wangsli/hyb-oa
1
0
派生 0
代码 工单 合并请求 工作流 3 软件包 项目 发布 百科 活动

R44 A2-A8 完成员工高级筛选批量操作与统计页

浏览代码
这个提交包含在：
wangsli
2026-03-29 12:27:44 +08:00
父节点 c3873999c2
当前提交 d11f5593d1
共修改 17 个文件，包含 1640 行新增和 337 行删除
下载 Patch 文件 下载 Diff 文件 展开所有文件 折叠所有文件
server/src/routes/users.js
+407 -178
查看文件
@@ -5,6 +5,13 @@ const { Readable } = require("node:stream");
const ExcelJS = require("exceljs");
const { z } = require("zod");
const {
EMPLOYMENT_STATUS_VALUES,
buildEmployeeDirectoryWhere,
parseEmployeeDirectoryFilters,
} = require("../services/employeeDirectoryFilters");
const { applyEmployeeTransfer } = require("../services/employeeLifecycle");
const { FEATURE_FLAG_KEYS, evaluateFeatureFlag } = require("../services/featureFlags");
const { AppError } = require("../utils/AppError");
const { sendData } = require("../utils/reply");
const { buildAuditLogData } = require("../utils/audit");
@@ -30,14 +37,9 @@ const roleCodeSchema = z.enum([
"admin",
]);
const listQuerySchema = z.object({
const listPaginationSchema = z.object({
page: z.coerce.number().int().min(1).optional(),
pageSize: z.coerce.number().int().min(1).max(100).optional(),
status: z.enum(["active", "archived"]).optional(),
q: z.string().max(100).optional(),
});
const listQueryWithDepartmentSchema = listQuerySchema.extend({
departmentId: z.string().uuid().optional(),
});
const createBodySchema = z.object({
@@ -90,6 +92,18 @@ const USER_IMPORT_ALLOWED_MIME_TYPES = new Set([
"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
]);
const USER_IMPORT_MAX_ROWS = 500;
const BATCH_EMPLOYEE_IDS_SCHEMA = z.array(z.string().uuid()).min(1);
const BATCH_TRANSFER_DEPARTMENT_SCHEMA = z.object({
employeeIds: BATCH_EMPLOYEE_IDS_SCHEMA,
departmentId: z.string().uuid(),
}).strict();
const BATCH_TOGGLE_SCHEMA = z.object({
employeeIds: BATCH_EMPLOYEE_IDS_SCHEMA,
}).strict();
const BATCH_SET_MANAGER_SCHEMA = z.object({
employeeIds: BATCH_EMPLOYEE_IDS_SCHEMA,
managerId: z.string().uuid(),
}).strict();
function parseUserId(params) {
const parsed = z.string().uuid().safeParse(params?.id);
@@ -105,9 +119,7 @@ function parseUserId(params) {
}
function parseListQuery(query, options = {}) {
const allowDepartmentFilter = options.allowDepartmentFilter === true;
const schema = allowDepartmentFilter ? listQueryWithDepartmentSchema : listQuerySchema;
const parsed = schema.safeParse(query ?? {});
const parsed = listPaginationSchema.safeParse(query ?? {});
if (!parsed.success) {
throw new AppError({
code: "VALID_001",
@@ -120,9 +132,7 @@ function parseListQuery(query, options = {}) {
return {
page: parsed.data.page ?? 1,
pageSize: parsed.data.pageSize ?? 20,
status: parsed.data.status,
q: parsed.data.q?.trim() ?? "",
departmentId: allowDepartmentFilter ? parsed.data.departmentId : undefined,
...parseEmployeeDirectoryFilters(query, options),
};
}
@@ -185,7 +195,18 @@ function mapEmployeeSummary(row) {
email: row.email,
status: row.status,
departmentId: row.department_id,
department: row.department ? { id: row.department.id, name: row.department.name } : null,
directManagerId: row.direct_manager_id ?? null,
directManager: row.direct_manager
? {
id: row.direct_manager.id,
employeeNo: row.direct_manager.employee_no,
name: row.direct_manager.name,
}
: null,
title: row.title,
employmentStatus: row.employment_status ?? null,
hireDate: row.hire_date?.toISOString?.()?.slice(0, 10) ?? null,
avatarUrl: row.avatar_path ? `/api/avatars/${row.id}` : null,
roleCodes: row.roles.map((item) => item.role_code),
createdAt: row.created_at?.toISOString?.() ?? null,
@@ -258,6 +279,163 @@ function buildValidationError(details, statusCode = 400) {
});
}
function parseBatchBody(schema, body) {
const parsed = schema.safeParse(body ?? {});
if (!parsed.success) {
throw buildValidationError(parsed.error.flatten());
}
const employeeIds = [...new Set(parsed.data.employeeIds)];
if (employeeIds.length > 50) {
throw buildValidationError({ employeeIds: "too_many" }, 409);
}
return {
...parsed.data,
employeeIds,
};
}
function ensureHasAnyPermission(fastify, request, permissionCodes) {
if (permissionCodes.some((code) => fastify.hasPermission(request.employee, code))) {
return;
}
throw new AppError({
code: "PERM_001",
message: "无权限",
statusCode: 403,
});
}
async function ensureLifecycleFeatureEnabled(fastify, request) {
const gate = await evaluateFeatureFlag({
prisma: fastify.prisma,
config: fastify.config,
flagKey: FEATURE_FLAG_KEYS.employeeLifecycle,
departmentId: request.employee.department_id ?? null,
strictDepartment: false,
});
if (!gate.enabled) {
throw buildValidationError({ featureFlag: "employee_lifecycle_v1_disabled", reason: gate.reason }, 409);
}
}
async function ensureDepartmentUsable(prisma, departmentId, fieldName = "departmentId") {
const department = await prisma.department.findUnique({
where: { id: departmentId },
select: { id: true, archived_at: true },
});
if (!department) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 400,
details: { [fieldName]: "not_found" },
});
}
if (department.archived_at) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 409,
details: { [fieldName]: "archived" },
});
}
}
async function ensureManagerUsable(prisma, managerId, options = {}) {
const fieldName = options.fieldName ?? "directManagerId";
const disallowedEmployeeIds = options.disallowedEmployeeIds ?? [];
if (disallowedEmployeeIds.includes(managerId)) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 409,
details: { [fieldName]: "self_not_allowed" },
});
}
const manager = await prisma.employee.findUnique({
where: { id: managerId },
select: { id: true, status: true },
});
if (!manager) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 400,
details: { [fieldName]: "not_found" },
});
}
if (manager.status !== "active") {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 409,
details: { [fieldName]: "inactive" },
});
}
}
async function ensureEmployeesExist(prisma, employeeIds) {
const employees = await prisma.employee.findMany({
where: { id: { in: employeeIds } },
select: { id: true },
});
if (employees.length !== employeeIds.length) {
const existingIds = new Set(employees.map((item) => item.id));
const missingId = employeeIds.find((item) => !existingIds.has(item));
throw new AppError({
code: "SYS_404",
message: "Not Found",
statusCode: 404,
details: { employeeId: missingId ?? null },
});
}
}
async function setEmployeeAccountStatus(tx, request, options) {
const updated = await tx.employee.update({
where: { id: options.employeeId },
data: {
status: options.status,
archived_at: options.status === "archived" ? options.now : null,
token_version: { increment: 1 },
updated_by: options.actorId,
},
select: {
id: true,
status: true,
token_version: true,
},
});
await tx.authSession.updateMany({
where: { employee_id: options.employeeId, revoked_at: null },
data: { revoked_at: options.now },
});
await tx.auditLog.create({
data: buildAuditLogData(request, {
actorId: options.actorId,
action: options.status === "archived" ? "SYSTEM_USER_DISABLED" : "SYSTEM_USER_ENABLED",
targetType: "employee",
targetId: options.employeeId,
extra: {},
}),
});
return updated;
}
function generateOneTimePassword() {
const password = `ResetA1${crypto.randomBytes(6).toString("hex")}`;
const errors = validatePassword(password);
@@ -720,7 +898,10 @@ async function createSystemUser(tx, options) {
email: true,
status: true,
department_id: true,
direct_manager_id: true,
title: true,
employment_status: true,
hire_date: true,
created_at: true,
updated_at: true,
},
@@ -745,31 +926,22 @@ async function usersRoutes(fastify, opts = {}) {
const basePath = basePathRaw.startsWith("/") ? basePathRaw : `/${basePathRaw}`;
const routeBasePath = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
const allowDepartmentFilter = opts.allowDepartmentFilter === true;
const listPermissionCodes =
Array.isArray(opts.listPermissionCodes) && opts.listPermissionCodes.length
? [...new Set(opts.listPermissionCodes)]
: ["system.users"];
const enableBatchActions = routeBasePath === "/users" && opts.enableBatchActions !== false;
fastify.get(
routeBasePath,
{
preHandler: fastify.requirePermission("system.users"),
preHandler: fastify.authenticate,
},
async (request, reply) => {
ensureHasAnyPermission(fastify, request, listPermissionCodes);
const query = parseListQuery(request.query, { allowDepartmentFilter });
const skip = (query.page - 1) * query.pageSize;
const q = query.q;
const where = {
...(query.status ? { status: query.status } : {}),
...(query.departmentId ? { department_id: query.departmentId } : {}),
...(q
? {
OR: [
{ employee_no: { contains: q, mode: "insensitive" } },
{ name: { contains: q, mode: "insensitive" } },
{ phone: { contains: q, mode: "insensitive" } },
{ email: { contains: q, mode: "insensitive" } },
],
}
: {}),
};
const where = buildEmployeeDirectoryWhere(query);
const [items, total] = await Promise.all([
fastify.prisma.employee.findMany({
@@ -785,10 +957,15 @@ async function usersRoutes(fastify, opts = {}) {
email: true,
status: true,
department_id: true,
direct_manager_id: true,
title: true,
employment_status: true,
hire_date: true,
avatar_path: true,
created_at: true,
updated_at: true,
department: { select: { id: true, name: true } },
direct_manager: { select: { id: true, employee_no: true, name: true } },
roles: { select: { role_code: true } },
},
}),
@@ -874,49 +1051,10 @@ async function usersRoutes(fastify, opts = {}) {
const hireDate = body.hireDate ? new Date(`${body.hireDate}T00:00:00.000Z`) : new Date();
const departmentId = body.departmentId ?? request.employee.department_id;
const department = await fastify.prisma.department.findUnique({
where: { id: departmentId },
select: { id: true, archived_at: true },
});
if (!department) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 400,
details: { departmentId: "not_found" },
});
}
if (department.archived_at) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 409,
details: { departmentId: "archived" },
});
}
await ensureDepartmentUsable(fastify.prisma, departmentId);
if (typeof body.directManagerId === "string") {
const manager = await fastify.prisma.employee.findUnique({
where: { id: body.directManagerId },
select: { id: true, status: true },
});
if (!manager) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 400,
details: { directManagerId: "not_found" },
});
}
if (manager.status !== "active") {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 409,
details: { directManagerId: "inactive" },
});
}
await ensureManagerUsable(fastify.prisma, body.directManagerId);
}
const now = new Date();
@@ -980,6 +1118,192 @@ async function usersRoutes(fastify, opts = {}) {
},
);
if (enableBatchActions) {
fastify.post(
`${routeBasePath}/batch/transfer-department`,
{
preHandler: fastify.requirePermission("system.users"),
},
async (request, reply) => {
await ensureLifecycleFeatureEnabled(fastify, request);
const body = parseBatchBody(BATCH_TRANSFER_DEPARTMENT_SCHEMA, request.body);
await ensureDepartmentUsable(fastify.prisma, body.departmentId);
await fastify.prisma.$transaction(async (tx) => {
await ensureEmployeesExist(tx, body.employeeIds);
for (const employeeId of body.employeeIds) {
await applyEmployeeTransfer(tx, {
employeeId,
actorId: request.employee.id,
departmentId: body.departmentId,
});
}
await tx.auditLog.create({
data: buildAuditLogData(request, {
actorId: request.employee.id,
action: "SYSTEM_USERS_BATCH_TRANSFER_DEPARTMENT",
targetType: "employee_batch",
extra: {
employeeIds: body.employeeIds,
departmentId: body.departmentId,
summary: {
total: body.employeeIds.length,
updated: body.employeeIds.length,
},
},
}),
});
});
return sendData(reply, request, {
summary: { total: body.employeeIds.length, updated: body.employeeIds.length },
employeeIds: body.employeeIds,
});
},
);
fastify.post(
`${routeBasePath}/batch/set-manager`,
{
preHandler: fastify.requirePermission("system.users"),
},
async (request, reply) => {
await ensureLifecycleFeatureEnabled(fastify, request);
const body = parseBatchBody(BATCH_SET_MANAGER_SCHEMA, request.body);
await ensureManagerUsable(fastify.prisma, body.managerId, {
fieldName: "managerId",
disallowedEmployeeIds: body.employeeIds,
});
await fastify.prisma.$transaction(async (tx) => {
await ensureEmployeesExist(tx, body.employeeIds);
for (const employeeId of body.employeeIds) {
await applyEmployeeTransfer(tx, {
employeeId,
actorId: request.employee.id,
directManagerId: body.managerId,
});
}
await tx.auditLog.create({
data: buildAuditLogData(request, {
actorId: request.employee.id,
action: "SYSTEM_USERS_BATCH_SET_MANAGER",
targetType: "employee_batch",
extra: {
employeeIds: body.employeeIds,
managerId: body.managerId,
summary: {
total: body.employeeIds.length,
updated: body.employeeIds.length,
},
},
}),
});
});
return sendData(reply, request, {
summary: { total: body.employeeIds.length, updated: body.employeeIds.length },
employeeIds: body.employeeIds,
});
},
);
fastify.post(
`${routeBasePath}/batch/disable`,
{
preHandler: fastify.requirePermission("system.users"),
},
async (request, reply) => {
const body = parseBatchBody(BATCH_TOGGLE_SCHEMA, request.body);
if (body.employeeIds.includes(request.employee.id)) {
throw buildValidationError({ user: "self_disable_not_allowed" }, 409);
}
const now = new Date();
await fastify.prisma.$transaction(async (tx) => {
await ensureEmployeesExist(tx, body.employeeIds);
for (const employeeId of body.employeeIds) {
await setEmployeeAccountStatus(tx, request, {
employeeId,
actorId: request.employee.id,
status: "archived",
now,
});
}
await tx.auditLog.create({
data: buildAuditLogData(request, {
actorId: request.employee.id,
action: "SYSTEM_USERS_BATCH_DISABLED",
targetType: "employee_batch",
extra: {
employeeIds: body.employeeIds,
summary: {
total: body.employeeIds.length,
updated: body.employeeIds.length,
},
},
}),
});
});
return sendData(reply, request, {
summary: { total: body.employeeIds.length, updated: body.employeeIds.length },
employeeIds: body.employeeIds,
});
},
);
fastify.post(
`${routeBasePath}/batch/enable`,
{
preHandler: fastify.requirePermission("system.users"),
},
async (request, reply) => {
const body = parseBatchBody(BATCH_TOGGLE_SCHEMA, request.body);
const now = new Date();
await fastify.prisma.$transaction(async (tx) => {
await ensureEmployeesExist(tx, body.employeeIds);
for (const employeeId of body.employeeIds) {
await setEmployeeAccountStatus(tx, request, {
employeeId,
actorId: request.employee.id,
status: "active",
now,
});
}
await tx.auditLog.create({
data: buildAuditLogData(request, {
actorId: request.employee.id,
action: "SYSTEM_USERS_BATCH_ENABLED",
targetType: "employee_batch",
extra: {
employeeIds: body.employeeIds,
summary: {
total: body.employeeIds.length,
updated: body.employeeIds.length,
},
},
}),
});
});
return sendData(reply, request, {
summary: { total: body.employeeIds.length, updated: body.employeeIds.length },
employeeIds: body.employeeIds,
});
},
);
}
if (routeBasePath === "/users") {
fastify.post(
`${routeBasePath}/import/dry-run`,
@@ -1146,59 +1470,14 @@ async function usersRoutes(fastify, opts = {}) {
}
if (typeof body.departmentId === "string") {
const department = await fastify.prisma.department.findUnique({
where: { id: body.departmentId },
select: { id: true, archived_at: true },
});
if (!department) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 400,
details: { departmentId: "not_found" },
});
}
if (department.archived_at) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 409,
details: { departmentId: "archived" },
});
}
await ensureDepartmentUsable(fastify.prisma, body.departmentId);
}
if (Object.prototype.hasOwnProperty.call(body, "directManagerId")) {
if (body.directManagerId === userId) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 409,
details: { directManagerId: "self_not_allowed" },
});
}
if (typeof body.directManagerId === "string") {
const manager = await fastify.prisma.employee.findUnique({
where: { id: body.directManagerId },
select: { id: true, status: true },
await ensureManagerUsable(fastify.prisma, body.directManagerId, {
disallowedEmployeeIds: [userId],
});
if (!manager) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 400,
details: { directManagerId: "not_found" },
});
}
if (manager.status !== "active") {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 409,
details: { directManagerId: "inactive" },
});
}
}
}
@@ -1605,37 +1884,12 @@ async function usersRoutes(fastify, opts = {}) {
const now = new Date();
const employee = await fastify.prisma.$transaction(async (tx) => {
const updated = await tx.employee.update({
where: { id: userId },
data: {
status: "archived",
archived_at: now,
token_version: { increment: 1 },
updated_by: request.employee.id,
},
select: {
id: true,
status: true,
token_version: true,
},
return setEmployeeAccountStatus(tx, request, {
employeeId: userId,
actorId: request.employee.id,
status: "archived",
now,
});
await tx.authSession.updateMany({
where: { employee_id: userId, revoked_at: null },
data: { revoked_at: now },
});
await tx.auditLog.create({
data: buildAuditLogData(request, {
actorId: request.employee.id,
action: "SYSTEM_USER_DISABLED",
targetType: "employee",
targetId: userId,
extra: {},
}),
});
return updated;
});
return sendData(reply, request, {
@@ -1655,37 +1909,12 @@ async function usersRoutes(fastify, opts = {}) {
const now = new Date();
const employee = await fastify.prisma.$transaction(async (tx) => {
const updated = await tx.employee.update({
where: { id: userId },
data: {
status: "active",
archived_at: null,
token_version: { increment: 1 },
updated_by: request.employee.id,
},
select: {
id: true,
status: true,
token_version: true,
},
return setEmployeeAccountStatus(tx, request, {
employeeId: userId,
actorId: request.employee.id,
status: "active",
now,
});
await tx.authSession.updateMany({
where: { employee_id: userId, revoked_at: null },
data: { revoked_at: now },
});
await tx.auditLog.create({
data: buildAuditLogData(request, {
actorId: request.employee.id,
action: "SYSTEM_USER_ENABLED",
targetType: "employee",
targetId: userId,
extra: {},
}),
});
return updated;
});
return sendData(reply, request, {