feat: add admin accounts and image templates

middleware.ts

@@ -1,6 +1,7 @@
 import { NextResponse, type NextRequest } from "next/server";
 import { SESSION_COOKIE_NAME, getAuthRuntimeConfig, safeNextPath } from "@/lib/auth/config";
-import { parseSessionCookieValue } from "@/lib/auth/session";
+import { hasAdminAccess } from "@/lib/auth/permissions";
+import { parseSessionCookieValue, readChunkedCookieValue } from "@/lib/auth/session";
 
 export async function middleware(request: NextRequest) {
   const config = getAuthRuntimeConfig();
@@ -9,10 +10,18 @@ export async function middleware(request: NextRequest) {
   const pathname = request.nextUrl.pathname;
   if (config.configured && config.sessionSecret) {
     const session = await parseSessionCookieValue(
-      request.cookies.get(SESSION_COOKIE_NAME)?.value,
+      readChunkedCookieValue(SESSION_COOKIE_NAME, (name) => request.cookies.get(name)?.value),
       config.sessionSecret
     );
-    if (session) return NextResponse.next();
+    if (session) {
+      if (isAdminPath(pathname) && !hasAdminAccess(session.user)) {
+        if (pathname.startsWith("/api/")) {
+          return NextResponse.json({ error: "需要管理员权限。" }, { status: 403 });
+        }
+        return NextResponse.redirect(new URL("/create", request.url));
+      }
+      return NextResponse.next();
+    }
   }
 
   if (pathname.startsWith("/api/")) {
@@ -34,6 +43,7 @@ export const config = {
     "/assets/:path*",
     "/logs/:path*",
     "/settings/:path*",
+    "/accounts/:path*",
     "/image-edit/:path*",
     "/uploads/:path*",
     "/generated-results/:path*",
@@ -41,6 +51,16 @@ export const config = {
     "/api/generations/:path*",
     "/api/logs/:path*",
     "/api/prompt/:path*",
-    "/api/settings/:path*"
+    "/api/settings/:path*",
+    "/api/admin/:path*"
   ]
 };
+
+function isAdminPath(pathname: string): boolean {
+  return pathname.startsWith("/logs") ||
+    pathname.startsWith("/settings") ||
+    pathname.startsWith("/accounts") ||
+    pathname.startsWith("/api/logs") ||
+    pathname.startsWith("/api/settings") ||
+    pathname.startsWith("/api/admin");
+}