fix: restore complete admin feature dependencies

2026-07-11 21:15:54 +02:00
1 parent 5b4228261a
commit 0cd753c735
@@ -0,0 +1,122 @@
+import type { z } from 'zod'
+import { auth } from '@/lib/auth'
+import { canAccess, getApiAdminContext } from '@/lib/permissions'
+import { type ActionResult, actionError, handleActionError } from '@/lib/safe-action-shared'
+
+export type { ActionResult }
+
+// ── Admin action wrapper ─────────────────────────────────────────────
+
+interface AdminActionOptions<TSchema extends z.ZodType | undefined = undefined> {
+  permission?: string
+  schema?: TSchema
+}
+
+type AdminActionContext<TSchema extends z.ZodType | undefined> = {
+  session: { user: { id: number; username: string; rank: number; look: string; mail: string } }
+} & (TSchema extends z.ZodType ? { data: z.infer<TSchema> } : object)
+
+/**
+ * Create a server action with admin auth + optional permission + optional Zod validation.
+ *
+ * @example
+ * export const updateNews = adminAction(
+ *   { permission: PERMS.NEWS_EDIT, schema: updateNewsSchema },
+ *   async (ctx) => {
+ *     await prisma.websiteArticle.update({ ... })
+ *     return actionOk()
+ *   }
+ * )
+ */
+export function adminAction<TSchema extends z.ZodType | undefined = undefined>(
+  options: AdminActionOptions<TSchema>,
+  handler: (ctx: AdminActionContext<TSchema>) => Promise<ActionResult>,
+) {
+  return async (
+    // biome-ignore lint/suspicious/noConfusingVoidType: void in conditional return lets callers omit the arg when there's no schema
+    input: TSchema extends z.ZodType ? z.input<TSchema> : void,
+  ): Promise<ActionResult> => {
+    try {
+      const apiCtx = await getApiAdminContext()
+      if (!apiCtx) return actionError('Unauthorized')
+
+      if (options.permission) {
+        if (!canAccess(apiCtx.permissions, options.permission, apiCtx.session.user.rank)) {
+          return actionError('Unauthorized')
+        }
+      }
+
+      let data: unknown
+      if (options.schema) {
+        const parsed = options.schema.safeParse(input)
+        if (!parsed.success) {
+          return {
+            ok: false,
+            error: 'Validation failed',
+            fieldErrors: parsed.error.flatten().fieldErrors as Record<string, string[]>,
+          }
+        }
+        data = parsed.data
+      }
+
+      const ctx = {
+        session: apiCtx.session,
+        ...(options.schema ? { data } : {}),
+      } as AdminActionContext<TSchema>
+
+      return await handler(ctx)
+    } catch (error) {
+      return handleActionError(error)
+    }
+  }
+}
+
+// ── Auth action wrapper (no permissions) ─────────────────────────────
+
+interface AuthActionOptions<TSchema extends z.ZodType | undefined = undefined> {
+  schema?: TSchema
+}
+
+type AuthActionContext<TSchema extends z.ZodType | undefined> = {
+  session: { user: { id: number; username: string; rank: number; look: string; mail: string } }
+} & (TSchema extends z.ZodType ? { data: z.infer<TSchema> } : object)
+
+/**
+ * Create a server action with auth only (no permission check).
+ */
+export function authAction<TSchema extends z.ZodType | undefined = undefined>(
+  options: AuthActionOptions<TSchema>,
+  handler: (ctx: AuthActionContext<TSchema>) => Promise<ActionResult>,
+) {
+  return async (
+    // biome-ignore lint/suspicious/noConfusingVoidType: void in conditional return lets callers omit the arg when there's no schema
+    input: TSchema extends z.ZodType ? z.input<TSchema> : void,
+  ): Promise<ActionResult> => {
+    try {
+      const session = await auth()
+      if (!session?.user) return actionError('Unauthorized')
+
+      let data: unknown
+      if (options.schema) {
+        const parsed = options.schema.safeParse(input)
+        if (!parsed.success) {
+          return {
+            ok: false,
+            error: 'Validation failed',
+            fieldErrors: parsed.error.flatten().fieldErrors as Record<string, string[]>,
+          }
+        }
+        data = parsed.data
+      }
+
+      const ctx = {
+        session,
+        ...(options.schema ? { data } : {}),
+      } as AuthActionContext<TSchema>
+
+      return await handler(ctx)
+    } catch (error) {
+      return handleActionError(error)
+    }
+  }
+}