用户组增加权限控制

src/app/api/admin/user/route.ts

@@ -5,6 +5,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { getAuthInfoFromCookie } from '@/lib/auth';
 import { getConfig } from '@/lib/config';
 import { db } from '@/lib/db';
+import { sanitizeFeaturePermissions } from '@/lib/feature-permissions';
 
 export const runtime = 'nodejs';
 
@@ -356,11 +357,13 @@ export async function POST(request: NextRequest) {
       }
       case 'userGroup': {
         // 用户组管理操作
-        const { groupAction, groupName, enabledApis } = body as {
+        const { groupAction, groupName, enabledApis, permissions } = body as {
           groupAction: 'add' | 'edit' | 'delete';
           groupName: string;
           enabledApis?: string[];
+          permissions?: string[];
         };
+        const normalizedPermissions = sanitizeFeaturePermissions(permissions);
 
         if (!adminConfig.UserConfig.Tags) {
           adminConfig.UserConfig.Tags = [];
@@ -375,6 +378,7 @@ export async function POST(request: NextRequest) {
             adminConfig.UserConfig.Tags.push({
               name: groupName,
               enabledApis: enabledApis || [],
+              permissions: normalizedPermissions,
             });
             break;
           }
@@ -384,6 +388,7 @@ export async function POST(request: NextRequest) {
               return NextResponse.json({ error: '用户组不存在' }, { status: 404 });
             }
             adminConfig.UserConfig.Tags[groupIndex].enabledApis = enabledApis || [];
+            adminConfig.UserConfig.Tags[groupIndex].permissions = normalizedPermissions;
             break;
           }
           case 'delete': {