96 lines
2.7 KiB
Python
96 lines
2.7 KiB
Python
"""
|
|
管理员路由：创建用户 / 用户列表 / 禁用或删除用户。
|
|
"""
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException, status
|
|
from pydantic import BaseModel
|
|
from sqlmodel import Session, select
|
|
|
|
from app.auth import hash_password, require_admin
|
|
from app.db import User, get_session
|
|
|
|
router = APIRouter(prefix="/admin", tags=["admin"])
|
|
|
|
|
|
class CreateUserRequest(BaseModel):
|
|
username: str
|
|
password: str
|
|
display_name: str = ""
|
|
is_admin: bool = False
|
|
|
|
|
|
class UserOut(BaseModel):
|
|
id: str
|
|
username: str
|
|
display_name: str
|
|
is_admin: bool
|
|
is_active: bool
|
|
created_at: str
|
|
|
|
|
|
@router.post("/users", response_model=UserOut)
|
|
def create_user(
|
|
body: CreateUserRequest,
|
|
_admin: User = Depends(require_admin),
|
|
session: Session = Depends(get_session),
|
|
):
|
|
existing = session.exec(select(User).where(User.username == body.username)).first()
|
|
if existing:
|
|
raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="用户名已存在")
|
|
if len(body.password) < 6:
|
|
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="密码至少 6 位")
|
|
|
|
user = User(
|
|
username=body.username,
|
|
hashed_password=hash_password(body.password),
|
|
display_name=body.display_name or body.username,
|
|
is_admin=body.is_admin,
|
|
)
|
|
session.add(user)
|
|
session.commit()
|
|
session.refresh(user)
|
|
return UserOut(
|
|
id=user.id,
|
|
username=user.username,
|
|
display_name=user.display_name,
|
|
is_admin=user.is_admin,
|
|
is_active=user.is_active,
|
|
created_at=user.created_at.isoformat(),
|
|
)
|
|
|
|
|
|
@router.get("/users", response_model=list[UserOut])
|
|
def list_users(
|
|
_admin: User = Depends(require_admin),
|
|
session: Session = Depends(get_session),
|
|
):
|
|
users = session.exec(select(User)).all()
|
|
return [
|
|
UserOut(
|
|
id=u.id,
|
|
username=u.username,
|
|
display_name=u.display_name,
|
|
is_admin=u.is_admin,
|
|
is_active=u.is_active,
|
|
created_at=u.created_at.isoformat(),
|
|
)
|
|
for u in users
|
|
]
|
|
|
|
|
|
@router.delete("/users/{user_id}")
|
|
def disable_user(
|
|
user_id: str,
|
|
_admin: User = Depends(require_admin),
|
|
session: Session = Depends(get_session),
|
|
):
|
|
user = session.exec(select(User).where(User.id == user_id)).first()
|
|
if not user:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="用户不存在")
|
|
if user.id == _admin.id:
|
|
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="不能禁用自己")
|
|
user.is_active = False
|
|
session.add(user)
|
|
session.commit()
|
|
return {"message": f"用户 {user.username} 已禁用"}
|