wangxuming/NianAIGC
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add database-refreshed identity authorization

Browse Source
This commit is contained in:
陈宗琦
2026-08-13 11:56:36 +08:00
parent 716a8031b1
commit c849077591
12 changed files with 1809 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
lib/server/auth/current-user.ts
View File

@@ -3,8 +3,8 @@ import { SESSION_COOKIE_NAME, getAuthRuntimeConfig } from "@/lib/auth/config";
import { hasAdminSessionAccess, hasSuperAdminAccess } from "@/lib/auth/permissions";
import { parseSessionCookieValue, readChunkedCookieValue, type AuthSession, type AuthUser } from "@/lib/auth/session";
import { DEFAULT_OWNER_ID } from "@/lib/server/runtime";
import { getPlatformOrganization, getPlatformUserById } from "@/lib/server/account-store";
import { authUserFromPlatformRecord } from "@/lib/server/auth/local";
import { loadPlatformAuthorizationSnapshot } from "@/lib/server/auth/platform-authorization-store";
import { authorizePlatformSession } from "@/lib/server/auth/platform-session";
export class AuthRequiredError extends Error {
status = 401;
@@ -57,18 +57,9 @@ export async function getOptionalAuthSession(): Promise<AuthSession | null> {
readChunkedCookieValue(SESSION_COOKIE_NAME, (name) => cookieStore.get(name)?.value),
config.sessionSecret
);
if (!session || session.user.clientId !== "platform") return null;
const account = await getPlatformUserById(session.user.id);
if (!account || account.status !== "active") return null;
if (session.sessionVersion && session.sessionVersion !== account.sessionVersion) return null;
const organization = account.organizationId ? await getPlatformOrganization(account.organizationId) : null;
if (account.role !== "super_admin" && account.organizationId && (!organization || organization.status !== "active")) return null;
return {
...session,
authMode: account.role === "user" ? "user" : "admin",
user: authUserFromPlatformRecord(account, organization),
sessionVersion: account.sessionVersion
};
if (!session) return null;
const authorization = await authorizePlatformSession(session, loadPlatformAuthorizationSnapshot);
return authorization.outcome === "authenticated" ? authorization.session : null;
}
export async function requireAppSession(): Promise<AuthSession> {