xiaoshu-app/projects/xiaoshu-admin/src/app/admin.guard.ts

import { inject } from '@angular/core';
import { CanActivateFn, Router } from '@angular/router';
import { AdminSessionService } from './admin-session.service';
import { AdminIdentity } from './admin.models';
import { CloudFunctionsService } from './cloud-functions.service';

export const adminGuard: CanActivateFn = (_route, state) => {
  const sessions = inject(AdminSessionService);
  if(sessions.session()?.passwordResetRequired&&state.url!=='/admin/change-password')return inject(Router).createUrlTree(['/admin/change-password']);
  if (sessions.isAuthenticated()) return true;
  return inject(Router).createUrlTree(['/admin/login'], { queryParams: { returnUrl: state.url } });
};

export const superAdminGuard: CanActivateFn = async (_route, state) => {
  const sessions = inject(AdminSessionService);
  const router = inject(Router);
  if (!sessions.isAuthenticated()) return router.createUrlTree(['/admin/login'], { queryParams: { returnUrl: state.url } });
  if (sessions.session()?.isSuperAdmin === true) return true;
  try {
    const identity = (await inject(CloudFunctionsService).admin<{ identity: AdminIdentity }>('meta')).identity;
    sessions.applyIdentity(identity);
    return identity.isSuperAdmin ? true : router.createUrlTree(['/admin/forbidden']);
  } catch {
    return router.createUrlTree(['/admin/forbidden']);
  }
};

export const operatorManagerGuard: CanActivateFn = async () => {
  const sessions=inject(AdminSessionService),router=inject(Router),functions=inject(CloudFunctionsService);
  try { const identity=(await functions.admin<{identity:AdminIdentity}>('meta')).identity; sessions.applyIdentity(identity); return identity.isSuperAdmin||identity.operationsRole==='ops-manager'?true:router.createUrlTree(['/admin/forbidden']); }
  catch { return router.createUrlTree(['/admin/forbidden']); }
};