760 lines
27 KiB
Python
760 lines
27 KiB
Python
# -*- coding: utf-8 -*-
|
||
"""
|
||
小程序认证路由 —— 微信登录、申请提交、状态查询、店铺切换、令牌刷新。
|
||
|
||
端点清单：
|
||
- POST /api/xcx/login — 微信登录（查找/创建用户 + 签发 JWT）
|
||
- POST /api/xcx/apply — 提交入驻申请
|
||
- GET /api/xcx/me — 查询自身状态 + 申请列表
|
||
- GET /api/xcx/me/sites — 查询关联店铺
|
||
- POST /api/xcx/switch-site — 切换当前店铺
|
||
- POST /api/xcx/refresh — 刷新令牌
|
||
- POST /api/xcx/dev-login — 开发模式 mock 登录（仅 WX_DEV_MODE=true）
|
||
- POST /api/xcx/dev-switch-role — 切换角色（仅 WX_DEV_MODE=true）
|
||
- POST /api/xcx/dev-switch-status — 切换用户状态（仅 WX_DEV_MODE=true）
|
||
- POST /api/xcx/dev-switch-binding — 切换人员绑定（仅 WX_DEV_MODE=true）
|
||
- GET /api/xcx/dev-context — 查询调试上下文（仅 WX_DEV_MODE=true）
|
||
"""
|
||
|
||
from __future__ import annotations
|
||
|
||
import logging
|
||
|
||
from fastapi import APIRouter, Depends, HTTPException, status
|
||
from jose import JWTError
|
||
from psycopg2 import errors as pg_errors
|
||
|
||
from app.auth.dependencies import (
|
||
CurrentUser,
|
||
get_current_user,
|
||
get_current_user_or_limited,
|
||
)
|
||
from app.auth.jwt import (
|
||
create_limited_token_pair,
|
||
create_token_pair,
|
||
decode_refresh_token,
|
||
)
|
||
from app import config
|
||
from app.database import get_connection
|
||
from app.services.application import (
|
||
create_application,
|
||
get_user_applications,
|
||
)
|
||
from app.schemas.xcx_auth import (
|
||
ApplicationRequest,
|
||
ApplicationResponse,
|
||
DevLoginRequest,
|
||
DevSwitchBindingRequest,
|
||
DevSwitchRoleRequest,
|
||
DevSwitchStatusRequest,
|
||
DevContextResponse,
|
||
RefreshTokenRequest,
|
||
SiteInfo,
|
||
SwitchSiteRequest,
|
||
UserStatusResponse,
|
||
WxLoginRequest,
|
||
WxLoginResponse,
|
||
)
|
||
from app.services.wechat import WeChatAuthError, code2session
|
||
from app.services.role import get_user_permissions
|
||
|
||
logger = logging.getLogger(__name__)
|
||
|
||
router = APIRouter(prefix="/api/xcx", tags=["小程序认证"])
|
||
|
||
|
||
# ── 辅助：查询用户在指定 site_id 下的角色 code 列表 ──────────
|
||
|
||
def _get_user_roles_at_site(conn, user_id: int, site_id: int) -> list[str]:
|
||
"""查询用户在指定 site_id 下的角色 code 列表。"""
|
||
with conn.cursor() as cur:
|
||
cur.execute(
|
||
"""
|
||
SELECT r.code
|
||
FROM auth.user_site_roles usr
|
||
JOIN auth.roles r ON usr.role_id = r.id
|
||
WHERE usr.user_id = %s AND usr.site_id = %s
|
||
""",
|
||
(user_id, site_id),
|
||
)
|
||
return [row[0] for row in cur.fetchall()]
|
||
|
||
|
||
def _get_user_default_site(conn, user_id: int) -> int | None:
|
||
"""获取用户第一个关联的 site_id（按创建时间排序）。"""
|
||
with conn.cursor() as cur:
|
||
cur.execute(
|
||
"""
|
||
SELECT DISTINCT site_id
|
||
FROM auth.user_site_roles
|
||
WHERE user_id = %s
|
||
ORDER BY site_id
|
||
LIMIT 1
|
||
""",
|
||
(user_id,),
|
||
)
|
||
row = cur.fetchone()
|
||
return row[0] if row else None
|
||
|
||
|
||
# ── POST /api/xcx/login ──────────────────────────────────
|
||
|
||
@router.post("/login", response_model=WxLoginResponse)
|
||
async def wx_login(body: WxLoginRequest):
|
||
"""
|
||
微信登录。
|
||
|
||
流程：code → code2session(openid) → 查找/创建 auth.users → 签发 JWT。
|
||
- disabled 用户返回 403
|
||
- 新用户自动创建（status=new），前端引导至申请页
|
||
- approved 用户签发包含 site_id + roles 的完整令牌
|
||
- new/pending/rejected 用户签发受限令牌
|
||
"""
|
||
# 1. 调用微信 code2Session
|
||
try:
|
||
wx_result = await code2session(body.code)
|
||
except WeChatAuthError as exc:
|
||
raise HTTPException(status_code=exc.http_status, detail=exc.detail)
|
||
except RuntimeError as exc:
|
||
# 微信配置缺失
|
||
logger.error("微信配置错误: %s", exc)
|
||
raise HTTPException(
|
||
status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
|
||
detail="服务器配置错误",
|
||
)
|
||
|
||
openid = wx_result["openid"]
|
||
unionid = wx_result.get("unionid")
|
||
|
||
# 2. 查找/创建用户
|
||
conn = get_connection()
|
||
try:
|
||
with conn.cursor() as cur:
|
||
cur.execute(
|
||
"SELECT id, status FROM auth.users WHERE wx_openid = %s",
|
||
(openid,),
|
||
)
|
||
row = cur.fetchone()
|
||
|
||
if row is None:
|
||
# 新用户：创建 new 记录（尚未提交申请）
|
||
try:
|
||
cur.execute(
|
||
"""
|
||
INSERT INTO auth.users (wx_openid, wx_union_id, status)
|
||
VALUES (%s, %s, 'new')
|
||
RETURNING id, status
|
||
""",
|
||
(openid, unionid),
|
||
)
|
||
row = cur.fetchone()
|
||
conn.commit()
|
||
except pg_errors.UniqueViolation:
|
||
# 并发创建：回滚后查询已有记录
|
||
conn.rollback()
|
||
cur.execute(
|
||
"SELECT id, status FROM auth.users WHERE wx_openid = %s",
|
||
(openid,),
|
||
)
|
||
row = cur.fetchone()
|
||
|
||
user_id, user_status = row
|
||
|
||
# 3. disabled 用户拒绝登录
|
||
if user_status == "disabled":
|
||
raise HTTPException(
|
||
status_code=status.HTTP_403_FORBIDDEN,
|
||
detail="账号已被禁用",
|
||
)
|
||
|
||
# 4. 签发令牌
|
||
if user_status == "approved":
|
||
# 查找默认 site_id 和角色
|
||
default_site_id = _get_user_default_site(conn, user_id)
|
||
if default_site_id is not None:
|
||
roles = _get_user_roles_at_site(conn, user_id, default_site_id)
|
||
tokens = create_token_pair(user_id, default_site_id, roles=roles)
|
||
else:
|
||
# approved 但无 site 绑定（异常边界），签发受限令牌
|
||
tokens = create_limited_token_pair(user_id)
|
||
else:
|
||
# new / pending / rejected → 受限令牌
|
||
tokens = create_limited_token_pair(user_id)
|
||
|
||
finally:
|
||
conn.close()
|
||
|
||
return WxLoginResponse(
|
||
access_token=tokens["access_token"],
|
||
refresh_token=tokens["refresh_token"],
|
||
token_type=tokens["token_type"],
|
||
user_status=user_status,
|
||
user_id=user_id,
|
||
)
|
||
|
||
|
||
# ── POST /api/xcx/apply ──────────────────────────────────
|
||
|
||
@router.post("/apply", response_model=ApplicationResponse)
|
||
async def submit_application(
|
||
body: ApplicationRequest,
|
||
user: CurrentUser = Depends(get_current_user_or_limited),
|
||
):
|
||
"""
|
||
提交入驻申请。
|
||
|
||
委托 application service 处理：
|
||
检查重复 pending → site_code 映射 → 创建记录 → 更新 nickname。
|
||
"""
|
||
result = await create_application(
|
||
user_id=user.user_id,
|
||
site_code=body.site_code,
|
||
applied_role_text=body.applied_role_text,
|
||
phone=body.phone,
|
||
employee_number=body.employee_number,
|
||
nickname=body.nickname,
|
||
)
|
||
return ApplicationResponse(**result)
|
||
|
||
|
||
# ── GET /api/xcx/me ───────────────────────────────────────
|
||
|
||
@router.get("/me", response_model=UserStatusResponse)
|
||
async def get_my_status(
|
||
user: CurrentUser = Depends(get_current_user_or_limited),
|
||
):
|
||
"""
|
||
查询自身状态 + 所有申请记录。
|
||
|
||
pending / approved / rejected 用户均可访问。
|
||
"""
|
||
conn = get_connection()
|
||
try:
|
||
with conn.cursor() as cur:
|
||
# 查询用户基本信息
|
||
cur.execute(
|
||
"SELECT id, status, nickname FROM auth.users WHERE id = %s",
|
||
(user.user_id,),
|
||
)
|
||
user_row = cur.fetchone()
|
||
if user_row is None:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||
detail="用户不存在",
|
||
)
|
||
|
||
user_id, user_status, nickname = user_row
|
||
finally:
|
||
conn.close()
|
||
|
||
# 委托 service 查询申请列表
|
||
app_list = await get_user_applications(user_id)
|
||
applications = [ApplicationResponse(**a) for a in app_list]
|
||
|
||
return UserStatusResponse(
|
||
user_id=user_id,
|
||
status=user_status,
|
||
nickname=nickname,
|
||
applications=applications,
|
||
)
|
||
|
||
|
||
# ── GET /api/xcx/me/sites ────────────────────────────────
|
||
|
||
@router.get("/me/sites", response_model=list[SiteInfo])
|
||
async def get_my_sites(
|
||
user: CurrentUser = Depends(get_current_user),
|
||
):
|
||
"""
|
||
查询当前用户关联的所有店铺及对应角色。
|
||
|
||
仅 approved 用户可访问（通过 get_current_user 依赖保证）。
|
||
"""
|
||
conn = get_connection()
|
||
try:
|
||
with conn.cursor() as cur:
|
||
cur.execute(
|
||
"""
|
||
SELECT usr.site_id,
|
||
COALESCE(scm.site_name, '未知店铺') AS site_name,
|
||
r.code AS role_code,
|
||
r.name AS role_name
|
||
FROM auth.user_site_roles usr
|
||
JOIN auth.roles r ON usr.role_id = r.id
|
||
LEFT JOIN auth.site_code_mapping scm ON usr.site_id = scm.site_id
|
||
WHERE usr.user_id = %s
|
||
ORDER BY usr.site_id, r.code
|
||
""",
|
||
(user.user_id,),
|
||
)
|
||
rows = cur.fetchall()
|
||
finally:
|
||
conn.close()
|
||
|
||
# 按 site_id 分组
|
||
sites_map: dict[int, SiteInfo] = {}
|
||
for site_id, site_name, role_code, role_name in rows:
|
||
if site_id not in sites_map:
|
||
sites_map[site_id] = SiteInfo(
|
||
site_id=site_id, site_name=site_name, roles=[]
|
||
)
|
||
sites_map[site_id].roles.append({"code": role_code, "name": role_name})
|
||
|
||
return list(sites_map.values())
|
||
|
||
|
||
# ── POST /api/xcx/switch-site ────────────────────────────
|
||
|
||
@router.post("/switch-site", response_model=WxLoginResponse)
|
||
async def switch_site(
|
||
body: SwitchSiteRequest,
|
||
user: CurrentUser = Depends(get_current_user),
|
||
):
|
||
"""
|
||
切换当前店铺。
|
||
|
||
验证用户在目标 site_id 下有角色绑定，然后签发包含新 site_id 的 JWT。
|
||
"""
|
||
conn = get_connection()
|
||
try:
|
||
with conn.cursor() as cur:
|
||
# 验证用户在目标 site_id 下有角色
|
||
cur.execute(
|
||
"""
|
||
SELECT 1 FROM auth.user_site_roles
|
||
WHERE user_id = %s AND site_id = %s
|
||
LIMIT 1
|
||
""",
|
||
(user.user_id, body.site_id),
|
||
)
|
||
if cur.fetchone() is None:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_403_FORBIDDEN,
|
||
detail="您在该店铺下没有角色绑定",
|
||
)
|
||
|
||
roles = _get_user_roles_at_site(conn, user.user_id, body.site_id)
|
||
|
||
# 查询用户状态
|
||
cur.execute(
|
||
"SELECT status FROM auth.users WHERE id = %s",
|
||
(user.user_id,),
|
||
)
|
||
user_row = cur.fetchone()
|
||
user_status = user_row[0] if user_row else "pending"
|
||
|
||
finally:
|
||
conn.close()
|
||
|
||
tokens = create_token_pair(user.user_id, body.site_id, roles=roles)
|
||
|
||
return WxLoginResponse(
|
||
access_token=tokens["access_token"],
|
||
refresh_token=tokens["refresh_token"],
|
||
token_type=tokens["token_type"],
|
||
user_status=user_status,
|
||
user_id=user.user_id,
|
||
)
|
||
|
||
|
||
# ── POST /api/xcx/refresh ────────────────────────────────
|
||
|
||
@router.post("/refresh", response_model=WxLoginResponse)
|
||
async def refresh_token(body: RefreshTokenRequest):
|
||
"""
|
||
刷新令牌。
|
||
|
||
解码 refresh_token → 根据用户当前状态签发新的令牌对。
|
||
- 受限 refresh_token（limited=True）→ 签发新的受限令牌对
|
||
- 完整 refresh_token → 签发新的完整令牌对（保持原 site_id）
|
||
"""
|
||
try:
|
||
payload = decode_refresh_token(body.refresh_token)
|
||
except JWTError:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||
detail="无效的刷新令牌",
|
||
)
|
||
|
||
user_id = int(payload["sub"])
|
||
is_limited = payload.get("limited", False)
|
||
|
||
conn = get_connection()
|
||
try:
|
||
with conn.cursor() as cur:
|
||
# 查询用户当前状态
|
||
cur.execute(
|
||
"SELECT id, status FROM auth.users WHERE id = %s",
|
||
(user_id,),
|
||
)
|
||
user_row = cur.fetchone()
|
||
if user_row is None:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||
detail="用户不存在",
|
||
)
|
||
|
||
_, user_status = user_row
|
||
|
||
if user_status == "disabled":
|
||
raise HTTPException(
|
||
status_code=status.HTTP_403_FORBIDDEN,
|
||
detail="账号已被禁用",
|
||
)
|
||
|
||
if is_limited or user_status != "approved":
|
||
# 受限令牌刷新 → 仍签发受限令牌
|
||
tokens = create_limited_token_pair(user_id)
|
||
else:
|
||
# 完整令牌刷新 → 使用原 site_id 签发
|
||
site_id = payload.get("site_id")
|
||
if site_id is None:
|
||
# 回退到默认 site
|
||
site_id = _get_user_default_site(conn, user_id)
|
||
if site_id is not None:
|
||
roles = _get_user_roles_at_site(conn, user_id, site_id)
|
||
tokens = create_token_pair(user_id, site_id, roles=roles)
|
||
else:
|
||
tokens = create_limited_token_pair(user_id)
|
||
|
||
finally:
|
||
conn.close()
|
||
|
||
return WxLoginResponse(
|
||
access_token=tokens["access_token"],
|
||
refresh_token=tokens["refresh_token"],
|
||
token_type=tokens["token_type"],
|
||
user_status=user_status,
|
||
user_id=user_id,
|
||
)
|
||
|
||
# ── POST /api/xcx/dev-login（仅开发模式） ─────────────────
|
||
|
||
if config.WX_DEV_MODE:
|
||
|
||
@router.post("/dev-login", response_model=WxLoginResponse)
|
||
async def dev_login(body: DevLoginRequest):
|
||
"""
|
||
开发模式 mock 登录。
|
||
|
||
直接根据 openid 查找/创建用户，跳过微信 code2Session。
|
||
- 已有用户：status 参数为空时保留当前状态，非空时覆盖
|
||
- 新用户：status 参数为空时默认 new，非空时使用指定值
|
||
仅在 WX_DEV_MODE=true 时注册。
|
||
"""
|
||
openid = body.openid
|
||
target_status = body.status # 可能为 None
|
||
|
||
conn = get_connection()
|
||
try:
|
||
with conn.cursor() as cur:
|
||
# 查找已有用户
|
||
cur.execute(
|
||
"SELECT id, status FROM auth.users WHERE wx_openid = %s",
|
||
(openid,),
|
||
)
|
||
row = cur.fetchone()
|
||
|
||
if row is None:
|
||
# 新用户：使用指定状态或默认 new
|
||
init_status = target_status or "new"
|
||
cur.execute(
|
||
"""
|
||
INSERT INTO auth.users (wx_openid, status)
|
||
VALUES (%s, %s)
|
||
RETURNING id, status
|
||
""",
|
||
(openid, init_status),
|
||
)
|
||
row = cur.fetchone()
|
||
conn.commit()
|
||
else:
|
||
# 已有用户：仅在显式传入 status 时覆盖
|
||
if target_status is not None:
|
||
user_id_existing = row[0]
|
||
cur.execute(
|
||
"UPDATE auth.users SET status = %s, updated_at = NOW() WHERE id = %s",
|
||
(target_status, user_id_existing),
|
||
)
|
||
conn.commit()
|
||
row = (user_id_existing, target_status)
|
||
|
||
user_id, user_status = row
|
||
|
||
# 签发令牌（逻辑与正常登录一致）
|
||
if user_status == "approved":
|
||
default_site_id = _get_user_default_site(conn, user_id)
|
||
if default_site_id is not None:
|
||
roles = _get_user_roles_at_site(conn, user_id, default_site_id)
|
||
tokens = create_token_pair(user_id, default_site_id, roles=roles)
|
||
else:
|
||
tokens = create_limited_token_pair(user_id)
|
||
else:
|
||
tokens = create_limited_token_pair(user_id)
|
||
|
||
finally:
|
||
conn.close()
|
||
|
||
return WxLoginResponse(
|
||
access_token=tokens["access_token"],
|
||
refresh_token=tokens["refresh_token"],
|
||
token_type=tokens["token_type"],
|
||
user_status=user_status,
|
||
user_id=user_id,
|
||
)
|
||
|
||
# ── GET /api/xcx/dev-context（仅开发模式） ────────────────
|
||
|
||
@router.get("/dev-context", response_model=DevContextResponse)
|
||
async def dev_context(
|
||
user: CurrentUser = Depends(get_current_user_or_limited),
|
||
):
|
||
"""
|
||
返回当前用户的完整调试上下文。
|
||
|
||
包含：用户信息、当前门店、角色、权限、人员绑定、所有关联门店。
|
||
允许受限令牌访问（返回基础信息，门店/角色/权限为空）。
|
||
"""
|
||
conn = get_connection()
|
||
try:
|
||
with conn.cursor() as cur:
|
||
# 用户基本信息
|
||
cur.execute(
|
||
"SELECT wx_openid, status, nickname FROM auth.users WHERE id = %s",
|
||
(user.user_id,),
|
||
)
|
||
u_row = cur.fetchone()
|
||
if u_row is None:
|
||
raise HTTPException(status_code=404, detail="用户不存在")
|
||
openid, u_status, nickname = u_row
|
||
|
||
# 当前门店名称
|
||
site_name = None
|
||
if user.site_id:
|
||
cur.execute(
|
||
"SELECT site_name FROM auth.site_code_mapping WHERE site_id = %s",
|
||
(user.site_id,),
|
||
)
|
||
sn_row = cur.fetchone()
|
||
site_name = sn_row[0] if sn_row else None
|
||
|
||
# 当前门店下的角色
|
||
roles = _get_user_roles_at_site(conn, user.user_id, user.site_id) if user.site_id else []
|
||
|
||
# 当前门店下的权限
|
||
permissions = await get_user_permissions(user.user_id, user.site_id) if user.site_id else []
|
||
|
||
# 人员绑定
|
||
binding = None
|
||
if user.site_id:
|
||
cur.execute(
|
||
"""
|
||
SELECT assistant_id, staff_id, binding_type
|
||
FROM auth.user_assistant_binding
|
||
WHERE user_id = %s AND site_id = %s
|
||
LIMIT 1
|
||
""",
|
||
(user.user_id, user.site_id),
|
||
)
|
||
b_row = cur.fetchone()
|
||
if b_row:
|
||
binding = {
|
||
"assistant_id": b_row[0],
|
||
"staff_id": b_row[1],
|
||
"binding_type": b_row[2],
|
||
}
|
||
|
||
# 所有关联门店
|
||
cur.execute(
|
||
"""
|
||
SELECT usr.site_id,
|
||
COALESCE(scm.site_name, '') AS site_name,
|
||
r.code, r.name
|
||
FROM auth.user_site_roles usr
|
||
JOIN auth.roles r ON usr.role_id = r.id
|
||
LEFT JOIN auth.site_code_mapping scm ON usr.site_id = scm.site_id
|
||
WHERE usr.user_id = %s
|
||
ORDER BY usr.site_id, r.code
|
||
""",
|
||
(user.user_id,),
|
||
)
|
||
site_rows = cur.fetchall()
|
||
finally:
|
||
conn.close()
|
||
|
||
sites_map: dict[int, dict] = {}
|
||
for sid, sname, rcode, rname in site_rows:
|
||
if sid not in sites_map:
|
||
sites_map[sid] = {"site_id": sid, "site_name": sname, "roles": []}
|
||
sites_map[sid]["roles"].append({"code": rcode, "name": rname})
|
||
|
||
return DevContextResponse(
|
||
user_id=user.user_id,
|
||
openid=openid,
|
||
status=u_status,
|
||
nickname=nickname,
|
||
site_id=user.site_id,
|
||
site_name=site_name,
|
||
roles=roles,
|
||
permissions=permissions,
|
||
binding=binding,
|
||
all_sites=list(sites_map.values()),
|
||
)
|
||
|
||
# ── POST /api/xcx/dev-switch-role（仅开发模式） ───────────
|
||
|
||
@router.post("/dev-switch-role", response_model=WxLoginResponse)
|
||
async def dev_switch_role(
|
||
body: DevSwitchRoleRequest,
|
||
user: CurrentUser = Depends(get_current_user),
|
||
):
|
||
"""
|
||
切换当前用户在当前门店下的角色。
|
||
|
||
删除旧角色绑定，插入新角色绑定，重签 token。
|
||
"""
|
||
valid_roles = ("coach", "staff", "site_admin", "tenant_admin")
|
||
if body.role_code not in valid_roles:
|
||
raise HTTPException(
|
||
status_code=400,
|
||
detail=f"无效角色，可选: {', '.join(valid_roles)}",
|
||
)
|
||
|
||
conn = get_connection()
|
||
try:
|
||
with conn.cursor() as cur:
|
||
# 查询目标角色 ID
|
||
cur.execute(
|
||
"SELECT id FROM auth.roles WHERE code = %s",
|
||
(body.role_code,),
|
||
)
|
||
role_row = cur.fetchone()
|
||
if role_row is None:
|
||
raise HTTPException(status_code=400, detail=f"角色 {body.role_code} 不存在")
|
||
role_id = role_row[0]
|
||
|
||
# 删除当前门店下的所有角色
|
||
cur.execute(
|
||
"DELETE FROM auth.user_site_roles WHERE user_id = %s AND site_id = %s",
|
||
(user.user_id, user.site_id),
|
||
)
|
||
|
||
# 插入新角色
|
||
cur.execute(
|
||
"""
|
||
INSERT INTO auth.user_site_roles (user_id, site_id, role_id)
|
||
VALUES (%s, %s, %s)
|
||
ON CONFLICT (user_id, site_id, role_id) DO NOTHING
|
||
""",
|
||
(user.user_id, user.site_id, role_id),
|
||
)
|
||
conn.commit()
|
||
|
||
# 重签 token
|
||
roles = _get_user_roles_at_site(conn, user.user_id, user.site_id)
|
||
cur.execute("SELECT status FROM auth.users WHERE id = %s", (user.user_id,))
|
||
u_status = cur.fetchone()[0]
|
||
finally:
|
||
conn.close()
|
||
|
||
tokens = create_token_pair(user.user_id, user.site_id, roles=roles)
|
||
return WxLoginResponse(
|
||
access_token=tokens["access_token"],
|
||
refresh_token=tokens["refresh_token"],
|
||
token_type=tokens["token_type"],
|
||
user_status=u_status,
|
||
user_id=user.user_id,
|
||
)
|
||
|
||
# ── POST /api/xcx/dev-switch-status（仅开发模式） ─────────
|
||
|
||
@router.post("/dev-switch-status", response_model=WxLoginResponse)
|
||
async def dev_switch_status(
|
||
body: DevSwitchStatusRequest,
|
||
user: CurrentUser = Depends(get_current_user_or_limited),
|
||
):
|
||
"""
|
||
切换当前用户状态，重签 token。
|
||
|
||
允许受限令牌访问（pending 用户也需要能切换状态）。
|
||
"""
|
||
valid_statuses = ("new", "pending", "approved", "rejected", "disabled")
|
||
if body.status not in valid_statuses:
|
||
raise HTTPException(
|
||
status_code=400,
|
||
detail=f"无效状态，可选: {', '.join(valid_statuses)}",
|
||
)
|
||
|
||
conn = get_connection()
|
||
try:
|
||
with conn.cursor() as cur:
|
||
cur.execute(
|
||
"UPDATE auth.users SET status = %s, updated_at = NOW() WHERE id = %s",
|
||
(body.status, user.user_id),
|
||
)
|
||
conn.commit()
|
||
|
||
# 根据新状态签发对应令牌
|
||
if body.status == "approved":
|
||
default_site_id = _get_user_default_site(conn, user.user_id)
|
||
if default_site_id is not None:
|
||
roles = _get_user_roles_at_site(conn, user.user_id, default_site_id)
|
||
tokens = create_token_pair(user.user_id, default_site_id, roles=roles)
|
||
else:
|
||
tokens = create_limited_token_pair(user.user_id)
|
||
else:
|
||
tokens = create_limited_token_pair(user.user_id)
|
||
finally:
|
||
conn.close()
|
||
|
||
return WxLoginResponse(
|
||
access_token=tokens["access_token"],
|
||
refresh_token=tokens["refresh_token"],
|
||
token_type=tokens["token_type"],
|
||
user_status=body.status,
|
||
user_id=user.user_id,
|
||
)
|
||
|
||
# ── POST /api/xcx/dev-switch-binding（仅开发模式） ────────
|
||
|
||
@router.post("/dev-switch-binding")
|
||
async def dev_switch_binding(
|
||
body: DevSwitchBindingRequest,
|
||
user: CurrentUser = Depends(get_current_user),
|
||
):
|
||
"""
|
||
切换当前用户在当前门店下的人员绑定。
|
||
|
||
删除旧绑定，插入新绑定。
|
||
"""
|
||
valid_types = ("assistant", "staff", "manager")
|
||
if body.binding_type not in valid_types:
|
||
raise HTTPException(
|
||
status_code=400,
|
||
detail=f"无效绑定类型，可选: {', '.join(valid_types)}",
|
||
)
|
||
|
||
conn = get_connection()
|
||
try:
|
||
with conn.cursor() as cur:
|
||
# 删除当前门店下的旧绑定
|
||
cur.execute(
|
||
"DELETE FROM auth.user_assistant_binding WHERE user_id = %s AND site_id = %s",
|
||
(user.user_id, user.site_id),
|
||
)
|
||
|
||
# 插入新绑定
|
||
cur.execute(
|
||
"""
|
||
INSERT INTO auth.user_assistant_binding
|
||
(user_id, site_id, assistant_id, staff_id, binding_type)
|
||
VALUES (%s, %s, %s, %s, %s)
|
||
""",
|
||
(user.user_id, user.site_id, body.assistant_id, body.staff_id, body.binding_type),
|
||
)
|
||
conn.commit()
|
||
finally:
|
||
conn.close()
|
||
|
||
return {"ok": True, "binding_type": body.binding_type}
|