feat: AIHR 智能人力资源管理系统初始提交

- 员工花名册管理（加密存储、导入导出）
- 薪酬管理（发薪批次、薪酬模版、加班费计算、工资条）
- 社保公积金（多城市配置、版本管理、基数调整）
- 解聘管理（6步流程、证据链、工作交接）
- AI 助手（合同审查、风险预测、RAG 知识库）
- Dashboard 仪表盘
- 设置与通知

backend/src/middleware/auditLog.ts

@@ -0,0 +1,27 @@
+import { AuthRequest } from './auth'
+import prisma from '../lib/prisma'
+
+export async function auditLog(
+  req: AuthRequest,
+  action: string,
+  entity: string,
+  entityId?: string,
+  detail?: Record<string, unknown>,
+) {
+  if (!req.user) return
+  try {
+    await prisma.auditLog.create({
+      data: {
+        orgId: req.user.orgId,
+        userId: req.user.id,
+        action,
+        entity,
+        entityId,
+        detail: detail ? JSON.parse(JSON.stringify(detail)) : undefined,
+        ip: req.ip,
+      },
+    })
+  } catch (err) {
+    console.error('Audit log error:', err)
+  }
+}

backend/src/middleware/auth.ts

@@ -0,0 +1,28 @@
+import { Request, Response, NextFunction } from 'express'
+import { verifyAccessToken } from '../lib/jwt'
+
+export interface AuthRequest extends Request {
+  user?: { id: string; orgId: string; role: string }
+  orgId?: string
+}
+
+export function authMiddleware(req: AuthRequest, res: Response, next: NextFunction) {
+  const authHeader = req.headers.authorization
+  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    return res.status(401).json({ success: false, error: { code: 'UNAUTHORIZED', message: '未提供认证令牌' } })
+  }
+  const token = authHeader.substring(7)
+  const payload = verifyAccessToken(token)
+  if (!payload) {
+    return res.status(401).json({ success: false, error: { code: 'TOKEN_INVALID', message: '令牌无效或已过期' } })
+  }
+  req.user = payload
+  next()
+}
+
+export function orgFilterMiddleware(req: AuthRequest, _res: Response, next: NextFunction) {
+  if (req.user) {
+    req.orgId = req.user.orgId
+  }
+  next()
+}

backend/src/middleware/errorHandler.ts

@@ -0,0 +1,37 @@
+import { Request, Response, NextFunction } from 'express'
+import { ZodError } from 'zod'
+import { PrismaClientKnownRequestError } from '@prisma/client/runtime/library'
+
+export function errorHandler(err: unknown, _req: Request, res: Response, _next: NextFunction) {
+  if (err instanceof ZodError) {
+    return res.status(422).json({
+      success: false,
+      error: {
+        code: 'VALIDATION_ERROR',
+        message: '输入校验失败',
+        details: err.errors.map((e) => ({ path: e.path.join('.'), message: e.message })),
+      },
+    })
+  }
+
+  if (err instanceof PrismaClientKnownRequestError) {
+    if (err.code === 'P2002') {
+      return res.status(400).json({
+        success: false,
+        error: { code: 'DUPLICATE', message: '数据已存在，请勿重复操作' },
+      })
+    }
+    if (err.code === 'P2025') {
+      return res.status(404).json({
+        success: false,
+        error: { code: 'NOT_FOUND', message: '记录不存在' },
+      })
+    }
+  }
+
+  console.error('Unhandled error:', err)
+  return res.status(500).json({
+    success: false,
+    error: { code: 'INTERNAL_ERROR', message: '服务器内部错误' },
+  })
+}

backend/src/middleware/rateLimit.ts

@@ -0,0 +1,19 @@
+import rateLimit from 'express-rate-limit'
+
+export const authLimiter = rateLimit({
+  windowMs: 60 * 60 * 1000,
+  max: 5,
+  message: { success: false, error: { code: 'RATE_LIMIT', message: '操作过于频繁，请稍后再试' } },
+})
+
+export const loginLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  max: 5,
+  message: { success: false, error: { code: 'RATE_LIMIT', message: '登录尝试过于频繁，请稍后再试' } },
+})
+
+export const apiLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  max: 100,
+  message: { success: false, error: { code: 'RATE_LIMIT', message: '请求过于频繁，请稍后再试' } },
+})