34 lines
1.2 KiB
TypeScript
34 lines
1.2 KiB
TypeScript
// GET /api/admin/users — 用户列表（admin）
|
||
import { NextRequest, NextResponse } from 'next/server'
|
||
import { verifyJwt } from '@shared/lib/auth/jwt'
|
||
import { authConfig } from '@/lib/auth-config'
|
||
import { dbQueryParams } from '@/lib/db'
|
||
import { hasPermission } from '@/lib/permissions'
|
||
|
||
export async function GET(request: NextRequest) {
|
||
const token = request.cookies.get('tlyq_session')?.value
|
||
if (!token) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
|
||
const payload = verifyJwt(token, authConfig.jwtSecret)
|
||
if (!payload || !hasPermission(String(payload.role || 'viewer'), 'users:view')) {
|
||
return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
|
||
}
|
||
|
||
const { searchParams } = new URL(request.url)
|
||
const username = searchParams.get('username') || ''
|
||
const role = searchParams.get('role') || ''
|
||
|
||
let where = 'WHERE 1=1'
|
||
const params: unknown[] = []
|
||
if (username) {
|
||
where += ' AND username LIKE ?'
|
||
params.push(`%${username}%`)
|
||
}
|
||
if (role) {
|
||
where += ' AND role = ?'
|
||
params.push(role)
|
||
}
|
||
|
||
const rows = dbQueryParams(`SELECT id, username, display_name, email, role, is_active, last_login_at FROM users ${where} ORDER BY id`, params)
|
||
return NextResponse.json(rows)
|
||
}
|