|
|
@@ -2948,7 +2948,7 @@ function maskMobile(value) { const mobile = text(value); if (mobile.length < 7)
|
|
|
function roleOf(context) { if (context.isSuperAdmin || context.roles.includes('ops-manager')) return 'ops-manager'; if (context.roles.includes('ops-staff')) return 'ops-staff'; if (context.roles.includes('ops-auditor')) return 'ops-auditor'; return 'ops-manager'; }
|
|
|
function requireRole(context, allowed) { const role = roleOf(context); if (!allowed.includes(role)) fail(403, '当前运营角色无权执行该操作'); return role; }
|
|
|
function companyIdOf(context, input) { if (context.isSuperAdmin && input.companyId) return String(input.companyId); return pointerId(context.company) || null; }
|
|
|
-function companyPointer(context, input) { const id = companyIdOf(context, input); return id ? Parse.Object.createWithoutData('Company', id) : null; }
|
|
|
+function companyPointer(context, input) { const id = companyIdOf(context, input); if(!id)return null;const pointer=new Parse.Object('Company');pointer.id=id;return pointer; }
|
|
|
function safe(value, depth = 0) { if (value == null || depth > 4) return value; if (Array.isArray(value)) return value.map((item) => safe(item, depth + 1)); if (value instanceof Date) return value.toISOString(); if (value && typeof value.toJSON === 'function') return safe(value.toJSON(), depth + 1); if (typeof value === 'object') { const out = {}; for (const [key,item] of Object.entries(value)) if (!/(?:password|secret|token|hash|masterkey|privatekey)/i.test(key)) out[key] = safe(item, depth + 1); return out; } return value; }
|
|
|
async function auth(request) {
|
|
|
const current = request.user || (typeof user !== 'undefined' ? user : null); if (!current) fail(401, '管理员会话已失效'); await current.fetch({ useMasterKey:true });
|
|
|
@@ -2958,7 +2958,7 @@ async function auth(request) {
|
|
|
const company = request.company || current.get('company') || null; if (!company && !isSuperAdmin) fail(403, '管理员账号尚未分配帐套'); return { current, roles, isSuperAdmin, company };
|
|
|
}
|
|
|
async function fieldsOf(className) { return (await new Parse.Schema(className).get({ useMasterKey:true })).fields || {}; }
|
|
|
-function tenant(query, fields, context, input) { if (!fields.company) return; const companyId = companyIdOf(context, input); if (companyId) query.equalTo('company', Parse.Object.createWithoutData('Company', companyId)); }
|
|
|
+function tenant(query, fields, context, input) { if (!fields.company) return; const company=companyPointer(context,input);if(company)query.equalTo('company',company); }
|
|
|
async function scopedObject(className, objectId, context, input) { if (!objectId) fail(400, '缺少目标记录'); const fields = await fieldsOf(className); const query = new Parse.Query(className); tenant(query, fields, context, input); return query.get(objectId, { useMasterKey:true }); }
|
|
|
function assertVersion(target, expected) { if (!expected) return; const actual = target.updatedAt ? target.updatedAt.toISOString() : ''; const wanted = dateIso(expected); if (actual && wanted && actual !== wanted) fail(409, '记录已被其他管理员修改,请刷新后重试'); }
|
|
|
function reasonOf(input) { const reason = text(input.reason); if (reason.length < 2 || reason.length > 500) fail(400, '操作原因必须为 2 至 500 个字符'); return reason; }
|