app/api/users.py

from flask import jsonify, request, current_app
from flask_jwt_extended import jwt_required, get_jwt_identity
from werkzeug.security import generate_password_hash
from app.models.user import User
from app.models.store import Store
from app.api import bp, api, ns_users
from flask_restx import Resource
from app import db

@ns_users.route('/')
class UserResource(Resource):
    @api.doc('list_users')
    @jwt_required()
    def get(self):
        """获取所有用户列表"""
        try:
            # 检查当前用户是否是管理员
            current_user_id = get_jwt_identity()
            current_user = User.query.get(current_user_id)
            
            if current_user.role != 'admin':
                return {'message': 'Permission denied'}, 403
                
            # 获取所有用户信息，并关联门店信息
            users = db.session.query(
                User, Store.name.label('store_name')
            ).outerjoin(
                Store, User.store_id == Store.id
            ).all()
            
            result = []
            for user, store_name in users:
                user_data = {
                    'id': user.id,
                    'username': user.username,
                    'role': user.role,
                    'store_id': user.store_id,
                    'store_name': store_name,
                    'created_at': user.created_at.isoformat() if user.created_at else None
                }
                result.append(user_data)
            
            return {'data': result}
            
        except Exception as e:
            current_app.logger.error(f'Error fetching users: {str(e)}')
            return {'message': 'Error fetching users'}, 500
            
    @api.doc('create_user')
    @jwt_required()
    def post(self):
        """创建新用户"""
        try:
            # 检查当前用户是否是管理员
            current_user_id = get_jwt_identity()
            current_user = User.query.get(current_user_id)
            
            if current_user.role != 'admin':
                return {'message': 'Permission denied'}, 403
            
            data = request.json
            
            # 检查用户名是否已存在
            if User.query.filter_by(username=data['username']).first():
                return {'message': 'Username already exists'}, 400
            
            # 创建新用户
            store_id = data.get('store_id')
            
            # 如果是门店经理必须指定门店
            if data['role'] == 'store_manager' and not store_id:
                return {'message': 'Store manager must be assigned to a store'}, 400
                
            # 如果不是门店经理则不需要门店
            if data['role'] != 'store_manager':
                store_id = None
                
            user = User(
                username=data['username'],
                role=data['role'],
                store_id=store_id
            )
            
            # 使用set_password方法设置密码
            user.set_password(data['password'])
            
            db.session.add(user)
            db.session.commit()
            
            # 获取关联的门店名称
            store_name = None
            if user.store_id:
                store = Store.query.get(user.store_id)
                if store:
                    store_name = store.name
            
            return {
                'id': user.id,
                'username': user.username,
                'role': user.role,
                'store_id': user.store_id,
                'store_name': store_name,
                'created_at': user.created_at.isoformat() if user.created_at else None
            }
            
        except Exception as e:
            current_app.logger.error(f'Error creating user: {str(e)}')
            db.session.rollback()
            return {'message': 'Error creating user'}, 500

@ns_users.route('/<int:id>')
class UserDetailResource(Resource):
    @api.doc('update_user')
    @jwt_required()
    def put(self, id):
        """更新用户信息"""
        try:
            # 检查当前用户是否是管理员
            current_user_id = get_jwt_identity()
            current_user = User.query.get(current_user_id)
            
            if current_user.role != 'admin':
                return {'message': 'Permission denied'}, 403
                
            data = request.json
            user = User.query.get_or_404(id)
            
            # 更新用户信息
            if 'username' in data and data['username'] != user.username:
                # 检查新用户名是否已存在
                if User.query.filter_by(username=data['username']).first():
                    return {'message': 'Username already exists'}, 400
                user.username = data['username']
                
            if 'role' in data:
                user.role = data['role']
                
            # 更新门店关联
            if data.get('role') == 'store_manager':
                if 'store_id' in data:
                    user.store_id = data['store_id']
            else:
                user.store_id = None
                
            # 更新密码（如果提供）
            if 'password' in data and data['password']:
                # 使用set_password方法更新密码
                user.set_password(data['password'])
                
            db.session.commit()
            
            # 获取关联的门店名称
            store_name = None
            if user.store_id:
                store = Store.query.get(user.store_id)
                if store:
                    store_name = store.name
            
            return {
                'id': user.id,
                'username': user.username,
                'role': user.role,
                'store_id': user.store_id,
                'store_name': store_name,
                'created_at': user.created_at.isoformat() if user.created_at else None
            }
            
        except Exception as e:
            current_app.logger.error(f'Error updating user: {str(e)}')
            db.session.rollback()
            return {'message': 'Error updating user'}, 500
    
    @api.doc('delete_user')
    @jwt_required()
    def delete(self, id):
        """删除用户"""
        try:
            # 检查当前用户是否是管理员
            current_user_id = get_jwt_identity()
            current_user = User.query.get(current_user_id)
            
            if current_user.role != 'admin':
                return {'message': 'Permission denied'}, 403
                
            # 防止删除自己的账号
            if id == current_user_id:
                return {'message': 'Cannot delete your own account'}, 403
                
            user = User.query.get_or_404(id)
            db.session.delete(user)
            db.session.commit()
            
            return {'message': 'User deleted successfully'}
            
        except Exception as e:
            current_app.logger.error(f'Error deleting user: {str(e)}')
            db.session.rollback()
            return {'message': 'Error deleting user'}, 500

@ns_users.route('/<int:id>/reset-password')
class UserPasswordResource(Resource):
    @api.doc('reset_password')
    @jwt_required()
    def post(self, id):
        """重置用户密码"""
        try:
            # 检查当前用户是否是管理员
            current_user_id = get_jwt_identity()
            current_user = User.query.get(current_user_id)
            
            if current_user.role != 'admin':
                return {'message': 'Permission denied'}, 403
                
            data = request.json
            user = User.query.get_or_404(id)
            
            if not data.get('password'):
                return {'message': 'Password is required'}, 400
                
            # 使用set_password方法重置密码
            user.set_password(data['password'])
            db.session.commit()
            
            return {'message': 'Password reset successfully'}
            
        except Exception as e:
            current_app.logger.error(f'Error resetting password: {str(e)}')
            db.session.rollback()
            return {'message': 'Error resetting password'}, 500