buff/backend/app/api/admin/admins.py

"""
管理员管理接口
"""
from fastapi import APIRouter, Depends, Query, Request
from sqlalchemy.orm import Session
from pydantic import BaseModel
from app.database import get_db
from app.api.deps import get_current_admin
from app.models.admin import Admin
from app.core.security import get_password_hash, verify_password
from datetime import datetime
from app.utils.timezone import beijing_now

router = APIRouter()

class AdminCreate(BaseModel):
    """创建管理员请求"""
    username: str
    password: str
    real_name: str = None
    email: str = None
    role: str = "super_admin"

class AdminUpdate(BaseModel):
    """更新管理员请求"""
    real_name: str = None
    email: str = None
    role: str = None

class AdminPasswordReset(BaseModel):
    """重置密码请求"""
    new_password: str

@router.get("")
async def get_admins(
    page: int = Query(1, ge=1),
    page_size: int = Query(10, ge=1, le=100),
    keyword: str = Query(None, description="搜索关键词（用户名、邮箱）"),
    role: str = Query(None, description="角色筛选"),
    status: int = Query(None, description="状态筛选：1-正常，0-禁用"),
    db: Session = Depends(get_db),
    current_admin = Depends(get_current_admin)
):
    """获取管理员列表"""
    offset = (page - 1) * page_size
    
    query = db.query(Admin).filter(Admin.is_deleted == 0)

    # 搜索
    if keyword:
        query = query.filter(
            (Admin.username.like(f"%{keyword}%")) |
            (Admin.email.like(f"%{keyword}%"))
        )
    
    # 筛选
    if role:
        query = query.filter(Admin.role == role)
    if status is not None:
        query = query.filter(Admin.status == status)
    
    # 排序
    query = query.order_by(Admin.created_at.desc())
    
    admins = query.offset(offset).limit(page_size).all()
    total = query.count()
    
    return {
        "code": 200,
        "msg": "成功",
        "data": [
            {
                "id": a.id,
                "username": a.username,
                "real_name": a.real_name,
                "email": a.email,
                "role": a.role,
                "status": a.status,
                "last_login_time": a.last_login_time.isoformat() if a.last_login_time else None,
                "last_login_ip": a.last_login_ip,
                "created_at": a.created_at.isoformat() if a.created_at else None,
                "updated_at": a.updated_at.isoformat() if a.updated_at else None
            }
            for a in admins
        ],
        "total": total,
        "page": page,
        "page_size": page_size
    }

@router.post("")
async def create_admin(
    req: AdminCreate,
    request: Request,
    db: Session = Depends(get_db),
    current_admin = Depends(get_current_admin)
):
    """创建管理员"""
    # 检查用户名是否存在
    existing = db.query(Admin).filter(Admin.username == req.username).first()
    if existing:
        return {"code": 400, "msg": "用户名已存在"}

    # 创建管理员
    admin = Admin(
        username=req.username,
        password=get_password_hash(req.password),
        real_name=req.real_name,
        email=req.email,
      # 系统只使用 super_admin 角色，强制写为 super_admin，避免外部传入其他值
      role='super_admin',
        status=1,
        created_at=beijing_now(),
        updated_at=beijing_now()
    )
    db.add(admin)

    # 刷新以获取ID
    db.flush()

    # 创建历史记录
    from app.utils.history import create_admin_history, create_operation_log
    create_admin_history(db, admin, "INSERT")

    # 记录操作日志
    client_ip = request.client.host if request.client else None
    create_operation_log(
        db=db,
        admin_id=current_admin.id,
        module="管理员管理",
        action="创建管理员",
        description=f"创建管理员账号：{req.username}",
        new_data={
            "username": req.username,
            "real_name": req.real_name,
            "email": req.email,
            "role": req.role
        },
        ip_address=client_ip
    )

    # 一次性提交所有更改
    db.commit()

    return {"code": 200, "msg": "创建成功", "data": {"id": admin.id}}

@router.get("/{admin_id}")
async def get_admin(
    admin_id: int,
    db: Session = Depends(get_db),
    current_admin = Depends(get_current_admin)
):
    """获取管理员详情"""
    admin = db.query(Admin).filter(Admin.id == admin_id).first()
    if not admin:
        return {"code": 404, "msg": "管理员不存在"}
    
    return {
        "code": 200,
        "msg": "成功",
        "data": {
            "id": admin.id,
            "username": admin.username,
            "real_name": admin.real_name,
            "email": admin.email,
            "role": admin.role,
            "status": admin.status,
            "last_login_time": admin.last_login_time.isoformat() if admin.last_login_time else None,
            "last_login_ip": admin.last_login_ip,
            "created_at": admin.created_at.isoformat() if admin.created_at else None,
            "updated_at": admin.updated_at.isoformat() if admin.updated_at else None
        }
    }

@router.put("/{admin_id}")
async def update_admin(
    admin_id: int,
    req: AdminUpdate,
    request: Request,
    db: Session = Depends(get_db),
    current_admin = Depends(get_current_admin)
):
    """更新管理员"""
    admin = db.query(Admin).filter(Admin.id == admin_id).first()
    if not admin:
        return {"code": 404, "msg": "管理员不存在"}

    # 不能修改自己的角色
    if current_admin.id == admin_id and req.role and req.role != admin.role:
        return {"code": 400, "msg": "不能修改自己的角色"}

    # 记录更新前的状态
    old_data = {
        "real_name": admin.real_name,
        "email": admin.email,
        "role": admin.role
    }

    # 更新字段
    if req.real_name is not None:
        admin.real_name = req.real_name
    if req.email is not None:
        admin.email = req.email
    if req.role is not None:
        # 系统只支持 super_admin，任何传入值都统一设置为 super_admin
        admin.role = 'super_admin'

    admin.updated_at = beijing_now()

    # 创建历史记录
    from app.utils.history import create_admin_history, create_operation_log
    create_admin_history(db, admin, "UPDATE")

    # 记录操作日志
    client_ip = request.client.host if request.client else None
    create_operation_log(
        db=db,
        admin_id=current_admin.id,
        module="管理员管理",
        action="更新管理员",
        description=f"更新管理员信息：{admin.username}",
        old_data=old_data,
        new_data={
            "real_name": admin.real_name,
            "email": admin.email,
            "role": admin.role
        },
        ip_address=client_ip
    )

    # 一次性提交所有更改
    db.commit()

    return {"code": 200, "msg": "更新成功"}

@router.put("/{admin_id}/reset-password")
async def reset_admin_password(
    admin_id: int,
    req: AdminPasswordReset,
    request: Request,
    db: Session = Depends(get_db),
    current_admin = Depends(get_current_admin)
):
    """重置管理员密码"""
    admin = db.query(Admin).filter(Admin.id == admin_id).first()
    if not admin:
        return {"code": 404, "msg": "管理员不存在"}

    # 更新密码
    admin.password = get_password_hash(req.new_password)
    admin.updated_at = beijing_now()

    # 记录操作日志
    from app.utils.history import create_operation_log
    client_ip = request.client.host if request.client else None
    create_operation_log(
        db=db,
        admin_id=current_admin.id,
        module="管理员管理",
        action="重置管理员密码",
        description=f"为管理员重置密码：{admin.username}",
        ip_address=client_ip
    )

    # 一次性提交所有更改
    db.commit()

    return {"code": 200, "msg": "密码重置成功"}

@router.put("/{admin_id}/status")
async def update_admin_status(
    admin_id: int,
    status: int = Query(..., description="状态：1-正常，0-禁用"),
    request: Request = None,
    db: Session = Depends(get_db),
    current_admin = Depends(get_current_admin)
):
    """启用/禁用管理员"""
    admin = db.query(Admin).filter(Admin.id == admin_id).first()
    if not admin:
        return {"code": 404, "msg": "管理员不存在"}

    # 不能禁用自己
    if current_admin.id == admin_id:
        return {"code": 400, "msg": "不能禁用自己"}

    old_status = admin.status
    admin.status = status
    admin.updated_at = beijing_now()

    # 记录操作日志
    from app.utils.history import create_operation_log
    client_ip = request.client.host if request and request.client else None
    status_text = "启用" if status == 1 else "禁用"
    create_operation_log(
        db=db,
        admin_id=current_admin.id,
        module="管理员管理",
        action="更新管理员状态",
        description=f"{status_text}管理员账号：{admin.username}",
        old_data={"status": old_status},
        new_data={"status": status},
        ip_address=client_ip
    )

    # 一次性提交所有更改
    db.commit()

    return {"code": 200, "msg": "状态更新成功"}

@router.delete("/{admin_id}")
async def delete_admin(
    admin_id: int,
    request: Request,
    db: Session = Depends(get_db),
    current_admin = Depends(get_current_admin)
):
    """删除管理员（软删除）"""
    admin = db.query(Admin).filter(Admin.id == admin_id, Admin.is_deleted == 0).first()
    if not admin:
        return {"code": 404, "msg": "管理员不存在"}

    # 不能删除自己
    if current_admin.id == admin_id:
        return {"code": 400, "msg": "不能删除自己"}

    admin.is_deleted = 1
    admin.updated_at = beijing_now()

    # 创建历史记录
    from app.utils.history import create_admin_history, create_operation_log
    create_admin_history(db, admin, "DELETE")

    # 记录操作日志
    client_ip = request.client.host if request.client else None
    create_operation_log(
        db=db,
        admin_id=current_admin.id,
        module="管理员管理",
        action="删除管理员",
        description=f"删除管理员账号：{admin.username}",
        old_data={
            "username": admin.username,
            "real_name": admin.real_name,
            "email": admin.email,
            "role": admin.role
        },
        ip_address=client_ip
    )

    # 一次性提交所有更改
    db.commit()

    return {"code": 200, "msg": "删除成功"}