用户组增加权限控制

src/app/api/manga/_utils.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 
 import { getAuthInfoFromCookie } from '@/lib/auth';
 import { db } from '@/lib/db';
+import { hasFeaturePermission } from '@/lib/permissions';
 
 export async function getAuthorizedUsername(request: NextRequest): Promise<string | NextResponse> {
   const authInfo = getAuthInfoFromCookie(request);
@@ -19,5 +20,10 @@ export async function getAuthorizedUsername(request: NextRequest): Promise<strin
     }
   }
 
+  const allowed = await hasFeaturePermission(authInfo.username, 'manga');
+  if (!allowed) {
+    return NextResponse.json({ error: '无权限访问漫画功能' }, { status: 403 });
+  }
+
   return authInfo.username;
 }