feat(roles): enhance role management panel with user list and inline …

app/api/roles/users/route.ts

@@ -1,10 +1,89 @@
 import { createDb } from "@/lib/db"
-import { users } from "@/lib/schema"
-import { eq } from "drizzle-orm"
+import { users, userRoles, roles } from "@/lib/schema"
+import { eq, like, or, sql } from "drizzle-orm"
+import { checkPermission } from "@/lib/auth"
+import { PERMISSIONS, ROLES } from "@/lib/permissions"
 
 export const runtime = "edge"
 
+export async function GET(request: Request) {
+  const canPromote = await checkPermission(PERMISSIONS.PROMOTE_USER)
+  if (!canPromote) {
+    return Response.json({ error: "权限不足" }, { status: 403 })
+  }
+
+  const { searchParams } = new URL(request.url)
+  const page = Math.max(1, Number(searchParams.get("page") || "1"))
+  const pageSize = Math.min(50, Math.max(1, Number(searchParams.get("pageSize") || "20")))
+  const search = searchParams.get("search")?.trim()
+
+  const db = createDb()
+
+  try {
+    const searchCondition = search
+      ? or(
+          like(users.username, `%${search}%`),
+          like(users.email, `%${search}%`),
+          like(users.name, `%${search}%`)
+        )
+      : undefined
+
+    const totalResult = await db
+      .select({ count: sql<number>`count(*)` })
+      .from(users)
+      .where(searchCondition)
+    const total = Number(totalResult[0].count)
+
+    const roleRank = sql`CASE COALESCE(${roles.name}, ${ROLES.CIVILIAN})
+      WHEN ${ROLES.EMPEROR} THEN 0
+      WHEN ${ROLES.DUKE} THEN 1
+      WHEN ${ROLES.KNIGHT} THEN 2
+      WHEN ${ROLES.CIVILIAN} THEN 3
+      ELSE 4
+    END`
+
+    const userList = await db
+      .select({
+        id: users.id,
+        name: users.name,
+        username: users.username,
+        email: users.email,
+        image: users.image,
+        role: roles.name,
+      })
+      .from(users)
+      .leftJoin(userRoles, eq(userRoles.userId, users.id))
+      .leftJoin(roles, eq(roles.id, userRoles.roleId))
+      .where(searchCondition)
+      .orderBy(roleRank, sql`LENGTH(COALESCE(${users.username}, ${users.name}))`, sql`LOWER(COALESCE(${users.username}, ${users.name}))`)
+      .limit(pageSize)
+      .offset((page - 1) * pageSize)
+
+    return Response.json({
+      users: userList.map((u) => ({
+        id: u.id,
+        name: u.name,
+        username: u.username,
+        email: u.email,
+        image: u.image,
+        role: u.role || null,
+      })),
+      total,
+      page,
+      pageSize,
+    })
+  } catch (error) {
+    console.error("Failed to list users:", error)
+    return Response.json({ error: "获取用户列表失败" }, { status: 500 })
+  }
+}
+
 export async function POST(request: Request) {
+  const canPromote = await checkPermission(PERMISSIONS.PROMOTE_USER)
+  if (!canPromote) {
+    return Response.json({ error: "权限不足" }, { status: 403 })
+  }
+
   try {
     const json = await request.json()
     const { searchText } = json as { searchText: string }
@@ -46,4 +125,4 @@ export async function POST(request: Request) {
       { status: 500 }
     )
   }
-} 
+}

app/api/users/[id]/route.ts

@@ -0,0 +1,52 @@
+import { createDb } from "@/lib/db";
+import { users, userRoles, apiKeys } from "@/lib/schema";
+import { eq } from "drizzle-orm";
+import { ROLES, PERMISSIONS } from "@/lib/permissions";
+import { checkPermission } from "@/lib/auth";
+import { getUserId } from "@/lib/apiKey";
+
+export const runtime = "edge";
+
+export async function DELETE(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const canManage = await checkPermission(PERMISSIONS.PROMOTE_USER);
+  if (!canManage) {
+    return Response.json({ error: "权限不足" }, { status: 403 });
+  }
+
+  try {
+    const { id: userId } = await params;
+    if (!userId) {
+      return Response.json({ error: "缺少必要参数" }, { status: 400 });
+    }
+
+    const currentUserId = await getUserId();
+    if (userId === currentUserId) {
+      return Response.json({ error: "不能删除自己" }, { status: 400 });
+    }
+
+    const db = createDb();
+
+    const targetUserRole = await db.query.userRoles.findFirst({
+      where: eq(userRoles.userId, userId),
+      with: {
+        role: true,
+      },
+    });
+
+    if (targetUserRole?.role.name === ROLES.EMPEROR) {
+      return Response.json({ error: "不能删除皇帝" }, { status: 400 });
+    }
+
+    // apiKeys 未配置级联删除，需先手动删除；其余（accounts / emails→messages / webhooks / userRoles）由外键级联处理
+    await db.delete(apiKeys).where(eq(apiKeys.userId, userId));
+    await db.delete(users).where(eq(users.id, userId));
+
+    return Response.json({ success: true });
+  } catch (error) {
+    console.error("Failed to delete user:", error);
+    return Response.json({ error: "操作失败" }, { status: 500 });
+  }
+}