42 lines
1.7 KiB
TypeScript
42 lines
1.7 KiB
TypeScript
// GET /api/internal/users — 供 OA 查询 assets 用户列表
|
|
// POST /api/internal/users — 供 OA 同步用户角色
|
|
import { NextRequest, NextResponse } from 'next/server'
|
|
import db from '@/lib/db'
|
|
|
|
const INTERNAL_KEY = process.env.INTERNAL_API_KEY || 'oa-internal-key-tlyq-2026'
|
|
|
|
export async function GET(request: NextRequest) {
|
|
const key = request.headers.get('x-internal-key')
|
|
if (key !== INTERNAL_KEY) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
|
|
|
|
const users = db.prepare(
|
|
'SELECT username, display_name, role FROM users WHERE is_active = 1 ORDER BY username'
|
|
).all() as { username: string; display_name: string; role: string }[]
|
|
return NextResponse.json({ users })
|
|
}
|
|
|
|
export async function POST(request: NextRequest) {
|
|
const key = request.headers.get('x-internal-key')
|
|
if (key !== INTERNAL_KEY) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
|
|
|
|
const body = await request.json()
|
|
const { username, displayName, role } = body
|
|
if (!username) {
|
|
return NextResponse.json({ error: 'username 必填' }, { status: 400 })
|
|
}
|
|
const VALID_ROLES = ['admin', 'editor', 'viewer']
|
|
const safeRole = VALID_ROLES.includes(role) ? role : 'viewer'
|
|
|
|
try {
|
|
db.prepare(
|
|
`INSERT INTO users (username, password_hash, display_name, role, is_active, created_at, updated_at)
|
|
VALUES (?, '', ?, ?, 1, datetime('now', '+8 hours'), datetime('now', '+8 hours'))
|
|
ON CONFLICT(username) DO UPDATE SET role = ?, display_name = ?,
|
|
updated_at = datetime('now', '+8 hours')`
|
|
).run(username, displayName || username, safeRole, safeRole, displayName || username)
|
|
return NextResponse.json({ success: true })
|
|
} catch {
|
|
return NextResponse.json({ error: '同步失败' }, { status: 500 })
|
|
}
|
|
}
|