From 6bba2649270768e8a523f382968f18cefba1bd4e Mon Sep 17 00:00:00 2001
From: gitadmin <aiyimickey@sina.com>
Date: Thu, 2 Jul 2026 18:02:12 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E7=A7=BB=E9=99=A4=20middleware=20adminP?=
 =?UTF-8?q?aths=EF=BC=8C=E8=A7=A3=E5=86=B3=E9=9D=9E=20admin=20=E8=A7=92?=
 =?UTF-8?q?=E8=89=B2=20Forbidden=20=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 移除 middleware 中的 adminPaths: ['/settings'] 配置
- settings 页面权限由各 API 端点自行检查，middleware 仅负责认证
- 修复 viewer/operator 等非 admin 角色访问 /settings/* 返回 403 的问题
- 侧边栏 hasAnyAdminPerm 增加 audit-logs 和 monitor 权限检查
---
 src/components/layout/Sidebar.tsx | 5 ++++-
 src/middleware.ts                 | 3 ++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/components/layout/Sidebar.tsx b/src/components/layout/Sidebar.tsx
index dfcffc9..eaaf184 100644
--- a/src/components/layout/Sidebar.tsx
+++ b/src/components/layout/Sidebar.tsx
@@ -22,7 +22,10 @@ const settingsItems = [
 ]
 
 function hasAnyAdminPerm(permissions: string[]): boolean {
-  return permissions.includes('*') || permissions.some(p => p.startsWith('users:') || p.startsWith('roles:') || p.startsWith('api-keys:'))
+  return permissions.includes('*') || permissions.some(p =>
+    p.startsWith('users:') || p.startsWith('roles:') || p.startsWith('api-keys:') ||
+    p.startsWith('audit-logs:') || p.startsWith('monitor:')
+  )
 }
 
 export default function Sidebar() {
diff --git a/src/middleware.ts b/src/middleware.ts
index 728229d..7638eab 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -1,9 +1,10 @@
 // issue-ai/src/middleware.ts — 使用共享 middleware 工厂
+// 注意：移除 adminPaths，settings 页面的权限由各 API 自行检查
+// middleware 仅负责认证（登录检查），不负责角色鉴权
 import { createMiddleware } from '@shared/lib/auth/middleware'
 
 export const middleware = createMiddleware({
   localCookieName: 'session_issue',
-  adminPaths: ['/settings'],
   enableApiKey: true,
 })