、router/index.js、App.js。关联逻辑（调用链/数据流）：/api/auth/me 无响应 -> 会话检查超时 -> authState 网络错误状态 -> App 网络提示与重试按钮。 */
test('shows a recoverable timeout state when the session check does not finish', async ({ page }) => {
await page.addInitScript(() => { window.__XYW_AUTH_CHECK_TIMEOUT_MS = 20; });
/** 代码作用（白话）：模拟接口不返回的网络故障，触发前端会话检查超时分支。关联文件：auth-api-client.js、auth-store.js。关联逻辑（调用链/数据流）：请求拦截 -> 保持挂起 -> 超时状态。 */
await page.route('**/api/auth/me', () => new Promise(() => {}));
await page.goto('/asset/#/overview');
await expect(page).toHaveURL(/#\/overview$/);
await expect(page.locator('.auth-network-error')).toBeVisible();
await expect(page.locator('.login-page, .app-shell')).toHaveCount(0);
});
/** Plain purpose: make the image-backed login page observable so an accidental plain-color fallback is caught. Related files: LoginView.js, black_hole.png. Flow: Vite asset import -> CSS custom property -> login background. */
test('renders the login page with its Vite-resolved black-hole background', async ({ page }) => {
await mockUnauthenticatedSession(page);
await page.goto('/asset/#/login');
const backgroundImage = await page.locator('.login-page').evaluate(element => getComputedStyle(element).getPropertyValue('--login-background-image'));
expect(backgroundImage).toContain('url(');
expect(backgroundImage).toContain('black_hole');
});
/** Plain purpose: keep the password input inside the browser-autofill compatibility container used by the working 5173 login page. Related files: LoginView.js, app.css. Flow: password autofill -> compatibility container/style -> user submits the real login form. */
test('keeps the password input inside its autofill compatibility wrapper', async ({ page }) => {
await mockUnauthenticatedSession(page);
await page.goto('/asset/#/login');
await expect(page.locator('.login-password-field input[aria-label="密码"]')).toBeVisible();
});
frontend/tests/phone-asset.spec.js
import { expect, test } from '@playwright/test';
import { expect, test } from './authenticated-test.js';
/**
* 代码作用（白话）：拦截手机号资产列表请求，给弹窗测试准备不依赖后端的空列表。
......
frontend/tests/wecom-account.spec.js
import { expect, test } from '@playwright/test';
import { expect, test } from './authenticated-test.js';
/** File purpose (plain language): checks the enterprise WeChat page's create flow, external-number navigation, and phone filter. */
test('creates an enterprise WeChat asset and exposes the required form', async ({ page }) => {
......
openspec/changes/integrate-authentication-to-master/design.md 0 → 100644
## Context
`origin/master` at `27c7b6d` contains device, phone, and WeCom management but not the authentication module. The source chain is `1cd0087`, `9d5953f`, `3f7c655`, `52071f0`, and `7a452f3`; `52071f0` changes only a historical OpenSpec document and is intentionally excluded under the approved documentation policy.
### Scope-file purpose notes
| Files | Purpose |
|---|---|
| `backend/src/main/java/com/xyw/console/auth/**` and `config/{SecurityConfig,WebConfig}.java` | Login, token/session validation, authorization, system-user administration, and HTTP security policy. |
| `backend/src/main/resources/db/migration/V1__system_user_auth_permissions.sql` | Adds permission/session fields required by authentication. |
| `backend/src/main/java/com/xyw/console/asset/**` changed files | Applies authentication and CSRF checks to existing asset APIs. |
| `frontend/src/modules/auth/**`, `router/index.js`, `main.js`, `App.js`, `index.html` | Login UI, browser state, first-load route decision, and neutral startup display. |
| Changed device, phone, WeCom, system-user frontend files and test files | Keep protected workspaces compatible and prove regressions are avoided. |
| `openspec/changes/integrate-authentication-to-master/**` | Sole planning record for this integration. |
## Goals / Non-Goals
**Goals:**
- Use a neutral first paint while the router validates the session.
- Send unauthenticated visitors to login without showing a protected shell.
- Keep a network failure at the requested URL with a retry path.
- Preserve asset management workflows for permitted users.
**Non-Goals:**
- Do not push, merge to `master`, deploy, or run a database migration without a further user approval.
- Do not include historical source-branch OpenSpec records.
- Do not redesign unrelated asset features.
## Decisions
1. Integrate four runtime commits on a new branch based on `origin/master`; omit `52071f0` because it affects only excluded historical documentation.
2. The router owns the initial current-user decision. The API client handles later expired sessions, avoiding competing redirects.
3. `index.html` provides a neutral boot screen and `main.js` waits for router readiness, avoiding the dashboard-to-login flash.
4. Backend and frontend are a paired release. A database without production data lowers data-risk now, but the inserted administrator's password hash, role, and page permissions must match backend rules before release.
5. Every new or modified method, object method, arrow function, and business callback in scope retains a plain-language comment describing its purpose, related files, and call/data flow.
## Risks / Trade-offs
- [Administrator cannot log in] -> verify password hash, administrator role, and page permissions against the implemented backend before release.
- [Asset regression] -> retain current `master` behavior and run device, phone, WeCom, and frontend regression suites.
- [Refresh flash returns] -> preserve the neutral boot contract and run the dedicated browser checks.
- [Session/CSRF mismatch] -> test authenticated and rejected writes in backend and browser suites.
- [Future production migration] -> approve migration execution separately; application rollback must not blindly delete user/role/permission data.
## Migration Plan
1. Use the isolated integration branch and verify its test evidence.
2. Before any release, insert a verified administrator using the backend-compatible password hash, role, and permissions.
3. Review and run the database migration only after explicit approval.
4. Deploy matching backend and frontend artifacts together.
5. If authentication or core asset behavior fails, roll back application artifacts together; preserve database data for review.
## Open Questions
1. Which exact administrator username, password hash process, role, and page permissions will be inserted before the first release?
2. When the branch is reviewed, do you approve a remote push and a new MR? Those actions remain out of scope for the current execution.
openspec/changes/integrate-authentication-to-master/proposal.md 0 → 100644
## Why
Authentication is a dependent feature chain outside `master`. The refresh-only fix cannot work on its own because `master` lacks the login, session, permission, and database code it needs.
## What Changes
- Integrate the authentication foundation, session/CSRF correction, login UI, and refresh redirect fix on a branch based on current `master`.
- Retain current device, phone, and WeCom asset behavior while adding authentication and page permissions.
- Exclude historical source-branch OpenSpec records; retain only this integration plan.
- **BREAKING**: management pages require a valid authenticated session after release.
## Capabilities
### New Capabilities
- `authentication-master-integration`: safe integration, verification, and release readiness for the full authentication feature.
### Modified Capabilities
<!-- None. -->
## Impact
- Backend authentication, authorization, CSRF protection, system-user data, and the related migration.
- Frontend login, startup routing, protected asset workspaces, and refresh behavior.
- Release readiness requires a valid administrator account and matching frontend/backend artifacts.
openspec/changes/integrate-authentication-to-master/specs/authentication-master-integration/spec.md 0 → 100644
## ADDED Requirements
### Requirement: Complete runtime authentication integration
The integration SHALL include the authentication foundation, session/CSRF correction, login experience, and refresh redirect fix as one feature branch based on current `master`. Historical source-branch OpenSpec records MUST NOT be present in the final integration diff.
#### Scenario: Integration branch is prepared
- **WHEN** maintainers inspect the integration branch
- **THEN** it contains the required runtime code and tests but excludes historical source-branch OpenSpec records
### Requirement: Safe initial routing
The frontend SHALL show an identity-neutral startup state until initial session validation completes. The router MUST own the initial current-user route decision. An unauthenticated visitor MUST NOT see a protected workspace before reaching login.
#### Scenario: Unauthenticated protected refresh
- **WHEN** an unauthenticated visitor refreshes a protected URL
- **THEN** the neutral boot state is shown before the login route, without a dashboard shell or dashboard-shaped placeholder
#### Scenario: Initial network failure
- **WHEN** initial current-user validation fails from a network error rather than a 401 response
- **THEN** the browser remains on the requested URL and provides a retry state
### Requirement: Protected asset compatibility
Permitted authenticated users SHALL retain their device, phone, WeCom, and system-user workflows. Unauthenticated or unauthorized protected writes MUST be rejected by the backend security policy.
#### Scenario: Permitted protected write
- **WHEN** a permitted signed-in user performs an allowed asset write with valid CSRF data
- **THEN** the backend accepts the operation
#### Scenario: Rejected protected write
- **WHEN** a visitor lacks a valid session or required permission for a protected write
- **THEN** the backend rejects the operation and the frontend does not report success
openspec/changes/integrate-authentication-to-master/tasks.md 0 → 100644
## 1. Integration preparation
- [x] 1.1 Confirm `origin/master` base `27c7b6d` and source commits `1cd0087`, `9d5953f`, `3f7c655`, `52071f0`, and `7a452f3`.
- [x] 1.2 Confirm that the database has no production data, no release is scheduled, and the first administrator will be inserted directly into the database before release.
- [x] 1.3 Create an isolated branch from current `master` without changing source branches or the user's dirty worktree.
- [x] 1.4 Exclude historical source-branch OpenSpec records; retain only this integration plan.
## 2. Runtime integration
- [x] 2.1 Apply `1cd0087`, `9d5953f`, `3f7c655`, and `7a452f3` in dependency order.
- [x] 2.2 Omit `52071f0` because it changes only historical documentation excluded by task 1.4.
- [x] 2.3 Confirm no code conflicts occurred with current device, phone, or WeCom changes.
- [x] 2.4 Retain the required beginner comments for new or modified backend and frontend methods/callbacks.
## 3. Verification
- [x] 3.1 Run the backend test suite.
- [x] 3.2 Run the frontend production build.
- [x] 3.3 Run the dedicated login and refresh browser tests.
- [x] 3.4 Run the complete frontend browser regression suite for device, phone, WeCom, and legacy pages.
- [x] 3.5 Review the final staged diff for accidental source documents, secrets, generated files, and omitted runtime files.
## 4. Deferred release actions
- [ ] 4.1 Verify the first inserted administrator's password hash, role, and page permissions against the backend implementation.
- [ ] 4.2 Obtain explicit approval before pushing this branch, creating an MR, merging to `master`, deploying, or running the database migration.
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment