app.py

from flask import Flask, render_template, request, redirect, url_for, flash, session
from flask_sqlalchemy import SQLAlchemy
from datetime import datetime, timedelta
from functools import wraps
import secrets
import sys
import os
import webbrowser
import threading

app = Flask(__name__)
app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///library.db'
app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
app.config['SECRET_KEY'] = 'your-secret-key-here'

db = SQLAlchemy(app)


# ==================== 数据库模型定义 ====================
class Book(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    title = db.Column(db.String(100), nullable=False)
    author = db.Column(db.String(50))
    isbn = db.Column(db.String(20))
    quantity = db.Column(db.Integer, default=1)
    available = db.Column(db.Integer, default=1)


# 用户模型
class User(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(50), unique=True, nullable=False)
    password = db.Column(db.String(100), nullable=False)
    real_name = db.Column(db.String(50), nullable=False)
    phone = db.Column(db.String(20))
    email = db.Column(db.String(100))
    created_date = db.Column(db.DateTime, default=datetime.now)
    is_active = db.Column(db.Boolean, default=True)
    is_admin = db.Column(db.Boolean, default=False)
    is_super_admin = db.Column(db.Boolean, default=False)
    borrows = db.relationship('Borrow', backref='user', lazy=True)


class AdminSettings(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    setting_key = db.Column(db.String(50), unique=True, nullable=False)
    setting_value = db.Column(db.String(200), nullable=False)
    description = db.Column(db.String(200))


class Borrow(db.Model):
    __tablename__ = 'borrow'
    id = db.Column('borrow_id', db.Integer, primary_key=True)
    book_id = db.Column('borrow_book_id', db.Integer, db.ForeignKey('book.id'))
    user_id = db.Column('borrow_user_id', db.Integer, db.ForeignKey('user.id'))
    borrower_name = db.Column('borrow_borrower_name', db.String(50))
    borrow_date = db.Column('borrow_borrow_date', db.DateTime, default=datetime.now)
    due_date = db.Column('borrow_due_date', db.DateTime)
    return_date = db.Column('borrow_return_date', db.DateTime, nullable=True)

    book = db.relationship('Book', backref='borrows')


class Blacklist(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    borrower_name = db.Column(db.String(50), unique=True, nullable=False)
    reason = db.Column(db.String(200))
    created_date = db.Column(db.DateTime, default=datetime.now)


class RetiredBook(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    title = db.Column(db.String(100), nullable=False)
    author = db.Column(db.String(50))
    isbn = db.Column(db.String(20))
    original_quantity = db.Column(db.Integer)
    retired_date = db.Column(db.DateTime, default=datetime.now)
    reason = db.Column(db.String(200), default="长期未借阅")


# ==================== 登录和权限验证装饰器 ====================
def login_required(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        if 'user_id' not in session:
            flash('请先登录！', 'warning')
            return redirect(url_for('login'))
        return f(*args, **kwargs)

    return decorated_function


def admin_required(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        if 'user_id' not in session:
            flash('请先登录！', 'warning')
            return redirect(url_for('login'))

        user = User.query.get(session['user_id'])
        if not user or not user.is_active:
            flash('账号已被禁用！', 'danger')
            session.clear()
            return redirect(url_for('login'))

        if not user.is_admin and not user.is_super_admin:
            flash('需要管理员权限！', 'danger')
            return redirect(url_for('home'))

        return f(*args, **kwargs)

    return decorated_function


def super_admin_required(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        if 'user_id' not in session:
            flash('请先登录！', 'warning')
            return redirect(url_for('login'))

        user = User.query.get(session['user_id'])
        if not user or not user.is_active:
            flash('账号已被禁用！', 'danger')
            session.clear()
            return redirect(url_for('login'))

        if not user.is_super_admin:
            flash('需要超级管理员权限！', 'danger')
            return redirect(url_for('admin_dashboard'))

        return f(*args, **kwargs)

    return decorated_function


# ==================== 初始化函数 ====================

def init_database():
    with app.app_context():
        db.create_all()

        # 创建默认的超级管理员（如果不存在）
        super_admin = User.query.filter_by(is_super_admin=True).first()
        if not super_admin:
            default_password = "admin123"  # 使用简单密码便于测试
            super_admin = User(
                username='superadmin',
                password=default_password,
                real_name='系统超级管理员',
                is_admin=True,
                is_super_admin=True
            )
            db.session.add(super_admin)
            db.session.commit()
            print(f"超级管理员已创建！用户名: superadmin, 密码: {default_password}")
            print("请立即登录并修改密码！")

        # 添加一个测试管理员（便于测试）
        test_admin = User.query.filter_by(username='testadmin').first()
        if not test_admin:
            test_admin = User(
                username='testadmin',
                password='test123',
                real_name='测试管理员',
                is_admin=True,
                is_super_admin=False
            )
            db.session.add(test_admin)
            db.session.commit()
            print(f"测试管理员已创建！用户名: testadmin, 密码: test123")

        print("数据库已初始化！")


# ==================== 路由定义 ====================
@app.route('/')
def home():
    is_logged_in = 'user_id' in session
    return render_template('home.html', is_logged_in=is_logged_in, session=session)


@app.route('/login', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        username = request.form['username'].strip()
        password = request.form['password'].strip()

        user = User.query.filter_by(username=username, password=password).first()

        if user:
            if not user.is_active:
                flash('该账号已被禁用！', 'danger')
                return render_template('login.html')

            session['user_id'] = user.id
            session['username'] = user.username
            session['real_name'] = user.real_name
            session['is_admin'] = user.is_admin
            session['is_super_admin'] = user.is_super_admin

            flash(f'欢迎回来，{user.real_name}！', 'success')

            if user.is_admin or user.is_super_admin:
                return redirect(url_for('admin_dashboard'))
            else:
                return redirect(url_for('home'))
        else:
            flash('用户名或密码错误！', 'danger')
            return render_template('login.html')

    return render_template('login.html')


@app.route('/logout')
def logout():
    session.clear()
    flash('您已成功退出登录！', 'info')
    return redirect(url_for('home'))


@app.route('/register', methods=['GET', 'POST'])
def register():
    if request.method == 'POST':
        try:
            username = request.form['username'].strip()
            password = request.form['password'].strip()
            real_name = request.form['real_name'].strip()
            phone = request.form.get('phone', '').strip()
            email = request.form.get('email', '').strip()

            if not all([username, password, real_name]):
                flash('用户名、密码和真实姓名不能为空！', 'danger')
                return render_template('register.html')

            if User.query.filter_by(username=username).first():
                flash('用户名已存在！', 'warning')
                return render_template('register.html')

            new_user = User(
                username=username,
                password=password,
                real_name=real_name,
                phone=phone if phone else None,
                email=email if email else None
            )

            db.session.add(new_user)
            db.session.commit()
            flash('注册成功！请登录。', 'success')
            return redirect(url_for('login'))

        except Exception as e:
            db.session.rollback()
            flash('注册时发生错误！', 'danger')
            print(f"Error: {e}")
            return render_template('register.html')

    return render_template('register.html')


# 管理员路由
@app.route('/admin')
@admin_required
def admin_dashboard():
    total_books = Book.query.count()
    total_users = User.query.count()
    active_borrows = Borrow.query.filter_by(return_date=None).count()
    return render_template('admin/dashboard.html',
                           total_books=total_books,
                           total_users=total_users,
                           active_borrows=active_borrows)


@app.route('/admin/books')
@admin_required
def admin_books():
    books = Book.query.all()
    return render_template('admin/books.html', books=books)


@app.route('/admin/add_book', methods=['GET', 'POST'])
@admin_required
def add_book():
    if request.method == 'POST':
        try:
            title = request.form['title'].strip()
            author = request.form.get('author', '').strip()
            isbn = request.form.get('isbn', '').strip()
            quantity_str = request.form['quantity']

            if not title:
                flash('书名不能为空！', 'danger')
                return render_template('admin/add_book.html')

            if not quantity_str.isdigit() or int(quantity_str) <= 0:
                flash('数量必须为正整数！', 'danger')
                return render_template('admin/add_book.html')

            quantity = int(quantity_str)

            existing_book = Book.query.filter_by(title=title).first()
            if existing_book:
                flash(f'书籍 "{title}" 已存在！', 'warning')
                return render_template('admin/add_book.html')

            new_book = Book(
                title=title,
                author=author if author else "未知作者",
                isbn=isbn if isbn else "无ISBN",
                quantity=quantity,
                available=quantity
            )

            db.session.add(new_book)
            db.session.commit()
            flash(f'书籍 "{title}" 添加成功！', 'success')
            return redirect(url_for('admin_books'))

        except Exception as e:
            db.session.rollback()
            flash('添加书籍时发生错误！', 'danger')
            print(f"Error: {e}")
            return render_template('admin/add_book.html')

    return render_template('admin/add_book.html')


@app.route('/admin/borrow')
@admin_required
def admin_borrow():
    borrow_records = Borrow.query.all()
    return render_template('admin/borrow.html', records=borrow_records)


@app.route('/admin/borrow_book', methods=['GET', 'POST'])
@admin_required
def borrow_book():
    if request.method == 'POST':
        try:
            user_id = int(request.form['user_id'])
            book_id = int(request.form['book_id'])
            due_days = int(request.form['due_days'])

            user = User.query.get(user_id)
            if not user:
                flash('用户不存在！', 'danger')
                return redirect(url_for('borrow_book'))

            if not user.is_active:
                flash('该用户账号已被禁用！', 'danger')
                return redirect(url_for('borrow_book'))

            if Blacklist.query.filter_by(borrower_name=user.real_name).first():
                flash('该用户已被禁止借书！', 'danger')
                return redirect(url_for('borrow_book'))

            current_borrows = Borrow.query.filter_by(user_id=user_id, return_date=None).count()
            if current_borrows >= 3:
                flash('该用户借书数量已达上限（3本）！', 'warning')
                return redirect(url_for('borrow_book'))

            book = Book.query.get(book_id)
            if not book:
                flash('书籍不存在！', 'danger')
                return redirect(url_for('borrow_book'))

            if book.available <= 0:
                flash('该书籍暂无库存！', 'warning')
                return redirect(url_for('borrow_book'))

            due_date = datetime.now() + timedelta(days=due_days)
            new_borrow = Borrow(
                book_id=book_id,
                user_id=user_id,
                borrower_name=user.real_name,
                due_date=due_date
            )
            book.available -= 1

            db.session.add(new_borrow)
            db.session.commit()
            flash('借阅成功！', 'success')
            return redirect(url_for('admin_borrow'))

        except ValueError:
            flash('请输入有效的数字！', 'danger')
            return redirect(url_for('borrow_book'))
        except Exception as e:
            db.session.rollback()
            flash('借阅过程中发生错误！', 'danger')
            print(f"Error: {e}")
            return redirect(url_for('borrow_book'))

    books = Book.query.filter(Book.available > 0).all()
    users = User.query.filter_by(is_active=True).all()
    return render_template('admin/borrow_book.html', books=books, users=users)

@app.route('/admin/return_book/<int:borrow_id>')
@admin_required
def return_book(borrow_id):
    borrow_record = Borrow.query.get(borrow_id)
    if borrow_record and not borrow_record.return_date:
        borrow_record.return_date = datetime.now()
        book = Book.query.get(borrow_record.book_id)
        if book:
            book.available += 1
        db.session.commit()
        flash('书籍归还成功！', 'success')
    return redirect(url_for('admin_borrow'))


@app.route('/admin/auto_retire_books')
@admin_required
def auto_retire_books():
    three_months_ago = datetime.now() - timedelta(days=90)
    all_books = Book.query.all()
    retired_count = 0

    for book in all_books:
        recent_borrow = Borrow.query.filter(
            Borrow.book_id == book.id,
            Borrow.borrow_date >= three_months_ago
        ).first()

        if not recent_borrow and book.available == book.quantity:
            retired_book = RetiredBook(
                title=book.title, author=book.author, isbn=book.isbn,
                original_quantity=book.quantity, reason="3个月内无借阅记录"
            )
            db.session.add(retired_book)
            db.session.delete(book)
            retired_count += 1

    db.session.commit()
    flash(f'已自动下架 {retired_count} 本长期未借阅的书籍', 'info')
    return redirect(url_for('retired_books'))


@app.route('/admin/manual_retire_book/<int:book_id>', methods=['GET', 'POST'])
@admin_required
def manual_retire_book(book_id):
    book = Book.query.get_or_404(book_id)

    if request.method == 'POST':
        reason = request.form.get('reason', '手动下架')
        if book.available != book.quantity:
            flash('该书籍还有未归还的副本，请先确保所有书籍已归还！', 'danger')
            return redirect(url_for('admin_books'))

        retired_book = RetiredBook(
            title=book.title, author=book.author, isbn=book.isbn,
            original_quantity=book.quantity, reason=reason
        )
        db.session.add(retired_book)
        db.session.delete(book)
        db.session.commit()
        flash('书籍下架成功！', 'success')
        return redirect(url_for('retired_books'))

    return render_template('admin/retire_book.html', book=book)


@app.route('/admin/retired_books')
@admin_required
def retired_books():
    retired_books = RetiredBook.query.order_by(RetiredBook.retired_date.desc()).all()
    return render_template('admin/retired_books.html', retired_books=retired_books)


@app.route('/admin/restore_book/<int:retired_id>')
@admin_required
def restore_book(retired_id):
    retired_book = RetiredBook.query.get_or_404(retired_id)

    if Book.query.filter_by(isbn=retired_book.isbn).first():
        flash('已存在相同ISBN的书籍，无法恢复！', 'warning')
        return redirect(url_for('retired_books'))

    new_book = Book(
        title=retired_book.title, author=retired_book.author, isbn=retired_book.isbn,
        quantity=retired_book.original_quantity, available=retired_book.original_quantity
    )
    db.session.add(new_book)
    db.session.delete(retired_book)
    db.session.commit()
    flash('书籍恢复成功！', 'success')
    return redirect(url_for('retired_books'))


@app.route('/admin/book_stats')
@admin_required
def book_stats():
    total_books = Book.query.count()
    available_books = db.session.query(db.func.sum(Book.available)).scalar() or 0
    borrowed_books = db.session.query(db.func.sum(Book.quantity - Book.available)).scalar() or 0
    retired_books = RetiredBook.query.count()

    oldest_borrows = db.session.query(
        Book, db.func.max(Borrow.borrow_date).label('last_borrow_date')
    ).outerjoin(Borrow).group_by(Book.id).order_by('last_borrow_date').limit(5).all()

    return render_template('admin/book_stats.html',
                           total_books=total_books,
                           available_books=available_books,
                           borrowed_books=borrowed_books,
                           retired_books=retired_books,
                           oldest_borrows=oldest_borrows)


@app.route('/admin/users')
@admin_required
def admin_users():
    users = User.query.all()
    return render_template('admin/users.html', users=users)


@app.route('/admin/user/<int:user_id>')
@admin_required
def user_detail(user_id):
    user = User.query.get_or_404(user_id)
    borrow_records = Borrow.query.filter_by(user_id=user_id).all()
    return render_template('admin/user_detail.html', user=user, borrow_records=borrow_records)


@app.route('/admin/toggle_user/<int:user_id>')
@admin_required
def toggle_user(user_id):
    user = User.query.get_or_404(user_id)
    user.is_active = not user.is_active
    db.session.commit()

    status = "启用" if user.is_active else "禁用"
    flash(f'用户 {user.real_name} 已{status}', 'success')
    return redirect(url_for('admin_users'))


@app.route('/admin/add_to_blacklist/<int:user_id>', methods=['POST'])
@admin_required
def add_to_blacklist(user_id):
    user = User.query.get_or_404(user_id)
    reason = request.form.get('reason', '违规借阅')

    if not Blacklist.query.filter_by(borrower_name=user.real_name).first():
        new_blacklist = Blacklist(borrower_name=user.real_name, reason=reason)
        db.session.add(new_blacklist)
        user.is_active = False
        db.session.commit()
        flash(f'用户 {user.real_name} 已被加入黑名单并禁用', 'danger')
    else:
        flash('该用户已在黑名单中', 'warning')

    return redirect(url_for('admin_users'))


# 移除黑名单的路由
@app.route('/admin/remove_from_blacklist/<string:borrower_name>')
@admin_required
def remove_from_blacklist(borrower_name):
    blacklist_entry = Blacklist.query.filter_by(borrower_name=borrower_name).first()

    if blacklist_entry:
        db.session.delete(blacklist_entry)
        db.session.commit()
        flash(f'已从黑名单中移除 {borrower_name}', 'success')
    else:
        flash('该用户不在黑名单中', 'warning')

    return redirect(url_for('admin_blacklist'))


# 黑名单管理页面
@app.route('/admin/blacklist')
@admin_required
def admin_blacklist():
    blacklist_entries = Blacklist.query.all()
    return render_template('admin/blacklist.html', blacklist_entries=blacklist_entries)


@app.route('/admin/manage_admins')
@super_admin_required
def manage_admins():
    admins = User.query.filter((User.is_admin == True) | (User.is_super_admin == True)).all()
    regular_users = User.query.filter_by(is_admin=False, is_super_admin=False).all()
    return render_template('admin/manage_admins.html',
                           admins=admins,
                           regular_users=regular_users)


@app.route('/admin/grant_admin/<int:user_id>')
@super_admin_required
def grant_admin(user_id):
    user = User.query.get_or_404(user_id)
    user.is_admin = True
    db.session.commit()
    flash(f'已授予 {user.real_name} 管理员权限', 'success')
    return redirect(url_for('manage_admins'))


@app.route('/admin/revoke_admin/<int:user_id>')
@super_admin_required
def revoke_admin(user_id):
    user = User.query.get_or_404(user_id)
    if not user.is_super_admin:
        user.is_admin = False
        db.session.commit()
        flash(f'已撤销 {user.real_name} 的管理员权限', 'info')
    else:
        flash('不能撤销超级管理员权限', 'warning')
    return redirect(url_for('manage_admins'))



# 管理员注册（只有超级管理员可以访问）
@app.route('/admin/register_admin', methods=['GET', 'POST'])
@super_admin_required
def register_admin():
    if request.method == 'POST':
        try:
            username = request.form['username'].strip()
            password = request.form['password'].strip()
            real_name = request.form['real_name'].strip()
            phone = request.form.get('phone', '').strip()
            email = request.form.get('email', '').strip()
            is_super_admin = 'is_super_admin' in request.form

            if not all([username, password, real_name]):
                flash('用户名、密码和真实姓名不能为空！', 'danger')
                return render_template('admin/register_admin.html')

            if User.query.filter_by(username=username).first():
                flash('用户名已存在！', 'warning')
                return render_template('admin/register_admin.html')

            new_admin = User(
                username=username,
                password=password,
                real_name=real_name,
                phone=phone if phone else None,
                email=email if email else None,
                is_admin=True,
                is_super_admin=is_super_admin
            )

            db.session.add(new_admin)
            db.session.commit()

            admin_type = "超级管理员" if is_super_admin else "管理员"
            flash(f'{admin_type} "{real_name}" 注册成功！', 'success')
            return redirect(url_for('manage_admins'))

        except Exception as e:
            db.session.rollback()
            flash('注册管理员时发生错误！', 'danger')
            print(f"Error: {e}")
            return render_template('admin/register_admin.html')

    return render_template('admin/register_admin.html')

@app.route('/user')
@login_required
def user_dashboard():
    user = User.query.get(session['user_id'])
    borrows = Borrow.query.filter_by(user_id=user.id).all()
    return render_template('user/dashboard.html', user=user, borrows=borrows)

@app.route('/user/borrow', methods=['GET', 'POST'])
@login_required
def user_borrow():
    user = User.query.get(session['user_id'])
    if request.method == 'POST':
        book_id = int(request.form['book_id'])
        due_days = int(request.form.get('due_days', 14))
        # 黑名单校验
        if Blacklist.query.filter_by(borrower_name=user.real_name).first():
            flash('您已被禁止借书！', 'danger')
            return redirect(url_for('user_borrow'))
        # 借阅上限校验
        current_borrows = Borrow.query.filter_by(user_id=user.id, return_date=None).count()
        if current_borrows >= 3:
            flash('借书数量已达上限（3本）！', 'warning')
            return redirect(url_for('user_borrow'))
        # 库存校验
        book = Book.query.get(book_id)
        if not book or book.available <= 0:
            flash('该书籍暂无库存！', 'warning')
            return redirect(url_for('user_borrow'))
        # 借书
        due_date = datetime.now() + timedelta(days=due_days)
        new_borrow = Borrow(
            book_id=book_id,
            user_id=user.id,
            borrower_name=user.real_name,
            due_date=due_date
        )
        book.available -= 1
        db.session.add(new_borrow)
        db.session.commit()
        flash('借阅成功！', 'success')
        return redirect(url_for('user_dashboard'))
    # GET 展示所有可借书籍
    books = Book.query.all()
    return render_template('user/borrow.html', books=books)

@app.route('/user/return/<int:borrow_id>')
@login_required
def user_return(borrow_id):
    borrow_record = Borrow.query.get(borrow_id)
    user = User.query.get(session['user_id'])
    if borrow_record and borrow_record.user_id == user.id and not borrow_record.return_date:
        borrow_record.return_date = datetime.now()
        book = Book.query.get(borrow_record.book_id)
        if book:
            book.available += 1
        db.session.commit()
        flash('归还成功！', 'success')
    else:
        flash('归还失败！', 'danger')
    return redirect(url_for('user_dashboard'))

@app.route('/user/profile', methods=['GET', 'POST'])
@login_required
def user_profile():
    user = User.query.get(session['user_id'])
    if request.method == 'POST':
        user.real_name = request.form['real_name'].strip()
        user.phone = request.form.get('phone', '').strip()
        email = request.form.get('email', '').strip()
        user.email = email if email else None
        db.session.commit()
        flash('信息修改成功！', 'success')
    # 渲染时将 None 转为空字符串
    user.phone = user.phone if user.phone else ''
    user.email = user.email if user.email else ''
    return render_template('user/profile.html', user=user)

if __name__ == '__main__':
    try:
        init_database()

        host = '0.0.0.0'
        port = int(os.environ.get('PORT', 5000))
        browser_url = f'http://127.0.0.1:{port}/'

        # Open default browser shortly after server starts
        def _open_browser():
            try:
                webbrowser.open(browser_url)
            except Exception:
                pass

        # When packaged by PyInstaller, disable debug and reloader
        if getattr(sys, 'frozen', False):
            threading.Timer(1.0, _open_browser).start()
            app.run(host=host, port=port, debug=False, use_reloader=False)
        else:
            # Development mode: keep debug on
            threading.Timer(1.0, _open_browser).start()
            app.run(debug=True, host=host, port=port)

    except Exception as e:
        print(f"错误原因: {e}")
        import traceback

        traceback.print_exc()
        # Don't wait for input here; when packaged we don't want the app to block on console input.