TalexDreamSoul/teatea-pension
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: use real settings data boundaries

Browse Source
This commit is contained in:
admin
2026-07-02 19:53:41 -07:00
parent 1cdf89c608
commit 5412bbb143
14 changed files with 414 additions and 170 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
app/api/settings/accounts/route.ts
View File

@@ -6,7 +6,11 @@ import { recordAuditLog } from "@/modules/core/server/audit";
import { getDatabase } from "@/modules/core/server/db";
import { getRoleDefinitions, hasPermission } from "@/modules/core/server/permissions";
import { accounts, memberships, organizations, roles } from "@/modules/core/server/schema";
import { readData } from "@/modules/core/server/store";
import {
listSettingsAccounts,
listSettingsMemberships,
listSettingsOrganizations,
} from "@/modules/core/server/settings";
function isRecord(value: unknown): value is Record<string, unknown> {
return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -27,35 +31,30 @@ export async function GET(): Promise<Response> {
return auth.response;
}
const data = await readData();
const canReadAllAccounts = hasPermission(auth.context.permissions, "platform:manage");
const organizationId = auth.context.organization?.id;
const roleDefinitions = await getRoleDefinitions(organizationId);
const canReadAllAccounts = Boolean(auth.context.account.platformRoleId) || hasPermission(auth.context.permissions, "platform:manage");
const organizationId = canReadAllAccounts ? undefined : auth.context.organization?.id;
const [accountRows, membershipRows, organizationRows, roleDefinitions] = await Promise.all([
listSettingsAccounts(organizationId ? { organizationId } : {}),
listSettingsMemberships(organizationId ? { organizationId } : {}),
listSettingsOrganizations(organizationId ? { organizationId } : {}),
getRoleDefinitions(auth.context.organization?.id),
]);
const roleById = new Map(roleDefinitions.map((role) => [role.id, role]));
const organizationById = new Map(data.organizations.map((organization) => [organization.id, organization]));
const scopedAccountIds =
organizationId && !canReadAllAccounts
? new Set(
data.memberships
.filter((membership) => membership.organizationId === organizationId)
.map((membership) => membership.accountId),
)
: null;
const organizationById = new Map(organizationRows.map((organization) => [organization.id, organization]));
return jsonSuccess("账号列表已加载", {
accounts: data.accounts
.filter((account) => !scopedAccountIds || scopedAccountIds.has(account.id))
.map((account) => {
const membership = organizationId
? data.memberships.find(
(item) => item.accountId === account.id && item.organizationId === organizationId && item.status === "active",
accounts: accountRows.map((account) => {
const membership = auth.context.organization?.id
? membershipRows.find(
(item) =>
item.accountId === account.id && item.organizationId === auth.context.organization?.id && item.status === "active",
)
: data.memberships.find((item) => item.accountId === account.id && item.status === "active");
const organization = membership ? organizationById.get(membership.organizationId) : undefined;
const platformRole = account.platformRoleId ? roleById.get(account.platformRoleId) : undefined;
: membershipRows.find((item) => item.accountId === account.id && item.status === "active");
const organization = membership ? organizationById.get(membership.organizationId) : undefined;
const platformRole = account.platformRoleId ? roleById.get(account.platformRoleId) : undefined;
return toPublicAccount(account, platformRole?.key ?? membership?.roleKey, organization);
}),
return toPublicAccount(account, platformRole?.key ?? membership?.roleKey, organization);
}),
});
}

9
app/api/settings/join-requests/route.ts
View File

@@ -1,6 +1,6 @@
import { jsonSuccess } from "@/modules/core/server/api";
import { requirePermission } from "@/modules/core/server/auth";
import { readData } from "@/modules/core/server/store";
import { listSettingsJoinRequests } from "@/modules/core/server/settings";
export async function GET(): Promise<Response> {
const auth = await requirePermission("account:read", {
@@ -12,12 +12,9 @@ export async function GET(): Promise<Response> {
return auth.response;
}
const data = await readData();
const organizationId = auth.context.organization?.id;
const organizationId = auth.context.account.platformRoleId ? undefined : auth.context.organization?.id;
return jsonSuccess("加入申请已加载", {
joinRequests: organizationId
? data.joinRequests.filter((request) => request.organizationId === organizationId)
: data.joinRequests,
joinRequests: await listSettingsJoinRequests(organizationId ? { organizationId } : {}),
});
}