卓信SAAS平台

// 共享API服务 (shared-api.ts)
import axios, { AxiosInstance, AxiosRequestConfig } from 'axios'
import { eventBus } from './event-bus'
 
class SharedApiService {
  private axiosInstance: AxiosInstance
  private baseURL: string
  private tenantId: string
 
  constructor() {
    this.baseURL = import.meta.env.VITE_API_BASE_URL
    this.axiosInstance = axios.create({
      baseURL: this.baseURL,
      timeout: 10000
    })
 
    this.setupInterceptors()
  }
 
  // 设置租户ID
  setTenantId(tenantId: string) {
    this.tenantId = tenantId
  }
 
  // 请求拦截器
  private setupInterceptors() {
    this.axiosInstance.interceptors.request.use(
      (config) => {
        // 添加租户头信息
        if (this.tenantId) {
          config.headers['X-Tenant-Id'] = this.tenantId
        }
 
        // 添加认证token
        const token = localStorage.getItem('access_token')
        if (token) {
          config.headers.Authorization = `Bearer ${token}`
        }
 
        return config
      },
      (error) => Promise.reject(error)
    )
 
    // 响应拦截器
    this.axiosInstance.interceptors.response.use(
      (response) => response,
      (error) => {
        if (error.response?.status === 401) {
          // 通知所有子应用token过期
          eventBus.emit('auth:token-expired')
        }
        return Promise.reject(error)
      }
    )
  }
 
  // 通用API方法
  async get<T>(url: string, config?: AxiosRequestConfig): Promise<T> {
    const response = await this.axiosInstance.get(url, config)
    return response.data
  }
 
  async post<T>(url: string, data?: any, config?: AxiosRequestConfig): Promise<T> {
    const response = await this.axiosInstance.post(url, data, config)
    return response.data
  }
 
  async put<T>(url: string, data?: any, config?: AxiosRequestConfig): Promise<T> {
    const response = await this.axiosInstance.put(url, data, config)
    return response.data
  }
 
  async delete<T>(url: string, config?: AxiosRequestConfig): Promise<T> {
    const response = await this.axiosInstance.delete(url, config)
    return response.data
  }
}
 
// 导出单例实例
export const sharedApi = new SharedApiService()

// 用户相关API (shared-user-api.ts)
import { sharedApi } from './shared-api'
 
export interface User {
  id: string
  name: string
  email: string
  role: string
  tenantId: string
}
 
export interface UserListParams {
  page?: number
  pageSize?: number
  keyword?: string
  role?: string
}
 
export class UserApiService {
  // 获取用户列表
  static async getUserList(params: UserListParams = {}) {
    return sharedApi.get<{
      data: User[]
      total: number
      page: number
      pageSize: number
    }>('/api/users', { params })
  }
 
  // 获取用户详情
  static async getUserDetail(userId: string) {
    return sharedApi.get<User>(`/api/users/${userId}`)
  }
 
  // 创建用户
  static async createUser(userData: Omit<User, 'id'>) {
    return sharedApi.post<User>('/api/users', userData)
  }
 
  // 更新用户
  static async updateUser(userId: string, userData: Partial<User>) {
    return sharedApi.put<User>(`/api/users/${userId}`, userData)
  }
 
  // 删除用户
  static async deleteUser(userId: string) {
    return sharedApi.delete(`/api/users/${userId}`)
  }
}

// 权限相关API (shared-permission-api.ts)
import { sharedApi } from './shared-api'
 
export interface Permission {
  id: string
  name: string
  code: string
  resource: string
  action: string
}
 
export interface Role {
  id: string
  name: string
  code: string
  permissions: Permission[]
}
 
export class PermissionApiService {
  // 获取当前用户权限
  static async getCurrentUserPermissions() {
    return sharedApi.get<Permission[]>('/api/auth/permissions')
  }
 
  // 获取角色列表
  static async getRoleList() {
    return sharedApi.get<Role[]>('/api/roles')
  }
 
  // 检查权限
  static async checkPermission(resource: string, action: string) {
    return sharedApi.post<{ hasPermission: boolean }>('/api/auth/check-permission', {
      resource,
      action
    })
  }
 
  // 获取用户角色
  static async getUserRoles(userId: string) {
    return sharedApi.get<Role[]>(`/api/users/${userId}/roles`)
  }
}

// 子应用中使用共享API (user-management-app.vue)
<template>
  <div class="user-management">
    <a-table 
      :columns="columns" 
      :data="userList" 
      :loading="loading"
      @page-change="handlePageChange"
    >
      <template #action="{ record }">
        <a-button @click="editUser(record)">编辑</a-button>
        <a-button status="danger" @click="deleteUser(record.id)">删除</a-button>
      </template>
    </a-table>
  </div>
</template>
 
<script setup lang="ts">
import { ref, onMounted } from 'vue'
import { UserApiService, type User } from '@shared/user-api'
import { PermissionApiService } from '@shared/permission-api'
 
const userList = ref<User[]>([])
const loading = ref(false)
const currentPage = ref(1)
const pageSize = ref(10)
 
// 获取用户列表
const fetchUserList = async () => {
  loading.value = true
  try {
    const response = await UserApiService.getUserList({
      page: currentPage.value,
      pageSize: pageSize.value
    })
    userList.value = response.data
  } catch (error) {
    console.error('获取用户列表失败:', error)
  } finally {
    loading.value = false
  }
}
 
// 编辑用户
const editUser = async (user: User) => {
  // 检查编辑权限
  const permissionCheck = await PermissionApiService.checkPermission('user', 'update')
  if (!permissionCheck.hasPermission) {
    console.warn('没有编辑用户的权限')
    return
  }
  
  // 执行编辑逻辑
  console.log('编辑用户:', user)
}
 
// 删除用户
const deleteUser = async (userId: string) => {
  // 检查删除权限
  const permissionCheck = await PermissionApiService.checkPermission('user', 'delete')
  if (!permissionCheck.hasPermission) {
    console.warn('没有删除用户的权限')
    return
  }
 
  try {
    await UserApiService.deleteUser(userId)
    await fetchUserList() // 重新获取列表
  } catch (error) {
    console.error('删除用户失败:', error)
  }
}
 
// 分页处理
const handlePageChange = (page: number) => {
  currentPage.value = page
  fetchUserList()
}
 
onMounted(() => {
  fetchUserList()
})
</script>

// tenant.middleware.ts
import { Injectable, NestMiddleware } from '@nestjs/common';
import { Request, Response, NextFunction } from 'express';
import { TenantService } from './tenant.service';
 
@Injectable()
export class TenantMiddleware implements NestMiddleware {
  constructor(private readonly tenantService: TenantService) {}
 
  async use(req: Request, res: Response, next: NextFunction) {
    try {
      // 从请求头或域名中获取租户标识
      const tenantId = req.headers['x-tenant-id'] || this.extractTenantFromHost(req.hostname);
      
      if (!tenantId) {
        return res.status(400).json({
          statusCode: 400,
          message: 'Tenant ID is required'
        });
      }
 
      // 验证租户合法性
      const tenant = await this.tenantService.validateTenant(tenantId as string);
      
      if (!tenant) {
        return res.status(403).json({
          statusCode: 403,
          message: 'Invalid tenant'
        });
      }
 
      // 将租户信息添加到请求对象
      req.tenant = tenant;
      next();
    } catch (error) {
      next(error);
    }
  }
 
  private extractTenantFromHost(hostname: string): string | null {
    // 从域名中提取租户信息，如 tenant1.example.com
    const parts = hostname.split('.');
    if (parts.length >= 3) {
      return parts[0];
    }
    return null;
  }
}

// tenant.context.ts
import { Injectable, Scope } from '@nestjs/common';
 
@Injectable({ scope: Scope.REQUEST })
export class TenantContext {
  private tenantId: string;
  private tenantConfig: any;
 
  setTenant(tenantId: string, config: any) {
    this.tenantId = tenantId;
    this.tenantConfig = config;
  }
 
  getTenantId(): string {
    return this.tenantId;
  }
 
  getTenantConfig(): any {
    return this.tenantConfig;
  }
 
  // 获取租户特定的数据库连接
  getDatabaseConnection() {
    return `tenant_${this.tenantId}`;
  }
}

// auth.guard.ts
import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';
import { JwtService } from '@nestjs/jwt';
import { Reflector } from '@nestjs/core';
 
@Injectable()
export class AuthGuard implements CanActivate {
  constructor(
    private readonly jwtService: JwtService,
    private readonly reflector: Reflector
  ) {}
 
  async canActivate(context: ExecutionContext): Promise<boolean> {
    const request = context.switchToHttp().getRequest();
    const token = this.extractTokenFromHeader(request);
 
    if (!token) {
      return false;
    }
 
    try {
      const payload = await this.jwtService.verifyAsync(token);
      
      // 验证租户权限
      const requiredTenantRoles = this.reflector.get<string[]>(
        'tenant_roles',
        context.getHandler()
      );
 
      if (requiredTenantRoles && !requiredTenantRoles.includes(payload.role)) {
        return false;
      }
 
      // 将用户信息添加到请求对象
      request.user = payload;
      return true;
    } catch {
      return false;
    }
  }
 
  private extractTokenFromHeader(request: Request): string | undefined {
    const [type, token] = request.headers.authorization?.split(' ') ?? [];
    return type === 'Bearer' ? token : undefined;
  }
}