59 lines
2.1 KiB
TypeScript
59 lines
2.1 KiB
TypeScript
import { canUserAccessPrivateTaskDetail } from '@/lib/user-permission-inherit'
|
|
import { isOperationsGMaterial, isRestrictedMaterial } from '@/lib/material-access-scope'
|
|
import { canAccessOperationsGMaterials } from '@/lib/material-organization-access'
|
|
import { isSuperAdmin } from '@/lib/department-permission'
|
|
|
|
export const TASK_DETAIL_PRIVACY_SELECT = {
|
|
taskDetailPrivate: true,
|
|
taskDetailDemandType: true,
|
|
taskDetailRequesterUserId: true,
|
|
accessScope: true,
|
|
} as const
|
|
|
|
export interface TaskDetailPrivacyMaterial {
|
|
materialType?: string | null
|
|
taskDetailPrivate?: boolean | null
|
|
taskDetailRequesterUserId?: string | null
|
|
accessScope?: string | null
|
|
}
|
|
|
|
export function isPrivateTaskDetail(material: TaskDetailPrivacyMaterial): boolean {
|
|
return material.taskDetailPrivate === true
|
|
}
|
|
|
|
/** 登录账号的素材范围准入。外部接口独立使用公开范围条件。 */
|
|
export async function canAccessMaterialPrivacy(
|
|
material: TaskDetailPrivacyMaterial,
|
|
userId?: string | null,
|
|
): Promise<boolean> {
|
|
if (!isRestrictedMaterial(material)) return true
|
|
if (!userId) return false
|
|
if (await isSuperAdmin(userId)) return true
|
|
if (isOperationsGMaterial(material)) return canAccessOperationsGMaterials(userId)
|
|
if (material.taskDetailRequesterUserId === userId) return true
|
|
return canUserAccessPrivateTaskDetail(userId)
|
|
}
|
|
|
|
export function privateTaskDetailAccessWhere(userId: string, canAccessAll: boolean) {
|
|
return {
|
|
materialType: '任务-详情',
|
|
taskDetailPrivate: true,
|
|
accessScope: 'general',
|
|
...(canAccessAll ? {} : { taskDetailRequesterUserId: userId }),
|
|
}
|
|
}
|
|
|
|
export async function buildMaterialPrivacyWhere(userId: string) {
|
|
if (await isSuperAdmin(userId)) return {}
|
|
|
|
const [canAccessPrivate, canAccessOperationsG] = await Promise.all([
|
|
canUserAccessPrivateTaskDetail(userId),
|
|
canAccessOperationsGMaterials(userId),
|
|
])
|
|
return { OR: [
|
|
{ taskDetailPrivate: false, accessScope: 'general' },
|
|
privateTaskDetailAccessWhere(userId, canAccessPrivate),
|
|
...(canAccessOperationsG ? [{ accessScope: 'operations_g' }] : []),
|
|
] }
|
|
}
|