fix(admin): cascade delete user tokens; test invite cleanup

2026-10-17 13:40:45 +08:00
parent 5452611a63
commit 78bfe188b6
2 changed files with 24 additions and 1 deletions
@@ -180,7 +180,7 @@ const server = http.createServer(async (req, res) => {
      // 用户删除：高危操作，级联清理（图床文件 → 用户库 → 附件目录 → 认证数据）
      if (req.method === 'POST' && route === '/admin/users/delete') {
        const body = await readJson(req);
-        const uid = Number(body.user_id);
+        const uid = String(body.user_id ?? '').trim();
        const target = db.prepare('SELECT id, username, is_admin FROM users WHERE id=?').get(uid);
        if (!target) return send(404, false, '用户不存在');
        if (target.id === auth.user_id) return send(400, false, '不能删除当前登录的账号自己');
@@ -208,6 +208,7 @@ const server = http.createServer(async (req, res) => {
        // 认证库级联清理
        db.exec('BEGIN');
        try {
+          db.prepare('DELETE FROM tokens WHERE user_id=?').run(target.id);
          db.prepare('DELETE FROM current WHERE user_id=?').run(target.id);
          db.prepare('DELETE FROM attachments WHERE user_id=?').run(target.id);
          db.prepare('DELETE FROM devices WHERE user_id=?').run(target.id);