rainblogweb/routes/tickets.js

const express = require('express');
const db = require('../db');
const { authMiddleware, adminOnly } = require('../middleware/auth');

const router = express.Router();

const CATEGORIES = new Set(['forum_bug', 'site_bug', 'feature', 'account', 'other']);
const PRIORITIES = new Set(['low', 'normal', 'high', 'urgent']);
const STATUSES = new Set(['open', 'processing', 'waiting', 'resolved', 'closed']);
const TRANSITIONS = {
  open: new Set(['processing', 'closed']),
  processing: new Set(['waiting', 'resolved', 'closed']),
  waiting: new Set(['processing', 'closed']),
  resolved: new Set(['closed', 'processing']),
  closed: new Set(['processing']),
};

function text(value, max = 0) {
  if (typeof value !== 'string') return '';
  const valueText = value.trim();
  return max && valueText.length > max ? valueText.slice(0, max) : valueText;
}

function currentUserRole(userId) {
  const user = db.get('SELECT role FROM users WHERE id = ?', [userId]);
  return user ? user.role : null;
}

function validateSourceUrl(value) {
  if (value === undefined || value === null || value === '') return { value: '' };
  if (typeof value !== 'string') return { error: '来源地址不合法' };
  if (value.length > 1000 || /[\u0000-\u001f\u007f]/.test(value)) return { error: '来源地址不合法' };
  const sourceUrl = value.trim();
  if (!sourceUrl) return { value: '' };
  if (sourceUrl.startsWith('/') && !sourceUrl.startsWith('//')) return { value: sourceUrl };
  if (!/^https?:\/\//i.test(sourceUrl)) return { error: '来源地址只允许站内路径或 http/https 地址' };
  try {
    const parsed = new URL(sourceUrl);
    if (!['http:', 'https:'].includes(parsed.protocol) || !parsed.hostname) return { error: '来源地址不合法' };
  } catch {
    return { error: '来源地址不合法' };
  }
  return { value: sourceUrl };
}

function pageParams(query) {
  const page = Number.parseInt(query.page, 10);
  const pageSize = Number.parseInt(query.pageSize, 10);
  return {
    page: Number.isInteger(page) && page >= 1 ? page : 1,
    pageSize: Number.isInteger(pageSize) && pageSize >= 1 && pageSize <= 50 ? pageSize : 20,
  };
}

function idParam(value) {
  const id = Number.parseInt(value, 10);
  return Number.isInteger(id) && id > 0 && String(id) === String(value) ? id : 0;
}

function getTicket(id) {
  return db.get(`SELECT t.*, u.username AS requester_name, u.nickname AS requester_nickname,
      a.username AS assignee_name, a.nickname AS assignee_nickname
    FROM tickets t
    LEFT JOIN users u ON u.id = t.requester_id
    LEFT JOIN users a ON a.id = t.assignee_id
    WHERE t.id = ?`, [id]);
}

function canAccess(ticket, user, role) {
  return !!ticket && !!role && (ticket.requester_id === user.id || role === 'admin');
}

function addEvent(insertEvent, ticketId, actorId, type, field = '', oldValue = '', newValue = '', detail = '') {
  insertEvent.run(ticketId, actorId || null, type, field, String(oldValue ?? ''), String(newValue ?? ''), detail);
}

function updateStatus(ticket, status, actorId, insertEvent) {
  if (!STATUSES.has(status)) return { error: '状态不合法' };
  if (ticket.status === status) return { changed: false };
  if (!TRANSITIONS[ticket.status] || !TRANSITIONS[ticket.status].has(status)) {
    return { error: '不允许的状态流转' };
  }
  const now = "datetime('now')";
  const values = [status];
  let sql = `UPDATE tickets SET status = ?, updated_at = ${now}`;
  if (status === 'resolved') sql += `, resolved_at = ${now}`;
  if (status === 'closed') sql += `, closed_at = ${now}`;
  if (status !== 'resolved') sql += ', resolved_at = NULL';
  if (status !== 'closed') sql += ', closed_at = NULL';
  sql += ' WHERE id = ?';
  values.push(ticket.id);
  db.getDb().prepare(sql).run(...values);
  addEvent(insertEvent, ticket.id, actorId, 'status_changed', 'status', ticket.status, status);
  return { changed: true };
}

function ticketResponse(ticket, isAdmin) {
  const messages = db.all(`SELECT tm.id, tm.ticket_id, tm.author_id, tm.content, tm.is_internal,
      tm.created_at, u.username AS author_name, u.nickname AS author_nickname, u.role AS author_role
    FROM ticket_messages tm LEFT JOIN users u ON u.id = tm.author_id
    WHERE tm.ticket_id = ? ${isAdmin ? '' : 'AND tm.is_internal = 0'}
    ORDER BY tm.created_at ASC, tm.id ASC`, [ticket.id]);
  const response = { ticket, messages };
  if (isAdmin) {
    response.events = db.all(`SELECT e.*, u.username AS actor_name, u.nickname AS actor_nickname
      FROM ticket_events e LEFT JOIN users u ON u.id = e.actor_id
      WHERE e.ticket_id = ? ORDER BY e.created_at ASC, e.id ASC`, [ticket.id]);
  }
  return response;
}

// 管理后台列表（作为管理后台的工单子 tab 使用）
router.get('/admin', authMiddleware, adminOnly, (req, res) => {
  const { page, pageSize } = pageParams(req.query);
  const conditions = [];
  const params = [];
  const filters = [
    ['status', STATUSES], ['priority', PRIORITIES], ['category', CATEGORIES],
  ];
  for (const [key, allowed] of filters) {
    if (req.query[key]) {
      if (!allowed.has(String(req.query[key]))) return res.status(400).json({ error: `${key} 不合法` });
      conditions.push(`t.${key} = ?`); params.push(String(req.query[key]));
    }
  }
  const assigneeId = req.query.assignee_id === 'null' ? null : idParam(req.query.assignee_id || '');
  if (req.query.assignee_id !== undefined) {
    if (req.query.assignee_id === 'null') conditions.push('t.assignee_id IS NULL');
    else if (!assigneeId) return res.status(400).json({ error: '负责人不合法' });
    else { conditions.push('t.assignee_id = ?'); params.push(assigneeId); }
  }
  const requesterId = req.query.requester_id ? idParam(req.query.requester_id) : 0;
  if (req.query.requester_id && !requesterId) return res.status(400).json({ error: '提交人不合法' });
  if (requesterId) { conditions.push('t.requester_id = ?'); params.push(requesterId); }
  if (req.query.q) {
    const q = text(req.query.q, 100);
    conditions.push('(t.ticket_no LIKE ? OR t.subject LIKE ? OR t.description LIKE ?)');
    params.push(`%${q}%`, `%${q}%`, `%${q}%`);
  }
  const where = conditions.length ? `WHERE ${conditions.join(' AND ')}` : '';
  const total = db.get(`SELECT COUNT(*) AS count FROM tickets t ${where}`, params).count;
  const list = db.all(`SELECT t.id, t.ticket_no, t.subject, t.category, t.priority, t.status,
      t.requester_id, t.assignee_id, t.source, t.created_at, t.updated_at, t.last_reply_at,
      u.username AS requester_name, u.nickname AS requester_nickname,
      a.username AS assignee_name, a.nickname AS assignee_nickname
    FROM tickets t LEFT JOIN users u ON u.id = t.requester_id LEFT JOIN users a ON a.id = t.assignee_id
    ${where} ORDER BY CASE t.status WHEN 'open' THEN 0 WHEN 'processing' THEN 1 WHEN 'waiting' THEN 2 WHEN 'resolved' THEN 3 ELSE 4 END,
      t.updated_at DESC, t.id DESC LIMIT ? OFFSET ?`, [...params, pageSize, (page - 1) * pageSize]);
  res.json({ tickets: list, list, total, page, pageSize, totalPages: Math.ceil(total / pageSize) });
});

router.get('/admin/stats', authMiddleware, adminOnly, (req, res) => {
  const row = db.get(`SELECT COUNT(*) AS total,
    SUM(status = 'open') AS open, SUM(status = 'processing') AS processing,
    SUM(status = 'waiting') AS waiting, SUM(status = 'resolved') AS resolved,
    SUM(status = 'closed') AS closed FROM tickets`);
  res.json(Object.fromEntries(Object.entries(row).map(([key, value]) => [key, Number(value) || 0])));
});

router.get('/admin/assignees', authMiddleware, adminOnly, (req, res) => {
  res.json(db.all("SELECT id, username, nickname FROM users WHERE role = 'admin' ORDER BY id ASC"));
});

// 用户自己的工单列表
router.get('/', authMiddleware, (req, res) => {
  const { page, pageSize } = pageParams(req.query);
  if (req.query.status && !STATUSES.has(String(req.query.status))) return res.status(400).json({ error: '状态不合法' });
  const params = [req.user.id];
  const statusSql = req.query.status ? 'AND t.status = ?' : '';
  if (req.query.status) params.push(String(req.query.status));
  const total = db.get(`SELECT COUNT(*) AS count FROM tickets t WHERE t.requester_id = ? ${statusSql}`, params).count;
  const list = db.all(`SELECT t.id, t.ticket_no, t.subject, t.category, t.priority, t.status, t.source,
      t.created_at, t.updated_at, t.last_reply_at
    FROM tickets t WHERE t.requester_id = ? ${statusSql}
    ORDER BY t.created_at DESC, t.id DESC LIMIT ? OFFSET ?`, [...params, pageSize, (page - 1) * pageSize]);
  res.json({ tickets: list, list, total, page, pageSize, totalPages: Math.ceil(total / pageSize) });
});

router.post('/', authMiddleware, (req, res) => {
  const body = req.body || {};
  const subject = text(body.subject, 120);
  const description = text(body.description, 20000);
  const category = text(body.category, 30) || 'other';
  const priority = text(body.priority, 20) || 'normal';
  const source = text(body.source, 20) || 'site';
  if (subject.length < 1 || description.length < 1) return res.status(400).json({ error: '标题和问题描述不能为空' });
  if (!CATEGORIES.has(category)) return res.status(400).json({ error: '问题分类不合法' });
  if (!PRIORITIES.has(priority)) return res.status(400).json({ error: '优先级不合法' });
  if (!['forum', 'site'].includes(source)) return res.status(400).json({ error: '来源不合法' });
  const sourceUrlResult = validateSourceUrl(body.source_url);
  if (sourceUrlResult.error) return res.status(400).json({ error: sourceUrlResult.error });
  const sourceUrl = sourceUrlResult.value;
  const sourceType = text(body.source_type, 40);
  const sourceId = body.source_id === undefined || body.source_id === '' ? 0 : idParam(String(body.source_id));
  if (body.source_id !== undefined && body.source_id !== '' && !sourceId) return res.status(400).json({ error: '来源编号不合法' });
  if (source === 'forum' && sourceId && !db.get('SELECT id FROM forum_posts WHERE id = ?', [sourceId])) {
    return res.status(400).json({ error: '关联的论坛帖子不存在' });
  }
  const browserInfo = text(body.browser_info, 1000);
  try {
    const result = db.transaction(() => {
      const database = db.getDb();
      const insertTicket = database.prepare(`INSERT INTO tickets
        (ticket_no, requester_id, subject, description, category, priority, source, source_url, source_type, source_id, browser_info)
        VALUES ('PENDING-' || hex(randomblob(8)), ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);
      const info = insertTicket.run(req.user.id, subject, description, category, priority, source, sourceUrl, sourceType, sourceId, browserInfo);
      const id = Number(info.lastInsertRowid);
      const ticketNo = `RW-${String(id).padStart(6, '0')}`;
      database.prepare('UPDATE tickets SET ticket_no = ? WHERE id = ?').run(ticketNo, id);
      const event = database.prepare(`INSERT INTO ticket_events
        (ticket_id, actor_id, event_type, field_name, old_value, new_value, detail) VALUES (?, ?, ?, ?, ?, ?, ?)`);
      addEvent(event, id, req.user.id, 'ticket_created', '', '', 'open', '用户创建工单');
      return { id, ticket_no: ticketNo };
    });
    res.status(201).json({ message: '工单已创建', ticket: getTicket(result.id) });
  } catch (e) {
    console.error('Ticket create error:', e.message);
    res.status(500).json({ error: '创建工单失败' });
  }
});

router.get('/:id/events', authMiddleware, adminOnly, (req, res) => {
  const id = idParam(req.params.id);
  if (!id) return res.status(404).json({ error: '工单不存在' });
  if (!getTicket(id)) return res.status(404).json({ error: '工单不存在' });
  res.json(db.all(`SELECT e.*, u.username AS actor_name, u.nickname AS actor_nickname
    FROM ticket_events e LEFT JOIN users u ON u.id = e.actor_id
    WHERE e.ticket_id = ? ORDER BY e.created_at ASC, e.id ASC`, [id]));
});

router.get('/:id', authMiddleware, (req, res) => {
  const id = idParam(req.params.id);
  const ticket = id ? getTicket(id) : null;
  if (!ticket) return res.status(404).json({ error: '工单不存在' });
  const role = currentUserRole(req.user.id);
  if (!role) return res.status(401).json({ error: '登录已失效' });
  if (!canAccess(ticket, req.user, role)) return res.status(403).json({ error: '无权限访问该工单' });
  res.json(ticketResponse(ticket, role === 'admin'));
});

router.post('/:id/messages', authMiddleware, (req, res) => {
  const id = idParam(req.params.id);
  const ticket = id ? getTicket(id) : null;
  if (!ticket) return res.status(404).json({ error: '工单不存在' });
  const role = currentUserRole(req.user.id);
  if (!role) return res.status(401).json({ error: '登录已失效' });
  if (!canAccess(ticket, req.user, role)) return res.status(403).json({ error: '无权限访问该工单' });
  const content = text(req.body && req.body.content, 20000);
  if (!content) return res.status(400).json({ error: '回复内容不能为空' });
  if (ticket.status === 'closed') return res.status(409).json({ error: '工单已关闭，不能回复' });
  try {
    db.transaction(() => {
      const database = db.getDb();
      database.prepare('INSERT INTO ticket_messages (ticket_id, author_id, content, is_internal) VALUES (?, ?, ?, 0)').run(id, req.user.id, content);
      let nextStatus = ticket.status;
      if (role !== 'admin' && ticket.status === 'waiting') nextStatus = 'processing';
      database.prepare(`UPDATE tickets SET updated_at = datetime('now'), last_reply_at = datetime('now'),
        first_response_at = CASE WHEN first_response_at IS NULL AND ? = 'admin' THEN datetime('now') ELSE first_response_at END,
        status = ? WHERE id = ?`).run(role, nextStatus, id);
      const event = database.prepare(`INSERT INTO ticket_events
        (ticket_id, actor_id, event_type, field_name, old_value, new_value, detail) VALUES (?, ?, ?, ?, ?, ?, ?)`);
      addEvent(event, id, req.user.id, 'message_added', '', '', '公开回复', '');
      if (nextStatus !== ticket.status) addEvent(event, id, req.user.id, 'status_changed', 'status', ticket.status, nextStatus, '用户回复后自动进入处理中');
    });
    res.status(201).json(ticketResponse(getTicket(id), role === 'admin'));
  } catch (e) {
    console.error('Ticket message error:', e.message);
    res.status(500).json({ error: '回复工单失败' });
  }
});

router.post('/:id/internal-messages', authMiddleware, adminOnly, (req, res) => {
  const id = idParam(req.params.id);
  if (!id || !getTicket(id)) return res.status(404).json({ error: '工单不存在' });
  const content = text(req.body && req.body.content, 20000);
  if (!content) return res.status(400).json({ error: '内部备注不能为空' });
  try {
    db.transaction(() => {
      const database = db.getDb();
      database.prepare('INSERT INTO ticket_messages (ticket_id, author_id, content, is_internal) VALUES (?, ?, ?, 1)').run(id, req.user.id, content);
      database.prepare("UPDATE tickets SET updated_at = datetime('now') WHERE id = ?").run(id);
      const event = database.prepare(`INSERT INTO ticket_events
        (ticket_id, actor_id, event_type, field_name, old_value, new_value, detail) VALUES (?, ?, ?, ?, ?, ?, ?)`);
      addEvent(event, id, req.user.id, 'internal_note_added', '', '', '', '管理员添加内部备注');
    });
    res.status(201).json(ticketResponse(getTicket(id), true));
  } catch (e) {
    console.error('Ticket internal message error:', e.message);
    res.status(500).json({ error: '添加内部备注失败' });
  }
});

router.put('/:id/status', authMiddleware, adminOnly, (req, res) => {
  const id = idParam(req.params.id);
  const ticket = id ? getTicket(id) : null;
  if (!ticket) return res.status(404).json({ error: '工单不存在' });
  const status = text(req.body && req.body.status, 20);
  try {
    const result = db.transaction(() => {
      const database = db.getDb();
      const event = database.prepare(`INSERT INTO ticket_events
        (ticket_id, actor_id, event_type, field_name, old_value, new_value, detail) VALUES (?, ?, ?, ?, ?, ?, ?)`);
      return updateStatus(ticket, status, req.user.id, event);
    });
    if (result.error) return res.status(result.error === '不允许的状态流转' ? 409 : 400).json({ error: result.error });
    res.json({ message: '状态已更新', ticket: getTicket(id) });
  } catch (e) { console.error('Ticket status error:', e.message); res.status(500).json({ error: '更新状态失败' }); }
});

router.put('/:id/priority', authMiddleware, adminOnly, (req, res) => {
  const id = idParam(req.params.id);
  const ticket = id ? getTicket(id) : null;
  if (!ticket) return res.status(404).json({ error: '工单不存在' });
  const priority = text(req.body && req.body.priority, 20);
  if (!PRIORITIES.has(priority)) return res.status(400).json({ error: '优先级不合法' });
  try {
    db.transaction(() => {
      const database = db.getDb();
      database.prepare("UPDATE tickets SET priority = ?, updated_at = datetime('now') WHERE id = ?").run(priority, id);
      const event = database.prepare(`INSERT INTO ticket_events
        (ticket_id, actor_id, event_type, field_name, old_value, new_value) VALUES (?, ?, ?, ?, ?, ?)`);
      addEvent(event, id, req.user.id, 'priority_changed', 'priority', ticket.priority, priority);
    });
    res.json({ message: '优先级已更新', ticket: getTicket(id) });
  } catch (e) { console.error('Ticket priority error:', e.message); res.status(500).json({ error: '更新优先级失败' }); }
});

router.put('/:id/assignee', authMiddleware, adminOnly, (req, res) => {
  const id = idParam(req.params.id);
  const ticket = id ? getTicket(id) : null;
  if (!ticket) return res.status(404).json({ error: '工单不存在' });
  const assigneeId = req.body && (req.body.assignee_id === null || req.body.assignee_id === '' ? null : idParam(String(req.body.assignee_id)));
  if (assigneeId !== null && !assigneeId) return res.status(400).json({ error: '负责人不合法' });
  if (assigneeId !== null && !db.get("SELECT id FROM users WHERE id = ? AND role = 'admin'", [assigneeId])) return res.status(400).json({ error: '负责人必须是管理员' });
  try {
    db.transaction(() => {
      const database = db.getDb();
      database.prepare("UPDATE tickets SET assignee_id = ?, updated_at = datetime('now') WHERE id = ?").run(assigneeId, id);
      const event = database.prepare(`INSERT INTO ticket_events
        (ticket_id, actor_id, event_type, field_name, old_value, new_value) VALUES (?, ?, ?, ?, ?, ?)`);
      addEvent(event, id, req.user.id, 'assignee_changed', 'assignee_id', ticket.assignee_id, assigneeId);
    });
    res.json({ message: '负责人已更新', ticket: getTicket(id) });
  } catch (e) { console.error('Ticket assignee error:', e.message); res.status(500).json({ error: '更新负责人失败' }); }
});

router.post('/:id/close', authMiddleware, (req, res) => changeUserStatus(req, res, 'closed'));
router.post('/:id/reopen', authMiddleware, (req, res) => changeUserStatus(req, res, 'processing'));

function changeUserStatus(req, res, status) {
  const id = idParam(req.params.id);
  const ticket = id ? getTicket(id) : null;
  if (!ticket) return res.status(404).json({ error: '工单不存在' });
  if (ticket.requester_id !== req.user.id) return res.status(403).json({ error: '无权限操作该工单' });
  if ((status === 'closed' && ticket.status === 'closed') || (status === 'processing' && !['resolved', 'closed'].includes(ticket.status))) {
    return res.status(409).json({ error: '当前状态不支持此操作' });
  }
  try {
    db.transaction(() => {
      const database = db.getDb();
      const event = database.prepare(`INSERT INTO ticket_events
        (ticket_id, actor_id, event_type, field_name, old_value, new_value, detail) VALUES (?, ?, ?, ?, ?, ?, ?)`);
      const result = updateStatus(ticket, status, req.user.id, event);
      if (result.error) throw new Error(result.error);
    });
    res.json({ message: status === 'closed' ? '工单已关闭' : '工单已重新打开', ticket: getTicket(id) });
  } catch (e) { res.status(e.message === '不允许的状态流转' ? 409 : 500).json({ error: e.message === '不允许的状态流转' ? e.message : '更新工单失败' }); }
}

module.exports = router;