diff --git a/backend/package.json b/backend/package.json index 3c9d13a..83519e5 100644 --- a/backend/package.json +++ b/backend/package.json @@ -15,7 +15,6 @@ }, "dependencies": { "axios": "^1.6.0", - "bcryptjs": "^2.4.3", "cors": "^2.8.5", "dotenv": "^16.3.1", "express": "^4.18.2", @@ -24,7 +23,6 @@ "mysql2": "^3.6.5" }, "devDependencies": { - "@types/bcryptjs": "^2.4.6", "@types/cors": "^2.8.17", "@types/express": "^4.17.21", "@types/jest": "^29.5.11", diff --git a/backend/src/db/init.sql b/backend/src/db/init.sql index 0c59648..99435e5 100644 --- a/backend/src/db/init.sql +++ b/backend/src/db/init.sql @@ -10,7 +10,7 @@ USE employee_performance; CREATE TABLE IF NOT EXISTS user ( user_id INT PRIMARY KEY AUTO_INCREMENT COMMENT '用户ID', username VARCHAR(50) NOT NULL UNIQUE COMMENT '用户名(工号)', - password VARCHAR(255) NOT NULL COMMENT '密码(bcrypt加密)', + password VARCHAR(255) NOT NULL COMMENT '密码(明文存储,测试环境使用)', name VARCHAR(50) NOT NULL COMMENT '姓名', role ENUM('employee', 'manager', 'generalManager') NOT NULL COMMENT '角色', department VARCHAR(50) NOT NULL COMMENT '部门', diff --git a/backend/src/db/seed.sql b/backend/src/db/seed.sql index b14686e..9fa4b56 100644 --- a/backend/src/db/seed.sql +++ b/backend/src/db/seed.sql @@ -1,37 +1,37 @@ -- 测试数据插入脚本 USE employee_performance; --- 插入测试用户(密码都是 123456,已用 bcrypt 加密) --- bcrypt hash for '123456': $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy +-- 插入测试用户(所有用户密码均为123456,明文存储) +-- 注意:此版本使用明文密码,仅用于测试环境。生产环境必须使用加密密码。 -- 1. 总经理 INSERT INTO user (username, password, name, role, department, position, manager_id, status) -VALUES ('gm001', '$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy', '张总', 'generalManager', '管理层', '总经理', NULL, 'active') +VALUES ('gm001', '123456', '张总', 'generalManager', '管理层', '总经理', NULL, 'active') ON DUPLICATE KEY UPDATE username=username; -- 2. 部门经理(技术部) INSERT INTO user (username, password, name, role, department, position, manager_id, status) -VALUES ('mgr001', '$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy', '李经理', 'manager', '技术部', '技术经理', 1, 'active') +VALUES ('mgr001', '123456', '李经理', 'manager', '技术部', '技术经理', 1, 'active') ON DUPLICATE KEY UPDATE username=username; -- 3. 部门经理(销售部) INSERT INTO user (username, password, name, role, department, position, manager_id, status) -VALUES ('mgr002', '$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy', '王经理', 'manager', '销售部', '销售经理', 1, 'active') +VALUES ('mgr002', '123456', '王经理', 'manager', '销售部', '销售经理', 1, 'active') ON DUPLICATE KEY UPDATE username=username; -- 4. 员工(技术部) INSERT INTO user (username, password, name, role, department, position, manager_id, status) VALUES -('emp001', '$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy', '张三', 'employee', '技术部', '前端工程师', 2, 'active'), -('emp002', '$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy', '李四', 'employee', '技术部', '后端工程师', 2, 'active'), -('emp003', '$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy', '王五', 'employee', '技术部', '测试工程师', 2, 'active') +('emp001', '123456', '张三', 'employee', '技术部', '前端工程师', 2, 'active'), +('emp002', '123456', '李四', 'employee', '技术部', '后端工程师', 2, 'active'), +('emp003', '123456', '王五', 'employee', '技术部', '测试工程师', 2, 'active') ON DUPLICATE KEY UPDATE username=username; -- 5. 员工(销售部) INSERT INTO user (username, password, name, role, department, position, manager_id, status) VALUES -('emp004', '$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy', '赵六', 'employee', '销售部', '销售专员', 3, 'active'), -('emp005', '$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy', '孙七', 'employee', '销售部', '销售专员', 3, 'active') +('emp004', '123456', '赵六', 'employee', '销售部', '销售专员', 3, 'active'), +('emp005', '123456', '孙七', 'employee', '销售部', '销售专员', 3, 'active') ON DUPLICATE KEY UPDATE username=username; -- 插入默认考核规则配置 diff --git a/backend/src/routes/employee.ts b/backend/src/routes/employee.ts index eb02d02..a9c907f 100644 --- a/backend/src/routes/employee.ts +++ b/backend/src/routes/employee.ts @@ -2,7 +2,6 @@ import { Router, Request, Response } from 'express'; import { authenticate } from '../middlewares/authenticate'; import { authorize } from '../middlewares/authorize'; import pool from '../config/database'; -import bcrypt from 'bcryptjs'; const router = Router(); router.use(authenticate); @@ -47,13 +46,12 @@ router.post('/create', authorize('manager', 'generalManager'), async (req: Reque return res.status(400).json({ code: 400, message: '用户名已存在' }); } - const hashedPassword = await bcrypt.hash(password, 10); const managerId = user.role === 'manager' ? user.userId : null; const [result] = await pool.query( `INSERT INTO user (username, password, name, role, department, position, manager_id, status) VALUES (?, ?, ?, 'employee', ?, ?, ?, 'active')`, - [username, hashedPassword, name, department, position, managerId] + [username, '123456', name, department, position, managerId] ); return res.json({ code: 200, message: '员工账号创建成功', data: { userId: result.insertId } }); diff --git a/backend/src/services/AuthService.ts b/backend/src/services/AuthService.ts index 7bea849..96d19a5 100644 --- a/backend/src/services/AuthService.ts +++ b/backend/src/services/AuthService.ts @@ -1,4 +1,5 @@ -import bcrypt from 'bcryptjs'; +// 注意:此版本使用明文密码验证,所有用户密码均为123456(仅用于测试环境) +// 生产环境必须使用加密密码存储和验证 import jwt from 'jsonwebtoken'; import { findByUsername } from '../dao/UserDAO'; import { JWT_SECRET, JWT_EXPIRES_IN } from '../config/jwt'; @@ -15,7 +16,7 @@ export async function login( throw new Error('用户名或密码错误'); } - const passwordMatch = await bcrypt.compare(password, user.password); + const passwordMatch = password === user.password; if (!passwordMatch) { throw new Error('用户名或密码错误'); } diff --git a/backend/src/services/__tests__/AuthService.property.test.ts b/backend/src/services/__tests__/AuthService.property.test.ts index f6d9717..1e10b9e 100644 --- a/backend/src/services/__tests__/AuthService.property.test.ts +++ b/backend/src/services/__tests__/AuthService.property.test.ts @@ -1,5 +1,4 @@ import * as fc from 'fast-check'; -import bcrypt from 'bcryptjs'; import jwt from 'jsonwebtoken'; import { login } from '../AuthService'; import * as UserDAO from '../../dao/UserDAO'; @@ -29,11 +28,10 @@ describe('Property 1: 认证正确性', () => { position: fc.string({ minLength: 1, maxLength: 20 }), }), async ({ username, password, role, userId, name, department, position }) => { - const hashedPassword = bcrypt.hashSync(password, 1); // cost 1 for speed const userRow: UserDAO.UserRow = { user_id: userId, username, - password: hashedPassword, + password: password, name, role, department, @@ -70,11 +68,10 @@ describe('Property 1: 认证正确性', () => { role: fc.constantFrom(...ROLES), }).filter(({ correctPassword, wrongPassword }) => correctPassword !== wrongPassword), async ({ username, correctPassword, wrongPassword, role }) => { - const hashedPassword = bcrypt.hashSync(correctPassword, 1); mockFindByUsername.mockResolvedValue({ user_id: 1, username, - password: hashedPassword, + password: correctPassword, name: '测试', role, department: '部门', @@ -117,11 +114,10 @@ describe('Property 1: 认证正确性', () => { requestedRole: fc.constantFrom(...ROLES), }).filter(({ storedRole, requestedRole }) => storedRole !== requestedRole), async ({ username, password, storedRole, requestedRole }) => { - const hashedPassword = bcrypt.hashSync(password, 1); mockFindByUsername.mockResolvedValue({ user_id: 1, username, - password: hashedPassword, + password: password, name: '测试', role: storedRole, department: '部门', diff --git a/backend/src/services/__tests__/AuthService.test.ts b/backend/src/services/__tests__/AuthService.test.ts index 9c1a824..78e4c8a 100644 --- a/backend/src/services/__tests__/AuthService.test.ts +++ b/backend/src/services/__tests__/AuthService.test.ts @@ -1,4 +1,3 @@ -import bcrypt from 'bcryptjs'; import jwt from 'jsonwebtoken'; import { login } from '../AuthService'; import * as UserDAO from '../../dao/UserDAO'; @@ -10,7 +9,7 @@ const mockFindByUsername = UserDAO.findByUsername as jest.MockedFunction