权限与风控

import { can, cannot, Action, Subject } from "@01mvp/permissions";
import type { AppUser } from "@01mvp/permissions";

const user: AppUser = { id: "user-123", role: Role.USER };

// 检查用户能否创建项目
if (can(user, Action.CREATE, Subject.PROJECT)) {
  // 允许操作
}

// 检查用户能否更新其他用户的信息（带具体数据）
if (cannot(user, Action.UPDATE, Subject.USER, { id: "other-user-id" })) {
  // 拒绝操作
}

import { createAppUser, getAvailableActions, mapDatabaseRoleToAppRole } from "@01mvp/permissions";

// 从数据库用户记录创建 AppUser（自动映射 role 字符串到枚举）
const appUser = createAppUser({ id: "1", role: "vip" });

// 获取用户在某个对象上所有可执行的操作
const actions = getAvailableActions(appUser, Subject.PROJECT);
// => ["read", "create", "update", "delete"]

// 示例：给 VIP 用户增加查看订阅详情的权限
can(Action.READ, Subject.SUBSCRIPTION);

interface RouteConfig {
  pattern: RegExp;              // URL 匹配模式
  type: "page" | "api";        // 路由类型（影响响应格式）
  requiresAuth?: boolean;       // 是否需要登录（默认 true）
  requiredPermission?: {        // 所需权限
    action: string;
    subject: string;
  };
  requiresSubscription?: boolean; // 是否需要有效订阅
  isAuthRoute?: boolean;        // 是否为登录页（登录用户会被重定向走）
}

import { matchRoute, checkRouteAccess } from "@01mvp/auth/route-protection";

// 定义路由规则
const routes = [
  { pattern: /^\/admin/, type: "page", requiredPermission: { action: "manage", subject: "all" } },
  { pattern: /^\/dashboard/, type: "page", requiresAuth: true },
  { pattern: /^\/login/, type: "page", isAuthRoute: true },
  { pattern: /^\/api\/premium/, type: "api", requiresSubscription: true },
];

// 在中间件中使用
const route = matchRoute(pathname, routes);
if (route) {
  const result = checkRouteAccess(route, {
    isAuthenticated: !!session,
    userId: session?.user?.id,
    hasSubscription: userHasSub,
    checkPermission: (action, subject) => can(user, action, subject),
  });
  if (!result.allowed) {
    if (result.redirectUrl) return redirect(result.redirectUrl);
    return new Response(result.reason, { status: result.statusCode });
  }
}

// apps/01mvp-web/src/lib/auth/auth-config.ts
const twoFactorPlugin = (() => {
  if (!config.auth.enableTwoFactor) {
    return null;
  }
  return twoFactor();
})();

model TwoFactor {
  id          String   @id
  userId      String
  secret      String   // TOTP 密钥（加密存储）
  backupCodes String   // 备份码（JSON 数组，加密存储）
  user        User     @relation(fields: [userId], references: [id])
}

import { isAdmin, hasPermission, AdminPermission } from "@01mvp/auth/permissions";

if (isAdmin(user)) {
  // 是管理员
}

if (hasPermission(user, AdminPermission.BAN_USERS)) {
  // 有封禁用户权限
}

# 是否启用验证码（设为 true 或 1 启用）
CAPTCHA_ENABLED=true

# Cloudflare Turnstile 秘钥
CLOUDFLARE_TURNSTILE_SECRET_KEY=your-turnstile-secret-key

import { createCaptchaVerifier } from "@01mvp/captcha";

const verifier = createCaptchaVerifier({
  enabled: true,
  provider: "cloudflare-turnstile",
  cloudflare: { secretKey: process.env.CLOUDFLARE_TURNSTILE_SECRET_KEY! },
});

// 在 API 路由中验证
const result = await verifier.verify(tokenFromFrontend, requestIp);
if (!result.success) {
  // 验证失败，拒绝请求
}

import { createRateLimiter, setRateLimitHeaders } from "@01mvp/rate-limit";

// 创建限制器：每个 IP 每 60 秒最多 100 次请求
const limiter = createRateLimiter({
  limit: 100,
  window: 60,       // 时间窗口（秒）
  prefix: "api",    // key 前缀（可选）
});

// 在 API 路由中检查
const result = await limiter.check(clientIp);

// 设置标准响应头
setRateLimitHeaders(response.headers, result);

if (!result.success) {
  return new Response("Too Many Requests", { status: 429 });
}

import { createTencentCloudModerationClient } from "@01mvp/tencent-cloud";

const client = createTencentCloudModerationClient({
  secretId: process.env.TENCENT_SECRET_ID!,
  secretKey: process.env.TENCENT_SECRET_KEY!,
});

const result = await client.textModeration("待审核的文本内容");

// result.suggestion: "Pass"（通过）| "Block"（拦截）| "Review"（人工复审）
// result.label: 内容分类标签
// result.score: 置信度分数
// result.keywords: 触发的敏感词

const result = await client.imageModeration("https://example.com/image.jpg");

// result.suggestion: "Pass" | "Block" | "Review"
// result.label: 违规类型标签
// result.subLabel: 细分子标签
// result.score: 置信度分数

TENCENT_SECRET_ID=your-secret-id
TENCENT_SECRET_KEY=your-secret-key

# .env.local
COOKIE_DOMAIN=.example.com