Jesse_Chen
754505d40a
Owner recovery lived in the identity-only migration path and could clear historical revocations on conflict. Admin layout also rethrew authorization 503s, turning service-unavailable failures into 500 responses.\n\nMove recovery behind the RBAC migration sequence, exclude revoked candidates without mutating their history, and terminate layout redirects at a no-store 503 route.
24 lines
717 B
TypeScript
24 lines
717 B
TypeScript
export type AdminPageAuthorizationStatus = 401 | 403 | 503;
|
|
|
|
export type AdminPageAccessFailure =
|
|
| { kind: "login"; location: "/login" }
|
|
| { kind: "forbidden"; status: 403; message: string }
|
|
| { kind: "unavailable"; status: 503; message: string; location: "/admin-unavailable" };
|
|
|
|
export function resolveAdminPageAccessFailure(
|
|
status: AdminPageAuthorizationStatus,
|
|
): AdminPageAccessFailure {
|
|
if (status === 401) {
|
|
return { kind: "login", location: "/login" };
|
|
}
|
|
if (status === 403) {
|
|
return { kind: "forbidden", status, message: "无权访问后台" };
|
|
}
|
|
return {
|
|
kind: "unavailable",
|
|
status,
|
|
message: "后台服务暂时不可用",
|
|
location: "/admin-unavailable",
|
|
};
|
|
}
|