fix

2026-08-17 21:20:45 +02:00
parent 321f11e817
commit 6fcdc74843
157 changed files with 2895 additions and 7544 deletions
@@ -0,0 +1,46 @@
+import { error, redirect } from "@sveltejs/kit";
+import type { LayoutServerLoad } from "./$types";
+import {
+	adminLoginRedirect,
+	fetchMeStaff,
+	isAdminSupportPath,
+	isFullPlatformAdmin,
+	isSupportDesk
+} from "$lib/server/require-platform-admin";
+
+/**
+ * SSR gate for /admin/* pages (not +server.ts endpoints).
+ * Unauthenticated → login?next=. Non-staff → /dashboard (no admin chrome).
+ * /admin/support* → support desk. All other admin pages (including logs + bootstrap) → full platform admin.
+ */
+export const load: LayoutServerLoad = async (event) => {
+	const result = await fetchMeStaff(event);
+	if (!result.ok) {
+		if (result.status === 401) {
+			redirect(303, adminLoginRedirect(event.url.pathname, event.url.search));
+		}
+		error(result.status, "Forbidden");
+	}
+
+	const me = result.me;
+	const path = event.url.pathname;
+	const supportPath = isAdminSupportPath(path);
+	const fullAdmin = isFullPlatformAdmin(me);
+	const supportDesk = isSupportDesk(me);
+
+	if (supportPath) {
+		if (!supportDesk) {
+			redirect(303, "/dashboard");
+		}
+		return { staff: { full_admin: fullAdmin, support_desk: true } };
+	}
+
+	if (!fullAdmin) {
+		if (supportDesk) {
+			redirect(303, "/admin/support");
+		}
+		redirect(303, "/dashboard");
+	}
+
+	return { staff: { full_admin: true, support_desk: supportDesk } };
+};