feat: add local auth billing and usage management

lib/auth/permissions.ts

@@ -1,45 +1,26 @@
-import type { AuthUser } from "@/lib/auth/session";
+import type { AuthSession, AuthUser } from "@/lib/auth/session";
 
 const DEFAULT_ADMIN_AUTHORITIES = [
   "ROLE_ADMIN",
-  "ROLE_1",
-  "1",
   "ADMIN",
   "SUPER_ADMIN",
   "SYS_ADMIN",
-  "ZHINIAN_ADMIN",
-  "sys_user_view",
-  "sys_user_add",
-  "sys_user_edit",
-  "sys_role_view",
-  "sys_log_view",
-  "sys_config_view",
-  "sys_client_view"
+  "ZHINIAN_ADMIN"
 ];
 
 const DEFAULT_ADMIN_USERS = [
   "ceshiop"
 ];
 
-const ADMIN_PREFIXES = [
-  "SYS_USER_",
-  "SYS_ROLE_",
-  "SYS_MENU_",
-  "SYS_LOG_",
-  "SYS_CONFIG_",
-  "SYS_CLIENT_",
-  "ADMIN:"
-];
-
 export function configuredAdminAuthorities(): string[] {
   const configured = process.env.ZHINIAN_ADMIN_AUTHORITIES;
-  if (configured === undefined) return DEFAULT_ADMIN_AUTHORITIES;
+  if (configured === undefined || !configured.trim()) return DEFAULT_ADMIN_AUTHORITIES;
   return splitConfiguredList(configured);
 }
 
 export function configuredAdminUsers(): string[] {
   const configured = process.env.ZHINIAN_ADMIN_USERS;
-  if (configured === undefined) return DEFAULT_ADMIN_USERS;
+  if (configured === undefined || !configured.trim()) return DEFAULT_ADMIN_USERS;
   return splitConfiguredList(configured);
 }
 
@@ -49,18 +30,35 @@ export function hasAdminAccess(
   adminUsers?: string[]
 ): boolean {
   if (!user) return false;
+  if (user.role) return user.role === "super_admin" || user.role === "organization_admin";
   const allowedUsers = new Set((adminUsers ?? configuredAdminUsers()).map(normalizeAccountName));
-  const identities = [user.username, user.subject, user.displayName, user.id]
+  const identities = [user.username, user.subject]
     .map((item) => item ? normalizeAccountName(item) : "")
     .filter(Boolean);
   if (identities.some((identity) => allowedUsers.has(identity))) return true;
 
-  if (!shouldUseAuthorityGrants(adminAuthorities)) return false;
   const allowed = new Set((adminAuthorities ?? configuredAdminAuthorities()).map(normalizeAuthority));
+  return user.authorities.some((authority) => allowed.has(normalizeAuthority(authority)));
+}
+
+export function hasSuperAdminAccess(user: AuthUser | null | undefined): boolean {
+  if (!user) return false;
+  if (user.role) return user.role === "super_admin";
+  const allowedAuthorities = new Set(configuredAdminAuthorities().map(normalizeAuthority));
   return user.authorities.some((authority) => {
     const normalized = normalizeAuthority(authority);
-    return allowed.has(normalized) || ADMIN_PREFIXES.some((prefix) => normalized.startsWith(prefix));
-  });
+    return normalized === "SUPER_ADMIN" || normalized === "ROLE_SUPER_ADMIN";
+  }) || (user.username ? configuredAdminUsers().some((item) => normalizeAccountName(item) === normalizeAccountName(user.username || "")) : false) ||
+    user.authorities.some((authority) => allowedAuthorities.has(normalizeAuthority(authority)) && normalizeAuthority(authority) === "SUPER_ADMIN");
+}
+
+export function hasOrganizationAdminAccess(user: AuthUser | null | undefined): boolean {
+  if (!user) return false;
+  return user.role === "organization_admin";
+}
+
+export function hasAdminSessionAccess(session: AuthSession | null | undefined): boolean {
+  return session?.authMode === "admin" && hasAdminAccess(session.user);
 }
 
 export function normalizeAuthority(value: string): string {
@@ -77,9 +75,3 @@ function splitConfiguredList(value: string): string[] {
     .map((item) => item.trim())
     .filter(Boolean);
 }
-
-function shouldUseAuthorityGrants(explicitAuthorities?: string[]): boolean {
-  if (explicitAuthorities !== undefined) return true;
-  if (process.env.ZHINIAN_ADMIN_AUTHORITIES !== undefined) return true;
-  return process.env.ZHINIAN_ADMIN_USERS === undefined;
-}