namespace think;

// 1. PHP 版本检测
if(version_compare(PHP_VERSION,'8.1.0','<')) die('require PHP >= 8.1.0!');

// 2. 安装引导（首次访问跳转到 /install/）
if (is_dir(__DIR__ . '/install') && !is_file(__DIR__ . '/install/install.lock'))
    exit(header('Location:/install/'));

// 3. 引入 Composer 自动加载
require __DIR__ . '/../vendor/autoload.php';

// 4. 启动 HTTP 应用
$http = (new App())->http;
$response = $http->run();
$response->send();
$http->end($response);

abstract class BaseController
{
    protected $app;
    protected $request;
    protected $token = '';
    protected $tokenName = '__token__';
    protected $msgTpl = '';
    protected $memUser = [];   // 前台会员信息

    public function __construct(App $app)
    {
        $this->app = $app;
        $this->request = $this->app->request;
        $this->__home();   // 前台集中业务（站点开关、会员信息）
        $this->__auth();   // 验证（登录、权限）—— 子类覆盖
        $this->__init();   // 控制器初始化 —— 子类覆盖
    }

    protected function __home() {
        // 站点关闭开关
        if(vconfig('site_close'))
            $this->exitMsg(vconfig('site_close_tip','系统升级维护中'), 400);
        // 获取前台会员 Session
        $this->memUser = (array)session(VT_MEMBER);
    }

    protected function __auth(){}  // 空方法，等待子类覆盖
    protected function __init(){}  // 空方法，等待子类覆盖
}

// 菜单添加时的参数验证
$d = $this->only([
    '@token'=>'',                          // CSRF Token 验证
    '@catid/d',                            // catid 转整数，@表示不执行 strip_sql
    'menu_name/*/{2,20}/菜单名称',          // 必填，2-20位，默认字符集
    'role_name/*/{2,20}/权限名称',          // 必填，2-20位
    'link_url/u',                          // 网址净化
    'menu_url/u',
    'role_url/u',
    'icon/u',
    '@parent_id/d',                        // 转整数
    '@listorder/d',
    '@ismenu/d',
    '@state/d'
]);

abstract class AdminBase extends BaseController
{
    protected $manUser = [];    // 后台管理员信息
    protected $appMap = '';     // 映射路径（如 /admin）
    protected $routeUri = '';   // 当前路由 URI

    // 覆盖父类，后台不需要前台业务
    protected function __home(){}

    // 后台认证初始化
    protected final function __auth()
    {
        $this->appMap = VT_DIR . '/' . (array_search("admin", config('app.app_map')) ?: 'admin');
        $this->isLogin();           // 第1步：验证登录
        $this->loadMenusRoles();    // 第2步：载入权限菜单
        $this->routeUri = strtolower(...);  // 第3步：构建当前路由URI
        $this->isPower();           // 第4步：验证操作权限
    }
}

private function isLogin()
{
    if(is_null($this->manUser = session(VT_MANAGER))){
        $url = $this->appMap.'/login/index';
        if($this->request->isAjax()){
            $this->exitMsg('您还未登录或已过期，请先登录！', 401, ['url'=>$url]);
        }else{
            $this->redirect($url);  // 直接跳转登录页
        }
    }
}

private function loadMenusRoles()
{
    // 从数据库重新查询用户，验证 Session 中的密码和盐值是否匹配
    $us = Manager::one("username = '{$this->manUser['username']}' AND state > 0");
    if($us && $this->manUser['password'] == $us['password']
          && $this->manUser['passsalt'] == $us['passsalt']){

        // ★ 单设备登录检测：配置 ip_login 为 2 或 3 时开启
        if(in_array(vconfig('ip_login',0),[2,3]) && $us['loginip'] != $this->request->ip()){
            session(null);
            $this->exitMsg('您的帐号已在其他终端登录！', ...);
        }

        // 超级管理员(userid=1)直接通过，非超管载入角色权限
        $this->manUser = $us['userid']>1
            ? array_merge($us, Roles::cache($us['roleid']))  // 合并角色权限
            : $us;
    }else{
        session(null);
        $this->exitMsg('您还未登录或已过期，请先登录！', ...);
    }
}

protected function getRoleExt()
{
    if($this->manUser['userid'] == 1) return 0;  // 超管直接返回0
    $d = explode('/', $this->routeUri);
    // 优先级：addon/* > addon/controller/* > addon/controller/action
    if(isset($this->manUser['role_ext'][$d[0].'/*'])){
        return $this->manUser['role_ext'][$d[0].'/*'];
    }elseif(...){
        return $this->manUser['role_ext'][$d[0].'/'.$d[1].'/*'];
    }elseif(...){
        return $this->manUser['role_ext'][$d[0].'/'.$d[1].'/'.$d[2].'/*'];
    }else{
        return $this->manUser['role_ext'][$this->routeUri] ?? 0;
    }
}

public function check()
{
    // 1. IP 锁定检测（默认5次失败锁定30分钟）
    $ip = $this->request->ip();
    if(Lock::check(['key'=>'LOGIN_'.$ip]))
        return $this->returnMsg(Lock::msg());

    // 2. 参数验证（用户名+密码+验证码）
    $d = $this->only(['username/*/u/管理帐号','password/*/p/登录密码','captcha']);

    // 3. 验证码校验（可在后台关闭）
    if(vconfig('admin_captcha',1) && !captcha_check($d['captcha']))
        return $this->returnMsg('验证码错误！');

    // 4. 查询用户
    $rs = Manager::one(compact('username'));
    if(empty($rs)){
        LoginLog::add($username, $password, '', '账号错误');
        Lock::add();  // 记录失败次数
        return $this->returnMsg('帐号或密码错误！');
    }

    // 5. 状态检测
    if($rs->state == 0) return $this->returnMsg('帐号已被停用！');

    // 6. 密码验证（前端 MD5 传输 → 后端再 MD5 + salt）
    if($rs->password === set_password($password, $rs->passsalt)){
        // 更新登录信息
        $rs->logintime = time();
        $rs->loginip   = $ip;
        $rs->logins ++;
        $rs->save();

        $rs = $rs->toArray();
        $rs['uid'] = 'AM-'.uniqid();  // 生成会话编号

        LoginLog::add($username, $password, $rs['passsalt']);
        session(VT_MANAGER, $rs);  // 写入 Session
        Lock::del();               // 清除锁定

        return $this->returnMsg('登录成功！', 1, ['url'=>($this->appMap ?: '/')]);
    }

    LoginLog::add($username, $password, $rs['passsalt'], '密码错误');
    Lock::add();
    return $this->returnMsg('帐号或密码错误！');
}

// 默认配置：5次失败，锁定1800秒（30分钟）
private static $config = [
    'times' => 5, 'time' => 1800, 'tips' => '登录',
    'key' => 'ToolLock', 'msg' => '', 'add' => false
];

// 检查是否已锁定
public static function check(array $c = [])
{
    self::$config = array_merge(self::$config, $c);
    $data = Cache::get(self::$config['key']);
    if(isset($data['times']) && $data['times'] >= self::$config['times']
       && (time() - $data['time']) < self::$config['time']){
        self::$config['msg'] = '多次登录失败，您已被锁定'.(intval(self::$config['time']/60)).'分钟';
        return true;  // 已锁定
    }
    return false;
}

// 缓存键：VMENUS_1（后台菜单）、VMENUS_2（会员菜单）
public static function cache(int $s = 0, int $t = 1)
{
    $k = 'VMENUS_'.$t;
    $r = cache($k);
    if(!$r || $s){
        $r = self::where("type=$t")
            ->order(['parent_id'=>'asc','listorder'=>'asc','menuid'=>'asc'])
            ->column('menuid,menu_name,role_name,link_url,menu_url,role_url,icon,catid,parent_id,state', 'menuid');
        cache($k, $r);
    }
    return $r;
}

// 缓存键：VMENUS_1_角色ID
public static function cache(int|array $role, int $reset = 0)
{
    $roleid = is_array($role) ? $role['roleid'] : $role;
    $key = 'VMENUS_1_'.$roleid;
    $rs = cache($key);
    if(!$rs || $reset){
        $rs = [];
        $str = '';
        $ro = is_array($role) ? $role : self::where(['state'=>1,'roleid'=>$roleid])
            ->field('roleid,role_name,role_menuid,role_ext')->findOrEmpty()->toArray();

        if(!empty($ro) && $ro['role_menuid']){
            $ms = SystemMenus::cache();  // 获取全部后台菜单
            foreach ($ms as $k=>$v){
                // 检查菜单ID是否在角色的 menuid 串中
                if(strpos(",$ro[role_menuid],", ",$k,") !== false){
                    $str .= $v['role_url'] ? ','.$v['role_url'] : '';
                }
            }
        }

        // 构建 actions 数组（用于权限校验）
        $rs['actions'] = explode(',', trim($str, ','));

        // 解析 role_ext（扩展权限）
        if($ro['role_ext']){
            $arr = explode("\n", $ro['role_ext']);
            $ro['role_ext'] = [];
            foreach($arr as $v){
                $ks = explode('=', $v);
                $ro['role_ext'][$ks[0]] = $ks[1] ?? 0;
            }
        }else{
            $ro['role_ext'] = [];
        }

        $rs = array_merge($ro, $rs);
        cache($key, $rs, 31536000);  // 缓存1年
    }
    return $rs;
}

public static function getMenus(array $data = [])
{
    $arr = []; $str = ',';
    if(isset($data['userid'])){
        $tp = 1; $md = $data['role_menuid'];  // 后台菜单
        $userid = $data['userid'];
        $data = self::cache(0, $tp);  // 全部后台菜单

        foreach($data as $k=>$v){
            // 非超管且菜单不在权限范围内 → 跳过
            $flag = (($userid>1 || $tp==2) && strpos(",$md,", ",$k,")===false);
            if(!$flag && $v['role_url'])
                $str .= $v['role_url'].',';  // 收集权限URL
            if(!$v['state'] || $flag) continue;

            $arr[] = [
                'id'     => $v['menuid'],
                'icon'   => $v['icon'],
                'name'   => $v['menu_name'],
                'catid'  => $v['catid'],
                'pid'    => $v['parent_id'],
                'url'    => $v['menu_url'] ? '#/'.$v['menu_url'] : '',
                'iframe' => $v['link_url']
            ];
        }
    }
    return ['menus'=>$arr, 'roles'=>$str];
}

'jwt' => [
    'algorithms'         => 'HS256',           // 签名算法
    'access_secret_key'  => '86433bf7adb7...',  // access 令牌密钥
    'refresh_secret_key' => '1713a24f7b11...',  // refresh 令牌密钥
    'access_exp'         => 7200,              // access 有效期 2小时
    'refresh_exp'        => 604800,            // refresh 有效期 7天
    'refresh_off'        => false,             // 是否禁用 refresh
    'iss'                => 'veitool',         // 签发者
    'nbf'                => 0,                 // 生效延迟
    'leeway'             => 60,                // 时钟偏差容忍
    'single_device_on'   => false,             // 单设备登录开关
    'cache_token_ttl'    => 604800,            // 缓存令牌TTL
    'cache_token_a_pre'  => 'JWT:TOKEN:',      // access 缓存前缀
    'cache_token_r_pre'  => 'JWT:REFRESH_TOKEN:', // refresh 缓存前缀
    'get_token_on'       => false,             // 是否支持 GET 传 token
    'get_token_key'      => 'authorization',
],

public static function generateToken(array $extend): array
{
    if (!isset($extend['id'])) {
        throw new RuntimeException('扩展缺少关键参数:id');
    }
    $config = self::getConfig();
    $config['access_exp']  = $extend['access_exp'] ?? $config['access_exp'];
    $config['refresh_exp'] = $extend['refresh_exp'] ?? $config['refresh_exp'];

    $payload = self::getPayload($config, $extend);  // 构建 JWT 载荷
    $secrets = self::getPrivateKey($config);        // 获取签名密钥

    // 生成 access_token
    $token = [
        'token_type'   => 'Bearer',
        'expires_in'   => $config['access_exp'],
        'access_token' => self::makeToken($payload['accessPayload'], $secrets['accessKey'], $config['algorithms'])
    ];

    // 生成 refresh_token
    if (!$config['refresh_off']) {
        $token['refresh_token'] = self::makeToken($payload['refreshPayload'], $secrets['refreshKey'], $config['algorithms']);
    }

    // 单设备登录：缓存 token 到 Redis
    if ($config['single_device_on']) {
        self::saveStoreToken($config, $extend, $token);
    }
    return $token;
}

private static function getPayload(array $config, array $extend): array
{
    $time = time();
    $basePayload = [
        'iss'    => $config['iss'],       // 签发者
        'aud'    => $config['iss'],       // 接收方
        'iat'    => $time,                // 签发时间
        'nbf'    => $time + ($config['nbf'] ?? 0), // 生效时间
        'exp'    => $time + $config['access_exp'], // 过期时间
        'extend' => $extend               // ★ 自定义扩展数据
    ];
    $resPayLoad['accessPayload'] = $basePayload;

    // refresh_token 使用更长的过期时间
    $basePayload['exp'] = $time + $config['refresh_exp'];
    $basePayload['extend']['access_exp'] = $config['refresh_exp'];
    $resPayLoad['refreshPayload'] = $basePayload;

    return $resPayLoad;
}

public static function verify(int $tokenType = 1, string $token = '', array $config = []): array
{
    $config = $config ?: self::getConfig();
    $token  = $token ?: self::getTokenFromHeaders($config);  // 从 Header 获取
    $pubKey = self::getPublicKey($config, $tokenType);

    try {
        JWT::$leeway = $config['leeway'];
        $decoded = JWT::decode($token, new Key($pubKey, $config['algorithms']));
    } catch (BeforeValidException $b) {
        throw new RuntimeException('身份令牌未生效，请稍后再试', 401011);
    } catch (ExpiredException $e) {
        throw new RuntimeException('身份令牌已过期，请重新登录', 401012);
    } catch (SignatureInvalidException $e) {
        throw new RuntimeException('身份令牌无效', 401013);
    } catch (Exception $e) {
        throw new RuntimeException('令牌错误：'. $e->getMessage(), 401014);
    }

    // 验证扩展字段
    if (!isset($decoded->extend) || empty($decoded->extend)) {
        throw new RuntimeException('身份令牌扩展字段不存在', 401015);
    }

    $decodeToken = json_decode(json_encode($decoded), true);

    // 单设备登录：检查 Redis 中的 token 是否匹配
    if ($config['single_device_on']) {
        $cacheTokenPre = $tokenType == 1 ? $config['cache_token_a_pre'] : $config['cache_token_r_pre'];
        $client = $decodeToken['extend']['client'] ?? self::TOKEN_CLIENT_WEB;
        StoreToken::verifyToken($cacheTokenPre, $client, (string)$decodeToken['extend']['id'], $token);
    }
    return $decodeToken;
}

public static function refreshToken(array &$_extend = []): array
{
    $config  = self::getConfig();
    $extend  = self::verify(2, '', $config);    // 先验证 refresh_token
    $_extend = $extend['extend'];                // 更新外部扩展指针

    $payload = self::getPayload($config, $extend['extend']);
    $secrets = self::getPrivateKey($config);

    // 计算 refresh_token 剩余时长，保持不过期
    if (($times = $extend['exp'] - time()) > 0) {
        $payload['refreshPayload']['exp'] = $extend['exp'];
        $payload['refreshPayload']['extend']['access_exp'] = $times;
        $config['refresh_exp'] = $times;
    }

    $newToken['access_token'] = self::makeToken(...);
    if (!$config['refresh_off']) {
        $newToken['refresh_token'] = self::makeToken(...);
    }
    // 更新 Redis 缓存
    if ($config['single_device_on']) {
        self::saveStoreToken($config, $extend, $newToken);
    }
    return $newToken;
}

class StoreToken
{
    // 缓存 token：JWT:TOKEN:WEB:1 → access_token
    public static function saveToken(string $pre, string $client, string $uid, int $ttl, string $token)
    {
        $cacheKey = self::generateKey($pre, $client, $uid);
        Cache::store('redis')->set($cacheKey, $token, $ttl + (int)config('veitool.jwt.leeway', 0));
    }

    // 验证 token：如果 Redis 中的 token 与当前请求的不同 → 已在其他设备登录
    public static function verifyToken(string $pre, string $client, string $uid, string $token): bool
    {
        $cacheKey = self::generateKey($pre, $client, $uid);
        $ttl = Cache::store('redis')->handler()->ttl($cacheKey);
        if ($ttl === -2 || $ttl === 0) {
            throw new RuntimeException('该帐号身份已过期，请重新登录.', 401012);
        } elseif (Cache::store('redis')->get($cacheKey) != $token) {
            throw new RuntimeException('该帐号已在其他设备登录，强制下线.', 401016);
        }
        return true;
    }

    private static function generateKey(string $pre, string $client, string $uid): string
    {
        return sprintf('%s%s:%s', $pre, $client, $uid);
    }
}

public function login()
{
    // ... 验证账号密码（与后台登录逻辑一致）...

    // 生成 JWT Token
    $access_exp = config('veitool.jwt.access_exp', 7200);
    $token = JwtToken::generateToken([
        'access_exp' => $access_exp,
        'username'   => $rs->username,
        'uid'        => $rs->uid,       // 会话编号
        'id'         => $rs->userid,    // 用户ID（关键：单设备登录的依据）
        'type'       => $d['type'],     // pc|h5|app
        'plat'       => 'veitool',
    ]);

    return $this->returnMsg('登录成功！', 1, ['token' => $token, 'access_exp' => $access_exp]);
}

class DataEncryptor
{
    // RSA 解密（用私钥解密前端用公钥加密的数据）
    public static function rsaDecrypt(?string $data) : string
    {
        $private_key = config('veitool.rsa_pri_key');
        $private_key = openssl_pkey_get_private($private_key);
        openssl_private_decrypt(base64_decode($data), $decrypted, $private_key);
        return $decrypted;
    }

    // AES-256-CBC 加密
    public static function aesEncrypt($data, string $key, string $iv) : string
    {
        $data = json_encode($data);
        $data = openssl_encrypt($data, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);
        return base64_encode($data);
    }

    // AES-256-CBC 解密
    public static function aesDecrypt(?string $data, string $key, string $iv) : array
    {
        $data = base64_decode($data);
        $data = openssl_decrypt($data, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);
        $data = json_decode($data, true);
        return self::formatJsonToArray($data);
    }

    // 处理带标号的同名键（如 items[0], items[1] → items 数组）
    public static function formatJsonToArray(array $arr) : array
    {
        foreach($arr as $key => $value){
            if(preg_match('/^(\w+)\[(\d+)\]$/', $key, $match)){
                $arr[$match[1]][] = $value;
                unset($arr[$key]);
            }
        }
        return $arr;
    }
}

// config/veitool.php
'rsa_pri_key' => <<<EOF
-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDScXb6...
-----END PRIVATE KEY-----
EOF,
'rsa_pub_key' => <<<EOF
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0nF2+iIO06SQKBz1...
-----END PUBLIC KEY-----
EOF,

class Base extends Model
{
    protected $createTime = 'add_time';      // 创建时间字段
    protected $updateTime = 'upd_time';      // 更新时间字段
    protected $deleteTime = 'del_time';      // 删除时间字段
    protected $hidden = ['del_time'];        // 隐藏字段
    protected $readonly = ['add_time'];      // 只读字段
    protected $defaultSoftDelete = 0;        // 软删除默认值

    // 获取单条数据
    public static function one(string|array $where = '', string $field = '*', string|array $order = [])
    {
        return self::where($where)->field($field)->order($order)->find();
    }

    // 获取多条数据
    public static function all(string|array $where = '', string $field = '*', string|array $order = [])
    {
        return self::where($where)->field($field)->order($order)->select();
    }

    // 删除数据（支持软删除和真删除）
    public static function del(mixed $where, bool $force = false)
    {
        if(empty($where) && 0 !== $where) return false;

        $query = (new static())->db();
        if($force) $query->removeOption('soft_delete');  // 真删

        // 支持多种 where 格式：字符串、键值对、闭包、主键
        if((is_string($where) && strpos($where, ' ') !== false)
           || (is_array($where) && key($where) !== 0)){
            $query->where($where);
            $where = [];
        }elseif($where instanceof \Closure){
            call_user_func_array($where, [&$query]);
            $where = [];
        }

        $result = $query->select((array)$where);
        $i = 0;
        foreach($result as $rs){
            $i += $rs->force($force)->delete();
        }
        return $i;
    }

    // 事务支持
    public static function beginTrans() { Db::startTrans(); }
    public static function commitTrans() { Db::commit(); }
    public static function rollbackTrans() { Db::rollback(); }
    public static function checkTrans(bool|int $res = false) {
        $res ? self::commitTrans() : self::rollbackTrans();
    }
}

class Menus extends AdminBase
{
    // 菜单列表（异步JSON）
    public function index(string $do = '')
    {
        if($do=='json'){
            $catid = $this->request->get('catid/d',0);
            return $this->returnMsg(
                M::where("type=1 AND catid=$catid")
                 ->order(['listorder'=>'asc','menuid'=>'asc'])->select()
            );
        }
        $this->assign(['category' => json_encode(C::catList('01',0,'title,catid'))]);
        return $this->fetch();
    }

    // 菜单添加
    public function add()
    {
        $d = $this->only(['@token'=>'','@catid/d','menu_name/*/{2,20}/菜单名称',
            'role_name/*/{2,20}/权限名称','link_url/u','menu_url/u','role_url/u',
            'icon/u','@parent_id/d','@listorder/d','@ismenu/d','@state/d']);
        $d['creator'] = $this->manUser['username'];
        M::create($d);
        M::cache(1);  // 刷新菜单缓存
        return $this->returnMsg("添加菜单成功", 1);
    }

    // 快速编辑（行内编辑）
    public function edit(string $do = '')
    {
        if($do=='up'){
            // 快编模式：只更新单个字段
            $value = $d['av'];
            $field = $d['af'];
            if(!in_array($field,['menu_name','menu_url','role_url','link_url','listorder','ismenu','state']))
                return $this->returnMsg("参数错误");
            // ...
            $Myobj->save([$field=>$value]);
            M::cache(1);
        }else{
            // 完整编辑
            $Myobj->save($d);
            M::cache(1);
        }
    }
}

class Roles extends AdminBase
{
    // 角色权限树JSON（zTree 格式）
    public function index(string $do = '')
    {
        if($do=='mjson'){
            $roleid = $this->request->get('roleid/d');
            $ids = '';
            if($roleid){
                $rs = R::one(['roleid'=>$roleid]);
                $ids = empty($rs) ? '' : $rs['role_menuid'];
            }
            $rs = SystemMenus::cache();
            $data = [];
            foreach($rs as $v){
                $flag = (strpos(",$ids,", ",$v[menuid],")!==false) ? true : false;
                $data[] = [
                    'id'=>$v['menuid'], 'pId'=>$v['parent_id'],
                    'name'=>$v['role_name'].' '.$v['role_url'],
                    'checked'=>$flag, 'open'=>true
                ];
            }
            return $this->returnMsg($data);
        }
        // ...
    }

    // 角色添加
    public function add()
    {
        $d = $this->only(['@token'=>'','role_name/*/{2,30}/角色名称',
            '@listorder/d','@state/d','role_menuid','role_ext']);
        // menuid 数组转逗号串
        $d['role_menuid'] = is_array($d['role_menuid'])
            ? implode(',', array_map('intval', $d['role_menuid'])) : '';
        $d['creator'] = $this->manUser['username'];
        $obj = R::create($d);
        // 立即缓存角色权限
        R::cache(['roleid'=>$obj->roleid,'role_name'=>$d['role_name'],
            'role_menuid'=>$d['role_menuid'],'role_ext'=>$d['role_ext']], 1);
        return $this->returnMsg("添加成功", 1);
    }
}

class Manager extends AdminBase
{
    // 管理员列表（带数据权限控制）
    public function index(string $do = '', string $action = '')
    {
        if($action=='info'){  // 个人中心
            // ...
        }elseif($action=='role'){  // 角色切换
            $roleid = $this->request->get('roleid/d');
            if($roleid!=$this->manUser['roleid']
               && in_array($roleid, explode(',', $this->manUser['roleids']))){
                M::update(['userid'=>$this->manUser['userid'],'roleid'=>$roleid]);
            }
            return $this->redirect($this->appMap);
        }
        if($do=='json'){
            // ★ 数据权限：getRoleExt() 返回0表示全部可见，返回1表示只能看自己
            $where = [[],[['username', '=', $this->manUser['username']]]];
            return $this->returnMsg(
                (new M())->listQuery($where[$this->getRoleExt()] ?? [], 'password,passsalt,token')
            );
        }
        // ...
    }

    // 用户添加
    public function add()
    {
        $d = $this->only(['@token'=>'','username/*/u/管理帐号','password/*/p/登录密码',
            '@groupid/d/请选择所属机构','roleids/*/i/请选择所属角色',
            'truename/?/n','mobile/?/m','email/?/e']);
        if(M::one(['username'=>$d['username']])) return $this->returnMsg("该用户帐号已经存在");
        $d["passsalt"] = random(8);                              // 生成随机盐
        $d["password"] = set_password($d["password"],$d["passsalt"]);
        $d["roleid"]   = explode(",",$d['roleids'])[0];          // 多角色取第一个为当前角色
        $d["creator"]  = $this->manUser['username'];
        M::create($d);
        return $this->returnMsg("添加用户成功", 1);
    }

    // 重置密码
    public function resetpwd()
    {
        $d = $this->only(['@token'=>'','@userid/d/参数错误','newPassword/*/p/新登录密码']);
        if($d["userid"]==1) return $this->returnMsg('超级管理员禁止重置密码');
        // 权限扩展检查
        if($d["userid"] != $this->manUser['userid'] && $this->getRoleExt() == 1)
            return $this->returnMsg("您没有重置其他用户密码的权限");
        $d["passsalt"] = random(8);
        $d["password"] = set_password($d["newPassword"],$d["passsalt"]);
        unset($d["newPassword"]);
        M::update($d);
        return $this->returnMsg("重置密码成功", 1);
    }
}

class Setting extends AdminBase
{
    // 设置首页
    public function index(string $do = '')
    {
        $groups = vconfig('sys_group',[]);  // 配置分组
        if($do=='json'){
            $group = $this->request->get('group', key($groups));
            $where[] = ['state','=',1];
            $where[] = ['addon','=',''];
            $where[] = ['group','=',strip_sql($group)];
            $rs = (new S())->listArray($where, 'name,title,value,type,options,private,relation,tips');

            // 根据配置类型预处理数据
            foreach($rs as &$v){
                if($v['type'] == 'images'){
                    $v['value'] = $v['value'] ? json_decode($v['value']) : [];
                }elseif($v['type'] == 'upfile'){
                    $v['filetype'] = $v['options']; $v['options'] = '';
                }elseif(in_array($v['type'], ['year','month','date','time','datetime'])){
                    $v['range'] = $v['options']; $v['options'] = '';
                }elseif($v['private']){
                    $v['value'] = half_replace($v['value']);  // 隐私字段脱敏
                }
                $v['placeholder'] = $v['tips'];
                if($v['options']) $v['options'] = parse_attr($v['options']);
            }
            return $this->returnMsg($rs, 1);
        }
        // ...
    }

    // 设置更新
    public function edit()
    {
        $d = $this->only(['@token'=>''], 'post', 'strip_sql', false);
        $group = $d['__g'] ?? 'system';
        // 查询该分组下的所有配置项
        $rs = (new S())->listArray($where, 'name,type,private');
        foreach($rs as $v){
            $name = $v['name'];
            if(in_array($name, ['sys_group','sys_type'])) continue;  // 关键配置不可改
            // 根据类型处理值
            if($v['type'] == 'checkbox'){
                $data['value'] = isset($d[$name]) ? implode(',', $d[$name]) : '';
            }elseif($v['type'] == 'images'){
                $data['value'] = isset($d[$name]) ? json_encode($d[$name]) : '';
            }else{
                $data['value'] = $d[$name] ?? 0;
                if($v['private'] && strpos($data['value'], '***') !== false) continue;  // 隐私含星号跳过
            }
            S::where("name='$name'")->update($data);
        }
        S::cache(1);  // 刷新配置缓存
        return $this->returnMsg("设置成功", 1);
    }
}

public static function cache(int $reset = 0)
{
    $key = 'VSETTING';
    $rs = cache($key);
    if(!$rs || $reset){
        $rs = self::getSetting();  // 从数据库读取全部配置
        cache($key, $rs);
    }
    return $rs;
}

public static function getSetting(string|null $name = null)
{
    $configs = self::column('value,type,name,addon');
    $result = [];
    foreach($configs as $config){
        // 根据类型解析值
        if($config['type'] == 'array'){
            $val = parse_attr($config['value']);
        }elseif($config['type'] == 'checkbox'){
            $val = $config['value']!='' ? explode(',', $config['value']) : [];
        }else{
            $val = $config['value'];
        }
        // 插件配置以 @插件名 为前缀
        if($config['addon']){
            $result['@'.$config['addon']][$config['name']] = $val;
        }else{
            $result[$config['name']] = $val;
        }
    }
    return is_null($name) ? $result : $result[$name];
}

function vconfig($name='', $default=''){
    static $_VCF = [];
    $_VCF = $_VCF ?: SystemSetting::cache();  // 首次调用加载缓存
    if($name){
        if(isset($_VCF[$name])){
            return $_VCF[$name];
        }
        // 支持 域.子域 格式（如 sys_group.title）
        $dt = explode('.', $name);
        if(isset($_VCF[$dt[0]])){
            $rs = $_VCF[$dt[0]];
            if(isset($dt[1])){
                $rs = $rs[$dt[1]] ?? $default;
            }
            return $rs;
        }
        // 插件配置：@插件名.键名
        return $default;
    }
    return $_VCF;  // 返回全部配置
}