koc-loop/lib/owner-scope.ts

import type { DatabaseClient } from "./database";
import { getRequestPrincipal } from "./user-auth";

export type OwnerScope =
  | { kind: "full" }
  | { kind: "owner"; wecomUserId: string };

export async function getOwnerScope(request: Request): Promise<OwnerScope> {
  const principal = await getRequestPrincipal(request);
  if (!principal) return { kind: "owner", wecomUserId: "" };
  if (principal.kind === "internal") return { kind: "full" };
  if (
    principal.user.role === "super_admin" ||
    principal.user.role === "admin"
  ) {
    return { kind: "full" };
  }
  return { kind: "owner", wecomUserId: principal.user.wecom_userid ?? "" };
}

export function ownerScopeUserid(scope: OwnerScope): string | undefined {
  return scope.kind === "owner" ? scope.wecomUserId : undefined;
}

export async function isTaskOwner(
  db: DatabaseClient,
  taskId: string,
  wecomUserId: string,
) {
  const id = String(taskId ?? "").trim();
  if (!id || !wecomUserId) return false;
  const row = await db
    .prepare("SELECT id FROM tasks WHERE id = ? AND owner_userid = ? LIMIT 1")
    .bind(id, wecomUserId)
    .first<{ id: string }>();
  return Boolean(row);
}

export async function isDistributionOwner(
  db: DatabaseClient,
  distributionId: string,
  wecomUserId: string,
) {
  const id = String(distributionId ?? "").trim();
  if (!id || !wecomUserId) return false;
  const row = await db
    .prepare(
      `SELECT d.id
       FROM distributions d
       JOIN tasks t ON t.id = d.task_id
       WHERE d.id = ? AND t.owner_userid = ?
       LIMIT 1`,
    )
    .bind(id, wecomUserId)
    .first<{ id: string }>();
  return Boolean(row);
}

export function ownerForbidden() {
  return Response.json({ error: "该任务未分配给您，无权操作" }, { status: 403 });
}