pk10/App/Controllers/Admin/AdminController.php

<?php
namespace App\Controllers\Admin;
use App\Core\AdminBaseController;
use Db\Database;

class AdminController extends AdminBaseController {
    /**
     * 构造函数 - 验证管理员权限
     */
    public function __construct() {
       $this->checkLogin();
       $this->checkAdmin();
    }

    
    /**
     * 管理员列表页面
     */
    public function index() {
        $db = new Database();
        // 只查询管理员角色的用户
        $admins = $db->select('users', '*', [
            'role' => 'admin',
            'ORDER' => ['id' => 'DESC']
        ]);
        $this->render('Admin/admin.php', [
            'admins' => $admins,
            'title' => '管理员管理'
        ]);
    }

    /**
     * 获取单个管理员数据（用于编辑和详情）
     */
    public function get($id) {
        header('Content-Type: application/json');
        
        if (empty($id) || !is_numeric($id)) {
            echo json_encode([
                'success' => false,
                'message' => '无效的管理员ID'
            ]);
            return;
        }

        $db = new Database();
        $admin = $db->get('users', '*', [
            'id' => $id,
            'role' => 'admin'  // 确保只获取管理员
        ]);

        if ($admin) {
            // 移除密码字段，避免泄露
            unset($admin['password']);
            
            echo json_encode([
                'success' => true,
                'data' => $admin
            ]);
        } else {
            echo json_encode([
                'success' => false,
                'message' => '管理员不存在'
            ]);
        }
    }

    public function update() {
        header('Content-Type: application/json');

        $data = $_POST;
        if (empty($data)) {
            echo json_encode([
                'success' => false,
                'message' => '未接收到数据'
            ]);
            return;
        }

        $db = new Database();
        $id = isset($data['id']) ? (int)$data['id'] : 0;
        $isEditMode = $id > 0;

        $username = trim($data['username'] ?? '');
        $email = trim($data['email'] ?? '');
        $status = isset($data['status']) ? (int)$data['status'] : 0;

        if (empty($username) || empty($email)) {
            echo json_encode([
                'success' => false,
                'message' => '用户名和邮箱不能为空'
            ]);
            return;
        }

        if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
            echo json_encode([
                'success' => false,
                'message' => '邮箱格式不正确'
            ]);
            return;
        }

        // 统一查重（排除当前 ID）
        $exists = $db->get('users', '*', [
            'AND' => [
                'OR' => [
                    'username' => $username,
                    'email' => $email
                ],
                'id[!]' => $id
            ]
        ]);

        if ($exists) {
            if ($exists['username'] === $username) {
                $msg = '用户名已存在';
            } elseif ($exists['email'] === $email) {
                $msg = '邮箱已被使用';
            } else {
                $msg = '用户名或邮箱已被占用';
            }
            echo json_encode([
                'success' => false,
                'message' => $msg
            ]);
            return;
        }

        // 准备数据 - 强制角色为 admin
        $adminData = [
            'username' => $username,
            'email' => $email,
            'role' => 'admin',  // 强制设置为管理员角色
            'status' => $status,
            'updated_at' => date('Y-m-d H:i:s')
        ];

        try {
            if ($isEditMode) {
                // 验证是否真的是管理员
                $existingAdmin = $db->get('users', 'id', [
                    'id' => $id,
                    'role' => 'admin'
                ]);
                
                if (!$existingAdmin) {
                    echo json_encode([
                        'success' => false,
                        'message' => '该用户不是管理员'
                    ]);
                    return;
                }
                
                // 如果密码不为空，更新密码
                if (!empty($data['password'])) {
                    if (strlen($data['password']) < 8) {
                        echo json_encode([
                            'success' => false,
                            'message' => '密码长度至少8位'
                        ]);
                        return;
                    }
                    $adminData['password'] = password_hash($data['password'], PASSWORD_DEFAULT);
                }

                $db->update('users', $adminData, ['id' => $id]);
                $message = '管理员更新成功';
            } else {
                // 新增时必须有密码
                if (empty($data['password']) || strlen($data['password']) < 8) {
                    echo json_encode([
                        'success' => false,
                        'message' => '密码长度至少8位'
                    ]);
                    return;
                }
                $adminData['password'] = password_hash($data['password'], PASSWORD_DEFAULT);
                $adminData['created_at'] = date('Y-m-d H:i:s');

                $id = $db->insert('users', $adminData);
                $message = '管理员创建成功';
            }

            echo json_encode([
                'success' => true,
                'message' => $message,
                'data' => ['id' => $id]
            ]);
        } catch (\Exception $e) {
            echo json_encode([
                'success' => false,
                'message' => '操作失败：' . $e->getMessage()
            ]);
        }
    }


    /**
     * 删除管理员
     */
    public function delete($id) {
        header('Content-Type: application/json');
        
        if (empty($id) || !is_numeric($id)) {
            echo json_encode([
                'success' => false,
                'message' => '无效的管理员ID'
            ]);
            return;
        }

        // 禁止删除自己
        session_start();
        if ($id == $_SESSION['user_id']) {
            echo json_encode([
                'success' => false,
                'message' => '不能删除当前登录的管理员'
            ]);
            return;
        }

        $db = new Database();
        
        // 确保只删除管理员角色
        $adminExists = $db->get('users', 'id', [
            'id' => $id,
            'role' => 'admin'
        ]);

        if (!$adminExists) {
            echo json_encode([
                'success' => false,
                'message' => '管理员不存在'
            ]);
            return;
        }
        
        // 检查是否还有其他管理员
        $adminCount = $db->count('users', [
            'role' => 'admin'
        ]);
        
        if ($adminCount <= 1) {
            echo json_encode([
                'success' => false,
                'message' => '不能删除最后一个管理员'
            ]);
            return;
        }

        try {
            $db->delete('users', [
                'id' => $id,
                'role' => 'admin'
            ]);
            
            echo json_encode([
                'success' => true,
                'message' => '管理员已删除'
            ]);
        } catch (\Exception $e) {
            echo json_encode([
                'success' => false,
                'message' => '删除失败：' . $e->getMessage()
            ]);
        }
    }

}