feat: add asset import services

src/lib/api-handler.ts

@@ -0,0 +1,38 @@
+import type { NextRequest } from 'next/server'
+import { NextResponse } from 'next/server'
+import { logAuthorizationEvent } from '@/lib/admin/authorization-events'
+import { canAccess, getApiAdminContext } from '@/lib/permissions'
+import { logServerError } from '@/lib/server-log'
+
+type AdminContext = NonNullable<Awaited<ReturnType<typeof getApiAdminContext>>>
+type RouteContext = { params?: Promise<Record<string, string | string[]>> }
+type AdminHandler = (
+  request: NextRequest,
+  context: AdminContext,
+  routeContext: RouteContext,
+) => Promise<Response> | Response
+
+export function withAdmin(options: { permission?: string }, handler: AdminHandler) {
+  return async (request: NextRequest, routeContext: RouteContext = {}) => {
+    const context = await getApiAdminContext()
+    if (!context) return NextResponse.json({ ok: false, error: 'Unauthorized' }, { status: 401 })
+    if (options.permission && !canAccess(context.permissions, options.permission, context.session.user.rank)) {
+      await logAuthorizationEvent({
+        kind: 'permission.denied',
+        userId: context.session.user.id,
+        username: context.session.user.username,
+        rank: context.session.user.rank,
+        permission: options.permission,
+        source: request.nextUrl.pathname,
+        reason: 'API permission check denied',
+      })
+      return NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 })
+    }
+    try {
+      return await handler(request, context, routeContext)
+    } catch (error) {
+      logServerError('admin.api_failed', error, { path: request.nextUrl.pathname, userId: context.session.user.id })
+      return NextResponse.json({ ok: false, error: 'Internal server error' }, { status: 500 })
+    }
+  }
+}