ffca168dbe
功能: - 通知提醒系统: 还款日提醒、逾期提醒、系统消息横幅、登录时通知 - 通知中心UI: 铃铛图标 + 下拉列表 + 未读徽章 - 定时任务: APScheduler 每小时检查即将到期的还款 - 邮件通知: SMTP 发送还款提醒和安全警告 - 异常登录通知: 3/5/10次失败触发网页和邮件通知 安全: - 登录安全告警: 异常登录次数达到阈值时发送通知 - 密码重置链接: 一次性使用, 5分钟有效期 - 登录频率限制: IP级和账户级限制 技术: - 后端: FastAPI + SQLAlchemy + PostgreSQL - 前端: 纯 HTML/CSS/JS - 部署: Docker Compose (新增 build 配置)
430 lines
15 KiB
Python
430 lines
15 KiB
Python
from fastapi import APIRouter, Depends, HTTPException, Query
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
from sqlalchemy import select, func, update
|
|
from pydantic import BaseModel
|
|
from app.core.database import get_db
|
|
from app.models.models import User, Debt, AuditLog, Group, SystemSetting
|
|
from app.schemas.schemas import (
|
|
AdminUserResponse, AdminDashboard, SystemSettingUpdate,
|
|
GroupCreate, GroupResponse, GroupMemberAdd, EmailServiceConfig,
|
|
)
|
|
from app.core.deps import require_admin
|
|
from app.core.security import hash_password
|
|
|
|
router = APIRouter(prefix="/admin", tags=["管理后台"])
|
|
|
|
|
|
@router.get("/dashboard", response_model=AdminDashboard)
|
|
async def admin_dashboard(
|
|
admin: User = Depends(require_admin),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
users_count = await db.execute(select(func.count(User.id)))
|
|
pending_count = await db.execute(select(func.count(User.id)).where(User.status == "pending"))
|
|
active_count = await db.execute(select(func.count(User.id)).where(User.status == "active"))
|
|
disabled_count = await db.execute(select(func.count(User.id)).where(User.status == "disabled"))
|
|
|
|
return AdminDashboard(
|
|
total_users=users_count.scalar(),
|
|
active_debts=0,
|
|
total_amount=0,
|
|
overdue_count=0,
|
|
rate_distribution={},
|
|
status_distribution={"pending": pending_count.scalar(), "active": active_count.scalar(), "disabled": disabled_count.scalar()},
|
|
)
|
|
|
|
|
|
@router.get("/users", response_model=list[AdminUserResponse])
|
|
async def list_users(
|
|
page: int = Query(1, ge=1),
|
|
size: int = Query(50, ge=1, le=200),
|
|
search: str = "",
|
|
status_filter: str = "",
|
|
admin: User = Depends(require_admin),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
q = select(User)
|
|
if search:
|
|
q = q.where(User.email.ilike(f"%{search}%") | User.nickname.ilike(f"%{search}%"))
|
|
if status_filter:
|
|
q = q.where(User.status == status_filter)
|
|
q = q.order_by(User.created_at.desc()).offset((page - 1) * size).limit(size)
|
|
result = await db.execute(q)
|
|
users = result.scalars().all()
|
|
|
|
groups_result = await db.execute(select(Group))
|
|
groups_map = {g.id: g.name for g in groups_result.scalars().all()}
|
|
|
|
out = []
|
|
for u in users:
|
|
dc = await db.execute(select(func.count(Debt.id)).where(Debt.user_id == u.id))
|
|
ta = await db.execute(select(func.coalesce(func.sum(Debt.amount), 0)).where(Debt.user_id == u.id))
|
|
ur = AdminUserResponse(
|
|
id=u.id, account=u.email, nickname=u.nickname,
|
|
real_email=u.real_email or "",
|
|
role=u.role, status=u.status, group_id=u.group_id,
|
|
created_at=u.created_at, debt_count=dc.scalar(),
|
|
total_amount=ta.scalar(), group_name=groups_map.get(u.group_id, ""),
|
|
)
|
|
out.append(ur)
|
|
return out
|
|
|
|
|
|
@router.put("/users/{user_id}/status")
|
|
async def set_user_status(
|
|
user_id: int,
|
|
status: str = "",
|
|
admin: User = Depends(require_admin),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
result = await db.execute(select(User).where(User.id == user_id))
|
|
user = result.scalar_one_or_none()
|
|
if not user:
|
|
raise HTTPException(status_code=404, detail="用户不存在")
|
|
if status:
|
|
user.status = status
|
|
else:
|
|
user.status = "active" if user.status != "active" else "disabled"
|
|
await db.commit()
|
|
return {"message": f"用户状态已更新为 {user.status}"}
|
|
|
|
|
|
@router.delete("/users/{user_id}")
|
|
async def delete_user(
|
|
user_id: int,
|
|
admin: User = Depends(require_admin),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
result = await db.execute(select(User).where(User.id == user_id))
|
|
user = result.scalar_one_or_none()
|
|
if not user:
|
|
raise HTTPException(status_code=404, detail="用户不存在")
|
|
if user.role == "admin":
|
|
raise HTTPException(status_code=400, detail="不能删除管理员")
|
|
debts_result = await db.execute(select(Debt).where(Debt.user_id == user_id))
|
|
for d in debts_result.scalars().all():
|
|
await db.delete(d)
|
|
await db.delete(user)
|
|
await db.commit()
|
|
return {"message": "用户已删除"}
|
|
|
|
|
|
@router.get("/users/{user_id}/debts")
|
|
async def view_user_debts(
|
|
user_id: int,
|
|
admin: User = Depends(require_admin),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
result = await db.execute(select(Debt).where(Debt.user_id == user_id))
|
|
return [{"id": d.id, "creditor": d.creditor_name, "amount": d.amount, "status": d.status} for d in result.scalars().all()]
|
|
|
|
|
|
@router.get("/logs")
|
|
async def get_audit_logs(
|
|
page: int = Query(1, ge=1),
|
|
size: int = Query(50, ge=1, le=200),
|
|
admin: User = Depends(require_admin),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
q = select(AuditLog).order_by(AuditLog.created_at.desc()).offset((page - 1) * size).limit(size)
|
|
result = await db.execute(q)
|
|
return [{"id": l.id, "user_id": l.user_id, "action": l.action, "details": l.details, "created_at": l.created_at.isoformat()} for l in result.scalars().all()]
|
|
|
|
|
|
@router.get("/groups", response_model=list[GroupResponse])
|
|
async def list_groups(
|
|
admin: User = Depends(require_admin),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
result = await db.execute(select(Group).order_by(Group.created_at.desc()))
|
|
groups = result.scalars().all()
|
|
out = []
|
|
for g in groups:
|
|
mc = await db.execute(select(func.count(User.id)).where(User.group_id == g.id))
|
|
gr = GroupResponse.model_validate(g)
|
|
gr.member_count = mc.scalar()
|
|
out.append(gr)
|
|
return out
|
|
|
|
|
|
@router.post("/groups", response_model=GroupResponse, status_code=201)
|
|
async def create_group(
|
|
req: GroupCreate,
|
|
admin: User = Depends(require_admin),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
group = Group(name=req.name, description=req.description)
|
|
db.add(group)
|
|
await db.commit()
|
|
await db.refresh(group)
|
|
gr = GroupResponse.model_validate(group)
|
|
gr.member_count = 0
|
|
return gr
|
|
|
|
|
|
@router.delete("/groups/{group_id}")
|
|
async def delete_group(
|
|
group_id: int,
|
|
admin: User = Depends(require_admin),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
result = await db.execute(select(Group).where(Group.id == group_id))
|
|
group = result.scalar_one_or_none()
|
|
if not group:
|
|
raise HTTPException(status_code=404, detail="组不存在")
|
|
await db.execute(select(User).where(User.group_id == group_id).update({"group_id": None}))
|
|
await db.delete(group)
|
|
await db.commit()
|
|
return {"message": "组已删除"}
|
|
|
|
|
|
@router.post("/groups/{group_id}/members")
|
|
async def add_group_member(
|
|
group_id: int,
|
|
req: GroupMemberAdd,
|
|
admin: User = Depends(require_admin),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
group = await db.execute(select(Group).where(Group.id == group_id))
|
|
if not group.scalar_one_or_none():
|
|
raise HTTPException(status_code=404, detail="组不存在")
|
|
user = await db.execute(select(User).where(User.id == req.user_id))
|
|
u = user.scalar_one_or_none()
|
|
if not u:
|
|
raise HTTPException(status_code=404, detail="用户不存在")
|
|
u.group_id = group_id
|
|
await db.commit()
|
|
return {"message": f"用户 {u.email} 已加入组"}
|
|
|
|
|
|
@router.delete("/groups/{group_id}/members/{user_id}")
|
|
async def remove_group_member(
|
|
group_id: int,
|
|
user_id: int,
|
|
admin: User = Depends(require_admin),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
result = await db.execute(select(User).where(User.id == user_id, User.group_id == group_id))
|
|
user = result.scalar_one_or_none()
|
|
if not user:
|
|
raise HTTPException(status_code=404, detail="用户不在此组中")
|
|
user.group_id = None
|
|
await db.commit()
|
|
return {"message": f"用户 {user.email} 已从组中移除"}
|
|
|
|
|
|
class AdminPasswordChange(BaseModel):
|
|
new_password: str
|
|
|
|
|
|
class AdminUserCreate(BaseModel):
|
|
account: str
|
|
password: str
|
|
nickname: str = ""
|
|
real_email: str = ""
|
|
role: str = "user"
|
|
group_id: int | None = None
|
|
|
|
|
|
class AdminUserUpdate(BaseModel):
|
|
account: str | None = None
|
|
nickname: str | None = None
|
|
real_email: str | None = None
|
|
role: str | None = None
|
|
group_id: int | None = None
|
|
|
|
|
|
@router.post("/users", response_model=AdminUserResponse, status_code=201)
|
|
async def create_user(
|
|
req: AdminUserCreate,
|
|
admin: User = Depends(require_admin),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
account = req.account.strip().lower()
|
|
existing = await db.execute(select(User).where(User.email == account))
|
|
if existing.scalar_one_or_none():
|
|
raise HTTPException(status_code=400, detail="账号已存在")
|
|
user = User(
|
|
email=account, password_hash=hash_password(req.password),
|
|
nickname=req.nickname, real_email=req.real_email, role=req.role, status="active",
|
|
group_id=req.group_id,
|
|
)
|
|
db.add(user)
|
|
await db.commit()
|
|
await db.refresh(user)
|
|
return AdminUserResponse(
|
|
id=user.id, account=user.email, nickname=user.nickname,
|
|
role=user.role, status=user.status, group_id=user.group_id,
|
|
created_at=user.created_at, debt_count=0, total_amount=0, group_name="",
|
|
)
|
|
|
|
|
|
@router.put("/users/{user_id}")
|
|
async def update_user(
|
|
user_id: int,
|
|
req: AdminUserUpdate,
|
|
admin: User = Depends(require_admin),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
result = await db.execute(select(User).where(User.id == user_id))
|
|
user = result.scalar_one_or_none()
|
|
if not user:
|
|
raise HTTPException(status_code=404, detail="用户不存在")
|
|
if req.account is not None:
|
|
account = req.account.strip().lower()
|
|
existing = await db.execute(select(User).where(User.email == account, User.id != user_id))
|
|
if existing.scalar_one_or_none():
|
|
raise HTTPException(status_code=400, detail="账号已存在")
|
|
user.email = account
|
|
if req.nickname is not None:
|
|
user.nickname = req.nickname
|
|
if req.real_email is not None:
|
|
user.real_email = req.real_email
|
|
if req.role is not None:
|
|
user.role = req.role
|
|
if req.group_id is not None or req.group_id == "":
|
|
user.group_id = req.group_id if req.group_id else None
|
|
await db.commit()
|
|
return {"message": "用户信息已更新"}
|
|
|
|
|
|
RESET_TOKEN_TTL_HOURS = 24
|
|
|
|
|
|
@router.put("/users/{user_id}/password")
|
|
async def admin_reset_password(
|
|
user_id: int,
|
|
admin: User = Depends(require_admin),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
import secrets
|
|
from datetime import datetime, timedelta
|
|
from app.models.models import SystemSetting
|
|
result = await db.execute(select(User).where(User.id == user_id))
|
|
user = result.scalar_one_or_none()
|
|
if not user:
|
|
raise HTTPException(status_code=404, detail="用户不存在")
|
|
if not user.real_email:
|
|
raise HTTPException(status_code=400, detail="该用户未绑定邮箱，无法发送重置链接")
|
|
token = secrets.token_urlsafe(32)
|
|
expires_at = (datetime.utcnow() + timedelta(hours=RESET_TOKEN_TTL_HOURS)).isoformat()
|
|
key = f"pwd_reset:{user.id}"
|
|
result = await db.execute(select(SystemSetting).where(SystemSetting.key == key))
|
|
setting = result.scalar_one_or_none()
|
|
value = f"{token}|{expires_at}"
|
|
if setting:
|
|
setting.value = value
|
|
else:
|
|
db.add(SystemSetting(key=key, value=value))
|
|
await db.commit()
|
|
from app.services.email_service import send_password_reset_link_email, get_site_url
|
|
site_url = await get_site_url()
|
|
reset_url = f"{site_url}/reset-password.html?token={token}&uid={user.id}"
|
|
await send_password_reset_link_email(user, reset_url, RESET_TOKEN_TTL_HOURS, f"管理员 {admin.email}")
|
|
return {"message": f"重置链接已发送至 {user.real_email}"}
|
|
|
|
|
|
SMTP_KEYS = ["smtp_host", "smtp_port", "smtp_user", "smtp_password", "smtp_from", "smtp_use_tls"]
|
|
|
|
|
|
@router.get("/email-config", response_model=EmailServiceConfig)
|
|
async def get_email_config(
|
|
admin: User = Depends(require_admin),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
result = await db.execute(select(SystemSetting).where(SystemSetting.key.in_(SMTP_KEYS)))
|
|
settings = {r.key: r.value for r in result.scalars().all()}
|
|
return EmailServiceConfig(
|
|
smtp_host=settings.get("smtp_host", ""),
|
|
smtp_port=int(settings.get("smtp_port", "465")),
|
|
smtp_user=settings.get("smtp_user", ""),
|
|
smtp_password=settings.get("smtp_password", ""),
|
|
smtp_from=settings.get("smtp_from", ""),
|
|
smtp_use_tls=settings.get("smtp_use_tls", "true") == "true",
|
|
)
|
|
|
|
|
|
@router.put("/email-config")
|
|
async def update_email_config(
|
|
req: EmailServiceConfig,
|
|
admin: User = Depends(require_admin),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
values = {
|
|
"smtp_host": req.smtp_host,
|
|
"smtp_port": str(req.smtp_port),
|
|
"smtp_user": req.smtp_user,
|
|
"smtp_password": req.smtp_password,
|
|
"smtp_from": req.smtp_from,
|
|
"smtp_use_tls": "true" if req.smtp_use_tls else "false",
|
|
}
|
|
for key, value in values.items():
|
|
result = await db.execute(select(SystemSetting).where(SystemSetting.key == key))
|
|
setting = result.scalar_one_or_none()
|
|
if setting:
|
|
setting.value = value
|
|
else:
|
|
db.add(SystemSetting(key=key, value=value))
|
|
await db.commit()
|
|
return {"message": "邮件服务配置已保存"}
|
|
|
|
|
|
class EmailTestRequest(BaseModel):
|
|
to_email: str
|
|
|
|
|
|
@router.post("/email-test")
|
|
async def test_email(
|
|
req: EmailTestRequest,
|
|
admin: User = Depends(require_admin),
|
|
):
|
|
from app.services.email_service import send_email
|
|
html = """
|
|
<div style="font-family:-apple-system,sans-serif;max-width:480px;margin:0 auto;padding:32px">
|
|
<h2 style="color:#16a34a;margin-bottom:16px">邮件服务测试</h2>
|
|
<p>您好，</p>
|
|
<p>这是一封债务管理系统的邮件服务测试邮件。</p>
|
|
<p>如果您收到此邮件，说明邮件服务器配置正确。</p>
|
|
<div style="background:#f5f5f7;border-radius:12px;padding:20px;margin:16px 0;text-align:center">
|
|
<p style="font-size:24px;margin:0">✅</p>
|
|
<p style="color:#16a34a;font-weight:600;margin:8px 0 0 0">邮件服务正常</p>
|
|
</div>
|
|
<p style="color:#6e6e73;font-size:13px">—— 债务管理系统</p>
|
|
</div>
|
|
"""
|
|
ok = await send_email(req.to_email, "【债务管理系统】邮件服务测试", html)
|
|
if ok:
|
|
return {"message": "发送成功，邮件服务器配置正确。"}
|
|
raise HTTPException(status_code=500, detail="邮件发送失败，请检查 SMTP 配置")
|
|
|
|
|
|
class SiteUrlUpdate(BaseModel):
|
|
site_url: str
|
|
|
|
|
|
@router.get("/site-url")
|
|
async def get_site_url_config(
|
|
admin: User = Depends(require_admin),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
result = await db.execute(select(SystemSetting).where(SystemSetting.key == "site_url"))
|
|
setting = result.scalar_one_or_none()
|
|
return {"site_url": setting.value if setting else ""}
|
|
|
|
|
|
@router.put("/site-url")
|
|
async def update_site_url(
|
|
req: SiteUrlUpdate,
|
|
admin: User = Depends(require_admin),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
url = req.site_url.strip().rstrip("/")
|
|
result = await db.execute(select(SystemSetting).where(SystemSetting.key == "site_url"))
|
|
setting = result.scalar_one_or_none()
|
|
if setting:
|
|
setting.value = url
|
|
else:
|
|
db.add(SystemSetting(key="site_url", value=url))
|
|
await db.commit()
|
|
return {"message": "站点地址已保存"}
|