项目迁移

src/security/authorization.mjs

@@ -0,0 +1,40 @@
+export const adminLevelNames = { super: '超级管理员', school: '校级管理员', class: '班级管理员' };
+
+export const permissionsByLevel = {
+  super: ['*'],
+  school: ['dashboard.read', 'candidates.read', 'candidates.write', 'candidates.review', 'registrations.read', 'registrations.review', 'payments.read', 'payments.write', 'results.read', 'centers.read', 'centers.write', 'workflows.inbox'],
+  class: ['dashboard.read', 'candidates.read', 'candidates.review', 'registrations.read', 'registrations.review', 'payments.read', 'payments.write', 'results.read', 'workflows.inbox']
+};
+
+export function hasPermission(user, permission) {
+  if (user?.role !== 'admin') return false;
+  const permissions = permissionsByLevel[user.adminLevel || 'super'] || [];
+  return permissions.includes('*') || permissions.includes(permission);
+}
+
+export function createPermissionGuard(sendError) {
+  return function requirePermission(user, response, permission) {
+    if (hasPermission(user, permission)) return true;
+    sendError(response, 403, '当前管理员层级无权执行此操作');
+    return false;
+  };
+}
+
+export function profileInScope(user, profile) {
+  if (user.adminLevel === 'super') return true;
+  if (user.adminLevel === 'school') return Boolean(user.schoolId && profile.schoolId === user.schoolId);
+  return Boolean(user.classId && profile.classId === user.classId);
+}
+
+export function registrationInScope(db, user, registration) {
+  const profile = db.candidateProfiles.find(item => item.userId === registration.userId);
+  return Boolean(profile && profileInScope(user, profile));
+}
+
+export function adminScopeLabel(db, user) {
+  if (user.adminLevel === 'super') return '全部学校与班级';
+  const school = db.schools.find(item => item.id === user.schoolId)?.name || '未绑定学校';
+  if (user.adminLevel === 'school') return school;
+  const schoolClass = db.classes.find(item => item.id === user.classId)?.name || '未绑定班级';
+  return `${school} · ${schoolClass}`;
+}