fix: unify staging admin access

frontend/src/lib/admin/auth-policy.ts

@@ -1,6 +1,6 @@
 import type { IdentityUser } from "@/modules/identity/contracts";
 
-export type AdminRole = "admin" | "viewer";
+export type AdminRole = "admin";
 
 export type AdminAccessResult =
   | { allowed: true; role: AdminRole }
@@ -11,13 +11,8 @@ export function authorizeAdminAccess(
   access: "read" | "write",
 ): AdminAccessResult {
   if (!user) return { allowed: false, status: 401 };
-  const role: AdminRole | null = user.role.includes("admin")
-    ? "admin"
-    : user.role.includes("viewer")
-      ? "viewer"
-      : null;
-  if (!role || (access === "write" && role !== "admin")) {
+  if (!user.role.includes("admin")) {
     return { allowed: false, status: 403 };
   }
-  return { allowed: true, role };
+  return { allowed: true, role: "admin" };
 }

frontend/src/lib/admin/auth.ts

@@ -34,7 +34,7 @@ export async function requireAdminSession(
 
   try {
     const user = await requireIdentityUser(
-      getIdentityAuthServices().admin.api,
+      getIdentityAuthServices().user.api,
       new Headers(await headers()),
     );
     const authorization = authorizeAdminAccess(user, access);

frontend/src/lib/admin/providers.ts

@@ -18,7 +18,7 @@ export type AdminIdentity = {
   id: string;
   email: string;
   name: string;
-  role: "admin" | "viewer";
+  role: "admin";
 };
 
 const apiBase = "/api/admin";
@@ -165,7 +165,7 @@ export const adminAccessControlProvider: AccessControlProvider = {
     }
     return role === "admin"
       ? { can: true }
-      : { can: false, reason: "viewer 仅可查看" };
+      : { can: false, reason: "无管理员权限" };
   },
   options: {
     buttons: { enableAccessControl: true, hideIfUnauthorized: true },

frontend/src/lib/supabase/admin.ts

@@ -19,7 +19,7 @@ export async function isAdminUser(user: { id?: string; email?: string | null })
       return rows[0]?.role
         .split(",")
         .map((role) => role.trim())
-        .some((role) => role === "admin" || role === "viewer") ?? false;
+        .some((role) => role === "admin") ?? false;
     } catch {
       return false;
     }

frontend/src/lib/supabase/server.ts

@@ -7,20 +7,15 @@ import { createLocalPostgresDataClient } from "@/lib/db/local-postgres-client";
 import { readDatabaseUrl } from "@/lib/db/config";
 import { getIdentityAuthServices } from "@/modules/identity/auth";
 import { readIdentitySession } from "@/modules/identity/session";
-import { readSelfHostedIdentityConfig } from "@/modules/identity/config";
-import { resolveIdentitySurface } from "@/modules/identity/host";
 import { getSupabasePublicConfig } from "./config";
 
 export async function createServerSupabaseClient() {
   if (process.env.AUTH_PROVIDER?.trim() === "self-hosted") {
     const requestHeaders = new Headers(await headers());
-    const services = getIdentityAuthServices();
-    const surface = resolveIdentitySurface(
-      requestHeaders.get("host"),
-      readSelfHostedIdentityConfig(process.env),
+    const session = await readIdentitySession(
+      getIdentityAuthServices().user.api,
+      requestHeaders,
     );
-    const auth = surface === "admin" ? services.admin : services.user;
-    const session = await readIdentitySession(auth.api, requestHeaders);
     return createLocalPostgresDataClient(
       readDatabaseUrl(process.env, "APP_DATABASE_URL"),
       session ? { id: session.user.id, email: session.user.email } : null,