jack/digital-psychology
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(admin): 收紧 isSuper、plan-prices RBAC 与封禁状态机

Browse Source 
避免 roles.write 绕过全部 can()；定价读写挂 membership.plans 权限；去掉快捷封禁双路径并让 ban/unban 走 lifecycle。

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
jackyu66git
2026-08-13 01:56:00 +08:00
co-authored by Cursor
parent 62cd8c45dd
commit 0d50c0ee73
10 changed files with 44 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/internal/handler/admin.go
+2 -2
View File
@@ -36,8 +36,8 @@ func (h *AdminHandler) Register(api *gin.RouterGroup) {
authed.POST("/users/:id/membership/grant", middleware.RequireAdminPermission(h.Svc, admin.PermMembershipGrant), h.GrantMembership)
authed.POST("/users/:id/ask-quota/grant", middleware.RequireAdminPermission(h.Svc, admin.PermAskQuotaGrant), h.GrantAskQuota)
authed.GET("/orders", middleware.RequireAdminPermission(h.Svc, admin.PermOrdersRead), h.ListOrders)
authed.GET("/membership/plan-prices", h.ListPlanPrices)
authed.PUT("/membership/plan-prices", h.PutPlanPrices)
authed.GET("/membership/plan-prices", middleware.RequireAdminPermission(h.Svc, admin.PermMembershipPlansRead), h.ListPlanPrices)
authed.PUT("/membership/plan-prices", middleware.RequireAdminPermission(h.Svc, admin.PermMembershipPlansWrite), h.PutPlanPrices)
authed.GET("/audit-logs", middleware.RequireAdminPermission(h.Svc, admin.PermAuditRead), h.ListAudit)
authed.GET("/analytics/overview", middleware.RequireAdminPermission(h.Svc, admin.PermAnalyticsRead), h.AnalyticsOverview)
authed.GET("/analytics/pages", middleware.RequireAdminPermission(h.Svc, admin.PermAnalyticsRead), h.AnalyticsPages)
apps/api/internal/handler/admin_system.go
+10 -2
View File
@@ -14,8 +14,8 @@ import (
)
func (h *AdminHandler) registerSystem(authed *gin.RouterGroup) {
authed.POST("/users/:id/ban", h.BanUser)
authed.POST("/users/:id/unban", h.UnbanUser)
authed.POST("/users/:id/ban", middleware.RequireAdminPermission(h.Svc, admin.PermUsersStatusWrite), h.BanUser)
authed.POST("/users/:id/unban", middleware.RequireAdminPermission(h.Svc, admin.PermUsersStatusWrite), h.UnbanUser)
authed.GET("/admins", h.ListAdmins)
authed.PATCH("/admins/:id", h.PatchAdmin)
authed.GET("/push-jobs", h.ListPushJobs)
@@ -39,6 +39,10 @@ func (h *AdminHandler) BanUser(c *gin.Context) {
response.Fail(c, http.StatusNotFound, 40401, "user not found")
return
}
if errors.Is(err, admin.ErrReasonRequired) || errors.Is(err, admin.ErrInvalidStatusEdge) {
response.Fail(c, http.StatusBadRequest, 40000, err.Error())
return
}
response.Fail(c, http.StatusInternalServerError, 50040, "ban failed")
return
}
@@ -61,6 +65,10 @@ func (h *AdminHandler) UnbanUser(c *gin.Context) {
response.Fail(c, http.StatusNotFound, 40401, "user not found")
return
}
if errors.Is(err, admin.ErrReasonRequired) || errors.Is(err, admin.ErrInvalidStatusEdge) {
response.Fail(c, http.StatusBadRequest, 40000, err.Error())
return
}
response.Fail(c, http.StatusInternalServerError, 50041, "unban failed")
return
}