feat: add admin accounts and image templates

tests/auth-permissions.test.ts

@@ -0,0 +1,46 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { configuredAdminAuthorities, configuredAdminUsers, hasAdminAccess } from "@/lib/auth/permissions";
+import type { AuthUser } from "@/lib/auth/session";
+
+const baseUser: AuthUser = {
+  id: "auth:app:1",
+  subject: "user-1",
+  username: "user-1",
+  displayName: "用户1",
+  clientId: "app",
+  authorities: [],
+  scope: ["server"]
+};
+
+describe("auth permission helpers", () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("treats ordinary users as non-admin", () => {
+    expect(hasAdminAccess({ ...baseUser, authorities: ["ROLE_USER"] })).toBe(false);
+  });
+
+  it("treats ceshiop as the default administrator account", () => {
+    expect(configuredAdminUsers()).toEqual(["ceshiop"]);
+    expect(hasAdminAccess({ ...baseUser, username: "ceshiop", subject: "ceshiop", authorities: [] })).toBe(true);
+  });
+
+  it("allows configured admin usernames to override the default account", () => {
+    vi.stubEnv("ZHINIAN_ADMIN_USERS", "ops-admin");
+    expect(configuredAdminUsers()).toEqual(["ops-admin"]);
+    expect(hasAdminAccess({ ...baseUser, username: "ceshiop", subject: "ceshiop", authorities: [] })).toBe(false);
+    expect(hasAdminAccess({ ...baseUser, username: "ops-admin", subject: "ops-admin", authorities: [] })).toBe(true);
+  });
+
+  it("accepts configured admin authorities and normalizes case", () => {
+    vi.stubEnv("ZHINIAN_ADMIN_AUTHORITIES", "custom-admin, sys_config_view");
+    expect(configuredAdminAuthorities()).toEqual(["custom-admin", "sys_config_view"]);
+    expect(hasAdminAccess({ ...baseUser, authorities: ["CUSTOM_ADMIN"] })).toBe(true);
+  });
+
+  it("accepts known system admin permission prefixes", () => {
+    expect(hasAdminAccess({ ...baseUser, authorities: ["sys_user_view"] })).toBe(true);
+    expect(hasAdminAccess({ ...baseUser, authorities: ["admin:accounts"] })).toBe(true);
+  });
+});