Ai config

controllers/users.js

@@ -1,5 +1,7 @@
 const { query } = require('../config/database')
 const crypto = require('crypto')
+const { paginate } = require('../utils/pagination')
+const { DEFAULT_PASSWORD } = require('../config/constants')
 
 function md5(str) {
   return crypto.createHash('md5').update(str).digest('hex')
@@ -59,6 +61,7 @@ async function login(ctx) {
   }
   
   const token = generateToken()
+  await query('UPDATE users SET token = ? WHERE id = ?', [token, user.id])
   
   const userInfo = {
     id: user.id,
@@ -79,129 +82,113 @@ async function login(ctx) {
 // 用户注册（普通用户）
 async function register(ctx) {
   const { phone, password, name } = ctx.request.body
-  
   if (!phone || !password || !name) {
-    ctx.body = {
-      code: 400,
-      message: '请填写完整信息'
-    }
+    ctx.body = { code: 400, message: '请填写完整信息' }
     return
   }
-  
+
   const existing = await query('SELECT * FROM users WHERE phone = ?', [phone])
-  
   if (existing.length > 0) {
-    ctx.body = {
-      code: 400,
-      message: '该手机号已注册'
-    }
+    ctx.body = { code: 400, message: '该手机号已注册' }
     return
   }
-  
+
   const result = await query(
     'INSERT INTO users (phone, password, name, avatar, points, role) VALUES (?, ?, ?, ?, ?, ?)',
     [phone, md5(password), name, '', 0, 0]
   )
-  
+
   ctx.body = {
     code: 200,
     message: '注册成功',
+    data: { id: result.insertId, phone, name, avatar: '', points: 0, role: 0 }
+  }
+}
+
+async function requireStaffAuth(ctx) {
+
+async function requireStaffAuth(ctx) {
+  const authHeader = ctx.headers.authorization || ''
+  const token = authHeader.replace('Bearer ', '')
+  if (!token) {
+    ctx.body = { code: 401, message: '未登录，请先登录店员账号' }
+    return null
+  }
+  const operators = await query('SELECT * FROM users WHERE token = ? AND role = 1 AND status = 1', [token])
+  if (operators.length === 0) {
+    ctx.body = { code: 401, message: '权限不足，仅店员可操作' }
+    return null
+  }
+  return operators[0]
+}
+
+async function createUser(phone, name, role) {
+  const existing = await query('SELECT * FROM users WHERE phone = ?', [phone])
+  if (existing.length > 0) return { conflict: true }
+
+  const result = await query(
+    'INSERT INTO users (phone, password, name, avatar, points, role) VALUES (?, ?, ?, ?, ?, ?)',
+    [phone, md5(DEFAULT_PASSWORD), name, '', 0, role]
+  )
+
+  return {
+    conflict: false,
     data: {
       id: result.insertId,
       phone,
       name,
       avatar: '',
       points: 0,
-      role: 0
+      role
     }
   }
 }
 
-// 店员注册（由店员帮助用户注册或店员自己注册）
+// 店员注册（需要店员权限）
 async function registerStaff(ctx) {
   const { phone, name } = ctx.request.body
-  
   if (!phone || !name) {
-    ctx.body = {
-      code: 400,
-      message: '请填写手机号和姓名'
-    }
+    ctx.body = { code: 400, message: '请填写手机号和姓名' }
     return
   }
-  
-  const existing = await query('SELECT * FROM users WHERE phone = ?', [phone])
-  
-  if (existing.length > 0) {
-    ctx.body = {
-      code: 400,
-      message: '该手机号已注册'
-    }
+
+  const operator = await requireStaffAuth(ctx)
+  if (!operator) return
+
+  const result = await createUser(phone, name, 1)
+  if (result.conflict) {
+    ctx.body = { code: 400, message: '该手机号已注册' }
     return
   }
-  
-  // 默认密码 123456
-  const defaultPassword = '123456'
-  
-  const result = await query(
-    'INSERT INTO users (phone, password, name, avatar, points, role) VALUES (?, ?, ?, ?, ?, ?)',
-    [phone, md5(defaultPassword), name, '', 0, 1]
-  )
-  
+
   ctx.body = {
     code: 200,
-    message: '店员注册成功，默认密码为123456',
-    data: {
-      id: result.insertId,
-      phone,
-      name,
-      avatar: '',
-      points: 0,
-      role: 1
-    }
+    message: `店员注册成功，默认密码为${DEFAULT_PASSWORD}`,
+    data: result.data
   }
 }
 
-// 店员帮助用户注册
+// 店员帮助用户注册（需要店员权限）
 async function registerByStaff(ctx) {
   const { phone, name } = ctx.request.body
-  
   if (!phone || !name) {
-    ctx.body = {
-      code: 400,
-      message: '请填写手机号和姓名'
-    }
+    ctx.body = { code: 400, message: '请填写手机号和姓名' }
     return
   }
-  
-  const existing = await query('SELECT * FROM users WHERE phone = ?', [phone])
-  
-  if (existing.length > 0) {
-    ctx.body = {
-      code: 400,
-      message: '该手机号已注册'
-    }
+
+  const operator = await requireStaffAuth(ctx)
+  if (!operator) return
+
+  const result = await createUser(phone, name, 0)
+  if (result.conflict) {
+    ctx.body = { code: 400, message: '该手机号已注册' }
     return
   }
-  
-  // 默认密码 123456
-  const defaultPassword = '123456'
-  
-  const result = await query(
-    'INSERT INTO users (phone, password, name, avatar, points, role) VALUES (?, ?, ?, ?, ?, ?)',
-    [phone, md5(defaultPassword), name, '', 0, 0]
-  )
-  
+
   ctx.body = {
     code: 200,
-    message: '用户注册成功，默认密码为123456',
-    data: {
-      id: result.insertId,
-      phone,
-      name,
-      avatar: '',
-      points: 0,
-      role: 0
-    }
+    message: `用户注册成功，默认密码为${DEFAULT_PASSWORD}`,
+    data: result.data
   }
 }
 
@@ -210,18 +197,7 @@ async function getUserInfo(ctx) {
   const userId = parseInt(ctx.query.id)
   
   if (!userId) {
-    // 返回默认用户信息
-    ctx.body = {
-      code: 200,
-      data: {
-        id: 1,
-        phone: '13800138000',
-        name: '张三',
-        avatar: '',
-        points: 1000,
-        role: 0
-      }
-    }
+    ctx.body = { code: 400, message: '缺少用户ID' }
     return
   }
   
@@ -265,11 +241,11 @@ async function getUsers(ctx) {
   
   sql += ' ORDER BY created_at DESC'
   
-  const users = await query(sql, params)
+  const result = await paginate(query, sql, params, ctx.query.page, ctx.query.pageSize)
   
   ctx.body = {
     code: 200,
-    data: users
+    ...result
   }
 }
 
@@ -394,14 +370,14 @@ async function resetPassword(ctx) {
     return
   }
   
-  const defaultPassword = '123456'
-  
+  const defaultPassword = DEFAULT_PASSWORD
+
   const result = await query('UPDATE users SET password = ? WHERE id = ?', [md5(defaultPassword), userId])
-  
+
   if (result.affectedRows > 0) {
     ctx.body = {
       code: 200,
-      message: '密码已重置为123456'
+      message: `密码已重置为${DEFAULT_PASSWORD}`
     }
   } else {
     ctx.body = {