用户组增加权限控制

src/app/api/netdisk/quark/instant-play/route.ts

@@ -3,6 +3,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { getAuthInfoFromCookie } from '@/lib/auth';
 import { getConfig } from '@/lib/config';
 import { createQuarkInstantPlayFolder } from '@/lib/netdisk/quark.client';
+import { hasFeaturePermission } from '@/lib/permissions';
 import { base58Encode } from '@/lib/utils';
 
 export const runtime = 'nodejs';
@@ -21,6 +22,9 @@ export async function POST(request: NextRequest) {
     if (!authInfo?.username) {
       return NextResponse.json({ error: '未登录' }, { status: 401 });
     }
+    if (!(await hasFeaturePermission(authInfo.username, 'netdisk_temp_play'))) {
+      return NextResponse.json({ error: '无权限使用临时播放' }, { status: 403 });
+    }
 
     const { shareUrl, passcode, title } = await request.json();
     if (!shareUrl) {

src/app/api/netdisk/quark/transfer/route.ts

@@ -3,6 +3,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { getAuthInfoFromCookie } from '@/lib/auth';
 import { getConfig } from '@/lib/config';
 import { transferQuarkShare } from '@/lib/netdisk/quark.client';
+import { hasFeaturePermission } from '@/lib/permissions';
 
 export const runtime = 'nodejs';
 
@@ -12,6 +13,9 @@ export async function POST(request: NextRequest) {
     if (!authInfo?.username) {
       return NextResponse.json({ error: '未登录' }, { status: 401 });
     }
+    if (!(await hasFeaturePermission(authInfo.username, 'netdisk_transfer'))) {
+      return NextResponse.json({ error: '无权限使用网盘转存' }, { status: 403 });
+    }
 
     const { shareUrl, passcode } = await request.json();
     if (!shareUrl) {