feat: enforce per-user module access in Makelore

electron/api/routes/auth.ts

@@ -25,6 +25,7 @@ import {
 } from '../../services/works-square-runtime';
 import { logger } from '../../utils/logger';
 import type { WorksSquareTokenPayload } from '../../services/works-square-session';
+import { normalizeModuleAccess } from '../../../shared/module-access';
 
 type AuthClientInput = {
   authBase?: unknown;
@@ -465,6 +466,39 @@ async function handleSessionActivity(
   });
 }
 
+async function handleCurrentUser(res: ServerResponse): Promise<void> {
+  const accessToken = await getValidWorksSquareAccessToken({ forceRefresh: false });
+  if (!accessToken) {
+    sendJson(res, 401, { success: false, error: '登录已过期，请重新授权。' });
+    return;
+  }
+
+  const response = await proxyAwareFetch(createWorksUrl('/api/auth/me').toString(), {
+    method: 'GET',
+    headers: {
+      Authorization: `Bearer ${accessToken}`,
+    },
+  });
+  const payload = await readResponsePayload(response);
+  if (!response.ok) {
+    sendJson(res, response.status === 401 ? 401 : 502, {
+      success: false,
+      error: response.status === 401
+        ? '登录已过期，请重新授权。'
+        : '暂时无法读取模块权限，请稍后重试。',
+    });
+    return;
+  }
+
+  const profile = payload && typeof payload === 'object' && !Array.isArray(payload)
+    ? payload as Record<string, unknown>
+    : {};
+  sendJson(res, 200, {
+    success: true,
+    moduleAccess: normalizeModuleAccess(profile.module_access),
+  });
+}
+
 async function ensureWorksSquareSessionRestored(): Promise<boolean> {
   if (getWorksSquareSessionRestoreStatus() === 'unavailable') {
     await retryWorksSquareSessionRestore();
@@ -614,6 +648,11 @@ export async function handleAuthRoutes(
       return true;
     }
 
+    if (url.pathname === '/api/auth/me' && req.method === 'GET') {
+      await handleCurrentUser(res);
+      return true;
+    }
+
     if (url.pathname === '/api/auth/session/clear' && req.method === 'POST') {
       await handleSessionClear(res, ctx);
       return true;