feat(admin): Add user management and upgrade to module permission system

Features - User Management (Phase 4.1): - Database: Add user_modules table for fine-grained module permissions - Database: Add 4 user permissions (view/create/edit/delete) to role_permissions - Backend: UserService (780 lines) - CRUD with tenant isolation - Backend: UserController + UserRoutes (648 lines) - 13 API endpoints - Backend: Batch import users from Excel - Frontend: UserListPage (412 lines) - list/filter/search/pagination - Frontend: UserFormPage (341 lines) - create/edit with module config - Frontend: UserDetailPage (393 lines) - details/tenant/module management - Frontend: 3 modal components (592 lines) - import/assign/configure - API: GET/POST/PUT/DELETE /api/admin/users/* endpoints Architecture Upgrade - Module Permission System: - Backend: Add getUserModules() method in auth.service - Backend: Login API returns modules array in user object - Frontend: AuthContext adds hasModule() method - Frontend: Navigation filters modules based on user.modules - Frontend: RouteGuard checks requiredModule instead of requiredVersion - Frontend: Remove deprecated version-based permission system - UX: Only show accessible modules in navigation (clean UI) - UX: Smart redirect after login (avoid 403 for regular users) Fixes: - Fix UTF-8 encoding corruption in ~100 docs files - Fix pageSize type conversion in userService (String to Number) - Fix authUser undefined error in TopNavigation - Fix login redirect logic with role-based access check - Update Git commit guidelines v1.2 with UTF-8 safety rules Database Changes: - CREATE TABLE user_modules (user_id, tenant_id, module_code, is_enabled) - ADD UNIQUE CONSTRAINT (user_id, tenant_id, module_code) - INSERT 4 permissions + role assignments - UPDATE PUBLIC tenant with 8 module subscriptions Technical: - Backend: 5 new files (~2400 lines) - Frontend: 10 new files (~2500 lines) - Docs: 1 development record + 2 status updates + 1 guideline update - Total: ~4900 lines of code Status: User management 100% complete, module permission system operational
2026-01-16 13:42:10 +08:00
parent 98d862dbd4
commit 66255368b7
560 changed files with 70424 additions and 52353 deletions
--- a/docs/05-部署文档/11-Node.js后端-SAE部署配置清单.md
+++ b/docs/05-部署文档/11-Node.js后端-SAE部署配置清单.md
@@ -1,24 +1,24 @@
 # Node.js 后端 - SAE部署配置清单

-> **<EFBFBD>𥕦遣<EFBFBD>園𡢿**嚗?025-12-24
-> **<EFBFBD>函蔡<EFBFBD>臬<EFBFBD>**嚗𡁏<E59A97>霂閧㴓憓<E3B493><E68693>Test嚗?
+> **创建时间**：2025-12-24
+> **部署环境**：测试环境（Test）
 > **应用名称**：nodejs-backend-test
-> **<EFBFBD>格<EFBFBD>閫<EFBFBD>聢**嚗?<3F>?GB
+> **目标规格**：1核2GB

 ---

 ## 🔐 生成的强JWT密钥

-**<EFBFBD>𩤃<EFBFBD> <20>滩<EFBFBD>嚗朞窈憒亙<E68692>靽萘恣甇文<E79487><E69687>伐<EFBFBD>銝滩<E98A9D>瘜<EFBFBD>蠧嚗?*
+**⚠️ 重要：请妥善保管此密钥，不要泄露！**

 ```bash
 JWT_SECRET=146c2fd064a69aa026496ee60e20483d07e951eae8323a501126469583433415
 ```

-**撖<EFBFBD>𤨎<EFBFBD>寞<EFBFBD>?*嚗?
- <EFBFBD>?64銝芸<E98A9D><E88AB8>剛<EFBFBD><E5899B>嗅<EFBFBD>蝚佗<E89D9A>256雿滚撩摨佗<E691A8>
- <EFBFBD>?摰<><E691B0><EFBFBD>𤩺㦤<F0A4A9BA><E3A6A4><EFBFBD>
- <EFBFBD>?蝚血<E89D9A><E8A180>煺漣<E785BA>臬<EFBFBD>摰匧<E691B0><E58CA7><EFBFBD><EFBFBD>
+**密钥特性**：
+- ✅ 64个十六进制字符（256位强度）
+- ✅ 完全随机生成
+- ✅ 符合生产环境安全标准

 ---

@@ -26,19 +26,19 @@ JWT_SECRET=146c2fd064a69aa026496ee60e20483d07e951eae8323a501126469583433415

 ### 方式1：逐个配置（SAE控制台）

-<EFBFBD>沒AE<EFBFBD>批<EFBFBD><EFBFBD>?<3F>?摨𠉛鍂<F0A0899B>滨蔭 <20>?<3F>臬<EFBFBD><E887AC>㗛<EFBFBD>銝哨<E98A9D><E593A8>𣂷葵瘛餃<E7989B>隞乩<E99A9E><E4B9A9>滨蔭嚗?
+在SAE控制台 → 应用配置 → 环境变量中，逐个添加以下配置：

-| <EFBFBD>㗛<EFBFBD><EFBFBD>?| <20>㗛<EFBFBD><E3979B>?| 霂湔<E99C82> |
+| 变量名 | 变量值 | 说明 |
 |--------|--------|------|
-| `DATABASE_URL` | `postgresql://airesearch:Xibahe%40fengzhibo117@pgm-2zex1m2y3r23hdn5.pg.rds.aliyuncs.com:5432/ai_clinical_research?connection_limit=18&pool_timeout=10` | RDS<EFBFBD>唳旿摨栞<EFBFBD><EFBFBD>伐<EFBFBD>瘜冽<EFBFBD>@蝻𣇉<EFBFBD>銝?40嚗?|
-| `JWT_SECRET` | `146c2fd064a69aa026496ee60e20483d07e951eae8323a501126469583433415` | <EFBFBD><EFBFBD> <20>啁<EFBFBD><E59581>鞟<EFBFBD>撘箏<E69298><E7AE8F>?|
+| `DATABASE_URL` | `postgresql://airesearch:Xibahe%40fengzhibo117@pgm-2zex1m2y3r23hdn5.pg.rds.aliyuncs.com:5432/ai_clinical_research?connection_limit=18&pool_timeout=10` | RDS数据库连接（注意@编码为%40） |
+| `JWT_SECRET` | `146c2fd064a69aa026496ee60e20483d07e951eae8323a501126469583433415` | 🔐 新生成的强密钥 |
 | `JWT_EXPIRES_IN` | `7d` | JWT过期时间 |
 | `DEEPSEEK_API_KEY` | `sk-7f8cc37a79fa4799860b38fc7ba2e150` | DeepSeek API密钥 |
 | `DASHSCOPE_API_KEY` | `sk-75b4ff29a14a49e79667a331034f3298` | 阿里千问API密钥 |
 | `CLOSEAI_API_KEY` | `sk-cu0ienbXYGGx2jc7BqP6ogtSWmP6fk918qV3RUdtGC3Ed1po` | CloseAI代理密钥 |
 | `CLOSEAI_OPENAI_BASE_URL` | `https://api.openai-proxy.org/v1` | OpenAI代理地址 |
 | `CLOSEAI_CLAUDE_BASE_URL` | `https://api.openai-proxy.org/anthropic` | Claude代理地址 |
-| `DIFY_API_URL` | `http://localhost/v1` | Dify<EFBFBD>滚𦛚<EFBFBD>啣<EFBFBD>嚗<EFBFBD>𧊋<EFBFBD>函蔡嚗?|
+| `DIFY_API_URL` | `http://localhost/v1` | Dify服务地址（未部署） |
 | `DIFY_API_KEY` | `dataset-mfvdiKvQ2l3NvxWm7RoYMN3c` | Dify API密钥 |
 | `PORT` | `3001` | 服务端口 |
 | `NODE_ENV` | `production` | 运行环境 |
@@ -54,9 +54,9 @@ JWT_SECRET=146c2fd064a69aa026496ee60e20483d07e951eae8323a501126469583433415

 ---

-### <EFBFBD>孵<EFBFBD>2嚗𡁏鸌<EFBFBD>誩紡<EFBFBD>伐<EFBFBD><EFBFBD>刻<EFBFBD>嚗?
+### 方式2：批量导入（推荐）

-撠<EFBFBD>誑銝见<EFBFBD>摰孵<EFBFBD><EFBFBD>塚<EFBFBD><EFBFBD>沒AE<EFBFBD>批<EFBFBD><EFBFBD>唬蝙<EFBFBD>?<3F>寥<EFBFBD>撖澆<E69296>"<22>蠘<EFBFBD>嚗?
+将以下内容复制，在SAE控制台使用"批量导入"功能：

 ```env
 DATABASE_URL=postgresql://airesearch:Xibahe%40fengzhibo117@pgm-2zex1m2y3r23hdn5.pg.rds.aliyuncs.com:5432/ai_clinical_research?connection_limit=18&pool_timeout=10
@@ -104,15 +104,15 @@ LOG_LEVEL=info
 ### ACR镜像仓库认证
 ```yaml
 Registry地址: crpi-cd5ij4pjt65mweeo-vpc.cn-beijing.personal.cr.aliyuncs.com
-<EFBFBD>冽<EFBFBD><EFBFBD>? gofeng117@163.com
+用户名: gofeng117@163.com
 密码: fengzhibo117
 ```

 ### 资源配置
 ```yaml
-CPU: 1<EFBFBD>?
+CPU: 1核
 内存: 2GB
-摰硺<EFBFBD><EFBFBD>? 1銝迎<E98A9D><E8BF8E>箏<EFBFBD>嚗?
+实例数: 1个（固定）
 ```

 ### 网络配置
@@ -127,16 +127,16 @@ VPC ID: vpc-2ze055cptkew9c38w4r06
 协议: TCP
 ```

-### <EFBFBD>亙熒璉<EFBFBD><EFBFBD>仿<EFBFBD>蝵?
+### 健康检查配置
 ```yaml
-璉<EFBFBD><EFBFBD>亦掩<EFBFBD>? HTTP
-璉<EFBFBD><EFBFBD>亥楝敺? /health
-璉<EFBFBD><EFBFBD>亦垢<EFBFBD>? 3001
-<EFBFBD>嘥<EFBFBD>撱嗉<EFBFBD>: 30蝘?
-璉<EFBFBD><EFBFBD>仿𡢿<EFBFBD>? 10蝘?
-頞<EFBFBD>𧒄<EFBFBD>園𡢿: 3蝘?
-銝滚<EFBFBD>摨琿<EFBFBD><EFBFBD>? 3甈?
-<EFBFBD>亙熒<EFBFBD><EFBFBD><EFBFBD>? 2甈?
+检查类型: HTTP
+检查路径: /health
+检查端口: 3001
+初始延迟: 30秒
+检查间隔: 10秒
+超时时间: 3秒
+不健康阈值: 3次
+健康阈值: 2次
 ```

 ### 启动命令
@@ -144,42 +144,42 @@ VPC ID: vpc-2ze055cptkew9c38w4r06
 node dist/server.js
 ```

-**霂湔<EFBFBD>**嚗?
- <EFBFBD>?銝漤<E98A9D>閬<EFBFBD><E996AC>銵?`prisma migrate deploy`嚗<EFBFBD>㺭<EFBFBD>桀歇<EFBFBD>朞<EFBFBD>pg_dump撖澆<EFBFBD>嚗?
- <EFBFBD>?銝漤<E98A9D>閬<EFBFBD><E996AC>銵?`prisma generate`嚗<EFBFBD><EFBFBD><EFBFBD>𤩺<EFBFBD>撱箸𧒄撌脩<EFBFBD><EFBFBD>琜<EFBFBD>
- <EFBFBD>?<3F>湔𦻖<E6B994>臬𢆡蝻𤥁<E89DBB><F0A4A581>𡒊<EFBFBD><F0A1928A>滚𦛚<E6BB9A>喳虾
+**说明**：
+- ✅ 不需要执行 `prisma migrate deploy`（数据已通过pg_dump导入）
+- ✅ 不需要执行 `prisma generate`（镜像构建时已生成）
+- ✅ 直接启动编译后的服务即可

 ---

-## <EFBFBD>?<3F>函蔡<E587BD>𡡞<EFBFBD>霂<EFBFBD><E99C82><EFBFBD>?
+## ✅ 部署后验证清单

 部署成功后，需要验证以下项目：

-### 1. 摨𠉛鍂<EFBFBD>嗆<EFBFBD><EFBFBD><EFBFBD><EFBFBD>?
- [ ] SAE<EFBFBD>批<EFBFBD><EFBFBD>唳遬蝷箏<EFBFBD><EFBFBD>函𠶖<EFBFBD><EFBFBD>蛹"餈鞱<E9A488>銝?
+### 1. 应用状态检查
+- [ ] SAE控制台显示应用状态为"运行中"
 - [ ] 健康检查显示为"通过"
 - [ ] 无重启或崩溃记录

-### 2. <EFBFBD>亙<EFBFBD>璉<EFBFBD><EFBFBD>?
+### 2. 日志检查
 查看实时日志，应该看到类似以下输出：
 ```
 ============================================================
 🚀 AI临床研究平台 - 后端服务器启动成功！
 ============================================================
 📍 服务地址: http://0.0.0.0:3001
-<EFBFBD><EFBFBD> <20>亙熒璉<E78692><E79289>? http://0.0.0.0:3001/health
+🔍 健康检查: http://0.0.0.0:3001/health
 📡 API入口: http://0.0.0.0:3001/api/v1
 🌍 运行环境: production
 ============================================================
 ```

-### 3. <EFBFBD>亙熒璉<EFBFBD><EFBFBD>交<EFBFBD>霂?
-<EFBFBD>瑕<EFBFBD>摨𠉛鍂<EFBFBD><EFBFBD><EFBFBD>蝵穃𧑐<EFBFBD><EFBFBD><EFBFBD>𠬍<EFBFBD><EFBFBD>扯<EFBFBD>嚗?
+### 3. 健康检查测试
+获取应用的内网地址后，执行：
 ```bash
 curl http://172.17.x.x:3001/health
 ```

-<EFBFBD><EFBFBD><EFBFBD>餈𥪜<EFBFBD>嚗?
+期望返回：
 ```json
 {
  "status": "ok",
@@ -189,11 +189,11 @@ curl http://172.17.x.x:3001/health
 }
 ```

-### 4. <EFBFBD>唳旿摨栞<EFBFBD><EFBFBD>交<EFBFBD>霂?
-璉<EFBFBD><EFBFBD>交𠯫敹𦯀葉<EFBFBD>臬炏<EFBFBD>㗇㺭<EFBFBD>桀<EFBFBD>餈墧𦻖<EFBFBD>𣂼<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>荔<EFBFBD><EFBFBD>䭾𥁒<EFBFBD>嗘縑<EFBFBD>胯<EFBFBD>?
+### 4. 数据库连接测试
+检查日志中是否有数据库连接成功的消息，无报错信息。

 ### 5. 记录内网地址
- [ ] 霈啣<EFBFBD>Node.js<EFBFBD>𡒊垢<EFBFBD><EFBFBD><EFBFBD>蝵穃𧑐<EFBFBD><EFBFBD>嚗<EFBFBD>聢撘𧶏<EFBFBD>`http://172.17.x.x:3001`嚗?
+- [ ] 记录Node.js后端的内网地址（格式：`http://172.17.x.x:3001`）
 - [ ] 更新到部署文档中

 ---
@@ -210,64 +210,63 @@ Node.js后端部署成功后：
   - 使用Node.js后端的内网地址
   - 完成前端应用的SAE部署

-3. **<EFBFBD>券曎頝舀<EFBFBD>霂?*
-   - <EFBFBD>滨垢 <20>?Node.js<EFBFBD>𡒊垢 <20>?Python敺格<E695BA><E6A0BC>?<3F>?RDS
-   - 撉諹<EFBFBD>摰峕㟲<EFBFBD><EFBFBD><EFBFBD><EFBFBD>⊥<EFBFBD>蝔?
+3. **全链路测试**
+   - 前端 → Node.js后端 → Python微服务 → RDS
+   - 验证完整的业务流程

 ---

 ## 📞 故障排查

-### <EFBFBD>桅<EFBFBD>1嚗𡁜<EFBFBD><EFBFBD>冽<EFBFBD>瘜訫鍳<EFBFBD>?
+### 问题1：应用无法启动
 **症状**：健康检查一直失败，应用显示"异常"

-**<EFBFBD>埝䰻甇仿炊**嚗?
-1. <EFBFBD>亦<EFBFBD>"摰墧𧒄<E5A2A7>亙<EFBFBD>"嚗峕<E59A97><E5B395>亙鍳<E4BA99>券<EFBFBD>霂?
-2. 撣貉<EFBFBD><EFBFBD>笔<EFBFBD>嚗?
+**排查步骤**：
+1. 查看"实时日志"，检查启动错误
+2. 常见原因：
   - DATABASE_URL格式错误（@未编码）
-   - 蝡臬藁<EFBFBD>滨蔭銝滚龪<EFBFBD>?
+   - 端口配置不匹配
   - 环境变量缺失

 ### 问题2：数据库连接失败
 **症状**：日志显示数据库连接超时

-**<EFBFBD>埝䰻甇仿炊**嚗?
-1. 璉<EFBFBD><EFBFBD>充DS<EFBFBD>賢<EFBFBD><EFBFBD>閙糓<EFBFBD>血<EFBFBD><EFBFBD>侮PC蝵烐挾嚗?72.17.0.0/16嚗?
-2. 璉<EFBFBD><EFBFBD>主ATABASE_URL銝剔<EFBFBD>撖<EFBFBD><EFBFBD><EFBFBD>臬炏甇<EFBFBD>＆蝻𣇉<EFBFBD>嚗㇀蝻𣇉<EFBFBD>銝?40嚗?
+**排查步骤**：
+1. 检查RDS白名单是否包含VPC网段（172.17.0.0/16）
+2. 检查DATABASE_URL中的密码是否正确编码（@编码为%40）
 3. 在SAE的Webshell中测试：
   ```bash
   curl -v telnet://pgm-2zex1m2y3r23hdn5.pg.rds.aliyuncs.com:5432
   ```

-### <EFBFBD>桅<EFBFBD>3嚗𡁜<EFBFBD>摨瑟<EFBFBD><EFBFBD>亥楝敺?04
+### 问题3：健康检查路径404
 **症状**：健康检查显示HTTP 404错误

-**閫<EFBFBD><EFBFBD><EFBFBD>寞<EFBFBD>**嚗?
- 蝖株恕<EFBFBD>亙熒璉<EFBFBD><EFBFBD>亥楝敺<EFBFBD>蛹 `/health`嚗<EFBFBD><EFBFBD><EFBFBD>?`/api/health`嚗?
+**解决方案**：
+- 确认健康检查路径为 `/health`（不是 `/api/health`）
 - 确认健康检查端口为 `3001`

 ---

 ## 🔒 安全注意事项

-1. **JWT撖<EFBFBD>𤨎靽脲擪**嚗?
-   - <EFBFBD>?撌脩<E6928C><E884A9>𣂼撩<F0A382BC>𤩺㦤撖<E3A6A4>𤨎
+1. **JWT密钥保护**：
+   - ✅ 已生成强随机密钥
   - ⚠️ 不要将密钥提交到Git
   - ⚠️ 不要在日志中打印密钥

-2. **<EFBFBD>唳旿摨枏<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>?*嚗?
-   - <EFBFBD>?雿輻鍂<E8BCBB>臬<EFBFBD><E887AC>㗛<EFBFBD>蝞∠<E89D9E>
-   - <EFBFBD>𩤃<EFBFBD> 瘜冽<E7989C>URL蝻𣇉<E89DBB>嚗㇀蝻𣇉<E89DBB>銝?40嚗?
+2. **数据库密码保护**：
+   - ✅ 使用环境变量管理
+   - ⚠️ 注意URL编码（@编码为%40）

-3. **API撖<EFBFBD>𤨎靽脲擪**嚗?
-   - <EFBFBD>?<3F><><EFBFBD>𧜵LM API撖<49>𤨎撌脤<E6928C>蝵桐蛹<E6A190>臬<EFBFBD><E887AC>㗛<EFBFBD>
+3. **API密钥保护**：
+   - ✅ 所有LLM API密钥已配置为环境变量
   - ⚠️ 定期轮换密钥

 ---

-**<EFBFBD><EFBFBD>﹝<EFBFBD>𥕦遣<EFBFBD>園𡢿**嚗?025-12-24
-**蝏湔擪鈭箏<EFBFBD>**嚗朞<E59A97>蝏游𣪧<E6B8B8>?
-
+**文档创建时间**：2025-12-24
+**维护人员**：运维团队