feat: multi-module iteration

2026-08-04 21:38:49 +08:00
parent 9d96c73246
commit 71f508e02b
1366 changed files with 202004 additions and 0 deletions
@@ -0,0 +1,26 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  Injectable,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { ClientApp } from '@dukang/shared-types';
+import { JwtAuthGuard } from './jwt-auth.guard';
+
+@Injectable()
+export class HqAuthGuard extends JwtAuthGuard implements CanActivate {
+  canActivate(context: ExecutionContext): boolean {
+    const ok = super.canActivate(context);
+    if (!ok) return false;
+
+    const req = context.switchToHttp().getRequest();
+    const clientApp = req.headers['x-client-app'] as ClientApp;
+    if (clientApp !== ClientApp.HQ_WEB) {
+      throw new UnauthorizedException('Invalid client app for admin');
+    }
+    if (req.user?.actorType !== 'HQ') {
+      throw new UnauthorizedException('HQ access required');
+    }
+    return true;
+  }
+}
@@ -0,0 +1,103 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+  SetMetadata,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import {
+  HQ_DANGEROUS_PERMISSION_KEYS,
+  HQ_ROLE_DEFAULT_PERMISSIONS,
+  expandHqPermissionKeys,
+  hasAnySystemSettingsPermission,
+  hqBasePermissionKeys,
+  type HqPermissionKey,
+} from '@dukang/shared-types';
+import { PrismaService } from '../prisma/prisma.module';
+import type { AuthUser } from './jwt-auth.guard';
+
+export const HQ_PERMISSIONS_KEY = 'hq:permissions';
+export const RequireHqPermissions = (...keys: string[]) =>
+  SetMetadata(HQ_PERMISSIONS_KEY, keys);
+/** 任意一项系统设置分组权限即可访问系统设置接口 */
+export const RequireAnySystemSettings = () =>
+  SetMetadata(HQ_PERMISSIONS_KEY, ['__any_system_settings__']);
+
+@Injectable()
+export class HqPermissionsResolver {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async resolveEffectiveKeys(actorId: bigint): Promise<HqPermissionKey[]> {
+    const account = await this.prisma.hqAccount.findUnique({
+      where: { id: actorId },
+      select: { adminRole: true, status: true },
+    });
+    if (!account || account.status !== 'ACTIVE') {
+      throw new ForbiddenException('HQ 账号不可用');
+    }
+
+    const userRows = await this.prisma.hqAccountPermission.findMany({
+      where: { hqAccountId: actorId },
+      select: { permissionKey: true },
+    });
+    const userKeys = userRows.map((r) => r.permissionKey);
+
+    if (account.adminRole === 'SUPER_ADMIN') {
+      // 超管含危险操作（删用户/订单/城市）；其他角色仍需在权限分配中显式勾选
+      return expandHqPermissionKeys([
+        ...hqBasePermissionKeys(),
+        ...HQ_DANGEROUS_PERMISSION_KEYS,
+        ...userKeys,
+      ]);
+    }
+
+    const roleRows = await this.prisma.hqRolePermission.findMany({
+      where: { adminRole: account.adminRole },
+      select: { permissionKey: true },
+    });
+
+    const roleKeys =
+      roleRows.length > 0
+        ? roleRows.map((r) => r.permissionKey)
+        : [...(HQ_ROLE_DEFAULT_PERMISSIONS[account.adminRole] ?? [])];
+
+    return expandHqPermissionKeys([...roleKeys, ...userKeys]);
+  }
+}
+
+@Injectable()
+export class HqPermissionGuard implements CanActivate {
+  constructor(
+    private readonly resolver: HqPermissionsResolver,
+    private readonly reflector: Reflector,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const req = context.switchToHttp().getRequest();
+    const user = req.user as AuthUser | undefined;
+    if (!user || user.actorType !== 'HQ') {
+      throw new ForbiddenException('需要 HQ 权限');
+    }
+    const keys = await this.resolver.resolveEffectiveKeys(user.actorId);
+    req.hqPermissionKeys = keys;
+
+    const required =
+      this.reflector.getAllAndOverride<string[]>(HQ_PERMISSIONS_KEY, [
+        context.getHandler(),
+        context.getClass(),
+      ]) ?? [];
+
+    if (!required.length) return true;
+    if (required.includes('__any_system_settings__')) {
+      if (!hasAnySystemSettingsPermission(keys)) {
+        throw new ForbiddenException('无系统设置权限');
+      }
+      return true;
+    }
+    if (!required.some((k) => keys.includes(k as HqPermissionKey))) {
+      throw new ForbiddenException('权限不足');
+    }
+    return true;
+  }
+}
@@ -0,0 +1,56 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  Injectable,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import { CLIENT_APP_ACTOR_MAP, ClientApp } from '@dukang/shared-types';
+
+export interface AuthUser {
+  actorType: string;
+  actorId: bigint;
+  clientApp: ClientApp;
+  sub: string;
+  phoneVerified: boolean;
+  /** Selected store after POST /shop/auth/select-store */
+  storeId?: bigint;
+}
+
+@Injectable()
+export class JwtAuthGuard implements CanActivate {
+  constructor(protected readonly jwtService: JwtService) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    const req = context.switchToHttp().getRequest();
+    const auth = req.headers.authorization as string | undefined;
+    if (!auth?.startsWith('Bearer ')) {
+      throw new UnauthorizedException('Missing token');
+    }
+    try {
+      const payload = this.jwtService.verify(auth.slice(7));
+      const clientApp = req.headers['x-client-app'] as ClientApp;
+      if (!clientApp || payload.clientApp !== clientApp) {
+        throw new UnauthorizedException('Invalid client app');
+      }
+      const expectedActor = CLIENT_APP_ACTOR_MAP[clientApp];
+      if (payload.actorType !== expectedActor) {
+        throw new UnauthorizedException('Actor mismatch');
+      }
+      req.user = {
+        actorType: payload.actorType,
+        actorId: BigInt(payload.actorId),
+        clientApp,
+        sub: payload.sub,
+        phoneVerified: !!payload.phoneVerified,
+        ...(payload.storeId != null && payload.storeId !== ''
+          ? { storeId: BigInt(payload.storeId) }
+          : {}),
+      } satisfies AuthUser;
+      return true;
+    } catch (err) {
+      if (err instanceof UnauthorizedException) throw err;
+      throw new UnauthorizedException('Invalid token');
+    }
+  }
+}
@@ -0,0 +1,50 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  Injectable,
+} from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import { CLIENT_APP_ACTOR_MAP, ClientApp } from '@dukang/shared-types';
+import type { AuthUser } from './jwt-auth.guard';
+
+/** C 端 H5 / 小程序同属 USER，目录白名单只认 actorId→手机号，允许端间 token 兼容 */
+const USER_CLIENT_APPS = new Set<ClientApp>([ClientApp.USER_MINI, ClientApp.USER_H5]);
+
+function clientAppCompatible(headerApp: ClientApp | undefined, payloadApp: unknown): boolean {
+  if (!headerApp || payloadApp == null) return false;
+  if (headerApp === payloadApp) return true;
+  return USER_CLIENT_APPS.has(headerApp) && USER_CLIENT_APPS.has(payloadApp as ClientApp);
+}
+
+@Injectable()
+export class OptionalJwtAuthGuard implements CanActivate {
+  constructor(private readonly jwtService: JwtService) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    const req = context.switchToHttp().getRequest();
+    const auth = req.headers.authorization as string | undefined;
+    if (!auth?.startsWith('Bearer ')) {
+      return true;
+    }
+    try {
+      const payload = this.jwtService.verify(auth.slice(7));
+      const clientApp = req.headers['x-client-app'] as ClientApp;
+      if (!clientAppCompatible(clientApp, payload.clientApp)) return true;
+      const expectedActor = CLIENT_APP_ACTOR_MAP[clientApp];
+      if (payload.actorType !== expectedActor) return true;
+      req.user = {
+        actorType: payload.actorType,
+        actorId: BigInt(payload.actorId),
+        clientApp,
+        sub: payload.sub,
+        phoneVerified: !!payload.phoneVerified,
+        ...(payload.storeId != null && payload.storeId !== ''
+          ? { storeId: BigInt(payload.storeId) }
+          : {}),
+      } satisfies AuthUser;
+    } catch {
+      /* ignore invalid token */
+    }
+    return true;
+  }
+}
@@ -0,0 +1,45 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import type { PartnerPermissionKey } from '@dukang/shared-types';
+import { PARTNER_PERMISSIONS_KEY } from '../decorators/partner-permission.decorator';
+import { PrismaService } from '../prisma/prisma.module';
+import { AuthUser, JwtAuthGuard } from './jwt-auth.guard';
+
+@Injectable()
+export class PartnerPermissionGuard implements CanActivate {
+  constructor(
+    private readonly jwtAuthGuard: JwtAuthGuard,
+    private readonly prisma: PrismaService,
+    private readonly reflector: Reflector,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    await this.jwtAuthGuard.canActivate(context);
+    const req = context.switchToHttp().getRequest();
+    const user = req.user as AuthUser;
+    if (user.actorType !== 'PARTNER') {
+      throw new ForbiddenException('仅合伙人可操作');
+    }
+    const account = await this.prisma.partnerAccount.findUniqueOrThrow({
+      where: { id: user.actorId },
+    });
+    if (account.isPrimary === 1) return true;
+
+    const required = this.reflector.getAllAndOverride<PartnerPermissionKey[]>(
+      PARTNER_PERMISSIONS_KEY,
+      [context.getHandler(), context.getClass()],
+    );
+    if (!required?.length) return true;
+
+    const perms = Array.isArray(account.permissions)
+      ? (account.permissions as string[])
+      : [];
+    if (required.some((p) => perms.includes(p))) return true;
+    throw new ForbiddenException('当前子账号无此操作权限');
+  }
+}
@@ -0,0 +1,32 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+} from '@nestjs/common';
+import { PrismaService } from '../prisma/prisma.module';
+import { AuthUser, JwtAuthGuard } from './jwt-auth.guard';
+
+@Injectable()
+export class PartnerPrimaryGuard implements CanActivate {
+  constructor(
+    private readonly jwtAuthGuard: JwtAuthGuard,
+    private readonly prisma: PrismaService,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    this.jwtAuthGuard.canActivate(context);
+    const req = context.switchToHttp().getRequest();
+    const user = req.user as AuthUser;
+    if (user.actorType !== 'PARTNER') {
+      throw new ForbiddenException('仅合伙人主账号可操作');
+    }
+    const account = await this.prisma.partnerAccount.findUniqueOrThrow({
+      where: { id: user.actorId },
+    });
+    if (account.isPrimary !== 1) {
+      throw new ForbiddenException('仅主账号可操作');
+    }
+    return true;
+  }
+}
@@ -0,0 +1,33 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+} from '@nestjs/common';
+import { PrismaService } from '../prisma/prisma.module';
+import type { AuthUser } from './jwt-auth.guard';
+
+@Injectable()
+export class PhoneVerifiedGuard implements CanActivate {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const req = context.switchToHttp().getRequest();
+    const user = req.user as AuthUser | undefined;
+    if (!user || user.actorType !== 'USER') {
+      throw new ForbiddenException('请先验证手机号');
+    }
+
+    const row = await this.prisma.user.findUnique({
+      where: { id: user.actorId },
+      select: { phoneVerifiedAt: true, mergedIntoUserId: true, status: true },
+    });
+    if (!row || row.status !== 1 || row.mergedIntoUserId) {
+      throw new ForbiddenException('账号状态异常，请重新进入');
+    }
+    if (!row.phoneVerifiedAt) {
+      throw new ForbiddenException('请先验证手机号');
+    }
+    return true;
+  }
+}
@@ -0,0 +1,30 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+} from '@nestjs/common';
+import { PrismaService } from '../prisma/prisma.module';
+import type { AuthUser } from './jwt-auth.guard';
+
+/** 门店主账号专用（提现等资金操作） */
+@Injectable()
+export class ShopPrimaryGuard implements CanActivate {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const req = context.switchToHttp().getRequest();
+    const user = req.user as AuthUser | undefined;
+    if (!user || user.actorType !== 'STORE') {
+      throw new ForbiddenException('仅门店主账号可操作');
+    }
+    const account = await this.prisma.storeAccount.findUnique({
+      where: { id: user.actorId },
+      select: { isPrimary: true },
+    });
+    if (!account || account.isPrimary !== 1) {
+      throw new ForbiddenException('仅门店主账号可申请提现');
+    }
+    return true;
+  }
+}
@@ -0,0 +1,15 @@
+import { CanActivate, ExecutionContext, ForbiddenException, Injectable } from '@nestjs/common';
+import type { AuthUser } from './jwt-auth.guard';
+
+/** Shop business APIs require JWT claim storeId (after select-store). */
+@Injectable()
+export class ShopStoreGuard implements CanActivate {
+  canActivate(context: ExecutionContext): boolean {
+    const req = context.switchToHttp().getRequest();
+    const user = req.user as AuthUser | undefined;
+    if (!user?.storeId) {
+      throw new ForbiddenException('请先选择门店');
+    }
+    return true;
+  }
+}
@@ -0,0 +1,27 @@
+import { ForbiddenException, Injectable } from '@nestjs/common';
+import { PrismaService } from '../prisma/prisma.module';
+import type { AuthUser } from '../guards/jwt-auth.guard';
+
+@Injectable()
+export class StoreMembershipService {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async assertStoreMembership(accountId: bigint, storeId: bigint) {
+    const binding = await this.prisma.storeAccountStore.findUnique({
+      where: {
+        storeAccountId_storeId: { storeAccountId: accountId, storeId },
+      },
+    });
+    if (!binding) {
+      throw new ForbiddenException('无权访问该门店');
+    }
+    return binding;
+  }
+
+  requireShopStoreId(user: AuthUser): bigint {
+    if (!user.storeId) {
+      throw new ForbiddenException('请先选择门店');
+    }
+    return user.storeId;
+  }
+}
@@ -0,0 +1,29 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+} from '@nestjs/common';
+import { PrismaService } from '../prisma/prisma.module';
+import type { AuthUser } from './jwt-auth.guard';
+
+@Injectable()
+export class SuperAdminGuard implements CanActivate {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const req = context.switchToHttp().getRequest();
+    const user = req.user as AuthUser | undefined;
+    if (!user || user.actorType !== 'HQ') {
+      throw new ForbiddenException('需要 HQ 权限');
+    }
+    const account = await this.prisma.hqAccount.findUnique({
+      where: { id: user.actorId },
+      select: { adminRole: true, status: true },
+    });
+    if (!account || account.status !== 'ACTIVE' || account.adminRole !== 'SUPER_ADMIN') {
+      throw new ForbiddenException('需要超级管理员权限');
+    }
+    return true;
+  }
+}