20593b7173
- Introduced `resolveDashboardGuild` to handle guild resolution for both managed and owner-panel bypass scenarios. - Updated `GuildLayout` and `WelcomePage` components to utilize the new guild resolution logic, improving access handling. - Enhanced `DashboardShell` to display an informational banner for users accessing guilds via the owner-panel bypass. - Added localization support for owner bypass messages in English and German. - Updated authentication logic to allow owner-panel users to access guilds without Discord Manage Guild permission.
64 lines
2.0 KiB
TypeScript
64 lines
2.0 KiB
TypeScript
import { redirect } from 'next/navigation';
|
|
import {
|
|
ownerRoleAtLeast,
|
|
OwnerRoleSchema,
|
|
type OwnerRole
|
|
} from '@nexumi/shared';
|
|
import { ForbiddenError, UnauthorizedError, requireAuth, requireAuthOrRedirect } from './auth';
|
|
import { env } from './env';
|
|
import { prisma } from './prisma';
|
|
import type { SessionPayload } from './session';
|
|
|
|
export type OwnerSession = SessionPayload & { ownerRole: OwnerRole };
|
|
|
|
function bootstrapOwnerIds(): string[] {
|
|
return env.OWNER_USER_IDS ?? [];
|
|
}
|
|
|
|
export async function resolveOwnerRole(userId: string): Promise<OwnerRole | null> {
|
|
if (bootstrapOwnerIds().includes(userId)) {
|
|
return 'OWNER';
|
|
}
|
|
const member = await prisma.ownerTeamMember.findUnique({ where: { userId } });
|
|
if (!member) {
|
|
return null;
|
|
}
|
|
const parsed = OwnerRoleSchema.safeParse(member.role);
|
|
return parsed.success ? parsed.data : null;
|
|
}
|
|
|
|
export async function isOwnerUser(userId: string): Promise<boolean> {
|
|
return (await resolveOwnerRole(userId)) !== null;
|
|
}
|
|
|
|
/**
|
|
* Owner-panel team members (any role) may open every guild where the bot is
|
|
* installed — for support without needing Manage Guild on Discord.
|
|
*/
|
|
export async function hasOwnerGuildBypass(userId: string): Promise<boolean> {
|
|
return (await resolveOwnerRole(userId)) !== null;
|
|
}
|
|
|
|
export async function requireOwner(minimum: OwnerRole = 'VIEWER'): Promise<OwnerSession> {
|
|
const session = await requireAuth();
|
|
const role = await resolveOwnerRole(session.user.id);
|
|
if (!role) {
|
|
throw new ForbiddenError('Owner panel access required');
|
|
}
|
|
if (!ownerRoleAtLeast(role, minimum)) {
|
|
throw new ForbiddenError('Insufficient owner role');
|
|
}
|
|
return { ...session, ownerRole: role };
|
|
}
|
|
|
|
export async function requireOwnerOrRedirect(minimum: OwnerRole = 'VIEWER'): Promise<OwnerSession> {
|
|
const session = await requireAuthOrRedirect();
|
|
const role = await resolveOwnerRole(session.user.id);
|
|
if (!role || !ownerRoleAtLeast(role, minimum)) {
|
|
redirect('/dashboard');
|
|
}
|
|
return { ...session, ownerRole: role };
|
|
}
|
|
|
|
export { UnauthorizedError, ForbiddenError };
|