xiner/Edu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(iam): v2 用户管理 RPC + F12 httpOnly Cookie

Browse Source 
admin-portal §2.3 P1 阻塞项补齐：CreateUser/UpdateUser/DeleteUser 3 RPC

iam.repository/service/grpc.controller 实现 3 用户管理方法（含 bcrypt + 审计）

iam.controller 新增 POST /v1/iam/users + DELETE /v1/iam/users/:id（@RequirePermission(IAM_USER_MANAGE)）

iam.dto 新增 createUserSchema Zod 校验

F12 httpOnly Cookie：refresh_token 改为 httpOnly+Secure+SameSite=Strict Cookie 下发

extractRefreshToken 优先读 cookie 回退 body + buildRefreshTokenCookie/buildClearCookie
This commit is contained in:
SpecialX
2026-07-14 22:59:28 +08:00
parent d11441c9a8
commit ad39a3bb0f
9 changed files with 650 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
services/iam/Dockerfile
View File

@@ -2,13 +2,12 @@
FROM node:22-alpine AS builder
WORKDIR /app
RUN corepack enable && corepack prepare pnpm@11.13.0 --activate
# 安装原生模块编译工具（bcrypt 需要 python3 + make + g++）
RUN apk add --no-cache python3 make g++
# 复制 workspace 配置 + tsconfig 基线
COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml tsconfig.base.json ./
# 移除 prepare 脚本（husky 在 Docker 中不可用）
RUN node -e "const p=require('./package.json');delete p.scripts.prepare;require('fs').writeFileSync('./package.json',JSON.stringify(p,null,2))"
# 复制 shared-proto（gRPC proto-loader 运行时加载）
COPY packages/shared-proto ./packages/shared-proto
@@ -18,47 +17,41 @@ COPY packages/shared-ts ./packages/shared-ts
# 复制 iam 源码
COPY services/iam ./services/iam
# 安装依赖（仅 iam + shared-ts）
RUN cd services/iam && pnpm install --frozen-lockfile
# HUSKY=0 跳过根 package.json 的 prepare:husky 脚本
ENV HUSKY=0
# 先构建 shared-ts（iam 依赖 @edu/shared-ts/outbox）
WORKDIR /app/packages/shared-ts
RUN pnpm build
# 只安装 iam 及其 workspace 依赖（@edu/shared-ts、@edu/shared-proto），不安装 arch-scan（避免 better-sqlite3 原生编译）
# 不使用 --ignore-scripts，让 bcrypt 的 install script 正常执行原生编译
RUN pnpm install --no-frozen-lockfile --filter @edu/iam-service...
# 构建 shared-ts（iam 依赖 @edu/shared-ts/outbox dist 产物）
RUN cd packages/shared-ts && pnpm build
# 构建 iam
WORKDIR /app/services/iam
RUN pnpm build
# 复制 proto 文件到 dist 旁（生产环境 ./proto/iam.proto）
RUN mkdir -p /app/proto && cp /app/packages/shared-proto/proto/iam.proto /app/proto/iam.proto
# Runtime stage
FROM node:22-alpine
WORKDIR /app
RUN corepack enable && corepack prepare pnpm@11.13.0 --activate
# 复制 workspace 配置 + tsconfig 基线
COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml tsconfig.base.json ./
# 移除 prepare 脚本（husky 在 Docker 中不可用）
RUN node -e "const p=require('./package.json');delete p.scripts.prepare;require('fs').writeFileSync('./package.json',JSON.stringify(p,null,2))"
# 复制 shared-proto + shared-ts（运行时需要）
# 复制 shared-proto + shared-ts（运行时需要：proto 文件 + shared-ts dist）
COPY packages/shared-proto ./packages/shared-proto
COPY packages/shared-ts ./packages/shared-ts
# 复制 iam
# 复制 iam 源码
COPY services/iam ./services/iam
# 从 builder 复制已编译的 prod node_modules + iam dist + shared-ts dist
COPY --from=builder /app/services/iam/node_modules ./services/iam/node_modules
COPY --from=builder /app/packages/shared-ts/node_modules ./packages/shared-ts/node_modules
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/services/iam/dist ./services/iam/dist
COPY --from=builder /app/packages/shared-ts/dist ./packages/shared-ts/dist
WORKDIR /app/services/iam
RUN pnpm install --prod --frozen-lockfile
# 复制构建产物
COPY --from=builder /app/services/iam/dist ./dist
COPY --from=builder /app/packages/shared-ts/dist /app/packages/shared-ts/dist
# 复制 proto 文件（生产环境从 ./proto/ 加载）
COPY --from=builder /app/proto ./proto
EXPOSE 3002 50052
CMD ["node", "dist/main.js"]