feat: restrict job posting with user roles

Author: thonatos

api/openapi.json

@@ -385,7 +385,7 @@
             }
           },
           "403": {
-            "description": "禁言或人机验证失败或新用户限制",
+            "description": "禁言、人机验证失败、新用户限制或招聘发布未授权",
             "content": {
               "application/json": {
                 "schema": {
@@ -6172,6 +6172,14 @@
                           },
                           "sort_order": {
                             "type": "number"
+                          },
+                          "scope": {
+                            "type": "string",
+                            "enum": [
+                              "public",
+                              "admin"
+                            ],
+                            "default": "public"
                           }
                         },
                         "required": [

apps/api/package.json

@@ -7,7 +7,7 @@
     "dev": "tsx watch src/index.ts",
     "build": "tsc",
     "start": "node dist/index.js",
-    "test": "tsx --test test/mail-template.test.ts test/health.test.ts test/admin-pagination.test.ts test/ip-ban-rules.test.ts test/moderation-helpers.test.ts",
+    "test": "tsx --test test/mail-template.test.ts test/health.test.ts test/admin-pagination.test.ts test/ip-ban-rules.test.ts test/moderation-helpers.test.ts test/roles-permissions.test.ts",
     "worker:moderation": "tsx src/worker/moderation-scan.ts",
     "typecheck": "tsc --noEmit",
     "gen:openapi": "tsx scripts/gen-openapi.ts"

apps/api/src/lib/db.ts

@@ -13,8 +13,9 @@ import {
   jobMeta,
   tabs,
   zones,
+  userRoles,
 } from "@cnode/db";
-import { eq, and, desc, inArray, sql, count } from "drizzle-orm";
+import { eq, and, desc, inArray, sql, count, isNull } from "drizzle-orm";
 import { v4 as uuidv4 } from "uuid";
 import { boolEq, boolValue } from "./db-compat";
 
@@ -179,6 +180,62 @@ export const userQueries = {
   },
 };
 
+export const roleQueries = {
+  async listByUserId(userId: number): Promise<string[]> {
+    const db = getDb();
+    const rows = await db
+      .select({ role: userRoles.role })
+      .from(userRoles)
+      .where(and(eq(userRoles.userId, userId), isNull(userRoles.revokedAt)));
+    return rows.map((row) => row.role);
+  },
+
+  async listByUserIds(userIds: number[]): Promise<Map<number, string[]>> {
+    const result = new Map<number, string[]>();
+    if (userIds.length === 0) return result;
+
+    const db = getDb();
+    const rows = await db
+      .select({ userId: userRoles.userId, role: userRoles.role })
+      .from(userRoles)
+      .where(and(inArray(userRoles.userId, userIds), isNull(userRoles.revokedAt)));
+    for (const row of rows) {
+      const roles = result.get(row.userId) || [];
+      roles.push(row.role);
+      result.set(row.userId, roles);
+    }
+    return result;
+  },
+
+  async hasRole(userId: number, role: string): Promise<boolean> {
+    const db = getDb();
+    const rows = await db
+      .select({ id: userRoles.id })
+      .from(userRoles)
+      .where(and(eq(userRoles.userId, userId), eq(userRoles.role, role), isNull(userRoles.revokedAt)))
+      .limit(1);
+    return rows.length > 0;
+  },
+
+  async grant(userId: number, role: string, grantedBy: number, reason?: string | null) {
+    const db = getDb();
+    await db
+      .insert(userRoles)
+      .values({ userId, role, grantedBy, reason: reason || null, createAt: new Date(), updateAt: new Date() })
+      .onConflictDoNothing();
+    return roleQueries.listByUserId(userId);
+  },
+
+  async revoke(userId: number, role: string) {
+    const db = getDb();
+    await db
+      .update(userRoles)
+      .set({ revokedAt: new Date(), updateAt: new Date() })
+      .where(and(eq(userRoles.userId, userId), eq(userRoles.role, role), isNull(userRoles.revokedAt)));
+    return roleQueries.listByUserId(userId);
+  },
+};
+
 function topicConditions(where: any) {
   const conditions: any[] = [];
   if (where.deleted !== undefined) {
@@ -204,12 +261,14 @@ function topicConditions(where: any) {
   if (where.publicVisible) {
     conditions.push(boolEq(topics.deleted, false));
     conditions.push(sql`coalesce(${topics.status}, 'published') <> 'deleted'`);
-    conditions.push(
-      sql`(${topics.tab} is null or ${topics.tab} not in (${sql.join(
-        INTERNAL_TABS.map((tab) => sql`${tab}`),
-        sql`, `,
-      )}))`,
-    );
+    if (!where.includeInternalTabs) {
+      conditions.push(
+        sql`(${topics.tab} is null or ${topics.tab} not in (${sql.join(
+          INTERNAL_TABS.map((tab) => sql`${tab}`),
+          sql`, `,
+        )}))`,
+      );
+    }
     conditions.push(
       sql`exists (select 1 from ${users} where ${users.id} = ${topics.authorId} and ${boolEq(users.isBlock, false)})`,
     );

apps/api/src/middleware/auth.ts

@@ -1,12 +1,13 @@
 import { createMiddleware } from "hono/factory";
 import { getCookie, setCookie, deleteCookie } from "hono/cookie";
-import { userQueries } from "../lib/db";
+import { roleQueries, userQueries } from "../lib/db";
 
 export interface AuthVars {
   user: Awaited<ReturnType<typeof userQueries.getById>> | null;
   isLogin: boolean;
   isAdmin: boolean;
   isMod: boolean;
+  roles: string[];
 }
 
 export function setSessionCookie(
@@ -58,13 +59,15 @@ export const authMiddleware = () =>
     const admins = (process.env.APP_ADMINS || "").split(",").filter(Boolean);
     const moderators = (process.env.APP_MODERATORS || "").split(",").filter(Boolean);
 
+    const roles = user ? await roleQueries.listByUserId(user.id) : [];
     const isAdmin = user ? admins.includes(user.loginname) : false;
-    const isMod = user ? moderators.includes(user.loginname) || isAdmin : false;
+    const isMod = user ? moderators.includes(user.loginname) || roles.includes("moderator") || isAdmin : false;
 
     c.set("user", user);
     c.set("isLogin", !!user);
     c.set("isAdmin", isAdmin);
     c.set("isMod", isMod);
+    c.set("roles", roles);
 
     await next();
   });

apps/api/src/routes/admin.ts

@@ -12,6 +12,7 @@ import {
   settingQueries,
   zoneQueries,
   tabQueries,
+  roleQueries,
 } from "../lib/db";
 import {
   auditLogs,
@@ -42,7 +43,7 @@ import { decrementScoreAndReplyCount } from "../lib/score";
 import { isValidIpRule } from "../middleware/ip-ban";
 import { applyProgressivePenalty } from "../lib/penalty";
 import { userSummary } from "../lib/format";
-import { createReportBodySchema, errorResponseSchema } from "@cnode/shared";
+import { createReportBodySchema, errorResponseSchema, roleAssignmentSchema, userRoleSchema } from "@cnode/shared";
 
 const admin = new OpenAPIHono<{
   Variables: AuthVars;
@@ -202,7 +203,7 @@ admin.post("/topic/:tid/good", modRequired(), async (c) => {
   return c.json({ success: true, message: topic.good ? "已取消加精" : "已加精" });
 });
 
-admin.post("/topic/:tid/lock", adminRequired(), async (c) => {
+admin.post("/topic/:tid/lock", modRequired(), async (c) => {
   const tid = Number(c.req.param("tid"));
   const topic = await topicQueries.getById(tid);
   if (!topic) return c.json({ success: false, error_msg: "话题不存在" }, 404);
@@ -252,7 +253,42 @@ admin.get("/admin/users", adminRequired(), async (c) => {
   let totalQuery = db.select({ c: count() }).from(users).$dynamic();
   if (where) { listQuery = listQuery.where(where) as any; totalQuery = totalQuery.where(where) as any; }
   const [list, totalResult] = await Promise.all([listQuery.orderBy(desc(users.createAt)).limit(pagination.limit).offset(pagination.offset), totalQuery]);
-  return c.json(paginated(list.map((u: any) => ({ id: u.id, loginname: u.loginname, email: u.email, avatar_url: u.avatar, score: u.score, topic_count: u.topicCount, reply_count: u.replyCount, is_block: !!u.isBlock, is_muted: !!u.isMuted || !!u.isBlock, active: !!u.active, create_at: u.createAt })), Number(totalResult[0]?.c || 0), pagination));
+  const rolesByUserId = await roleQueries.listByUserIds(list.map((u: any) => u.id));
+  return c.json(paginated(list.map((u: any) => ({ id: u.id, loginname: u.loginname, email: u.email, avatar_url: u.avatar, score: u.score, topic_count: u.topicCount, reply_count: u.replyCount, roles: rolesByUserId.get(u.id) || [], is_block: !!u.isBlock, is_muted: !!u.isMuted || !!u.isBlock, active: !!u.active, create_at: u.createAt })), Number(totalResult[0]?.c || 0), pagination));
+});
+
+admin.get("/admin/users/:id/roles", adminRequired(), async (c) => {
+  const id = Number(c.req.param("id"));
+  if (!id || Number.isNaN(id)) return c.json({ success: false, error_msg: "用户不存在" }, 404);
+  const target = await userQueries.getById(id);
+  if (!target) return c.json({ success: false, error_msg: "用户不存在" }, 404);
+  const roles = await roleQueries.listByUserId(id);
+  return c.json({ success: true, data: { user_id: id, roles } });
+});
+
+admin.post("/admin/users/:id/roles", adminRequired(), async (c) => {
+  const id = Number(c.req.param("id"));
+  const target = id > 0 && !Number.isNaN(id) ? await userQueries.getById(id) : null;
+  if (!target) return c.json({ success: false, error_msg: "用户不存在" }, 404);
+  const parsed = roleAssignmentSchema.safeParse(await c.req.json().catch(() => ({})));
+  if (!parsed.success) return c.json({ success: false, error_msg: "角色无效" }, 422);
+  const user = c.get("user")!;
+  const roles = await roleQueries.grant(id, parsed.data.role, user.id, parsed.data.reason);
+  await auditQueries.log(user.id, user.loginname, "grant_role", { type: "user", id: String(id), name: target.loginname }, "success", JSON.stringify({ role: parsed.data.role, reason: parsed.data.reason || null }));
+  return c.json({ success: true, data: { user_id: id, roles } });
+});
+
+admin.delete("/admin/users/:id/roles/:role", adminRequired(), async (c) => {
+  const id = Number(c.req.param("id"));
+  const target = id > 0 && !Number.isNaN(id) ? await userQueries.getById(id) : null;
+  if (!target) return c.json({ success: false, error_msg: "用户不存在" }, 404);
+  const role = c.req.param("role");
+  const parsed = userRoleSchema.safeParse(role);
+  if (!parsed.success) return c.json({ success: false, error_msg: "角色无效" }, 422);
+  const user = c.get("user")!;
+  const roles = await roleQueries.revoke(id, parsed.data);
+  await auditQueries.log(user.id, user.loginname, "revoke_role", { type: "user", id: String(id), name: target.loginname }, "success", JSON.stringify({ role: parsed.data }));
+  return c.json({ success: true, data: { user_id: id, roles } });
 });
 
 admin.post("/user/:name/block", adminRequired(), async (c) => {
@@ -740,6 +776,7 @@ admin.get("/admin/tabs", adminRequired(), async (c) => {
     label: r.label,
     visible: !!r.visible,
     sort_order: r.sortOrder || 0,
+    scope: r.scope || "public",
   }));
   return c.json({ success: true, data });
 });
@@ -765,6 +802,7 @@ admin.patch("/admin/tabs/:id", adminRequired(), async (c) => {
       label: updated.label,
       visible: !!updated.visible,
       sort_order: updated.sortOrder || 0,
+      scope: updated.scope || "public",
     },
   });
 });

apps/api/src/routes/auth.ts

@@ -14,7 +14,7 @@ import {
   githubUnbindSchema,
   errorResponseSchema,
 } from "@cnode/shared";
-import { auditQueries, settingQueries, userQueries } from "../lib/db";
+import { auditQueries, roleQueries, settingQueries, userQueries } from "../lib/db";
 import { sendActiveMail, sendResetPassMail } from "../lib/mail";
 import { setSessionCookie, clearSessionCookie, authMiddleware, type AuthVars } from "../middleware/auth";
 import { perIpPerDay, perUserPerDay } from "../middleware/rate-limit";
@@ -332,9 +332,10 @@ auth.openapi(meRoute, async (c) => {
   if (!user) return c.json({ success: false, data: null }, 200);
   const admins = (process.env.APP_ADMINS || "").split(",").filter(Boolean);
   const moderators = (process.env.APP_MODERATORS || "").split(",").filter(Boolean);
+  const roles = await roleQueries.listByUserId(user.id);
   const isAdmin = admins.includes(user.loginname);
-  const isMod = moderators.includes(user.loginname) || isAdmin;
-  return c.json({ success: true, data: { loginname: user.loginname, email: user.email, github_username: user.githubUsername, github_bound: !!user.githubId, url: user.url, location: user.location, signature: user.signature, weibo: user.weibo, receive_reply_mail: !!user.receiveReplyMail, receive_at_mail: !!user.receiveAtMail, is_admin: isAdmin, is_mod: isMod, is_muted: !!user.isMuted || !!user.isBlock, is_block: !!user.isBlock } }, 200);
+  const isMod = moderators.includes(user.loginname) || roles.includes("moderator") || isAdmin;
+  return c.json({ success: true, data: { loginname: user.loginname, email: user.email, github_username: user.githubUsername, github_bound: !!user.githubId, url: user.url, location: user.location, signature: user.signature, weibo: user.weibo, receive_reply_mail: !!user.receiveReplyMail, receive_at_mail: !!user.receiveAtMail, is_admin: isAdmin, is_mod: isMod, roles, is_muted: !!user.isMuted || !!user.isBlock, is_block: !!user.isBlock } }, 200);
 });
 
 // --- POST /auth/local/setting ---

apps/api/src/routes/topic.ts

@@ -1,6 +1,6 @@
 import { OpenAPIHono, createRoute } from "@hono/zod-openapi";
 import _ from "lodash";
-import { settingQueries, topicQueries, userQueries, replyQueries, jobMetaQueries } from "../lib/db";
+import { settingQueries, topicQueries, userQueries, replyQueries, jobMetaQueries, roleQueries } from "../lib/db";
 import { incrementScoreAndTopicCount } from "../lib/score";
 import { sendMessageToMentionUsers } from "../lib/at";
 import { checkContent } from "../lib/moderation";
@@ -49,6 +49,18 @@ async function isNewUserForTopicGate(user: any) {
   return accountAgeHours < minHours || Number(user.replyCount || 0) < minReplies;
 }
 
+export function canPostJobFromRoles(isAdmin: boolean, roles: string[]) {
+  return isAdmin || roles.includes("recruiter");
+}
+
+function isAdminUser(user: any) {
+  return (process.env.APP_ADMINS || "").split(",").filter(Boolean).includes(user.loginname);
+}
+
+async function canPostJob(user: any) {
+  return canPostJobFromRoles(isAdminUser(user), await roleQueries.listByUserId(user.id));
+}
+
 const listTopicsRoute = createRoute({
   method: "get",
   path: "/topics",
@@ -78,6 +90,10 @@ topic.openapi(listTopicsRoute, async (c) => {
   const { page, limit, tab, mdrender } = c.req.valid("query");
 
   const query: any = {};
+  const isAdmin = c.get("isAdmin");
+  if (tab && INTERNAL_TABS.has(tab) && !isAdmin) {
+    return c.json({ success: true as const, data: [], total: 0 }, 200);
+  }
   if (!tab || tab === "all") {
     query.excludeTabs = ["job"];
   } else if (tab === "good") {
@@ -86,6 +102,7 @@ topic.openapi(listTopicsRoute, async (c) => {
     query.tab = tab;
   }
   query.publicVisible = true;
+  query.includeInternalTabs = isAdmin;
 
   const topicsList = await topicQueries.getByQuery(query, {
     limit,
@@ -283,7 +300,7 @@ const createTopicRoute = createRoute({
       content: { "application/json": { schema: errorResponseSchema } },
     },
     403: {
-      description: "禁言或人机验证失败或新用户限制",
+      description: "禁言、人机验证失败、新用户限制或招聘发布未授权",
       content: { "application/json": { schema: errorResponseSchema } },
     },
     422: {
@@ -313,6 +330,10 @@ topic.openapi(createTopicRoute, async (c) => {
 
   const { title, tab, content } = body;
 
+  if (tab === "job" && !(await canPostJob(user))) {
+    return c.json({ success: false as const, error_msg: "招聘发布需要授权" }, 403);
+  }
+
   const titleCheck = await checkContent(title);
   if (titleCheck.hit) {
     return c.json(
@@ -431,6 +452,14 @@ topic.openapi(updateTopicRoute, async (c) => {
     return c.json({ success: false as const, error_msg: "话题已锁定" }, 403);
   }
 
+  if (topicData.tab !== "job" && tab === "job" && !(await canPostJob(user))) {
+    return c.json({ success: false as const, error_msg: "招聘发布需要授权" }, 403);
+  }
+
+  if (topicData.tab === "job" && tab !== "job" && !c.get("isAdmin")) {
+    return c.json({ success: false as const, error_msg: "招聘话题不能改为普通分类" }, 403);
+  }
+
   await topicQueries.updateTopic(tid, { title, tab, content });
 
   if (tab === "job" && body.job_meta) {

apps/api/src/routes/zone.ts

@@ -193,6 +193,7 @@ zone.openapi(listTabsRoute, async (c) => {
     label: r.label,
     visible: !!r.visible,
     sort_order: r.sortOrder || 0,
+    scope: r.scope || "public",
   }));
   return c.json({ success: true as const, data }, 200);
 });

apps/api/test/roles-permissions.test.ts

@@ -0,0 +1,27 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { userRoleSchema } from "@cnode/shared";
+import { canRunTopicAction } from "../src/routes/admin";
+import { canPostJobFromRoles } from "../src/routes/topic";
+
+test("job posting requires admin or recruiter", () => {
+  assert.equal(canPostJobFromRoles(false, []), false);
+  assert.equal(canPostJobFromRoles(false, ["moderator"]), false);
+  assert.equal(canPostJobFromRoles(false, ["recruiter"]), true);
+  assert.equal(canPostJobFromRoles(true, []), true);
+});
+
+test("role schema rejects unknown roles", () => {
+  assert.equal(userRoleSchema.safeParse("moderator").success, true);
+  assert.equal(userRoleSchema.safeParse("recruiter").success, true);
+  assert.equal(userRoleSchema.safeParse("admin").success, false);
+  assert.equal(userRoleSchema.safeParse("owner").success, false);
+});
+
+test("moderators can run only known topic governance actions", () => {
+  assert.equal(canRunTopicAction("delete", false, true), true);
+  assert.equal(canRunTopicAction("mute", false, true), true);
+  assert.equal(canRunTopicAction("top", false, true), true);
+  assert.equal(canRunTopicAction("unknown", false, true), false);
+  assert.equal(canRunTopicAction("delete", false, false), false);
+});