feat: add local auth billing and usage management

tests/auth-permissions.test.ts

@@ -1,6 +1,11 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
-import { configuredAdminAuthorities, configuredAdminUsers, hasAdminAccess } from "@/lib/auth/permissions";
-import type { AuthUser } from "@/lib/auth/session";
+import {
+  configuredAdminAuthorities,
+  configuredAdminUsers,
+  hasAdminAccess,
+  hasAdminSessionAccess
+} from "@/lib/auth/permissions";
+import type { AuthSession, AuthUser } from "@/lib/auth/session";
 
 const baseUser: AuthUser = {
   id: "auth:app:1",
@@ -21,6 +26,12 @@ describe("auth permission helpers", () => {
     expect(hasAdminAccess({ ...baseUser, authorities: ["ROLE_USER"] })).toBe(false);
   });
 
+  it("uses the platform role as the single source of browser permissions", () => {
+    expect(hasAdminAccess({ ...baseUser, role: "user", authorities: ["ROLE_SUPER_ADMIN"] })).toBe(false);
+    expect(hasAdminAccess({ ...baseUser, role: "organization_admin", authorities: [] })).toBe(true);
+    expect(hasAdminAccess({ ...baseUser, role: "super_admin", authorities: [] })).toBe(true);
+  });
+
   it("treats ceshiop as the default administrator account", () => {
     expect(configuredAdminUsers()).toEqual(["ceshiop"]);
     expect(hasAdminAccess({ ...baseUser, username: "ceshiop", subject: "ceshiop", authorities: [] })).toBe(true);
@@ -31,22 +42,43 @@ describe("auth permission helpers", () => {
     expect(configuredAdminUsers()).toEqual(["ops-admin"]);
     expect(hasAdminAccess({ ...baseUser, username: "ceshiop", subject: "ceshiop", authorities: [] })).toBe(false);
     expect(hasAdminAccess({ ...baseUser, username: "ops-admin", subject: "ops-admin", authorities: [] })).toBe(true);
+    expect(hasAdminAccess({ ...baseUser, displayName: "ops-admin", authorities: [] })).toBe(false);
   });
 
-  it("uses configured admin usernames without falling back to default authority grants", () => {
+  it("uses configured admin usernames without granting common platform permissions", () => {
     vi.stubEnv("ZHINIAN_ADMIN_USERS", "admin");
     expect(hasAdminAccess({ ...baseUser, username: "staff", subject: "staff", authorities: ["sys_user_view"] })).toBe(false);
     expect(hasAdminAccess({ ...baseUser, username: "admin", subject: "admin", authorities: [] })).toBe(true);
   });
 
-  it("accepts configured admin authorities and normalizes case", () => {
-    vi.stubEnv("ZHINIAN_ADMIN_AUTHORITIES", "custom-admin, sys_config_view");
-    expect(configuredAdminAuthorities()).toEqual(["custom-admin", "sys_config_view"]);
+  it("accepts exact configured admin authorities and normalizes case", () => {
+    vi.stubEnv("ZHINIAN_ADMIN_AUTHORITIES", "custom-admin, role_ops_admin");
+    expect(configuredAdminAuthorities()).toEqual(["custom-admin", "role_ops_admin"]);
     expect(hasAdminAccess({ ...baseUser, authorities: ["CUSTOM_ADMIN"] })).toBe(true);
+    expect(hasAdminAccess({ ...baseUser, authorities: ["CUSTOM_ADMIN_EXTRA"] })).toBe(false);
   });
 
-  it("accepts known system admin permission prefixes", () => {
-    expect(hasAdminAccess({ ...baseUser, authorities: ["sys_user_view"] })).toBe(true);
-    expect(hasAdminAccess({ ...baseUser, authorities: ["admin:accounts"] })).toBe(true);
+  it("accepts dedicated admin roles but rejects generic roles and SYS permissions", () => {
+    expect(hasAdminAccess({ ...baseUser, authorities: ["ROLE_ADMIN"] })).toBe(true);
+    expect(hasAdminAccess({ ...baseUser, authorities: ["SUPER_ADMIN"] })).toBe(true);
+    expect(hasAdminAccess({ ...baseUser, authorities: ["ROLE_1"] })).toBe(false);
+    expect(hasAdminAccess({ ...baseUser, authorities: ["1"] })).toBe(false);
+    expect(hasAdminAccess({ ...baseUser, authorities: ["sys_user_view"] })).toBe(false);
+    expect(hasAdminAccess({ ...baseUser, authorities: ["admin:accounts"] })).toBe(false);
+  });
+
+  it("requires both admin login mode and an administrator identity", () => {
+    const adminUser = { ...baseUser, authorities: ["ROLE_ADMIN"] };
+    const session = (authMode: AuthSession["authMode"], user = adminUser): AuthSession => ({
+      version: 1,
+      authMode,
+      issuedAt: 100,
+      expiresAt: 200,
+      user
+    });
+
+    expect(hasAdminSessionAccess(session("user"))).toBe(false);
+    expect(hasAdminSessionAccess(session("admin"))).toBe(true);
+    expect(hasAdminSessionAccess(session("admin", { ...baseUser, authorities: ["ROLE_USER"] }))).toBe(false);
   });
 });