用户组增加权限控制

src/app/api/emby/cms-proxy/[token]/route.ts

@@ -4,6 +4,7 @@ import { NextRequest, NextResponse } from 'next/server';
 
 import { getConfig } from '@/lib/config';
 import { EmbyClient } from '@/lib/emby.client';
+import { hasFeaturePermission } from '@/lib/permissions';
 
 export const runtime = 'nodejs';
 
@@ -45,7 +46,8 @@ export async function GET(
     if (username) {
       // 检查用户是否被封禁
       const userInfo = await db.getUserInfoV2(username);
-      if (userInfo && !userInfo.banned) {
+      const allowed = await hasFeaturePermission(username, 'emby');
+      if (userInfo && !userInfo.banned && allowed) {
         isValidToken = true;
       }
     }

src/app/api/emby/detail/route.ts

@@ -4,6 +4,7 @@ import { NextRequest, NextResponse } from 'next/server';
 
 import { embyManager } from '@/lib/emby-manager';
 import { getProxyToken } from '@/lib/emby-token';
+import { requireFeaturePermission } from '@/lib/permissions';
 
 export const runtime = 'nodejs';
 
@@ -17,6 +18,8 @@ export async function GET(request: NextRequest) {
   }
 
   try {
+    const authResult = await requireFeaturePermission(request, 'emby', '无权限访问 Emby');
+    if (authResult instanceof NextResponse) return authResult;
     // 获取Emby客户端
     const client = await embyManager.getClient(embyKey);
 

src/app/api/emby/image/[token]/[itemId]/route.ts

@@ -4,6 +4,7 @@ import { NextRequest, NextResponse } from 'next/server';
 
 import { getAuthInfoFromCookie } from '@/lib/auth';
 import { getConfig } from '@/lib/config';
+import { hasFeaturePermission } from '@/lib/permissions';
 
 export const runtime = 'nodejs';
 
@@ -54,14 +55,18 @@ export async function GET(
       if (username) {
         // 检查用户是否被封禁
         const userInfo = await db.getUserInfoV2(username);
-        if (userInfo && !userInfo.banned) {
+        const allowed = await hasFeaturePermission(username, 'emby');
+        if (userInfo && !userInfo.banned && allowed) {
           hasValidToken = true;
         }
       }
     }
 
     // 验证用户登录
-    const hasValidAuth = authInfo && authInfo.username;
+    const hasValidAuth = !!(
+      authInfo?.username &&
+      (await hasFeaturePermission(authInfo.username, 'emby'))
+    );
 
     // 两者至少满足其一
     if (!hasValidToken && !hasValidAuth) {

src/app/api/emby/list/route.ts

@@ -5,6 +5,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { getCachedEmbyList, setCachedEmbyList } from '@/lib/emby-cache';
 import { embyManager } from '@/lib/emby-manager';
 import { getProxyToken } from '@/lib/emby-token';
+import { requireFeaturePermission } from '@/lib/permissions';
 
 export const runtime = 'nodejs';
 
@@ -18,6 +19,8 @@ export async function GET(request: NextRequest) {
   const sortOrder = searchParams.get('sortOrder') || 'Ascending';
 
   try {
+    const authResult = await requireFeaturePermission(request, 'emby', '无权限访问 Emby');
+    if (authResult instanceof NextResponse) return authResult;
     // 判断是否是默认排序（只有默认排序才使用缓存）
     const isDefaultSort = sortBy === 'SortName' && sortOrder === 'Ascending';
 

src/app/api/emby/play/[token]/[filename]/route.ts

@@ -4,6 +4,7 @@ import { NextRequest, NextResponse } from 'next/server';
 
 import { getAuthInfoFromCookie } from '@/lib/auth';
 import { getConfig } from '@/lib/config';
+import { hasFeaturePermission } from '@/lib/permissions';
 
 export const runtime = 'nodejs';
 
@@ -55,14 +56,18 @@ export async function GET(
       if (username) {
         // 检查用户是否被封禁
         const userInfo = await db.getUserInfoV2(username);
-        if (userInfo && !userInfo.banned) {
+        const allowed = await hasFeaturePermission(username, 'emby');
+        if (userInfo && !userInfo.banned && allowed) {
           hasValidToken = true;
         }
       }
     }
 
     // 验证用户登录
-    const hasValidAuth = authInfo && authInfo.username;
+    const hasValidAuth = !!(
+      authInfo?.username &&
+      (await hasFeaturePermission(authInfo.username, 'emby'))
+    );
 
     // 两者至少满足其一
     if (!hasValidToken && !hasValidAuth) {

src/app/api/emby/sources/route.ts

@@ -1,6 +1,7 @@
-import { NextResponse } from 'next/server';
+import { NextRequest, NextResponse } from 'next/server';
 
 import { embyManager } from '@/lib/emby-manager';
+import { requireFeaturePermission } from '@/lib/permissions';
 
 export const runtime = 'nodejs';
 export const dynamic = 'force-dynamic'; // 禁用缓存
@@ -8,8 +9,10 @@ export const dynamic = 'force-dynamic'; // 禁用缓存
 /**
  * 获取所有启用的Emby源列表
  */
-export async function GET() {
+export async function GET(request: NextRequest) {
   try {
+    const authResult = await requireFeaturePermission(request, 'emby', '无权限访问 Emby');
+    if (authResult instanceof NextResponse) return authResult;
     const sources = await embyManager.getEnabledSources();
 
     return NextResponse.json({

src/app/api/emby/views/route.ts

@@ -4,11 +4,14 @@ import { NextRequest, NextResponse } from 'next/server';
 
 import { getCachedEmbyViews, setCachedEmbyViews } from '@/lib/emby-cache';
 import { embyManager } from '@/lib/emby-manager';
+import { requireFeaturePermission } from '@/lib/permissions';
 
 export const runtime = 'nodejs';
 
 export async function GET(request: NextRequest) {
   try {
+    const authResult = await requireFeaturePermission(request, 'emby', '无权限访问 Emby');
+    if (authResult instanceof NextResponse) return authResult;
     const { searchParams } = new URL(request.url);
     const embyKey = searchParams.get('embyKey') || undefined;