v1.0.10

2026-08-03 00:07:01 +08:00
commit 71c6e8d9c1
112 changed files with 7815 additions and 0 deletions
@@ -0,0 +1,37 @@
+<?php
+/**
+ * 找回密码接口  POST /api/auth/forgot.php
+ * 入参：username / contact_email
+ * 说明：占位实现 —— 校验账号存在后返回成功（后续可接入 SMTP 发送重置邮件/短信验证码）。
+ */
+require_once __DIR__ . '/../common/db.php';
+require_once __DIR__ . '/../common/response.php';
+require_once __DIR__ . '/../common/logger.php';
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    Response::error('请求方式错误', 400);
+}
+
+$username     = trim($_POST['username'] ?? '');
+$contactEmail = trim($_POST['contact_email'] ?? '');
+
+if ($username === '' || $contactEmail === '') {
+    Response::error('请输入账号和联系邮箱');
+}
+if (!filter_var($contactEmail, FILTER_VALIDATE_EMAIL)) {
+    Response::error('邮箱格式不正确');
+}
+
+$pdo = DB::getInstance()->getPdo();
+$stmt = $pdo->prepare("SELECT id, username, real_name FROM system_users WHERE username = ? AND is_active = 1 LIMIT 1");
+$stmt->execute([$username]);
+$user = $stmt->fetch();
+
+if (!$user) {
+    Response::error('账号不存在或已禁用');
+}
+
+// TODO: 接入 SMTP 后向 contactEmail 发送重置链接/验证码
+logAction((int)$user['id'], $user['username'], 'forgot', 'auth', 'system_users', (int)$user['id'], ['contact_email' => $contactEmail]);
+
+Response::success(null, '重置邮件已发送（占位实现，请接入SMTP后生效）');
@@ -0,0 +1,67 @@
+<?php
+/**
+ * 登录接口  POST /api/auth/login.php
+ * 入参：username / password / slider_token（滑块验证通过后的token）
+ * 出参（成功）：{ code:0, msg:'登录成功', data:{ real_name, role_name, permissions } }
+ */
+require_once __DIR__ . '/../common/db.php';
+require_once __DIR__ . '/../common/response.php';
+require_once __DIR__ . '/../common/logger.php';
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    Response::error('请求方式错误', 400);
+}
+
+$username    = trim($_POST['username'] ?? '');
+$password    = (string)($_POST['password'] ?? '');
+$sliderToken = trim($_POST['slider_token'] ?? '');
+
+// 滑块验证：前端 slider.js 拖动通过后生成的 token，服务端校验非空且格式合法
+if ($sliderToken === '' || strlen($sliderToken) < 10) {
+    Response::error('请先完成滑块验证');
+}
+if ($username === '' || $password === '') {
+    Response::error('请输入账号和密码');
+}
+
+$pdo = DB::getInstance()->getPdo();
+$stmt = $pdo->prepare(
+    "SELECT u.*, r.role_name, r.permissions
+     FROM system_users u
+     LEFT JOIN system_roles r ON r.id = u.role_id
+     WHERE u.username = ? LIMIT 1"
+);
+$stmt->execute([$username]);
+$user = $stmt->fetch();
+
+if (!$user || !hash_equals($user['password'], sha1($password))) {
+    Response::error('账号或密码错误');
+}
+if ((int)$user['is_active'] !== 1) {
+    Response::error('账号已被禁用，请联系管理员');
+}
+
+// 更新最后登录时间/IP
+$ip = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
+$upd = $pdo->prepare("UPDATE system_users SET last_login_time = NOW(), last_login_ip = ? WHERE id = ?");
+$upd->execute([$ip, $user['id']]);
+
+// 写入 Session
+if (session_status() === PHP_SESSION_NONE) {
+    session_start();
+}
+$_SESSION['user_id']     = (int)$user['id'];
+$_SESSION['username']    = $user['username'];
+$_SESSION['real_name']   = $user['real_name'] ?? $user['username'];
+$_SESSION['role_id']     = (int)$user['role_id'];
+$_SESSION['role_name']   = $user['role_name'] ?? '';
+$_SESSION['permissions'] = json_decode($user['permissions'] ?? '[]', true) ?: [];
+
+// 操作日志
+logAction((int)$user['id'], $user['username'], 'login', 'auth', 'system_users', (int)$user['id'], ['ip' => $ip]);
+
+Response::success([
+    'real_name'   => $_SESSION['real_name'],
+    'role_name'   => $_SESSION['role_name'],
+    'permissions' => $_SESSION['permissions'],
+], '登录成功');
@@ -0,0 +1,26 @@
+<?php
+/**
+ * 登出接口  POST /api/auth/logout.php
+ */
+require_once __DIR__ . '/../common/db.php';
+require_once __DIR__ . '/../common/response.php';
+require_once __DIR__ . '/../common/logger.php';
+require_once __DIR__ . '/../common/auth.php';
+
+if (session_status() === PHP_SESSION_NONE) {
+    session_start();
+}
+
+if (!empty($_SESSION['user_id'])) {
+    logAction((int)$_SESSION['user_id'], $_SESSION['username'] ?? '', 'logout', 'auth', 'system_users', (int)$_SESSION['user_id']);
+}
+
+// 清空并销毁会话
+$_SESSION = [];
+if (ini_get('session.use_cookies')) {
+    $p = session_get_cookie_params();
+    setcookie(session_name(), '', time() - 42000, $p['path'], $p['domain'], $p['secure'], $p['httponly']);
+}
+session_destroy();
+
+Response::success(null, '已退出登录');
@@ -0,0 +1,24 @@
+<?php
+/**
+ * 会话校验接口  GET /api/auth/session.php
+ * 前端页面加载时调用：未登录返回 401（前端跳转登录页），已登录返回当前用户信息。
+ */
+require_once __DIR__ . '/../common/response.php';
+require_once __DIR__ . '/../common/auth.php';
+
+requireLogin();
+
+$pdo = DB::getInstance()->getPdo();
+$stmt = $pdo->prepare("SELECT last_login_time, last_login_ip FROM system_users WHERE id = ?");
+$stmt->execute([(int)$_SESSION['user_id']]);
+$loginInfo = $stmt->fetch() ?: [];
+
+Response::success([
+    'user_id'         => (int)$_SESSION['user_id'],
+    'username'        => $_SESSION['username'],
+    'real_name'       => $_SESSION['real_name'],
+    'role_name'       => $_SESSION['role_name'],
+    'permissions'     => $_SESSION['permissions'],
+    'last_login_time' => $loginInfo['last_login_time'] ?? null,
+    'last_login_ip'   => $loginInfo['last_login_ip'] ?? null,
+]);