78 lines
2.8 KiB
TypeScript
78 lines
2.8 KiB
TypeScript
import type { AuthSession, AuthUser } from "@/lib/auth/session";
|
|
|
|
const DEFAULT_ADMIN_AUTHORITIES = [
|
|
"ROLE_ADMIN",
|
|
"ADMIN",
|
|
"SUPER_ADMIN",
|
|
"SYS_ADMIN",
|
|
"ZHINIAN_ADMIN"
|
|
];
|
|
|
|
const DEFAULT_ADMIN_USERS = [
|
|
"ceshiop"
|
|
];
|
|
|
|
export function configuredAdminAuthorities(): string[] {
|
|
const configured = process.env.ZHINIAN_ADMIN_AUTHORITIES;
|
|
if (configured === undefined || !configured.trim()) return DEFAULT_ADMIN_AUTHORITIES;
|
|
return splitConfiguredList(configured);
|
|
}
|
|
|
|
export function configuredAdminUsers(): string[] {
|
|
const configured = process.env.ZHINIAN_ADMIN_USERS;
|
|
if (configured === undefined || !configured.trim()) return DEFAULT_ADMIN_USERS;
|
|
return splitConfiguredList(configured);
|
|
}
|
|
|
|
export function hasAdminAccess(
|
|
user: AuthUser | null | undefined,
|
|
adminAuthorities?: string[],
|
|
adminUsers?: string[]
|
|
): boolean {
|
|
if (!user) return false;
|
|
if (user.role) return user.role === "super_admin" || user.role === "organization_admin";
|
|
const allowedUsers = new Set((adminUsers ?? configuredAdminUsers()).map(normalizeAccountName));
|
|
const identities = [user.username, user.subject]
|
|
.map((item) => item ? normalizeAccountName(item) : "")
|
|
.filter(Boolean);
|
|
if (identities.some((identity) => allowedUsers.has(identity))) return true;
|
|
|
|
const allowed = new Set((adminAuthorities ?? configuredAdminAuthorities()).map(normalizeAuthority));
|
|
return user.authorities.some((authority) => allowed.has(normalizeAuthority(authority)));
|
|
}
|
|
|
|
export function hasSuperAdminAccess(user: AuthUser | null | undefined): boolean {
|
|
if (!user) return false;
|
|
if (user.role) return user.role === "super_admin";
|
|
const allowedAuthorities = new Set(configuredAdminAuthorities().map(normalizeAuthority));
|
|
return user.authorities.some((authority) => {
|
|
const normalized = normalizeAuthority(authority);
|
|
return normalized === "SUPER_ADMIN" || normalized === "ROLE_SUPER_ADMIN";
|
|
}) || (user.username ? configuredAdminUsers().some((item) => normalizeAccountName(item) === normalizeAccountName(user.username || "")) : false) ||
|
|
user.authorities.some((authority) => allowedAuthorities.has(normalizeAuthority(authority)) && normalizeAuthority(authority) === "SUPER_ADMIN");
|
|
}
|
|
|
|
export function hasOrganizationAdminAccess(user: AuthUser | null | undefined): boolean {
|
|
if (!user) return false;
|
|
return user.role === "organization_admin";
|
|
}
|
|
|
|
export function hasAdminSessionAccess(session: AuthSession | null | undefined): boolean {
|
|
return session?.authMode === "admin" && hasAdminAccess(session.user);
|
|
}
|
|
|
|
export function normalizeAuthority(value: string): string {
|
|
return value.trim().replace(/[-\s]+/g, "_").toUpperCase();
|
|
}
|
|
|
|
function normalizeAccountName(value: string): string {
|
|
return value.trim().toLowerCase();
|
|
}
|
|
|
|
function splitConfiguredList(value: string): string[] {
|
|
return value
|
|
.split(/[\n,]+/)
|
|
.map((item) => item.trim())
|
|
.filter(Boolean);
|
|
}
|