refactor: 移除控制器中直接的管理员权限检查。

Author: OSpoon

backend/app/controllers/knowledge_bases_controller.ts

@@ -16,10 +16,6 @@ export default class KnowledgeBasesController {
   }
 
   public async store({ request, response, auth }: HttpContext) {
-    if (!auth.user!.isAdmin) {
-      return response.forbidden({ message: 'You do not have permission to perform this action' })
-    }
-
     const data = request.only(['keyword', 'description', 'exampleSql', 'sourceType'])
 
     // Validate that keyword is unique
@@ -40,10 +36,6 @@ export default class KnowledgeBasesController {
   }
 
   public async update({ params, request, response, auth }: HttpContext) {
-    if (!auth.user!.isAdmin) {
-      return response.forbidden({ message: 'You do not have permission to perform this action' })
-    }
-
     const itemOriginal = await KnowledgeBase.findOrFail(params.id)
     const data = request.only(['keyword', 'description', 'exampleSql', 'status', 'sourceType'])
 
@@ -60,11 +52,7 @@ export default class KnowledgeBasesController {
     return response.json(item)
   }
 
-  public async destroy({ params, response, auth }: HttpContext) {
-    if (!auth.user!.isAdmin) {
-      return response.forbidden({ message: 'You do not have permission to perform this action' })
-    }
-
+  public async destroy({ params, response }: HttpContext) {
     await KnowledgeBaseService.delete(params.id)
 
     return response.json({ message: 'Deleted successfully' })

backend/app/controllers/roles_controller.ts

@@ -16,10 +16,6 @@ export default class RolesController {
 
   async store({ request, response, auth }: HttpContext) {
     const { name, slug, description, permissionIds } = request.all()
-    const currentUser = auth.user!
-    if (!currentUser.isAdmin) {
-      return response.forbidden({ message: 'You do not have permission to perform this action' })
-    }
 
     const role = await Role.create({ name, slug, description })
 
@@ -50,10 +46,6 @@ export default class RolesController {
   async update({ params, request, response, auth }: HttpContext) {
     const role = await Role.findOrFail(params.id)
     const { name, slug, description, permissionIds } = request.all()
-    const currentUser = auth.user!
-    if (!currentUser.isAdmin) {
-      return response.forbidden({ message: 'You do not have permission to perform this action' })
-    }
 
     const previousData = role.toJSON()
 
@@ -82,10 +74,6 @@ export default class RolesController {
 
   async destroy({ params, response, request, auth }: HttpContext) {
     const role = await Role.findOrFail(params.id)
-    const currentUser = auth.user!
-    if (!currentUser.isAdmin) {
-      return response.forbidden({ message: 'You do not have permission to perform this action' })
-    }
 
     await role.delete()
 

backend/app/controllers/users_controller.ts

@@ -3,10 +3,7 @@ import User from '#models/user'
 import { AuditService } from '#services/audit_service'
 
 export default class UsersController {
-  async index({ auth, response }: HttpContext) {
-    if (!auth.user!.isAdmin) {
-      return response.forbidden({ message: 'You do not have permission to perform this action' })
-    }
+  async index({ response }: HttpContext) {
     const users = await User.query().preload('roles')
     return response.ok(
       users.map(user => ({
@@ -19,10 +16,6 @@ export default class UsersController {
   async update({ params, request, response, auth }: HttpContext) {
     const user = await User.findOrFail(params.id)
     const { fullName, email, roleIds, isActive } = request.all()
-    const currentUser = auth.user!
-    if (!currentUser.isAdmin) {
-      return response.forbidden({ message: 'You do not have permission to perform this action' })
-    }
 
     const previousData = user.toJSON()
 
@@ -55,10 +48,6 @@ export default class UsersController {
 
   async destroy({ params, response, request, auth }: HttpContext) {
     const user = await User.query().where('id', params.id).preload('roles').firstOrFail()
-    const currentUser = auth.user!
-    if (!currentUser.isAdmin) {
-      return response.forbidden({ message: 'You do not have permission to perform this action' })
-    }
 
     // Check if the user being deleted is an admin
     const isAdmin = user.roles.some(role => role.slug === 'admin')