feat: add admin accounts and image templates

lib/auth/permissions.ts

@@ -0,0 +1,77 @@
+import type { AuthUser } from "@/lib/auth/session";
+
+const DEFAULT_ADMIN_AUTHORITIES = [
+  "ROLE_ADMIN",
+  "ROLE_1",
+  "1",
+  "ADMIN",
+  "SUPER_ADMIN",
+  "SYS_ADMIN",
+  "ZHINIAN_ADMIN",
+  "sys_user_view",
+  "sys_user_add",
+  "sys_user_edit",
+  "sys_role_view",
+  "sys_log_view",
+  "sys_config_view",
+  "sys_client_view"
+];
+
+const DEFAULT_ADMIN_USERS = [
+  "ceshiop"
+];
+
+const ADMIN_PREFIXES = [
+  "SYS_USER_",
+  "SYS_ROLE_",
+  "SYS_MENU_",
+  "SYS_LOG_",
+  "SYS_CONFIG_",
+  "SYS_CLIENT_",
+  "ADMIN:"
+];
+
+export function configuredAdminAuthorities(): string[] {
+  const configured = process.env.ZHINIAN_ADMIN_AUTHORITIES?.trim();
+  if (!configured) return DEFAULT_ADMIN_AUTHORITIES;
+  return configured
+    .split(/[\n,]+/)
+    .map((item) => item.trim())
+    .filter(Boolean);
+}
+
+export function configuredAdminUsers(): string[] {
+  const configured = process.env.ZHINIAN_ADMIN_USERS?.trim();
+  if (!configured) return DEFAULT_ADMIN_USERS;
+  return configured
+    .split(/[\n,]+/)
+    .map((item) => item.trim())
+    .filter(Boolean);
+}
+
+export function hasAdminAccess(
+  user: AuthUser | null | undefined,
+  adminAuthorities = configuredAdminAuthorities(),
+  adminUsers = configuredAdminUsers()
+): boolean {
+  if (!user) return false;
+  const allowedUsers = new Set(adminUsers.map(normalizeAccountName));
+  const identities = [user.username, user.subject, user.displayName, user.id]
+    .map((item) => item ? normalizeAccountName(item) : "")
+    .filter(Boolean);
+  if (identities.some((identity) => allowedUsers.has(identity))) return true;
+
+  const allowed = new Set(adminAuthorities.map(normalizeAuthority));
+  return user.authorities.some((authority) => {
+    const normalized = normalizeAuthority(authority);
+    return allowed.has(normalized) || ADMIN_PREFIXES.some((prefix) => normalized.startsWith(prefix));
+  });
+}
+
+export function normalizeAuthority(value: string): string {
+  return value.trim().replace(/[-\s]+/g, "_").toUpperCase();
+}
+
+function normalizeAccountName(value: string): string {
+  return value.trim().toLowerCase();
+}