78 lines
2.0 KiB
TypeScript
78 lines
2.0 KiB
TypeScript
import type { AuthUser } from "@/lib/auth/session";
|
|
|
|
const DEFAULT_ADMIN_AUTHORITIES = [
|
|
"ROLE_ADMIN",
|
|
"ROLE_1",
|
|
"1",
|
|
"ADMIN",
|
|
"SUPER_ADMIN",
|
|
"SYS_ADMIN",
|
|
"ZHINIAN_ADMIN",
|
|
"sys_user_view",
|
|
"sys_user_add",
|
|
"sys_user_edit",
|
|
"sys_role_view",
|
|
"sys_log_view",
|
|
"sys_config_view",
|
|
"sys_client_view"
|
|
];
|
|
|
|
const DEFAULT_ADMIN_USERS = [
|
|
"ceshiop"
|
|
];
|
|
|
|
const ADMIN_PREFIXES = [
|
|
"SYS_USER_",
|
|
"SYS_ROLE_",
|
|
"SYS_MENU_",
|
|
"SYS_LOG_",
|
|
"SYS_CONFIG_",
|
|
"SYS_CLIENT_",
|
|
"ADMIN:"
|
|
];
|
|
|
|
export function configuredAdminAuthorities(): string[] {
|
|
const configured = process.env.ZHINIAN_ADMIN_AUTHORITIES?.trim();
|
|
if (!configured) return DEFAULT_ADMIN_AUTHORITIES;
|
|
return configured
|
|
.split(/[\n,]+/)
|
|
.map((item) => item.trim())
|
|
.filter(Boolean);
|
|
}
|
|
|
|
export function configuredAdminUsers(): string[] {
|
|
const configured = process.env.ZHINIAN_ADMIN_USERS?.trim();
|
|
if (!configured) return DEFAULT_ADMIN_USERS;
|
|
return configured
|
|
.split(/[\n,]+/)
|
|
.map((item) => item.trim())
|
|
.filter(Boolean);
|
|
}
|
|
|
|
export function hasAdminAccess(
|
|
user: AuthUser | null | undefined,
|
|
adminAuthorities = configuredAdminAuthorities(),
|
|
adminUsers = configuredAdminUsers()
|
|
): boolean {
|
|
if (!user) return false;
|
|
const allowedUsers = new Set(adminUsers.map(normalizeAccountName));
|
|
const identities = [user.username, user.subject, user.displayName, user.id]
|
|
.map((item) => item ? normalizeAccountName(item) : "")
|
|
.filter(Boolean);
|
|
if (identities.some((identity) => allowedUsers.has(identity))) return true;
|
|
|
|
const allowed = new Set(adminAuthorities.map(normalizeAuthority));
|
|
return user.authorities.some((authority) => {
|
|
const normalized = normalizeAuthority(authority);
|
|
return allowed.has(normalized) || ADMIN_PREFIXES.some((prefix) => normalized.startsWith(prefix));
|
|
});
|
|
}
|
|
|
|
export function normalizeAuthority(value: string): string {
|
|
return value.trim().replace(/[-\s]+/g, "_").toUpperCase();
|
|
}
|
|
|
|
function normalizeAccountName(value: string): string {
|
|
return value.trim().toLowerCase();
|
|
}
|