初次提交

app/composables/usePermissions.ts

@@ -0,0 +1,113 @@
+import { computed, ref } from 'vue'
+import { useAuth } from './useAuth'
+
+export const rolesConfig = ref(null)
+
+export const fetchRolesConfig = async () => {
+  if (rolesConfig.value) return
+  try {
+    const data = await $fetch('/api/roles')
+    rolesConfig.value = data
+  } catch (err) {
+    console.error('Failed to fetch roles config', err)
+  }
+}
+
+export const usePermissions = () => {
+  const auth = useAuth()
+
+  // 检查用户是否可以访问后台
+  const canAccessAdmin = computed(() => {
+    if (!auth.user.value || !auth.user.value.role) return false
+    const role = auth.user.value.role
+    if (rolesConfig.value && rolesConfig.value[role]) {
+      return rolesConfig.value[role].canAccessAdmin
+    }
+    // Fallback if config not loaded
+    return ['SONG_ADMIN', 'ADMIN', 'SUPER_ADMIN', 'STAFF', 'VICE_MINISTER', 'MINISTER', 'RESIDENT'].includes(role)
+  })
+
+  // 检查用户是否可以访问指定页面
+  const canAccessPage = (page: string): boolean => {
+    if (!auth.user.value || !auth.user.value.role) return false
+    const role = auth.user.value.role
+
+    // 超级管理员可以访问所有页面 (作为兜底保护)
+    if (role === 'SUPER_ADMIN') return true
+
+    if (rolesConfig.value && rolesConfig.value[role]) {
+      return rolesConfig.value[role].pages.includes(page)
+    }
+
+    return false
+  }
+
+  // 获取用户可访问的页面列表
+  const getUserPages = computed(() => {
+    if (!auth.user.value || !auth.user.value.role) return []
+    const role = auth.user.value.role
+    
+    if (rolesConfig.value && rolesConfig.value[role]) {
+      return rolesConfig.value[role].pages
+    }
+    
+    return []
+  })
+
+  // 角色检查
+  const isUser = computed(() => auth.user.value?.role === 'USER')
+  const isSongAdmin = computed(() => auth.user.value?.role === 'SONG_ADMIN')
+  const isAdmin = computed(() => auth.user.value?.role === 'ADMIN')
+  const isSuperAdmin = computed(() => auth.user.value?.role === 'SUPER_ADMIN')
+
+  // 权限组合检查 (为了兼容性保留，但最好根据实际权限判断)
+  const isAdminOrAbove = computed(() => {
+    const role = auth.user.value?.role
+    return ['ADMIN', 'SUPER_ADMIN', 'VICE_MINISTER', 'MINISTER'].includes(role)
+  })
+
+  const isSongAdminOrAbove = computed(() => {
+    const role = auth.user.value?.role
+    return ['SONG_ADMIN', 'ADMIN', 'SUPER_ADMIN', 'STAFF', 'VICE_MINISTER', 'MINISTER', 'RESIDENT'].includes(role)
+  })
+
+  // 检查是否可以管理用户角色
+  const canManageUserRole = (targetRole: string): boolean => {
+    if (!auth.user.value) return false
+
+    // 只有超级管理员可以分配角色
+    if (auth.user.value.role === 'SUPER_ADMIN') {
+      return true
+    }
+
+    return false
+  }
+
+  // 检查是否可以打印排期
+  const canPrintSchedule = computed(() => {
+    if (!auth.user.value) return false
+    const role = auth.user.value.role
+    return ['SONG_ADMIN', 'ADMIN', 'SUPER_ADMIN'].includes(role)
+  })
+
+  return {
+    // 页面访问权限
+    canAccessAdmin,
+    canAccessPage,
+    getUserPages,
+
+    // 角色检查
+    isUser,
+    isSongAdmin,
+    isAdmin,
+    isSuperAdmin,
+    isAdminOrAbove,
+    isSongAdminOrAbove,
+
+    // 功能权限
+    canPrintSchedule,
+
+    // 用户管理权限
+    canManageUserRole
+  }
+}