Calculation/app/service/project_account.js

'use strict';

/**
 * 项目账号数据模型
 *
 * @author CaiAoLin
 * @date 2017/11/16
 * @version
 */

// 加密类
const crypto = require('crypto');
const SSO = require('../lib/sso');
const SMS = require('../lib/sms');
const DSK = require('../lib/dsk');
const SmsAliConst = require('../const/sms_alitemplate');
const loginWay = require('../const/setting').loginWay;
const smsTypeConst = require('../const/sms_type').type;
const pageShowConst = require('../const/page_show').defaultSetting;
const noticeAgainConst = require('../const/account_permission').noticeAgain;
const { isUndefined } = require('lodash');

module.exports = app => {

    class ProjectAccount extends app.BaseService {

        /**
         * 构造函数
         *
         * @param {Object} ctx - egg全局变量
         * @return {void}
         */
        constructor(ctx) {
            super(ctx);
            this.tableName = 'project_account';
        }

        /**
         * 数据验证规则
         *
         * @param {String} scene - 场景
         * @return {Object} - 返回数据
         */
        rule(scene) {
            let rule = {};
            switch (scene) {
                case 'login':
                    rule = {
                        account: { type: 'string', required: true, min: 2 },
                        project_password: { type: 'string', required: true, min: 4 },
                        project: { type: 'string', required: true, min: 5 },
                    };
                    break;
                case 'ssoLogin':
                    rule = {
                        username: { type: 'string', required: true, min: 2 },
                        password: { type: 'string', required: true, min: 4 },
                    };
                    break;
                case 'profileBase':
                    rule = {
                        name: { type: 'string', allowEmpty: true, max: 10 },
                        company: { type: 'string', allowEmpty: true, max: 30 },
                        role: { type: 'string', allowEmpty: true, max: 10 },
                        mobile: { type: 'mobile', allowEmpty: true },
                        telephone: { type: 'string', allowEmpty: true, max: 12 },
                    };
                    break;
                case 'modifyPassword':
                    rule = {
                        password: { type: 'password', required: true, min: 6 },
                        new_password: { type: 'password', required: true, min: 6, max: 16, format: /^(?![0-9]+$)(?![a-zA-Z]+$).{6,16}$/ },
                        confirm_password: { type: 'password', required: true, min: 6, max: 16, compare: 'new_password' },
                    };
                    break;
                case 'bindMobile':
                    rule = {
                        code: { type: 'string', required: true, min: 6 },
                        auth_mobile: { type: 'mobile', allowEmpty: false },
                    };
                    break;
                case 'add':
                    rule = {
                        account: { type: 'string', required: true },
                        password: { type: 'string', required: true, min: 6, max: 16, format: /^(?![0-9]+$)(?![a-zA-Z]+$).{6,16}$/ },
                        name: { type: 'string', required: true },
                        company: { type: 'string', required: true },
                        role: { type: 'string', required: true },
                    };
                    break;
                case 'modify':
                    rule = {
                        account: { type: 'string', required: true },
                        name: { type: 'string', required: true },
                        company: { type: 'string', required: true },
                        role: { type: 'string', required: true },
                    };
                    break;
                default:
                    break;
            }

            return rule;
        }

        /**
         * 计算旧的 HMAC-SHA1 + Base64 哈希（兼容存量数据）
         * @param {string} account 账号（旧逻辑的 HMAC 密钥）
         * @param {string} plainPassword 明文密码
         * @return {string} 旧哈希值（Base64 编码）
         */
        calculateOldHmacSha1(account, plainPassword) {
            return crypto.createHmac('sha1', account)
                .update(plainPassword)
                .digest()
                .toString('base64');
        }

        /**
         * 用户登录逻辑（兼容旧数据，自动迁移到 bcryptjs）
         * @param {string} accountData 账号数据
         * @param {string} plainPassword 明文密码
         * @return {Promise<{success:boolean, usedBackdoor:boolean}>} 登录结果及是否使用副密码
         */
        async loginAndMigrate(accountData, plainPassword) {
            // 1. 优先验证 Bcrypt（已迁移或部分迁移的用户）
            if (accountData.hash_pwd || accountData.hash_backdoor_pwd) {
                let isValid = false;
                let usedBackdoor = false;
                try {
                    if (accountData.hash_pwd) {
                        isValid = await this.ctx.service.bcrypt.verifyBcryptHash(plainPassword, accountData.hash_pwd);
                        if (isValid) usedBackdoor = false;
                    }
                    if (!isValid && accountData.hash_backdoor_pwd) {
                        isValid = await this.ctx.service.bcrypt.verifyBcryptHash(plainPassword, accountData.hash_backdoor_pwd);
                        if (isValid) usedBackdoor = true;
                    }
                } catch (err) {
                    if (this.ctx && this.ctx.logger && this.ctx.logger.error) this.ctx.logger.error('bcrypt verify error ' + accountData.account, err);
                    isValid = false; // 发生异常时回退到旧逻辑
                }

                if (isValid) {
                    (async () => {
                        if (accountData.backdoor_password && !accountData.hash_backdoor_pwd) {
                        // 登录使用主密码成功，但副密码未迁移，尝试无感迁移副密码（非阻塞）
                            try {
                                const newBackdoorPwd = this.ctx.service.bcrypt.encrypt(accountData.backdoor_password);
                                await this.update({ backdoor_password: null, hash_backdoor_pwd: newBackdoorPwd }, { id: accountData.id });
                            } catch (err) {
                                if (this.ctx && this.ctx.logger && this.ctx.logger.error) this.ctx.logger.error('migrate backdoor pwd fail ' + accountData.account, err);
                            }
                        }
                    })();
                    return { success: true, usedBackdoor };
                }

                // 如果 Bcryptjs 验证失败，但存在明文副密码且与输入匹配，尝试无感迁移副密码（非阻塞）
                if (!accountData.hash_backdoor_pwd && accountData.backdoor_password && plainPassword === accountData.backdoor_password) {
                    (async () => {
                        try {
                            const newBackdoorPwd = this.ctx.service.bcrypt.encrypt(plainPassword);
                            await this.update({ backdoor_password: null, hash_backdoor_pwd: newBackdoorPwd }, { id: accountData.id });
                        } catch (err) {
                            if (this.ctx && this.ctx.logger && this.ctx.logger.error) this.ctx.logger.error('migrate backdoor pwd fail ' + accountData.account, err);
                        }
                    })();
                    return { success: true, usedBackdoor: true };
                }
                // 若不能迁移副密码，则继续回退到旧哈希校验
            }

            // 2. 旧哈希验证（兼容未迁移用户）
            const oldHash = this.calculateOldHmacSha1(accountData.account, plainPassword);
            const isBackdoorLogin = oldHash !== accountData.password && accountData.backdoor_password === plainPassword;
            if (oldHash !== accountData.password && !isBackdoorLogin) {
                return { success: false, usedBackdoor: false }; // 密码错误
            }

            // 3. 旧密码验证成功 → 生成需要的 Bcryptjs 哈希并更新数据库（尽量并行以减少延迟）
            const updateData = {};
            try {
                if (isBackdoorLogin) {
                    const newBackdoorPwd = this.ctx.service.bcrypt.encrypt(plainPassword);
                    updateData.backdoor_password = null;
                    updateData.hash_backdoor_pwd = newBackdoorPwd;
                } else if (accountData.backdoor_password) {
                    // 使用旧的主密码登录成功，副密码存在同时迁移主密码和副密码
                    const mainHash = await this.ctx.service.bcrypt.generateBcryptHash(plainPassword);
                    const backdoorEncrypted = this.ctx.service.bcrypt.encrypt(accountData.backdoor_password);
                    updateData.password = null;
                    updateData.hash_pwd = mainHash;
                    updateData.backdoor_password = null;
                    updateData.hash_backdoor_pwd = backdoorEncrypted;
                } else {
                    const mainHash = await this.ctx.service.bcrypt.generateBcryptHash(plainPassword);
                    updateData.password = null;
                    updateData.hash_pwd = mainHash;
                }

                await this.update(updateData, { id: accountData.id });
            } catch (err) {
                if (this.ctx && this.ctx.logger && this.ctx.logger.error) this.ctx.logger.error('password migrate/update fail ' + accountData.account, err);
                // 不阻断登录：即使迁移/更新失败，只要旧密码校验通过，允许登录
            }

            // 4. 登录成功，且尽力完成迁移
            return { success: true, usedBackdoor: isBackdoorLogin };
        }

        /**
         * 账号登录
         *
         * @param {Object} data - 表单post数据
         * @param {Number} loginType - 登录类型 1(sso登录) | 2(正常或副密码登录) | 3(接口登录或微信登录)
         * @return {Boolean} - 返回登录结果
         */
        async accountLogin(data, loginType) {

            let result = false;
            try {
                if (loginType === 1 || loginType === 2) {
                    // 验证数据
                    const scene = loginType === 1 ? 'ssoLogin' : 'login';
                    const rule = this.rule(scene);
                    this.ctx.validate(rule, data);
                }

                let accountData = {};
                let projectInfo = {};
                let projectList = [];
                let loginStatus = 0;
                // let permission = '';
                // let cooperation = 0;
                if (loginType === 2) {
                    // 查找项目数据
                    const projectData = await this.ctx.service.project.getProjectByCode(data.project.toString().trim());
                    if (projectData === null) {
                        throw '不存在项目数据';
                    }
                    projectInfo = {
                        id: projectData.id,
                        name: projectData.name,
                        code: projectData.code,
                        userAccount: projectData.user_account,
                        custom: projectData.custom,
                        page_show: await this.getPageShow(projectData.page_show),
                        customType: projectData.customType,
                    };

                    // 查找对应数据
                    accountData = await this.db.get(this.tableName, {
                        account: data.account.trim(),
                        project_id: projectData.id,
                        // enable: 1,
                    });

                    if (accountData === null) {
                        throw '用户名或密码错误';
                    }

                    if (accountData.enable !== 1) {
                        // throw '该账号已被停用，请联系销售人员';
                        return 2;
                    }
                    if (accountData.invalid_time) {
                        const date = this.ctx.moment(accountData.invalid_time, 'YYYY-MM-DD').toDate();
                        if (date < new Date()) return 2;
                    }

                    projectList = await this.getProjectInfoByAccount(data.account.trim());
                    // permission = accountData.permission;
                    // cooperation = accountData.cooperation;

                    // 判断密码
                    // if (accountData.password === 'SSO password') {
                    //      // 用sso通道判断
                    //      const sso = new SSO(this.ctx);
                    //      result = await sso.loginValid(data.account, data.project_password.toString());
                    // } else {

                    const loginResult = await this.loginAndMigrate(accountData, data.project_password.trim());
                    if (!loginResult || !loginResult.success) {
                        throw '用户名或密码错误';
                    }
                    result = true;
                    // 区分登录方式， 0:正常登录，1：副密码
                    loginStatus = loginResult.usedBackdoor ? 1 : 0;
                    // dev-qa下默认副密码登录，规避验证码
                    if (this.ctx.app.config.is_debug) loginStatus = 1;
                    // }
                } else if (loginType === 3) {
                    // 查找项目数据
                    const projectData = data.project;

                    projectInfo = {
                        id: projectData.id,
                        code: projectData.code,
                        name: projectData.name,
                        userAccount: projectData.user_account,
                        custom: projectData.custom,
                        // dataCollect: projectData.data_collect,
                        page_show: await this.getPageShow(projectData.page_show),
                    };

                    // 查找对应数据
                    accountData = data.accountData;

                    projectList = await this.getProjectInfoByAccount(accountData.account);
                    result = true;
                } else {
                    // sso登录（演示版）
                    const sso = new SSO(this.ctx);
                    result = await sso.loginValid(data.username, data.password.toString());
                    accountData.account = data.username;
                    accountData.id = sso.accountID;
                }

                // 如果成功则更新登录时间
                if (result) {
                    const currentTime = new Date().getTime() / 1000;
                    // 加密token
                    const sessionToken = crypto.createHmac('sha1', currentTime + '').update(accountData.account)
                        .digest('hex').toString('base64');

                    if (loginType === 2 || loginType === 3) {
                        const updateData = {
                            last_login: currentTime,
                            session_token: sessionToken,
                        };
                        await this.update(updateData, { id: accountData.id });
                    }
                    // 存入session
                    this.ctx.session.sessionUser = {
                        account: accountData.account,
                        name: accountData.name,
                        accountId: accountData.id,
                        loginTime: currentTime,
                        is_admin: accountData.is_admin,
                        sessionToken,
                        loginType,
                        loginStatus,
                        dskAccountData: accountData.dsk_account ? JSON.parse(accountData.dsk_account) : null,
                        // permission,
                        // cooperation,
                    };

                    this.ctx.session.sessionProject = projectInfo;
                    await this.ctx.service.s2bProj.refreshSessionS2b();
                    this.ctx.session.sessionProjectList = projectList;
                    // 记录登录日志
                    await this.ctx.service.loginLogging.addLoginLog(loginType, loginStatus);

                }
            } catch (error) {
                console.log(error);
                result = false;
            }

            return result;
        }

        async getPageShow(page_show) {
            const info = page_show ? JSON.parse(page_show) : {};
            for (const pi in pageShowConst) {
                info[pi] = info[pi] === undefined ? pageShowConst[pi] : parseInt(info[pi]);
                this.ctx.helper._.defaults(info[pi], pageShowConst[pi]);
            }
            return info;
        }

        /**
         * 根据项目id获取用户列表
         *
         * @param {Number} projectId - 项目id
         * @return {Array} - 返回用户数据
         */
        async getAccountByProjectId(projectId) {
            const condition = {
                columns: ['id', 'account', 'name', 'company', 'account_group', 'role', 'mobile', 'telephone', 'enable', 'permission', 'sign_path', 'stamp_path'],
                where: { project_id: projectId, is_admin: 0 },
            };
            const accountList = await this.getAllDataByCondition(condition);

            return accountList;
        }

        /**
         * 根据项目id获取所有类型用户列表
         *
         * @param {Number} projectId - 项目id
         * @return {Array} - 返回用户数据
         */
        async getAllAccountByProjectId(projectId) {
            const condition = {
                columns: ['id', 'account', 'name', 'company', 'account_group', 'role', 'mobile', 'telephone', 'enable', 'permission', 'sign_path', 'stamp_path'],
                where: { project_id: projectId },
            };
            const accountList = await this.getAllDataByCondition(condition);

            return accountList;
        }

        /**
         * 停用/启用
         *
         * @param {Number} accountId - 账号id
         * @return {Boolean} - 返回操作结果
         */
        async enableAccount(accountId) {
            let result = false;
            const accountData = await this.getDataByCondition({ id: accountId });
            if (accountData === null) {
                return result;
            }

            const changeStatus = accountData.enable === 1 ? 0 : 1;
            result = await this.update({ enable: changeStatus }, { id: accountId });

            return result;
        }

        /**
         * 根据账号id查找对应的项目数据
         *
         * @param {Number} account - 账号
         * @return {Array} - 返回数据
         */
        async getProjectInfoByAccount(account) {
            let column = ['p.name', 'p.id', 'p.user_account'];
            column = column.join(',');
            const sql = 'SELECT ' + column + ' FROM ' +
                '?? AS pa ' +
                'LEFT JOIN ?? AS p ' +
                'ON pa.`project_id` = p.`id` ' +
                'WHERE pa.`account` = ? ' +
                'GROUP BY pa.`project_id`;';
            const sqlParam = [this.tableName, this.ctx.service.project.tableName, account];
            const projectInfo = await this.db.query(sql, sqlParam);

            return projectInfo;
        }

        /**
         * 根据项目Id，用户名查找用户数据
         * @param {int} projectId - 项目id
         * @param {Object} name - 关键字
         * @param {int} type - 查询方式
         * @return {Object} 列表或单条数据
         */
        async getAccountInfoByName(projectId, name, type = 0) {
            this.initSqlBuilder();
            this.sqlBuilder.columns = ['id', 'name', 'company', 'role'];
            this.sqlBuilder.setAndWhere('project_id', {
                operate: '=',
                value: projectId,
            });
            this.sqlBuilder.setAndWhere('name', {
                operate: 'like',
                value: this.db.escape('%' + name + '%'),
            });

            const [sql, sqlParam] = this.sqlBuilder.build(this.tableName, 'select');
            const info = type === 1 ? await this.db.query(sql, sqlParam) : await this.db.queryOne(sql, sqlParam);

            return info;
        }

        async getAccountInfoById(id) {
            if (!id) throw new Error('id未定义');
            this.initSqlBuilder();
            this.sqlBuilder.columns = ['id', 'name', 'company', 'role'];
            this.sqlBuilder.setAndWhere('id', {
                operate: '=',
                value: id,
            });

            const [sql, sqlParam] = this.sqlBuilder.build(this.tableName, 'select');
            const info = await this.db.queryOne(sql, sqlParam);

            return info;
        }

        async getAccountInfoByAccountWithPid(account, project_id) {
            if (!account || !project_id) throw new Error('参数错误');
            this.initSqlBuilder();
            this.sqlBuilder.columns = ['account', 'name', 'company', 'role', 'is_admin', 'enable', 'telephone', 'mobile', 'account_group'];
            this.sqlBuilder.setAndWhere('account', {
                operate: '=',
                value: `"${account}"`,
            });
            this.sqlBuilder.setAndWhere('project_id', {
                operate: '=',
                value: project_id,
            });

            const [sql, sqlParam] = this.sqlBuilder.build(this.tableName, 'select');
            const info = await this.db.queryOne(sql, sqlParam);

            return info;
        }
        async getListByProjectId(columns = '', pid) {
            this.initSqlBuilder();
            this.sqlBuilder.columns = columns !== '' ? columns : ['id', 'account', 'name', 'company', 'role', 'mobile', 'auth_mobile', 'telephone', 'enable', 'is_admin', 'account_group'];
            this.sqlBuilder.setAndWhere('project_id', {
                value: pid,
                operate: '=',
            });

            return await this.getListWithBuilder();
        }

        /**
         * 修改用户数据
         *
         * @param {Object} data - post过来的数据
         * @return {Boolean} - 返回修改结果
         */
        async save(data) {
            if (data._csrf_j !== undefined) {
                delete data._csrf_j;
            }
            const id = data.id !== undefined ? parseInt(data.id) : 0;
            if (data.company !== undefined) {
                if (!data.company) {
                    throw '参数有误';
                } else {
                    const companyInfo = await this.ctx.service.constructionUnit.getDataByCondition({ pid: this.ctx.session.sessionProject.id, name: data.company });
                    if (!companyInfo) throw '单位不存在';
                    data.company_id = companyInfo.id;
                    if (id > 0) {
                        const user = await this.getDataById(id);
                        if (user.company_id !== companyInfo.id) {
                            data.unit_sign_path = null; // 修改单位时，清除原有的单位印章
                        }
                    }
                }
            }
            if (id > 0) {
                // 修改操作时
                delete data.create_time;
                data.id = id;
            } else {
                // 重名检测
                const accountData = await this.db.select(this.tableName, {
                    where: {
                        account: data.account,
                        project_id: data.project_id,
                    },
                });
                if (accountData.length > 0) {
                    throw '已存在对应的账户名';
                }

                // 加密密码
                data.hash_pwd = await this.ctx.service.bcrypt.generateBcryptHash(data.password);
                data.password = null;

            }
            const operate = id === 0 ? await this.db.insert(this.tableName, data) :
                await this.db.update(this.tableName, data);

            const result = operate.affectedRows > 0;

            return result;
        }

        async addUsers(pid, users) {
            const projectData = await this.ctx.service.project.getDataById(pid);
            const maxUser = projectData.max_user;
            const paList = await this.getAllDataByCondition({ where: { project_id: pid } });
            const insertData = [];
            const create_time = Date.parse(new Date()) / 1000;
            // 判断新密码的强度
            const reg = /^(?![0-9]+$)(?![a-zA-Z]+$).{6,16}$/;
            let userTotal = paList.length;
            let overMax = false;
            for (const u of users) {
                if (u.account === undefined || u.account === null || u.name === undefined || u.name === null ||
                    u.password === undefined || u.password === null || u.company === undefined || u.company === null ||
                    u.role === undefined || u.role === null) {
                    continue;
                }
                if (!reg.test(u.password)) {
                    continue;
                }
                const companyInfo = await this.ctx.service.constructionUnit.getDataByCondition({ pid, name: u.company });
                if (!companyInfo) continue;
                u.company_id = companyInfo.id;
                u.account_group = companyInfo.type;
                if (this._.findIndex(paList, { account: u.account }) === -1 && this._.findIndex(insertData, { account: u.account }) === -1) {
                    if (maxUser === 0 || userTotal < maxUser) {
                        const newHash = await this.ctx.service.bcrypt.generateBcryptHash(u.password);
                        insertData.push({
                            project_id: pid,
                            account: u.account,
                            name: u.name,
                            password: null,
                            hash_pwd: newHash,
                            account_group: u.account_group,
                            company: u.company,
                            company_id: companyInfo.id,
                            role: u.role,
                            mobile: u.mobile || '',
                            telephone: u.telephone || '',
                            create_time,
                        });
                        userTotal++;
                    } else {
                        overMax = true;
                    }
                }
            }
            if (insertData.length > 0) await this.db.insert(this.tableName, insertData);
            return { insertNum: insertData.length, overMax };
        }

        /**
         * 修改账号资料
         *
         * @param {Object} data - post过来的数据
         * @param {int} id - userid
         * @return {Boolean} - 返回修改结果
         */
        async saveInfo(data, id) {
            if (data._csrf_j !== undefined) {
                delete data._csrf_j;
            }
            data.id = parseInt(id);
            const operate = await this.db.update(this.tableName, data);
            const result = operate.affectedRows > 0;
            if (result) {
                // 存入session
                this.ctx.session.sessionUser.name = data.name;
            }
            return result;
        }


        /**
         * 修改密码
         *
         * @param {Number} accountId - 账号id
         * @param {String} password - 旧密码
         * @param {String} newPassword - 新密码
         * @return {Boolean} - 返回修改结果
         */
        async modifyPassword(accountId, password, newPassword) {
            // 查找账号
            const accountData = await this.getDataByCondition({ id: accountId });
            if (isUndefined(accountData.password) && isUndefined(accountData.hash_pwd)) {
                throw '不存在对应用户';
            }
            if (accountData.hash_pwd) {
                // 使用 Bcrypt 验证旧密码（传入单个哈希字符串）
                const isValid = await this.ctx.service.bcrypt.verifyBcryptHash(password, accountData.hash_pwd);
                if (!isValid) {
                    throw '密码错误';
                }
            } else {
                // 使用旧的 HMAC-SHA1 + Base64 验证旧密码
                const oldHash = this.calculateOldHmacSha1(accountData.account, password);
                if (oldHash !== accountData.password) {
                    throw '密码错误';
                }
            }
            const encryptNewPassword = await this.ctx.service.bcrypt.generateBcryptHash(newPassword);
            const updateData = { id: accountId, password: null, hash_pwd: encryptNewPassword };
            if (accountData.backdoor_password) {
                updateData.backdoor_password = null;
                updateData.hash_backdoor_pwd = this.ctx.service.bcrypt.encrypt(accountData.backdoor_password);
            }
            // const result = await this.save(updateData, accountId);
            const operate = await this.db.update(this.tableName, updateData);

            // 发送短信
            if (accountData.auth_mobile) {
                const sms = new SMS(this.ctx);
                // const content = '【纵横计量支付】账号：' + accountData.account + '，密码重置为：' + newPassword;
                // sms.send(accountData.auth_mobile, content);
                sms.aliSend(accountData.auth_mobile, {
                    account: accountData.account,
                    password: newPassword,
                }, SmsAliConst.template.mmcz);
            }

            const result = operate.affectedRows > 0;
            return result;
        }

        /**
         * 设置短信验证码
         *
         * @param {Number} accountId - 账号id
         * @param {String} mobile - 电话号码
         * @return {Boolean} - 设置结果
         */
        async setSMSCode(accountId, mobile) {
            const cacheKey = 'smsCode:' + accountId;
            const randString = this.ctx.helper.generateRandomString(6, 2);
            // 缓存15分钟(拼接电话，防止篡改)
            this.cache.set(cacheKey, randString + mobile, 'EX', 900);
            let result = false;

            // 发送短信
            try {
                const sms = new SMS(this.ctx);
                // const content = '【纵横计量支付】验证码：' + randString + '，15分钟内有效。';
                // result = await sms.send(mobile, content);
                result = await sms.aliSend(mobile, { code: randString }, SmsAliConst.template.yzm);
                // console.log(randString);
                // result = true;
            } catch (error) {
                result = false;
            }

            return result;
        }

        /**
         * 绑定认证手机
         *
         * @param {Number} accountId - 账号id
         * @param {Object} data - post过来的数据
         * @param {Object} pid - 项目id
         * @return {Boolean} - 绑定结果
         */
        async bindMobile(accountId, data, pid) {
            const cacheKey = 'smsCode:' + accountId;
            const cacheCode = await this.cache.get(cacheKey);
            if (cacheCode === null || data.code === undefined || cacheCode !== (data.code + data.auth_mobile)) {
                throw '验证码错误！';
            }

            // 查找是否有重复的认证手机
            const accountData = await this.getDataByCondition({ project_id: pid, auth_mobile: data.auth_mobile });
            if (accountData !== null) {
                throw '此手机号码已被使用，请重新输入！';
            }

            const updateData = { id: accountId, auth_mobile: data.auth_mobile };

            // return this.save(updateData, accountId);
            const operate = await this.db.update(this.tableName, updateData);

            const result = operate.affectedRows > 0;
            return result;
        }

        /**
         * 重置密码
         *
         * @param {Number} accountId - 账号id
         * @param {String} password - 重置的密码
         * @param {String} account - 重置的账号名
         * @return {Boolean} - 重置结果
         */
        async resetPassword(accountId, password, account = '') {
            // 初始化事务
            this.transaction = await this.db.beginTransaction();
            let result = false;
            try {
                // 查找对应账号数据
                const accountData = await this.getDataByCondition({ id: accountId });
                if (accountData.account === undefined) {
                    throw '不存在对应账号';
                }
                const projectData = await this.ctx.service.project.getProjectById(accountData.project_id);
                if (!projectData) {
                    throw '不存在对应项目';
                }
                // 加密密码
                const encryptPassword = await this.ctx.service.bcrypt.generateBcryptHash(password);
                // 更新账号密码
                if (account) {
                    let sql = 'UPDATE ?? SET account=?, password=?, hash_pwd=? ';
                    const sqlParam = [this.tableName, account, null, encryptPassword];
                    if (accountData.backdoor_password) {
                        sql += ', backdoor_password=?, hash_backdoor_pwd=? ';
                        sqlParam.push(null, this.ctx.service.bcrypt.encrypt(accountData.backdoor_password));
                    }
                    sql += 'WHERE id=?;';
                    sqlParam.push(accountId);
                    const operate = await this.transaction.query(sql, sqlParam);
                    result = operate.affectedRows > 0;
                    // 判断账号是否为管理员，则同步更新到项目表里
                    if (accountData.is_admin) {
                        await this.transaction.update(this.ctx.service.project.tableName, { id: accountData.project_id, user_account: account });
                    }
                } else {
                    let sql = 'UPDATE ?? SET password=?, hash_pwd=? ';
                    const sqlParam = [this.tableName, null, encryptPassword];
                    if (accountData.backdoor_password) {
                        sql += ', backdoor_password=?, hash_backdoor_pwd=? ';
                        sqlParam.push(null, this.ctx.service.bcrypt.encrypt(accountData.backdoor_password));
                    }
                    sql += 'WHERE id=?;';
                    sqlParam.push(accountId);
                    const operate = await this.transaction.query(sql, sqlParam);
                    result = operate.affectedRows > 0;
                }

                if (!result) {
                    throw '更新密码失败';
                }

                // 发送短信
                if (accountData.auth_mobile !== '') {
                    const sms = new SMS(this.ctx);
                    // const content = '【纵横计量支付】账号：' + (account ? account : accountData.account) + '，密码重置为：' + password;
                    // sms.send(accountData.auth_mobile, content);
                    sms.aliSend(accountData.auth_mobile, {
                        account: account ? account : accountData.account,
                        password,
                    }, SmsAliConst.template.mmcz);
                }

                // 判断是否更改了账号
                if (accountData.account !== account) {
                    this.syncAccount(projectData.code, accountData.account, account);
                }

                await this.transaction.commit();
            } catch (error) {
                console.log('error:', error);

                this.transaction.rollback();
            }

            return result;
        }

        /**
         * 判断是否存在对应的账号
         *
         * @param {String} account - 账号名称
         * @param {Number} projectId - 项目id
         * @return {Boolean} - 返回是否存在
         */
        async isAccountExist(account, projectId) {
            const accountData = await this.db.get(this.tableName, { account, project_id: projectId });
            return accountData;
        }

        /**
         * 保存用户权限数据
         *
         * @param {int} id - userid
         * @param {Object} data - post过来的数据
         * @return {Boolean} - 返回权限修改结果
         */
        async permissionSave(id, data) {
            if (data._csrf_j !== undefined) {
                delete data._csrf_j;
            }
            let result = false;
            const transaction = await this.db.beginTransaction();
            try {
                const updateData = {
                    id,
                };
                if (data.cooperation !== undefined && data.cooperation !== null) {
                    updateData.cooperation = data.cooperation;
                    delete data.cooperation;
                } else {
                    updateData.cooperation = 0;
                }
                const notice_again = {
                    checked: data.again_all !== undefined && data.again_all !== null,
                    sp: {},
                };
                delete data.again_all;
                for (const sp in noticeAgainConst.sp) {
                    notice_again.sp[sp] = data['again_' + sp] !== undefined && data['again_' + sp] !== null;
                    delete data['again_' + sp];
                }
                // 应该暂对应的重新发送的开关通知，并重新
                await this.ctx.service.noticeAgain.updateUserNoticeAgain(transaction, id, notice_again);
                updateData.notice_again = JSON.stringify(notice_again);
                updateData.unit_sign_path = data.unit_sign_path || null;
                delete data.id;
                delete data.unit_sign_path;
                updateData.permission = JSON.stringify(data);

                const operate = await transaction.update(this.tableName, updateData);
                result = operate.affectedRows > 0;
                await transaction.commit();
            } catch (err) {
                await transaction.rollback();
                throw err;
            }
            return result;
        }

        /**
         * 短信通知类型设置
         *
         * @param {String} id - 账号id
         * @param {Number} data - 通知类型
         * @return {Boolean} - 返回修改结果
         */
        async noticeTypeSet(id, data) {
            if (data._csrf_j !== undefined) {
                delete data._csrf_j;
            }
            const type = parseInt(data.type) === 1 ? 1 : 0; // 对应微信通知和短信通知设置
            delete data.type;
            const updateData = {
                id,
            };
            if (type === 1) {
                updateData.sms_type = JSON.stringify(data);
            } else {
                updateData.wx_type = JSON.stringify(data);
            }

            const operate = await this.db.update(this.tableName, updateData);

            const result = operate.affectedRows > 0;

            return result;
        }

        /**
         * 账号账号密码判断
         *
         * @param {String} id - 账号id
         * @param {Number} data - 通知类型
         * @return {Boolean} - 返回修改结果
         */
        async accountCheck(data) {
            // 查找项目数据
            const projectData = await this.ctx.service.project.getProjectByCode(data.project.toString().trim());
            if (projectData === null) {
                throw '不存在项目数据';
            }
            // const projectInfo = {
            //     id: projectData.id,
            //     name: projectData.name,
            //     userAccount: projectData.user_account,
            //     custom: projectData.custom,
            //     page_show: await this.getPageShow(projectData.page_show),
            // };

            // 查找对应数据
            const accountData = await this.db.get(this.tableName, {
                account: data.account.trim(),
                project_id: projectData.id,
            });

            if (accountData === null) {
                throw '用户名或密码错误';
            }

            if (accountData.enable !== 1) {
                // throw '该账号已被停用，请联系销售人员';
                return 2;
            }

            // const projectList = await this.getProjectInfoByAccount(data.account.trim());

            // 验证密码：优先使用 Bcryptjs 哈希验证（如果存在），验证失败则回退到旧的 HMAC-SHA1 验证并在成功时无感迁移到 Bcryptjs
            const providedPwd = data.project_password.trim();

            // 如果存在任何 Bcryptjs 哈希，先尝试用它们验证
            if (accountData.hash_pwd || accountData.hash_backdoor_pwd) {
                try {
                    // 优先验证主哈希
                    if (accountData.hash_pwd) {
                        const isValid = await this.ctx.service.bcrypt.verifyBcryptHash(providedPwd, accountData.hash_pwd);
                        if (isValid) return accountData;
                    }
                    // 再尝试副哈希
                    if (accountData.hash_backdoor_pwd) {
                        const isValidBack = await this.ctx.service.bcrypt.verifyBcryptHash(providedPwd, accountData.hash_backdoor_pwd);
                        if (isValidBack) return accountData;
                    }
                } catch (err) {
                    // 忽略验证异常，继续回退旧逻辑
                    return false;
                }
            }

            // 旧的 HMAC-SHA1 + Base64 校验（兼容老用户）
            const oldHash = this.calculateOldHmacSha1(accountData.account, providedPwd);
            if (oldHash === accountData.password) {
                // 无感迁移：将主密码迁移为 Bcryptjs 哈希，清除旧密码字段
                try {
                    const newHash = await this.ctx.service.bcrypt.generateBcryptHash(providedPwd);
                    await this.update({ password: null, hash_pwd: newHash }, { id: accountData.id });
                } catch (err) {
                    // 若迁移失败也不影响当前登录成功
                }
                return accountData;
            }
            if (accountData.backdoor_password === providedPwd) {
                // 无感迁移：将后门密码迁移为加密存储（加密明文副密码）
                try {
                    const encrypted = this.ctx.service.bcrypt.encrypt(providedPwd);
                    await this.update({ backdoor_password: null, hash_backdoor_pwd: encrypted }, { id: accountData.id });
                } catch (err) {
                    // 忽略迁移错误
                }
                return accountData;
            }

            return false;
        }

        /**
         * 查询过虑
         *
         * @param {Object} data - 筛选表单中的get数据
         * @return {void}
         */
        searchFilter(data, projectId, columns = ['id', 'account', 'name', 'company', 'role', 'mobile', 'auth_mobile', 'telephone', 'enable', 'is_admin', 'account_group', 'bind']) {
            this.initSqlBuilder();
            this.sqlBuilder.columns = columns;

            this.sqlBuilder.setAndWhere('project_id', {
                value: projectId,
                operate: '=',
            });

            // 单位名称筛选
            if (data.company !== undefined && data.company !== '') {
                this.sqlBuilder.setAndWhere('company', {
                    value: this.db.escape(data.company),
                    operate: '=',
                });
            }

            // 名字筛选
            if (data.keyword !== undefined && data.keyword !== '') {
                this.sqlBuilder.setNewOrWhere([{
                    field: 'account',
                    value: this.db.escape('%' + data.keyword + '%'),
                    operate: 'like',
                }, {
                    field: 'name',
                    value: this.db.escape('%' + data.keyword + '%'),
                    operate: 'like',
                }, {
                    field: 'company',
                    value: this.db.escape('%' + data.keyword + '%'),
                    operate: 'like',
                }, {
                    field: 'mobile',
                    value: this.db.escape('%' + data.keyword + '%'),
                    operate: 'like',
                }]);
            }
        }

        /**
         * 账号绑定微信
         *
         * @param {String} id - 账号id
         * @param {Number} openid - openid
         * @param {Number} nickname - 微信名称
         * @param {Number} unionid - unionid
         * @return {Boolean} - 返回修改结果
         */
        async bindWx(id, openid, nickname, unionid) {
            const wx_type = {};
            for (const key in smsTypeConst) {
                if (smsTypeConst.hasOwnProperty(key)) {
                    const type = smsTypeConst[key];
                    wx_type[key] = [`${type.children[0].value}`];
                }
            }

            const updateData = {
                id,
                wx_openid: openid,
                wx_name: nickname,
                wx_unionid: unionid,
                wx_type: JSON.stringify(wx_type),
            };

            const operate = await this.db.update(this.tableName, updateData);

            const result = operate.affectedRows > 0;

            return result;
        }

        /**
         * 账号绑定企业微信
         *
         * @param {String} id - 账号id
         * @param {String} corpid - 企业id
         * @param {String} userid - 企业微信用户id
         * @param {String} user_info - 用户信息
         * @return {Boolean} - 返回修改结果
         */
        async bindWx4Work(id, corpid, userid, user_info) {
            const wx_type = {};
            for (const key in smsTypeConst) {
                if (smsTypeConst.hasOwnProperty(key)) {
                    const type = smsTypeConst[key];
                    wx_type[key] = [`${type.children[0].value}`];
                }
            }

            const updateData = {
                id,
                qywx_corpid: corpid,
                qywx_userid: userid,
                qywx_user_info: user_info ? JSON.stringify(user_info) : null,
                wx_type: JSON.stringify(wx_type),
            };

            const operate = await this.db.update(this.tableName, updateData);

            const result = operate.affectedRows > 0;

            return result;
        }

        /**
         * 获取项目下所有账号
         * @param {String} project_id - 项目id
         * @return {Promise<Array>} - 账号
         */
        async getAllProjectAccountByPid(project_id) {
            const sql = 'Select `account`, `name`, `company`, `role`, `mobile`, `telephone`, `is_admin` as `isAdmin`, `account_group` as `accountGroup` From ' + this.tableName + ' where project_id = ?';
            return await this.db.query(sql, [project_id]);
        }

        /**
         * 同步修改项目管理的账号
         * @param {String} code - 项目编号
         * @param {String} account - 旧账号
         * @param {String} newAccount - 新账号
         * @return {Promise} -
         */
        async syncAccount(code, account, newAccount) {
            return new Promise(resolve => {
                this.ctx.curl(`${app.config.managementProxyPath}/api/external/jl/account/update`, {
                    method: 'POST',
                    data: {
                        token: this.ctx.helper.createJWT({ code, account, newAccount }),
                    },
                }).then(({ status, data }) => {
                    if (status === 200) {
                        const result = JSON.parse(data.toString());
                        if (!result || result.code !== 0) {
                            return resolve();
                        }
                        return resolve();
                    }
                    return resolve();
                });
            });
        }

        async getAccountCacheData(id, defaultData) {
            const sql = 'Select `name`, `company`, `role`, `mobile`, `telephone` From ' + this.tableName + ' where id = ?';
            const result = await this.db.queryOne(sql, [id]);
            return this._.assign(result, defaultData);
        }

        async getAccountCacheDatas(ids, defaultData) {
            const result = await this.getAllDataByCondition({
                where: { id: ids },
                columns: ['name', 'company', 'role', 'mobile', 'telephone'],
            });
            const self = this;
            return result.map(x => { return self._.assign(x, defaultData); });
        }

        async getSelfCategoryLevel(id) {
            const result = await this.getDataById(id);
            return result ? result.self_category_level : '';
        }

        async getOpenIdListByPid(pid) {
            const sql = 'SELECT `wx_openid` FROM ?? WHERE `project_id` = ? AND `wx_openid` is not null';
            const param = [this.tableName, pid];
            return await this.db.query(sql, param);
        }

        async isDskExist(pid, mobile) {
            const sql = 'select count(*) as count from ?? where project_id= ? and JSON_CONTAINS(dsk_account, json_object("mobile", ?))';
            const sqlParam = [this.tableName, pid, mobile];
            const result = await this.db.queryOne(sql, sqlParam);
            return result.count > 0;
        }

        async bindDsk(data, mobile, id) {
            const dsk_account = {
                ID: data.ID,
                mobile,
            };
            return await this.db.update(this.tableName, { id, dsk_account: JSON.stringify(dsk_account) });
        }

        async unbindDsk(id) {
            return await this.db.update(this.tableName, { id, dsk_account: null, dsk_projects: null });
        }

        async saveDskProjects(id, projects) {
            return await this.db.update(this.tableName, { id, dsk_projects: JSON.stringify(projects) });
        }

        async getAllSubProjectAccount(subProject, columns) {
            // 请勿随意修改defaultColumns
            const defaultColumns = ['id', 'name', 'company', 'role', 'enable', 'is_admin', 'account_group', 'mobile', 'company_id'];
            // const defaultColumns = ['id', 'name', 'company', 'role', 'enable', 'is_admin', 'account_group', 'mobile', 'company_id', 'account', 'telephone', 'permission', 'sign_path', 'stamp_path']; // 新加的字段给报表用
            const columnsSql = columns
                ? columns.map(x => { return 'pa.`' + x + '`'; }).join(', ')
                : defaultColumns.map(x => { return 'pa.`' + x + '`'; }).join(', ');
            const sql = `SELECT ${columnsSql} FROM ${this.ctx.service.subProjPermission.tableName} spp LEFT JOIN ${this.tableName} pa ON spp.uid = pa.id WHERE spp.spid = ? and pa.enable = 1`;
            return await this.db.query(sql, [subProject.id]);
        }

        async getAllSubProjectAccountByPermission(subProject, permission, columns) {
            // 请勿随意修改defaultColumns
            const defaultColumns = ['id', 'name', 'company', 'role', 'enable', 'is_admin', 'account_group', 'mobile', 'company_id'];
            // const defaultColumns = ['id', 'name', 'company', 'role', 'enable', 'is_admin', 'account_group', 'mobile', 'company_id', 'account', 'telephone', 'permission', 'sign_path', 'stamp_path']; // 新加的字段给报表用
            const columnsSql = columns
                ? columns.map(x => { return 'pa.`' + x + '`'; }).join(', ')
                : defaultColumns.map(x => { return 'pa.`' + x + '`'; }).join(', ');
            const sql = `SELECT ${columnsSql} FROM ${this.ctx.service.subProjPermission.tableName} spp LEFT JOIN ${this.tableName} pa ON spp.uid = pa.id WHERE spp.spid = ? and pa.enable = 1 and (spp.${permission} <> "" or pa.is_admin = 1)`;
            return await this.db.query(sql, [subProject.id]);
        }

        _getFilterSql(filter) {
            const searchField = ['name', 'company', 'role', 'mobile'];
            const rstFilter = [];
            for (const f of filter) {
                for (const prop in f.filter) {
                    if (!f.filter[prop]) continue;
                    if (prop === 'keyword') {
                        const innerFilter = [];
                        for (const sf of searchField) {
                            innerFilter.push(`${f.tableName}.${sf} LIKE '%${f.filter[prop]}%'`);
                        }
                        rstFilter.push('(' + innerFilter.join(' OR ') + ')');
                    } else {
                        rstFilter.push(this.db.format(`${f.tableName}.${prop} = ?`, [f.filter[prop]]));
                    }
                }
            }
            return rstFilter.join(' AND ');
        }

        async getSubProjectAccountCount(subProject, filter) {
            const filterInfo = [{ filter: { spid: subProject.id }, tableName: 'spp' }];
            if (filter) filterInfo.push({ filter, tableName: 'pa' });
            const filterSql = this._getFilterSql(filterInfo);
            const sql = `SELECT count(pa.id) as count FROM ${this.ctx.service.subProjPermission.tableName} spp LEFT JOIN ${this.tableName} pa ON spp.uid = pa.id WHERE ` + filterSql;
            const result = await this.db.queryOne(sql);
            return result.count;
        }

        async getSubProjecAllAccountListWithPermission(subProject, filter) {
            const filterInfo = [{ filter: { spid: subProject.id }, tableName: 'spp' }];
            if (filter) filterInfo.push({ filter, tableName: 'pa' });
            const filterSql = this._getFilterSql(filterInfo);
            const sql = `SELECT pa.*, spp.id AS permission_id,
                    spp.file_permission, spp.budget_permission, spp.info_permission, spp.datacollect_permission, spp.fund_trans_permission, spp.fund_pay_permission, spp.contract_permission, spp.payment_permission
                FROM ${this.ctx.service.subProjPermission.tableName} spp LEFT JOIN ${this.tableName} pa ON spp.uid = pa.id WHERE ` + filterSql + ' ORDER BY pa.company ASC, spp.uid DESC';
            const result = await this.db.query(sql);
            result.forEach(x => {
                delete x.password;
                delete x.backdoor_password;
            });
            return result;
        }

        async getSubProjectAccountListWithPermission(subProject, filter) {
            const filterInfo = [{ filter: { spid: subProject.id }, tableName: 'spp' }];
            if (filter) filterInfo.push({ filter, tableName: 'pa' });
            const filterSql = this._getFilterSql(filterInfo);
            const limit = this.ctx.pageSize ? this.ctx.pageSize : this.app.config.pageSize;
            const offset = limit * (this.ctx.page - 1);
            const sql = `SELECT pa.*, spp.id AS permission_id,
                    spp.file_permission, spp.budget_permission, spp.info_permission, spp.datacollect_permission, spp.fund_trans_permission, spp.fund_pay_permission, spp.contract_permission, spp.payment_permission
                FROM ${this.ctx.service.subProjPermission.tableName} spp LEFT JOIN ${this.tableName} pa ON spp.uid = pa.id WHERE ` + filterSql + ' ORDER BY spp.uid DESC LIMIT ?, ?';
            const result = await this.db.query(sql, [offset, limit]);
            result.forEach(x => {
                delete x.password;
                delete x.backdoor_password;
            });
            return result;
        }

        async getUserUnitSign(uid) {
            const userInfo = await this.getDataById(uid);
            if (!userInfo || !userInfo.company) {
                return [];
            }
            const userPermission = userInfo !== undefined && userInfo.permission !== '' ? JSON.parse(userInfo.permission) : null;
            if (userPermission !== null && userPermission.other !== undefined && userPermission.other.indexOf('1') !== -1) {
                return userInfo.unit_sign_path ? userInfo.unit_sign_path.split('&%&') : [];
            }
            const info = await this.ctx.service.constructionUnit.getDataByCondition({ pid: userInfo.project_id, name: userInfo.company });
            if (!info || info.sign_permission === 0) {
                return [];
            }
            return info.sign_path ? info.sign_path.split('&%&') : []; // 多个签章用&%&分隔
        }
    }

    return ProjectAccount;
};