From d09d853764316282939728d2ae3090440f355ffa Mon Sep 17 00:00:00 2001 From: adonis Date: Wed, 19 Aug 2026 18:49:08 +0330 Subject: [PATCH] fix(settings): hide can_edit=1 keys on superadmin settings page Filter program settings UI by generated system-key allowlist so editable tenant settings (e.g. montzar_product_id) never appear in superadmin. Co-authored-by: Cursor --- src/config/superAdminSettingKeys.ts | 199 ++++++++++++++++++++++++++++ src/pages/ProgramSettingsPage.vue | 2 + 2 files changed, 201 insertions(+) create mode 100644 src/config/superAdminSettingKeys.ts diff --git a/src/config/superAdminSettingKeys.ts b/src/config/superAdminSettingKeys.ts new file mode 100644 index 0000000..ec6bbe2 --- /dev/null +++ b/src/config/superAdminSettingKeys.ts @@ -0,0 +1,199 @@ +/** + * کلیدهای تنظیمات سوپرادمین — هم‌تراز deploy_settings_const.sql + * تولید خودکار: controlpanel_server/scripts/sync-superadmin-setting-template.mjs + */ +export const SUPERADMIN_SYSTEM_SETTING_KEYS = new Set([ + "accounting_provider", + "admin_url", + "apk_download_link", + "app_url", + "bale_bot_token", + "chart_id", + "chart_use_local_data", + "chat_api", + "chat_api_key", + "chat_download_url", + "chat_upload_url", + "chat_webhook_base_url", + "chat_webhook_secret", + "customer_direct_sms", + "customer_special_pricing", + "down_price", + "enable_conditional_order", + "enable_customer_level_profit", + "enable_product_funds", + "external_order_api_enabled", + "external_payment_base_url", + "external_payment_client_id", + "external_payment_client_secret", + "external_payment_enabled", + "external_payment_gateway", + "external_payment_return_url", + "external_payment_webhook_url", + "fee_deduct_from_gold", + "group_sms", + "has_page_earn_money", + "has_page_gift_card", + "has_page_notification", + "has_page_price_trigger", + "is_store", + "jibit_enabled", + "logo_login", + "logo_register", + "main_metal", + "main_wallet_products", + "metal_type", + "montify_name", + "montzar_base_url", + "montzar_closed", + "montzar_diff", + "montzar_last_product_log", + "montzar_live_price", + "montzar_mazaneh", + "montzar_order_response", + "montzar_token", + "montzar_truly_buy_mazaneh", + "montzar_truly_sell_mazaneh", + "node_client_id", + "node_shared_secret", + "pargar_api_token", + "pargar_item_id_gold", + "pargar_item_id_rial", + "pargar_password", + "pargar_username", + "payping_fin_customer_id", + "payping_fin_sync_enabled", + "payping_fin_token", + "payping_fin_url", + "payping_gateway_items", + "payping_gateway_name", + "payping_round_toman", + "payping_start_url", + "payping_strict_failed_withdraw", + "payping_verify_url", + "permision__enabled", + "price_channel_access", + "price_channel_bale_to", + "price_channel_rubika_to", + "price_channel_telegram_to", + "price_extreme_date", + "referral_bonus_amount", + "rubika_bot_token", + "send_to_pargar", + "send_to_tahesab", + "show_to_users_chat", + "sms_panel", + "sse_path", + "tahesab_bank_account", + "tahesab_db", + "tahesab_host", + "tahesab_port", + "tahesab_token", + "telegram_bot_token", + "unit", + "up_price", + "wallet_payment_provider", + "wss_enabled", + "zarin_api", + "zarin_gorohe_kar", + "zarin_name_g", + "zarin_noe_kar", + "zarin_noe_kar_tedadi", + "zarin_token", + "zarin_uid_prefix", +]); + +export const SUPERADMIN_EDITABLE_SETTING_KEYS = new Set([ + "auto_active_customer", + "balance_report_exclude_customer_id", + "banner_enabled", + "buy_fee", + "change_mesghal", + "charge_notif", + "close_price", + "deposit_account_holder", + "deposit_account_number", + "deposit_card_number", + "deposit_method_card_to_card", + "deposit_method_gateway", + "deposit_method_identified", + "deposit_method_shetab", + "deposit_sheba", + "deposit_sms_support_number", + "endDay", + "fee_conditional_order", + "fee_free", + "fee_service_charge_percentage", + "gift_for_referral", + "gift_for_referrer", + "has_chat", + "jibit_verification", + "main_product_price", + "min_deposit", + "min_first_buy", + "min_withdraw", + "minimum_sell", + "montzar_mobile", + "montzar_open_buy", + "montzar_open_sell", + "montzar_password", + "montzar_product_id", + "name_fa", + "open_register", + "price_channel_diff", + "price_channel_enabled", + "price_channel_footer_id", + "price_channel_footer_link", + "price_channel_footer_phone", + "price_channel_messengers", + "price_channel_min_seconds", + "products_site_link_enabled", + "products_site_link_text", + "products_site_link_url", + "referral_gift_buy_from_montzar", + "referral_gift_on_first_order", + "referral_id", + "referral_limit", + "referral_show", + "register_jibit_verify", + "register_referral_bonus_message", + "register_referral_sms_to_referrer", + "require_zero_main_gold_before_other_buy", + "sell_fee", + "show_gold_ounce_price", + "show_home_price_when_closed", + "show_last_price", + "show_product_card_meta", + "show_product_details", + "show_product_trade_status", + "sms_notif_bank_card_admin", + "sms_notif_bank_card_customer", + "sms_notif_fund_withdraw_admin", + "sms_notif_fund_withdraw_customer", + "sms_notif_gateway_charge_admin", + "sms_notif_jibit_admin", + "sms_notif_login_otp", + "sms_notif_order_admin", + "sms_notif_order_customer", + "sms_notif_price_trigger", + "sms_notif_register_admin", + "sms_notif_register_customer", + "sms_notif_support_admin", + "sms_notif_wallet_alert", + "sms_notif_withdraw_admin", + "sms_notif_withdraw_otp", + "startDay", + "support_messenger", + "support_messenger_id", + "support_messenger_text", + "tracking_systems", + "tracking_systems_enabled", +]); + +export function isSuperAdminSystemSettingKey(key?: string | null): boolean { + const k = String(key || '').trim(); + if (!k) return false; + if (SUPERADMIN_EDITABLE_SETTING_KEYS.has(k)) return false; + return SUPERADMIN_SYSTEM_SETTING_KEYS.has(k); +} + diff --git a/src/pages/ProgramSettingsPage.vue b/src/pages/ProgramSettingsPage.vue index 40ab5aa..f44b1ed 100644 --- a/src/pages/ProgramSettingsPage.vue +++ b/src/pages/ProgramSettingsPage.vue @@ -38,6 +38,7 @@ import { normalizeSettingRow, resolveSettingFieldType, } from '@/config/khanegiSettingCatalog' +import { isSuperAdminSystemSettingKey } from '@/config/superAdminSettingKeys' import type { KhanegiSettingRow } from '@/config/khanegiSettingRow' import { useAuthStore } from '@/stores/auth' @@ -133,6 +134,7 @@ const filteredRows = computed(() => { const q = search.value.trim().toLowerCase() return [...items.value] .filter((row) => { + if (!isSuperAdminSystemSettingKey(row.key)) return false if (!isSettingVisible(row.key)) return false if (filterType.value && resolveSettingFieldType(row) !== filterType.value) return false if (!q) return true