371 lines
20 KiB
JavaScript
371 lines
20 KiB
JavaScript
const express = require('express');
|
|
const db = require('../db');
|
|
const { authMiddleware, adminOnly } = require('../middleware/auth');
|
|
|
|
const router = express.Router();
|
|
|
|
const CATEGORIES = new Set(['forum_bug', 'site_bug', 'feature', 'account', 'other']);
|
|
const PRIORITIES = new Set(['low', 'normal', 'high', 'urgent']);
|
|
const STATUSES = new Set(['open', 'processing', 'waiting', 'resolved', 'closed']);
|
|
const TRANSITIONS = {
|
|
open: new Set(['processing', 'closed']),
|
|
processing: new Set(['waiting', 'resolved', 'closed']),
|
|
waiting: new Set(['processing', 'closed']),
|
|
resolved: new Set(['closed', 'processing']),
|
|
closed: new Set(['processing']),
|
|
};
|
|
|
|
function text(value, max = 0) {
|
|
if (typeof value !== 'string') return '';
|
|
const valueText = value.trim();
|
|
return max && valueText.length > max ? valueText.slice(0, max) : valueText;
|
|
}
|
|
|
|
function currentUserRole(userId) {
|
|
const user = db.get('SELECT role FROM users WHERE id = ?', [userId]);
|
|
return user ? user.role : null;
|
|
}
|
|
|
|
function validateSourceUrl(value) {
|
|
if (value === undefined || value === null || value === '') return { value: '' };
|
|
if (typeof value !== 'string') return { error: '来源地址不合法' };
|
|
if (value.length > 1000 || /[\u0000-\u001f\u007f]/.test(value)) return { error: '来源地址不合法' };
|
|
const sourceUrl = value.trim();
|
|
if (!sourceUrl) return { value: '' };
|
|
if (sourceUrl.startsWith('/') && !sourceUrl.startsWith('//')) return { value: sourceUrl };
|
|
if (!/^https?:\/\//i.test(sourceUrl)) return { error: '来源地址只允许站内路径或 http/https 地址' };
|
|
try {
|
|
const parsed = new URL(sourceUrl);
|
|
if (!['http:', 'https:'].includes(parsed.protocol) || !parsed.hostname) return { error: '来源地址不合法' };
|
|
} catch {
|
|
return { error: '来源地址不合法' };
|
|
}
|
|
return { value: sourceUrl };
|
|
}
|
|
|
|
function pageParams(query) {
|
|
const page = Number.parseInt(query.page, 10);
|
|
const pageSize = Number.parseInt(query.pageSize, 10);
|
|
return {
|
|
page: Number.isInteger(page) && page >= 1 ? page : 1,
|
|
pageSize: Number.isInteger(pageSize) && pageSize >= 1 && pageSize <= 50 ? pageSize : 20,
|
|
};
|
|
}
|
|
|
|
function idParam(value) {
|
|
const id = Number.parseInt(value, 10);
|
|
return Number.isInteger(id) && id > 0 && String(id) === String(value) ? id : 0;
|
|
}
|
|
|
|
function getTicket(id) {
|
|
return db.get(`SELECT t.*, u.username AS requester_name, u.nickname AS requester_nickname,
|
|
a.username AS assignee_name, a.nickname AS assignee_nickname
|
|
FROM tickets t
|
|
LEFT JOIN users u ON u.id = t.requester_id
|
|
LEFT JOIN users a ON a.id = t.assignee_id
|
|
WHERE t.id = ?`, [id]);
|
|
}
|
|
|
|
function canAccess(ticket, user, role) {
|
|
return !!ticket && !!role && (ticket.requester_id === user.id || role === 'admin');
|
|
}
|
|
|
|
function addEvent(insertEvent, ticketId, actorId, type, field = '', oldValue = '', newValue = '', detail = '') {
|
|
insertEvent.run(ticketId, actorId || null, type, field, String(oldValue ?? ''), String(newValue ?? ''), detail);
|
|
}
|
|
|
|
function updateStatus(ticket, status, actorId, insertEvent) {
|
|
if (!STATUSES.has(status)) return { error: '状态不合法' };
|
|
if (ticket.status === status) return { changed: false };
|
|
if (!TRANSITIONS[ticket.status] || !TRANSITIONS[ticket.status].has(status)) {
|
|
return { error: '不允许的状态流转' };
|
|
}
|
|
const now = "datetime('now')";
|
|
const values = [status];
|
|
let sql = `UPDATE tickets SET status = ?, updated_at = ${now}`;
|
|
if (status === 'resolved') sql += `, resolved_at = ${now}`;
|
|
if (status === 'closed') sql += `, closed_at = ${now}`;
|
|
if (status !== 'resolved') sql += ', resolved_at = NULL';
|
|
if (status !== 'closed') sql += ', closed_at = NULL';
|
|
sql += ' WHERE id = ?';
|
|
values.push(ticket.id);
|
|
db.getDb().prepare(sql).run(...values);
|
|
addEvent(insertEvent, ticket.id, actorId, 'status_changed', 'status', ticket.status, status);
|
|
return { changed: true };
|
|
}
|
|
|
|
function ticketResponse(ticket, isAdmin) {
|
|
const messages = db.all(`SELECT tm.id, tm.ticket_id, tm.author_id, tm.content, tm.is_internal,
|
|
tm.created_at, u.username AS author_name, u.nickname AS author_nickname, u.role AS author_role
|
|
FROM ticket_messages tm LEFT JOIN users u ON u.id = tm.author_id
|
|
WHERE tm.ticket_id = ? ${isAdmin ? '' : 'AND tm.is_internal = 0'}
|
|
ORDER BY tm.created_at ASC, tm.id ASC`, [ticket.id]);
|
|
const response = { ticket, messages };
|
|
if (isAdmin) {
|
|
response.events = db.all(`SELECT e.*, u.username AS actor_name, u.nickname AS actor_nickname
|
|
FROM ticket_events e LEFT JOIN users u ON u.id = e.actor_id
|
|
WHERE e.ticket_id = ? ORDER BY e.created_at ASC, e.id ASC`, [ticket.id]);
|
|
}
|
|
return response;
|
|
}
|
|
|
|
// 管理后台列表（作为管理后台的工单子 tab 使用）
|
|
router.get('/admin', authMiddleware, adminOnly, (req, res) => {
|
|
const { page, pageSize } = pageParams(req.query);
|
|
const conditions = [];
|
|
const params = [];
|
|
const filters = [
|
|
['status', STATUSES], ['priority', PRIORITIES], ['category', CATEGORIES],
|
|
];
|
|
for (const [key, allowed] of filters) {
|
|
if (req.query[key]) {
|
|
if (!allowed.has(String(req.query[key]))) return res.status(400).json({ error: `${key} 不合法` });
|
|
conditions.push(`t.${key} = ?`); params.push(String(req.query[key]));
|
|
}
|
|
}
|
|
const assigneeId = req.query.assignee_id === 'null' ? null : idParam(req.query.assignee_id || '');
|
|
if (req.query.assignee_id !== undefined) {
|
|
if (req.query.assignee_id === 'null') conditions.push('t.assignee_id IS NULL');
|
|
else if (!assigneeId) return res.status(400).json({ error: '负责人不合法' });
|
|
else { conditions.push('t.assignee_id = ?'); params.push(assigneeId); }
|
|
}
|
|
const requesterId = req.query.requester_id ? idParam(req.query.requester_id) : 0;
|
|
if (req.query.requester_id && !requesterId) return res.status(400).json({ error: '提交人不合法' });
|
|
if (requesterId) { conditions.push('t.requester_id = ?'); params.push(requesterId); }
|
|
if (req.query.q) {
|
|
const q = text(req.query.q, 100);
|
|
conditions.push('(t.ticket_no LIKE ? OR t.subject LIKE ? OR t.description LIKE ?)');
|
|
params.push(`%${q}%`, `%${q}%`, `%${q}%`);
|
|
}
|
|
const where = conditions.length ? `WHERE ${conditions.join(' AND ')}` : '';
|
|
const total = db.get(`SELECT COUNT(*) AS count FROM tickets t ${where}`, params).count;
|
|
const list = db.all(`SELECT t.id, t.ticket_no, t.subject, t.category, t.priority, t.status,
|
|
t.requester_id, t.assignee_id, t.source, t.created_at, t.updated_at, t.last_reply_at,
|
|
u.username AS requester_name, u.nickname AS requester_nickname,
|
|
a.username AS assignee_name, a.nickname AS assignee_nickname
|
|
FROM tickets t LEFT JOIN users u ON u.id = t.requester_id LEFT JOIN users a ON a.id = t.assignee_id
|
|
${where} ORDER BY CASE t.status WHEN 'open' THEN 0 WHEN 'processing' THEN 1 WHEN 'waiting' THEN 2 WHEN 'resolved' THEN 3 ELSE 4 END,
|
|
t.updated_at DESC, t.id DESC LIMIT ? OFFSET ?`, [...params, pageSize, (page - 1) * pageSize]);
|
|
res.json({ tickets: list, list, total, page, pageSize, totalPages: Math.ceil(total / pageSize) });
|
|
});
|
|
|
|
router.get('/admin/stats', authMiddleware, adminOnly, (req, res) => {
|
|
const row = db.get(`SELECT COUNT(*) AS total,
|
|
SUM(status = 'open') AS open, SUM(status = 'processing') AS processing,
|
|
SUM(status = 'waiting') AS waiting, SUM(status = 'resolved') AS resolved,
|
|
SUM(status = 'closed') AS closed FROM tickets`);
|
|
res.json(Object.fromEntries(Object.entries(row).map(([key, value]) => [key, Number(value) || 0])));
|
|
});
|
|
|
|
router.get('/admin/assignees', authMiddleware, adminOnly, (req, res) => {
|
|
res.json(db.all("SELECT id, username, nickname FROM users WHERE role = 'admin' ORDER BY id ASC"));
|
|
});
|
|
|
|
// 用户自己的工单列表
|
|
router.get('/', authMiddleware, (req, res) => {
|
|
const { page, pageSize } = pageParams(req.query);
|
|
if (req.query.status && !STATUSES.has(String(req.query.status))) return res.status(400).json({ error: '状态不合法' });
|
|
const params = [req.user.id];
|
|
const statusSql = req.query.status ? 'AND t.status = ?' : '';
|
|
if (req.query.status) params.push(String(req.query.status));
|
|
const total = db.get(`SELECT COUNT(*) AS count FROM tickets t WHERE t.requester_id = ? ${statusSql}`, params).count;
|
|
const list = db.all(`SELECT t.id, t.ticket_no, t.subject, t.category, t.priority, t.status, t.source,
|
|
t.created_at, t.updated_at, t.last_reply_at
|
|
FROM tickets t WHERE t.requester_id = ? ${statusSql}
|
|
ORDER BY t.created_at DESC, t.id DESC LIMIT ? OFFSET ?`, [...params, pageSize, (page - 1) * pageSize]);
|
|
res.json({ tickets: list, list, total, page, pageSize, totalPages: Math.ceil(total / pageSize) });
|
|
});
|
|
|
|
router.post('/', authMiddleware, (req, res) => {
|
|
const body = req.body || {};
|
|
const subject = text(body.subject, 120);
|
|
const description = text(body.description, 20000);
|
|
const category = text(body.category, 30) || 'other';
|
|
const priority = text(body.priority, 20) || 'normal';
|
|
const source = text(body.source, 20) || 'site';
|
|
if (subject.length < 1 || description.length < 1) return res.status(400).json({ error: '标题和问题描述不能为空' });
|
|
if (!CATEGORIES.has(category)) return res.status(400).json({ error: '问题分类不合法' });
|
|
if (!PRIORITIES.has(priority)) return res.status(400).json({ error: '优先级不合法' });
|
|
if (!['forum', 'site'].includes(source)) return res.status(400).json({ error: '来源不合法' });
|
|
const sourceUrlResult = validateSourceUrl(body.source_url);
|
|
if (sourceUrlResult.error) return res.status(400).json({ error: sourceUrlResult.error });
|
|
const sourceUrl = sourceUrlResult.value;
|
|
const sourceType = text(body.source_type, 40);
|
|
const sourceId = body.source_id === undefined || body.source_id === '' ? 0 : idParam(String(body.source_id));
|
|
if (body.source_id !== undefined && body.source_id !== '' && !sourceId) return res.status(400).json({ error: '来源编号不合法' });
|
|
if (source === 'forum' && sourceId && !db.get('SELECT id FROM forum_posts WHERE id = ?', [sourceId])) {
|
|
return res.status(400).json({ error: '关联的论坛帖子不存在' });
|
|
}
|
|
const browserInfo = text(body.browser_info, 1000);
|
|
try {
|
|
const result = db.transaction(() => {
|
|
const database = db.getDb();
|
|
const insertTicket = database.prepare(`INSERT INTO tickets
|
|
(ticket_no, requester_id, subject, description, category, priority, source, source_url, source_type, source_id, browser_info)
|
|
VALUES ('PENDING-' || hex(randomblob(8)), ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);
|
|
const info = insertTicket.run(req.user.id, subject, description, category, priority, source, sourceUrl, sourceType, sourceId, browserInfo);
|
|
const id = Number(info.lastInsertRowid);
|
|
const ticketNo = `RW-${String(id).padStart(6, '0')}`;
|
|
database.prepare('UPDATE tickets SET ticket_no = ? WHERE id = ?').run(ticketNo, id);
|
|
const event = database.prepare(`INSERT INTO ticket_events
|
|
(ticket_id, actor_id, event_type, field_name, old_value, new_value, detail) VALUES (?, ?, ?, ?, ?, ?, ?)`);
|
|
addEvent(event, id, req.user.id, 'ticket_created', '', '', 'open', '用户创建工单');
|
|
return { id, ticket_no: ticketNo };
|
|
});
|
|
res.status(201).json({ message: '工单已创建', ticket: getTicket(result.id) });
|
|
} catch (e) {
|
|
console.error('Ticket create error:', e.message);
|
|
res.status(500).json({ error: '创建工单失败' });
|
|
}
|
|
});
|
|
|
|
router.get('/:id/events', authMiddleware, adminOnly, (req, res) => {
|
|
const id = idParam(req.params.id);
|
|
if (!id) return res.status(404).json({ error: '工单不存在' });
|
|
if (!getTicket(id)) return res.status(404).json({ error: '工单不存在' });
|
|
res.json(db.all(`SELECT e.*, u.username AS actor_name, u.nickname AS actor_nickname
|
|
FROM ticket_events e LEFT JOIN users u ON u.id = e.actor_id
|
|
WHERE e.ticket_id = ? ORDER BY e.created_at ASC, e.id ASC`, [id]));
|
|
});
|
|
|
|
router.get('/:id', authMiddleware, (req, res) => {
|
|
const id = idParam(req.params.id);
|
|
const ticket = id ? getTicket(id) : null;
|
|
if (!ticket) return res.status(404).json({ error: '工单不存在' });
|
|
const role = currentUserRole(req.user.id);
|
|
if (!role) return res.status(401).json({ error: '登录已失效' });
|
|
if (!canAccess(ticket, req.user, role)) return res.status(403).json({ error: '无权限访问该工单' });
|
|
res.json(ticketResponse(ticket, role === 'admin'));
|
|
});
|
|
|
|
router.post('/:id/messages', authMiddleware, (req, res) => {
|
|
const id = idParam(req.params.id);
|
|
const ticket = id ? getTicket(id) : null;
|
|
if (!ticket) return res.status(404).json({ error: '工单不存在' });
|
|
const role = currentUserRole(req.user.id);
|
|
if (!role) return res.status(401).json({ error: '登录已失效' });
|
|
if (!canAccess(ticket, req.user, role)) return res.status(403).json({ error: '无权限访问该工单' });
|
|
const content = text(req.body && req.body.content, 20000);
|
|
if (!content) return res.status(400).json({ error: '回复内容不能为空' });
|
|
if (ticket.status === 'closed') return res.status(409).json({ error: '工单已关闭，不能回复' });
|
|
try {
|
|
db.transaction(() => {
|
|
const database = db.getDb();
|
|
database.prepare('INSERT INTO ticket_messages (ticket_id, author_id, content, is_internal) VALUES (?, ?, ?, 0)').run(id, req.user.id, content);
|
|
let nextStatus = ticket.status;
|
|
if (role !== 'admin' && ticket.status === 'waiting') nextStatus = 'processing';
|
|
database.prepare(`UPDATE tickets SET updated_at = datetime('now'), last_reply_at = datetime('now'),
|
|
first_response_at = CASE WHEN first_response_at IS NULL AND ? = 'admin' THEN datetime('now') ELSE first_response_at END,
|
|
status = ? WHERE id = ?`).run(role, nextStatus, id);
|
|
const event = database.prepare(`INSERT INTO ticket_events
|
|
(ticket_id, actor_id, event_type, field_name, old_value, new_value, detail) VALUES (?, ?, ?, ?, ?, ?, ?)`);
|
|
addEvent(event, id, req.user.id, 'message_added', '', '', '公开回复', '');
|
|
if (nextStatus !== ticket.status) addEvent(event, id, req.user.id, 'status_changed', 'status', ticket.status, nextStatus, '用户回复后自动进入处理中');
|
|
});
|
|
res.status(201).json(ticketResponse(getTicket(id), role === 'admin'));
|
|
} catch (e) {
|
|
console.error('Ticket message error:', e.message);
|
|
res.status(500).json({ error: '回复工单失败' });
|
|
}
|
|
});
|
|
|
|
router.post('/:id/internal-messages', authMiddleware, adminOnly, (req, res) => {
|
|
const id = idParam(req.params.id);
|
|
if (!id || !getTicket(id)) return res.status(404).json({ error: '工单不存在' });
|
|
const content = text(req.body && req.body.content, 20000);
|
|
if (!content) return res.status(400).json({ error: '内部备注不能为空' });
|
|
try {
|
|
db.transaction(() => {
|
|
const database = db.getDb();
|
|
database.prepare('INSERT INTO ticket_messages (ticket_id, author_id, content, is_internal) VALUES (?, ?, ?, 1)').run(id, req.user.id, content);
|
|
database.prepare("UPDATE tickets SET updated_at = datetime('now') WHERE id = ?").run(id);
|
|
const event = database.prepare(`INSERT INTO ticket_events
|
|
(ticket_id, actor_id, event_type, field_name, old_value, new_value, detail) VALUES (?, ?, ?, ?, ?, ?, ?)`);
|
|
addEvent(event, id, req.user.id, 'internal_note_added', '', '', '', '管理员添加内部备注');
|
|
});
|
|
res.status(201).json(ticketResponse(getTicket(id), true));
|
|
} catch (e) {
|
|
console.error('Ticket internal message error:', e.message);
|
|
res.status(500).json({ error: '添加内部备注失败' });
|
|
}
|
|
});
|
|
|
|
router.put('/:id/status', authMiddleware, adminOnly, (req, res) => {
|
|
const id = idParam(req.params.id);
|
|
const ticket = id ? getTicket(id) : null;
|
|
if (!ticket) return res.status(404).json({ error: '工单不存在' });
|
|
const status = text(req.body && req.body.status, 20);
|
|
try {
|
|
const result = db.transaction(() => {
|
|
const database = db.getDb();
|
|
const event = database.prepare(`INSERT INTO ticket_events
|
|
(ticket_id, actor_id, event_type, field_name, old_value, new_value, detail) VALUES (?, ?, ?, ?, ?, ?, ?)`);
|
|
return updateStatus(ticket, status, req.user.id, event);
|
|
});
|
|
if (result.error) return res.status(result.error === '不允许的状态流转' ? 409 : 400).json({ error: result.error });
|
|
res.json({ message: '状态已更新', ticket: getTicket(id) });
|
|
} catch (e) { console.error('Ticket status error:', e.message); res.status(500).json({ error: '更新状态失败' }); }
|
|
});
|
|
|
|
router.put('/:id/priority', authMiddleware, adminOnly, (req, res) => {
|
|
const id = idParam(req.params.id);
|
|
const ticket = id ? getTicket(id) : null;
|
|
if (!ticket) return res.status(404).json({ error: '工单不存在' });
|
|
const priority = text(req.body && req.body.priority, 20);
|
|
if (!PRIORITIES.has(priority)) return res.status(400).json({ error: '优先级不合法' });
|
|
try {
|
|
db.transaction(() => {
|
|
const database = db.getDb();
|
|
database.prepare("UPDATE tickets SET priority = ?, updated_at = datetime('now') WHERE id = ?").run(priority, id);
|
|
const event = database.prepare(`INSERT INTO ticket_events
|
|
(ticket_id, actor_id, event_type, field_name, old_value, new_value) VALUES (?, ?, ?, ?, ?, ?)`);
|
|
addEvent(event, id, req.user.id, 'priority_changed', 'priority', ticket.priority, priority);
|
|
});
|
|
res.json({ message: '优先级已更新', ticket: getTicket(id) });
|
|
} catch (e) { console.error('Ticket priority error:', e.message); res.status(500).json({ error: '更新优先级失败' }); }
|
|
});
|
|
|
|
router.put('/:id/assignee', authMiddleware, adminOnly, (req, res) => {
|
|
const id = idParam(req.params.id);
|
|
const ticket = id ? getTicket(id) : null;
|
|
if (!ticket) return res.status(404).json({ error: '工单不存在' });
|
|
const assigneeId = req.body && (req.body.assignee_id === null || req.body.assignee_id === '' ? null : idParam(String(req.body.assignee_id)));
|
|
if (assigneeId !== null && !assigneeId) return res.status(400).json({ error: '负责人不合法' });
|
|
if (assigneeId !== null && !db.get("SELECT id FROM users WHERE id = ? AND role = 'admin'", [assigneeId])) return res.status(400).json({ error: '负责人必须是管理员' });
|
|
try {
|
|
db.transaction(() => {
|
|
const database = db.getDb();
|
|
database.prepare("UPDATE tickets SET assignee_id = ?, updated_at = datetime('now') WHERE id = ?").run(assigneeId, id);
|
|
const event = database.prepare(`INSERT INTO ticket_events
|
|
(ticket_id, actor_id, event_type, field_name, old_value, new_value) VALUES (?, ?, ?, ?, ?, ?)`);
|
|
addEvent(event, id, req.user.id, 'assignee_changed', 'assignee_id', ticket.assignee_id, assigneeId);
|
|
});
|
|
res.json({ message: '负责人已更新', ticket: getTicket(id) });
|
|
} catch (e) { console.error('Ticket assignee error:', e.message); res.status(500).json({ error: '更新负责人失败' }); }
|
|
});
|
|
|
|
router.post('/:id/close', authMiddleware, (req, res) => changeUserStatus(req, res, 'closed'));
|
|
router.post('/:id/reopen', authMiddleware, (req, res) => changeUserStatus(req, res, 'processing'));
|
|
|
|
function changeUserStatus(req, res, status) {
|
|
const id = idParam(req.params.id);
|
|
const ticket = id ? getTicket(id) : null;
|
|
if (!ticket) return res.status(404).json({ error: '工单不存在' });
|
|
if (ticket.requester_id !== req.user.id) return res.status(403).json({ error: '无权限操作该工单' });
|
|
if ((status === 'closed' && ticket.status === 'closed') || (status === 'processing' && !['resolved', 'closed'].includes(ticket.status))) {
|
|
return res.status(409).json({ error: '当前状态不支持此操作' });
|
|
}
|
|
try {
|
|
db.transaction(() => {
|
|
const database = db.getDb();
|
|
const event = database.prepare(`INSERT INTO ticket_events
|
|
(ticket_id, actor_id, event_type, field_name, old_value, new_value, detail) VALUES (?, ?, ?, ?, ?, ?, ?)`);
|
|
const result = updateStatus(ticket, status, req.user.id, event);
|
|
if (result.error) throw new Error(result.error);
|
|
});
|
|
res.json({ message: status === 'closed' ? '工单已关闭' : '工单已重新打开', ticket: getTicket(id) });
|
|
} catch (e) { res.status(e.message === '不允许的状态流转' ? 409 : 500).json({ error: e.message === '不允许的状态流转' ? e.message : '更新工单失败' }); }
|
|
}
|
|
|
|
module.exports = router;
|