greeneclipse
8580c996c3
Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.
72 lines
2.3 KiB
TypeScript
72 lines
2.3 KiB
TypeScript
import { api, ApiError, failureMessage } from "$lib/api";
|
|
import type { MeResponse, StaffAccess } from "$lib/types";
|
|
|
|
export type AdminGateResult =
|
|
| { ok: true; me: MeResponse; staff: StaffAccess }
|
|
| { ok: false; reason: "auth" | "forbidden" | "error"; message: string };
|
|
|
|
function resolveStaff(me: MeResponse): StaffAccess {
|
|
if (me.staff_access) {
|
|
return {
|
|
staff_role: me.staff_access.staff_role,
|
|
full_admin: Boolean(me.staff_access.full_admin),
|
|
support_desk: Boolean(me.staff_access.support_desk),
|
|
is_support_only: Boolean(me.staff_access.is_support_only)
|
|
};
|
|
}
|
|
// Legacy fallback when staff_access is absent (pre-migration clients).
|
|
const full = Boolean(me.user?.is_platform_admin);
|
|
return {
|
|
full_admin: full,
|
|
support_desk: full,
|
|
is_support_only: false
|
|
};
|
|
}
|
|
|
|
export async function requirePlatformAdmin(): Promise<AdminGateResult> {
|
|
try {
|
|
const me = await api<MeResponse>("/api/auth/me");
|
|
const staff = resolveStaff(me);
|
|
if (!staff.full_admin) {
|
|
return { ok: false, reason: "forbidden", message: "Platform admin required." };
|
|
}
|
|
return { ok: true, me, staff };
|
|
} catch (err) {
|
|
if (err instanceof ApiError && err.status === 401) {
|
|
return { ok: false, reason: "auth", message: "Authentication required." };
|
|
}
|
|
if (err instanceof ApiError && err.status === 403) {
|
|
return { ok: false, reason: "forbidden", message: "Platform admin required." };
|
|
}
|
|
return {
|
|
ok: false,
|
|
reason: "error",
|
|
message: failureMessage(err, "Failed to verify admin access")
|
|
};
|
|
}
|
|
}
|
|
|
|
/** Full admin or support_staff — for /admin/support desk pages. */
|
|
export async function requireSupportDesk(): Promise<AdminGateResult> {
|
|
try {
|
|
const me = await api<MeResponse>("/api/auth/me");
|
|
const staff = resolveStaff(me);
|
|
if (!staff.support_desk) {
|
|
return { ok: false, reason: "forbidden", message: "Support desk access required." };
|
|
}
|
|
return { ok: true, me, staff };
|
|
} catch (err) {
|
|
if (err instanceof ApiError && err.status === 401) {
|
|
return { ok: false, reason: "auth", message: "Authentication required." };
|
|
}
|
|
if (err instanceof ApiError && err.status === 403) {
|
|
return { ok: false, reason: "forbidden", message: "Support desk access required." };
|
|
}
|
|
return {
|
|
ok: false,
|
|
reason: "error",
|
|
message: failureMessage(err, "Failed to verify support access")
|
|
};
|
|
}
|
|
}
|