record-life的API设计

// wrangler.toml
/*
name = "api-service"
main = "src/index.js"
compatibility_date = "2023-10-01"

[vars]
JWT_SECRET = "your-jwt-secret-key"

[[d1_databases]]
binding = "DB"
database_name = "your-database-name"
database_id = "your-database-id"
*/

export default {
  async fetch(request, env) {
    const corsHeaders = {
      'Access-Control-Allow-Origin': '*',
      'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
      'Access-Control-Allow-Headers': 'Content-Type, Authorization',
    };

    // 处理预检请求
    if (request.method === 'OPTIONS') {
      return new Response(null, { headers: corsHeaders });
    }

    const url = new URL(request.url);
    const path = url.pathname;
    const method = request.method;

    try {
      // 路由处理
      if (path.startsWith('/api/users')) {
        return handleUsers(request, env, corsHeaders);
      } else if (path.startsWith('/api/records')) {
        return handleRecords(request, env, corsHeaders);
      } else {
        return createResponse({ error: 'Not Found', message: 'API endpoint not found' }, 404, corsHeaders);
      }
    } catch (error) {
      console.error('API Error:', error);
      return createResponse({ error: 'Internal Server Error', message: error.message }, 500, corsHeaders);
    }
  }
};

// 统一响应格式
function createResponse(data, status = 200, corsHeaders = {}) {
  const headers = {
    'Content-Type': 'application/json',
    ...corsHeaders
  };
  
  return new Response(JSON.stringify({
    success: status >= 200 && status < 300,
    data: status >= 200 && status < 300 ? data : null,
    error: status >= 400 ? data : null,
    timestamp: new Date().toISOString()
  }), { status, headers });
}

// 身份验证中间件
async function authenticateAdmin(request, env) {
  const authHeader = request.headers.get('Authorization');
  
  if (!authHeader || !authHeader.startsWith('Basic ')) {
    throw new Error('Missing or invalid Authorization header');
  }

  try {
    const credentials = atob(authHeader.slice(6));
    const [account, password] = credentials.split(':');
    
    // 查询用户信息
    const user = await env.DB.prepare(
      'SELECT id, account, name, role, password FROM users WHERE account = ?'
    ).bind(account).first();

    if (!user) {
      throw new Error('User not found');
    }

    // 验证密码（这里假设密码已经加密存储，实际应该使用bcrypt等）
    if (user.password !== password) {
      throw new Error('Invalid password');
    }

    // 检查权限
    if (user.role !== 'admin') {
      throw new Error('Insufficient permissions. Admin role required');
    }

    return user;
  } catch (error) {
    throw new Error('Authentication failed: ' + error.message);
  }
}

// 用户相关API处理
async function handleUsers(request, env, corsHeaders) {
  const url = new URL(request.url);
  const userId = url.pathname.split('/')[3];
  const method = request.method;

  try {
    // 需要管理员权限的操作
    if (['POST', 'PUT', 'DELETE'].includes(method)) {
      await authenticateAdmin(request, env);
    }

    switch (method) {
      case 'GET':
        if (userId) {
          return await getUserById(env, userId, corsHeaders);
        } else {
          return await getAllUsers(env, url, corsHeaders);
        }
      
      case 'POST':
        return await createUser(request, env, corsHeaders);
      
      case 'PUT':
        if (!userId) {
          return createResponse({ error: 'Bad Request', message: 'User ID is required' }, 400, corsHeaders);
        }
        return await updateUser(request, env, userId, corsHeaders);
      
      case 'DELETE':
        if (!userId) {
          return createResponse({ error: 'Bad Request', message: 'User ID is required' }, 400, corsHeaders);
        }
        return await deleteUser(env, userId, corsHeaders);
      
      default:
        return createResponse({ error: 'Method Not Allowed' }, 405, corsHeaders);
    }
  } catch (error) {
    const statusCode = error.message.includes('Authentication failed') ? 401 : 
                      error.message.includes('Insufficient permissions') ? 403 : 
                      error.message.includes('Not found') ? 404 : 400;
    return createResponse({ error: 'Operation failed', message: error.message }, statusCode, corsHeaders);
  }
}

// 记录相关API处理
async function handleRecords(request, env, corsHeaders) {
  const url = new URL(request.url);
  const recordId = url.pathname.split('/')[3];
  const method = request.method;

  try {
    // 需要管理员权限的操作
    if (['POST', 'PUT', 'DELETE'].includes(method)) {
      await authenticateAdmin(request, env);
    }

    switch (method) {
      case 'GET':
        if (recordId) {
          return await getRecordById(env, recordId, corsHeaders);
        } else {
          return await getAllRecords(env, url, corsHeaders);
        }
      
      case 'POST':
        return await createRecord(request, env, corsHeaders);
      
      case 'PUT':
        if (!recordId) {
          return createResponse({ error: 'Bad Request', message: 'Record ID is required' }, 400, corsHeaders);
        }
        return await updateRecord(request, env, recordId, corsHeaders);
      
      case 'DELETE':
        if (!recordId) {
          return createResponse({ error: 'Bad Request', message: 'Record ID is required' }, 400, corsHeaders);
        }
        return await deleteRecord(env, recordId, corsHeaders);
      
      default:
        return createResponse({ error: 'Method Not Allowed' }, 405, corsHeaders);
    }
  } catch (error) {
    const statusCode = error.message.includes('Authentication failed') ? 401 : 
                      error.message.includes('Insufficient permissions') ? 403 : 
                      error.message.includes('Not found') ? 404 : 400;
    return createResponse({ error: 'Operation failed', message: error.message }, statusCode, corsHeaders);
  }
}

// 用户操作函数
async function getAllUsers(env, url, corsHeaders) {
  const page = parseInt(url.searchParams.get('page')) || 1;
  const limit = parseInt(url.searchParams.get('limit')) || 10;
  const offset = (page - 1) * limit;

  const { results } = await env.DB.prepare(
    'SELECT id, account, name, role, created_at, updated_at, extra_data FROM users LIMIT ? OFFSET ?'
  ).bind(limit, offset).all();

  const countResult = await env.DB.prepare('SELECT COUNT(*) as total FROM users').first();
  
  return createResponse({
    users: results,
    pagination: {
      page,
      limit,
      total: countResult.total,
      pages: Math.ceil(countResult.total / limit)
    }
  }, 200, corsHeaders);
}

async function getUserById(env, userId, corsHeaders) {
  const user = await env.DB.prepare(
    'SELECT id, account, name, role, created_at, updated_at, extra_data FROM users WHERE id = ?'
  ).bind(userId).first();

  if (!user) {
    return createResponse({ error: 'Not Found', message: 'User not found' }, 404, corsHeaders);
  }

  return createResponse(user, 200, corsHeaders);
}

async function createUser(request, env, corsHeaders) {
  const body = await request.json();
  
  // 验证必需字段
  if (!body.account || !body.password || !body.name) {
    return createResponse({ error: 'Bad Request', message: 'Account, password and name are required' }, 400, corsHeaders);
  }

  // 检查账号是否已存在
  const existingUser = await env.DB.prepare(
    'SELECT id FROM users WHERE account = ?'
  ).bind(body.account).first();

  if (existingUser) {
    return createResponse({ error: 'Conflict', message: 'Account already exists' }, 409, corsHeaders);
  }

  const result = await env.DB.prepare(
    'INSERT INTO users (account, password, name, role, extra_data) VALUES (?, ?, ?, ?, ?)'
  ).bind(
    body.account,
    body.password, // 实际应用中应该加密
    body.name,
    body.role || 'normal',
    body.extra_data ? JSON.stringify(body.extra_data) : null
  ).run();

  const newUser = await env.DB.prepare(
    'SELECT id, account, name, role, created_at, updated_at, extra_data FROM users WHERE id = ?'
  ).bind(result.meta.last_row_id).first();

  return createResponse(newUser, 201, corsHeaders);
}

async function updateUser(request, env, userId, corsHeaders) {
  const body = await request.json();
  
  // 检查用户是否存在
  const existingUser = await env.DB.prepare(
    'SELECT id FROM users WHERE id = ?'
  ).bind(userId).first();

  if (!existingUser) {
    return createResponse({ error: 'Not Found', message: 'User not found' }, 404, corsHeaders);
  }

  const updates = [];
  const bindings = [];
  
  if (body.account !== undefined) {
    updates.push('account = ?');
    bindings.push(body.account);
  }
  if (body.password !== undefined) {
    updates.push('password = ?');
    bindings.push(body.password); // 实际应用中应该加密
  }
  if (body.name !== undefined) {
    updates.push('name = ?');
    bindings.push(body.name);
  }
  if (body.role !== undefined) {
    updates.push('role = ?');
    bindings.push(body.role);
  }
  if (body.extra_data !== undefined) {
    updates.push('extra_data = ?');
    bindings.push(body.extra_data ? JSON.stringify(body.extra_data) : null);
  }
  
  if (updates.length === 0) {
    return createResponse({ error: 'Bad Request', message: 'No fields to update' }, 400, corsHeaders);
  }

  updates.push('updated_at = datetime(\'now\', \'localtime\')');
  bindings.push(userId);

  await env.DB.prepare(
    `UPDATE users SET ${updates.join(', ')} WHERE id = ?`
  ).bind(...bindings).run();

  const updatedUser = await env.DB.prepare(
    'SELECT id, account, name, role, created_at, updated_at, extra_data FROM users WHERE id = ?'
  ).bind(userId).first();

  return createResponse(updatedUser, 200, corsHeaders);
}

async function deleteUser(env, userId, corsHeaders) {
  // 检查用户是否存在
  const existingUser = await env.DB.prepare(
    'SELECT id FROM users WHERE id = ?'
  ).bind(userId).first();

  if (!existingUser) {
    return createResponse({ error: 'Not Found', message: 'User not found' }, 404, corsHeaders);
  }

  // 删除关联的记录
  await env.DB.prepare('DELETE FROM records WHERE creator_id = ?').bind(userId).run();

  // 删除用户
  await env.DB.prepare('DELETE FROM users WHERE id = ?').bind(userId).run();

  return createResponse({ message: 'User deleted successfully' }, 200, corsHeaders);
}

// 记录操作函数
async function getAllRecords(env, url, corsHeaders) {
  const page = parseInt(url.searchParams.get('page')) || 1;
  const limit = parseInt(url.searchParams.get('limit')) || 10;
  const offset = (page - 1) * limit;

  const { results } = await env.DB.prepare(`
    SELECT r.*, u.account as creator_account, u.name as creator_name 
    FROM records r 
    JOIN users u ON r.creator_id = u.id 
    ORDER BY r.created_at DESC 
    LIMIT ? OFFSET ?
  `).bind(limit, offset).all();

  const countResult = await env.DB.prepare('SELECT COUNT(*) as total FROM records').first();
  
  return createResponse({
    records: results,
    pagination: {
      page,
      limit,
      total: countResult.total,
      pages: Math.ceil(countResult.total / limit)
    }
  }, 200, corsHeaders);
}

async function getRecordById(env, recordId, corsHeaders) {
  const record = await env.DB.prepare(`
    SELECT r.*, u.account as creator_account, u.name as creator_name 
    FROM records r 
    JOIN users u ON r.creator_id = u.id 
    WHERE r.id = ?
  `).bind(recordId).first();

  if (!record) {
    return createResponse({ error: 'Not Found', message: 'Record not found' }, 404, corsHeaders);
  }

  return createResponse(record, 200, corsHeaders);
}

async function createRecord(request, env, corsHeaders) {
  const body = await request.json();
  
  // 验证必需字段
  if (body.creator_id === undefined) {
    return createResponse({ error: 'Bad Request', message: 'Creator ID is required' }, 400, corsHeaders);
  }

  // 验证创建者是否存在
  const creator = await env.DB.prepare(
    'SELECT id FROM users WHERE id = ?'
  ).bind(body.creator_id).first();

  if (!creator) {
    return createResponse({ error: 'Bad Request', message: 'Creator not found' }, 400, corsHeaders);
  }

  const result = await env.DB.prepare(
    'INSERT INTO records (creator_id, content_text, content_media, extra_data) VALUES (?, ?, ?, ?)'
  ).bind(
    body.creator_id,
    body.content_text || null,
    body.content_media ? (Array.isArray(body.content_media) ? JSON.stringify(body.content_media) : body.content_media) : null,
    body.extra_data ? JSON.stringify(body.extra_data) : null
  ).run();

  const newRecord = await env.DB.prepare(`
    SELECT r.*, u.account as creator_account, u.name as creator_name 
    FROM records r 
    JOIN users u ON r.creator_id = u.id 
    WHERE r.id = ?
  `).bind(result.meta.last_row_id).first();

  return createResponse(newRecord, 201, corsHeaders);
}

async function updateRecord(request, env, recordId, corsHeaders) {
  const body = await request.json();
  
  // 检查记录是否存在
  const existingRecord = await env.DB.prepare(
    'SELECT id FROM records WHERE id = ?'
  ).bind(recordId).first();

  if (!existingRecord) {
    return createResponse({ error: 'Not Found', message: 'Record not found' }, 404, corsHeaders);
  }

  const updates = [];
  const bindings = [];
  
  if (body.creator_id !== undefined) {
    updates.push('creator_id = ?');
    bindings.push(body.creator_id);
  }
  if (body.content_text !== undefined) {
    updates.push('content_text = ?');
    bindings.push(body.content_text);
  }
  if (body.content_media !== undefined) {
    updates.push('content_media = ?');
    bindings.push(body.content_media ? (Array.isArray(body.content_media) ? JSON.stringify(body.content_media) : body.content_media) : null);
  }
  if (body.extra_data !== undefined) {
    updates.push('extra_data = ?');
    bindings.push(body.extra_data ? JSON.stringify(body.extra_data) : null);
  }
  
  if (updates.length === 0) {
    return createResponse({ error: 'Bad Request', message: 'No fields to update' }, 400, corsHeaders);
  }

  updates.push('updated_at = datetime(\'now\', \'localtime\')');
  bindings.push(recordId);

  await env.DB.prepare(
    `UPDATE records SET ${updates.join(', ')} WHERE id = ?`
  ).bind(...bindings).run();

  const updatedRecord = await env.DB.prepare(`
    SELECT r.*, u.account as creator_account, u.name as creator_name 
    FROM records r 
    JOIN users u ON r.creator_id = u.id 
    WHERE r.id = ?
  `).bind(recordId).first();

  return createResponse(updatedRecord, 200, corsHeaders);
}

async function deleteRecord(env, recordId, corsHeaders) {
  // 检查记录是否存在
  const existingRecord = await env.DB.prepare(
    'SELECT id FROM records WHERE id = ?'
  ).bind(recordId).first();

  if (!existingRecord) {
    return createResponse({ error: 'Not Found', message: 'Record not found' }, 404, corsHeaders);
  }

  // 删除记录
  await env.DB.prepare('DELETE FROM records WHERE id = ?').bind(recordId).run();

  return createResponse({ message: 'Record deleted successfully' }, 200, corsHeaders);
}

这个Cloudflare Workers代码提供了完整的API服务，具有以下特性：

主要功能：

1. 完整的CRUD操作：支持users和records表的增删改查
2. 权限控制：DELETE、PUT、POST操作需要管理员权限验证
3. 身份验证：基于Basic Auth的账号密码验证
4. 统一响应格式：包含成功状态、数据、错误信息和时间戳
5. CORS支持：自动添加跨域请求头
6. 分页支持：GET请求支持分页参数
7. 错误处理：完善的错误处理和状态码返回

API端点：

Users API

• GET /api/users - 获取所有用户（分页）
• GET /api/users/{id} - 获取指定用户
• POST /api/users - 创建用户（需要管理员权限）
• PUT /api/users/{id} - 更新用户（需要管理员权限）
• DELETE /api/users/{id} - 删除用户（需要管理员权限）

Records API

• GET /api/records - 获取所有记录（分页）
• GET /api/records/{id} - 获取指定记录
• POST /api/records - 创建记录（需要管理员权限）
• PUT /api/records/{id} - 更新记录（需要管理员权限）
• DELETE /api/records/{id} - 删除记录（需要管理员权限）

使用说明：

1. 在Cloudflare Workers中部署此代码
2. 配置D1数据库绑定
3. 设置环境变量（如JWT_SECRET）
4. 使用Basic Auth进行API调用（账号密码需在users表中存在且role为admin）