66 lines
2.5 KiB
TypeScript
66 lines
2.5 KiB
TypeScript
import { redirect } from '@tanstack/react-router'
|
|
import { can, useAuthStore } from '@/auth/store'
|
|
import { getFirstAccessibleRoute } from '@/components/layout/nav'
|
|
|
|
/**
|
|
* Admin permission keys — mirrors the backend catalog
|
|
* (Modules/{Module}/app/Permissions/{Module}Permissions.php).
|
|
*/
|
|
export const PERM = {
|
|
CATEGORY_READ: 'admin:category:read',
|
|
CATEGORY_CREATE: 'admin:category:create',
|
|
CATEGORY_UPDATE: 'admin:category:update',
|
|
CATEGORY_DELETE: 'admin:category:delete',
|
|
CATEGORY_APPROVE: 'admin:category:approve',
|
|
COMMENT_READ: 'admin:comment:read',
|
|
COMMENT_MODERATE: 'admin:comment:moderate',
|
|
FILEX_READ: 'admin:filex:read',
|
|
FILEX_MODERATE: 'admin:filex:moderate',
|
|
DIMZOU_READ: 'admin:dimzou:read',
|
|
DIMZOU_RETRANSLATE: 'admin:dimzou:retranslate',
|
|
EXC_READ: 'admin:exc:read',
|
|
STUDIO_READ: 'admin:studio:read',
|
|
STUDIO_MANAGE: 'admin:studio:manage',
|
|
STUDIO_AGENT_TOKEN_ISSUE: 'admin:studio:agent-token:issue',
|
|
LOCALE_READ: 'admin:locale:read',
|
|
LOCALE_CREATE: 'admin:locale:create',
|
|
LOCALE_UPDATE: 'admin:locale:update',
|
|
LOCALE_DELETE: 'admin:locale:delete',
|
|
SID_MANAGE: 'admin:sid:manage',
|
|
SID_OVERRIDE: 'admin:sid:override',
|
|
NOTIFICATION_READ: 'admin:notification:read',
|
|
RESUME_READ: 'admin:resume:read',
|
|
RESUME_MANAGE: 'admin:resume:manage',
|
|
ROBOT_TOKEN_ISSUE: 'auth:robot-token:issue',
|
|
API_DOCS_READ: 'auth:api-docs:read',
|
|
// internal operator consoles — `auth:` prefixed, so super-admin only
|
|
// (the `admin` role is synced to admin:% keys and would otherwise inherit it)
|
|
DB_STUDIO_ACCESS: 'auth:db-studio:access',
|
|
MINIO_CONSOLE_ACCESS: 'auth:minio-console:access',
|
|
// role management — only super-admin holds these
|
|
ROLE_READ: 'auth:role:read',
|
|
ROLE_CREATE: 'auth:role:create',
|
|
ROLE_UPDATE: 'auth:role:update',
|
|
ROLE_DELETE: 'auth:role:delete',
|
|
ROLE_ASSIGN: 'auth:role:assign',
|
|
PERMISSION_READ: 'auth:permission:read',
|
|
PERMISSION_MANAGE: 'auth:permission:manage',
|
|
USER_READ: 'admin:user:read',
|
|
USER_MANAGE: 'admin:user:manage',
|
|
} as const
|
|
|
|
export type Permission = (typeof PERM)[keyof typeof PERM]
|
|
|
|
/**
|
|
* Route `beforeLoad` guard. Redirects home when the session is loaded and
|
|
* lacks the permission; lets the request through while the session is still
|
|
* empty (the API's 403 is the backstop, and /auth/me refreshes the store).
|
|
*/
|
|
export function requirePermission(permission: Permission): void {
|
|
const { user } = useAuthStore.getState()
|
|
if (user && !can(permission)) {
|
|
const target = getFirstAccessibleRoute()
|
|
throw redirect({ to: target && target !== '/' ? target : '/' })
|
|
}
|
|
}
|