用户系统

art-agent/backend/app/api/admin.py

@@ -0,0 +1,95 @@
+"""
+管理员路由：创建用户 / 用户列表 / 禁用或删除用户。
+"""
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from pydantic import BaseModel
+from sqlmodel import Session, select
+
+from app.auth import hash_password, require_admin
+from app.db import User, get_session
+
+router = APIRouter(prefix="/admin", tags=["admin"])
+
+
+class CreateUserRequest(BaseModel):
+    username: str
+    password: str
+    display_name: str = ""
+    is_admin: bool = False
+
+
+class UserOut(BaseModel):
+    id: str
+    username: str
+    display_name: str
+    is_admin: bool
+    is_active: bool
+    created_at: str
+
+
+@router.post("/users", response_model=UserOut)
+def create_user(
+    body: CreateUserRequest,
+    _admin: User = Depends(require_admin),
+    session: Session = Depends(get_session),
+):
+    existing = session.exec(select(User).where(User.username == body.username)).first()
+    if existing:
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="用户名已存在")
+    if len(body.password) < 6:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="密码至少 6 位")
+
+    user = User(
+        username=body.username,
+        hashed_password=hash_password(body.password),
+        display_name=body.display_name or body.username,
+        is_admin=body.is_admin,
+    )
+    session.add(user)
+    session.commit()
+    session.refresh(user)
+    return UserOut(
+        id=user.id,
+        username=user.username,
+        display_name=user.display_name,
+        is_admin=user.is_admin,
+        is_active=user.is_active,
+        created_at=user.created_at.isoformat(),
+    )
+
+
+@router.get("/users", response_model=list[UserOut])
+def list_users(
+    _admin: User = Depends(require_admin),
+    session: Session = Depends(get_session),
+):
+    users = session.exec(select(User)).all()
+    return [
+        UserOut(
+            id=u.id,
+            username=u.username,
+            display_name=u.display_name,
+            is_admin=u.is_admin,
+            is_active=u.is_active,
+            created_at=u.created_at.isoformat(),
+        )
+        for u in users
+    ]
+
+
+@router.delete("/users/{user_id}")
+def disable_user(
+    user_id: str,
+    _admin: User = Depends(require_admin),
+    session: Session = Depends(get_session),
+):
+    user = session.exec(select(User).where(User.id == user_id)).first()
+    if not user:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="用户不存在")
+    if user.id == _admin.id:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="不能禁用自己")
+    user.is_active = False
+    session.add(user)
+    session.commit()
+    return {"message": f"用户 {user.username} 已禁用"}