From eb6fe2a369f2fac912d83f09ee2f6f59356407c9 Mon Sep 17 00:00:00 2001 From: "s.esmaeili" Date: Fri, 16 Oct 2026 09:27:41 +0330 Subject: [PATCH] =?UTF-8?q?Grant=20the=20static=20super-admin=20mobile=20f?= =?UTF-8?q?ull=20ALL=5FRIDS=20and=20move=20slider=20into=20=D8=AB=D8=A7?= =?UTF-8?q?=D8=A8=D8=AA=E2=80=8C=D9=87=D8=A7=20permissions.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Cursor --- apps/admin-panel/src/utils/superAdmin.ts | 2 ++ apps/admin-panel/src/views/manage/Const.vue | 10 +++++---- .../src/views/user/permissionConst.ts | 22 +++++++------------ apps/api/src/modules/auth/guards.spec.ts | 7 ++++-- apps/api/src/modules/auth/super-admin.ts | 14 ++++++++---- 5 files changed, 31 insertions(+), 24 deletions(-) diff --git a/apps/admin-panel/src/utils/superAdmin.ts b/apps/admin-panel/src/utils/superAdmin.ts index 2cbb9b9..d242d54 100644 --- a/apps/admin-panel/src/utils/superAdmin.ts +++ b/apps/admin-panel/src/utils/superAdmin.ts @@ -6,6 +6,8 @@ * gated by `users.isSuperAdmin` in place instead. * * Keep in step with SUPER_ADMIN_RIDS in apps/api/src/modules/auth/super-admin.ts. + * Login/JWT for that mobile grants the full ALL_RIDS set on the API side; this + * set is only the tree-filter used when editing other roles' permissions. */ export const SUPER_ADMIN_RIDS: ReadonlySet = new Set([ 'persons.create.single', diff --git a/apps/admin-panel/src/views/manage/Const.vue b/apps/admin-panel/src/views/manage/Const.vue index 7b8a202..8a4ba94 100644 --- a/apps/admin-panel/src/views/manage/Const.vue +++ b/apps/admin-panel/src/views/manage/Const.vue @@ -94,10 +94,10 @@ ذخیره برچسب ها - + @@ -370,7 +370,9 @@ onMounted(async () => { await Promise.all([loadBrands(), users.isSuperAdmin ? loadCollections() : Promise.resolve()]); const [t, s] = await Promise.all([ api.get('const/__list__tags'), - hasPermission('custom.config.statics.slider') ? api.get('const/slider') : Promise.resolve(null), + users.isSuperAdmin || hasPermission('custom.config.statics.slider') + ? api.get('const/slider') + : Promise.resolve(null), ]); tags.value = Array.isArray(t.data) ? t.data : []; sliders.value = Array.isArray(s?.data) ? s.data : []; diff --git a/apps/admin-panel/src/views/user/permissionConst.ts b/apps/admin-panel/src/views/user/permissionConst.ts index d397f3b..1de9245 100644 --- a/apps/admin-panel/src/views/user/permissionConst.ts +++ b/apps/admin-panel/src/views/user/permissionConst.ts @@ -827,6 +827,14 @@ export const treeData: PermissionNode[] = [ "key": "config.statics.tags.remove" }, ] + }, + { + "title": "اسلایدر موبایل", + "key": "custom.config.statics.slider" + }, + { + "title": "برچسب بنر اول سایت", + "key": "custom.config.statics.tags.banner.ids" } ] }, @@ -855,19 +863,5 @@ export const treeData: PermissionNode[] = [ { "title": "خبرنامه", "key": "newsletters.newsletters", - }, - { - "title": "سفارشی", - "key": "custom", - "children": [ - { - "title": "اسلایدر موبایل", - "key": "custom.config.statics.slider" - }, - { - "title": "برچسب بنر اول سایت", - "key": "custom.config.statics.tags.banner.ids" - }, - ] } ] diff --git a/apps/api/src/modules/auth/guards.spec.ts b/apps/api/src/modules/auth/guards.spec.ts index 430115d..0e29144 100644 --- a/apps/api/src/modules/auth/guards.spec.ts +++ b/apps/api/src/modules/auth/guards.spec.ts @@ -78,8 +78,11 @@ describe('PermissionsGuard — several rids', () => { }); describe('withSuperAdminRids', () => { - it('adds the super-admin rids for the super admin only', () => { - expect(withSuperAdminRids(SUPER_ADMIN_MOBILE, [])).toContain('config.wallet'); + it('grants every ALL_RIDS entry for the super admin only', () => { + const granted = withSuperAdminRids(SUPER_ADMIN_MOBILE, []); + expect(granted).toContain('config.wallet'); + expect(granted).toContain('custom.config.statics.slider'); + expect(granted.length).toBeGreaterThan(100); expect(withSuperAdminRids('09120000000', ['product.list'])).toEqual(['product.list']); }); }); diff --git a/apps/api/src/modules/auth/super-admin.ts b/apps/api/src/modules/auth/super-admin.ts index 08cf543..7cf0cd0 100644 --- a/apps/api/src/modules/auth/super-admin.ts +++ b/apps/api/src/modules/auth/super-admin.ts @@ -1,3 +1,5 @@ +import { ALL_RIDS } from './acl.constants'; + /** * The one account allowed to see the super-admin-only features (retail * customers and orders, bankers, walk-in shopkeepers, branches and workshops, @@ -9,8 +11,9 @@ export const SUPER_ADMIN_MOBILE = '09128081392'; /** * Rids of those features. The admin panel no longer offers them on the - * permission screen (except to the super admin), so the super admin is granted - * them here whatever its user type holds. + * permission screen (except to the super admin). Kept for the permission-tree + * filter in the panel; login/JWT grant the full ALL_RIDS set instead (see + * withSuperAdminRids) so this phone always sees every gated screen. */ export const SUPER_ADMIN_RIDS = [ 'persons.create.single', @@ -42,7 +45,10 @@ export function isSuperAdmin(mobile: string | null | undefined): boolean { return mobile?.trim() === SUPER_ADMIN_MOBILE; } -/** The raw rids an admin holds, plus SUPER_ADMIN_RIDS for the super admin. */ +/** + * For the super-admin mobile, grant every rid in ALL_RIDS (plus any extras + * already on the user type). Other admins keep only what their user type holds. + */ export function withSuperAdminRids(mobile: string | null | undefined, rids: string[]): string[] { - return isSuperAdmin(mobile) ? [...new Set([...rids, ...SUPER_ADMIN_RIDS])] : rids; + return isSuperAdmin(mobile) ? [...new Set([...rids, ...ALL_RIDS])] : rids; }