77 lines
1.9 KiB
PHP
77 lines
1.9 KiB
PHP
<?php
|
|
|
|
namespace App\Utilities;
|
|
|
|
use App\Models\Auth\User;
|
|
|
|
class SystemAccess
|
|
{
|
|
public const SUPER_ADMIN = 'super_admin';
|
|
public const ADMIN = 'admin';
|
|
public const USER = 'user';
|
|
|
|
public static function roleName(?User $user = null): string
|
|
{
|
|
$user ??= user();
|
|
|
|
if (! $user) {
|
|
return '';
|
|
}
|
|
|
|
// 身份变更必须立即生效，不能沿用权限库中已缓存的旧角色。
|
|
$roles = $user->roles()->pluck('name')->all();
|
|
|
|
foreach ([self::SUPER_ADMIN, self::ADMIN, self::USER] as $role) {
|
|
if (in_array($role, $roles, true)) {
|
|
return $role;
|
|
}
|
|
}
|
|
|
|
return '';
|
|
}
|
|
|
|
public static function canOpenSettings(?User $user = null): bool
|
|
{
|
|
return in_array(self::roleName($user), [self::SUPER_ADMIN, self::ADMIN], true);
|
|
}
|
|
|
|
public static function isSuperAdmin(?User $user = null): bool
|
|
{
|
|
return self::roleName($user) === self::SUPER_ADMIN;
|
|
}
|
|
|
|
public static function canManageUser(User $actor, User $target): bool
|
|
{
|
|
if (self::isSuperAdmin($actor)) {
|
|
return true;
|
|
}
|
|
|
|
return self::roleName($actor) === self::ADMIN
|
|
&& self::roleName($target) === self::USER;
|
|
}
|
|
|
|
public static function assignableRoles(?User $actor = null): array
|
|
{
|
|
$actor ??= user();
|
|
|
|
if (self::isSuperAdmin($actor)) {
|
|
return [
|
|
self::SUPER_ADMIN => '主管理员（最高权限）',
|
|
self::ADMIN => '管理员',
|
|
self::USER => '普通用户',
|
|
];
|
|
}
|
|
|
|
return [self::USER => '普通用户'];
|
|
}
|
|
|
|
public static function roleLabels(): array
|
|
{
|
|
return [
|
|
self::SUPER_ADMIN => '主管理员',
|
|
self::ADMIN => '管理员',
|
|
self::USER => '普通用户',
|
|
];
|
|
}
|
|
}
|