登录注册与权限体系

// middleware.ts
import { NextRequest, NextResponse } from 'next/server'
import { betterFetch } from '@better-fetch/fetch'
 
const publicPaths = ['/', '/pricing', '/blog', '/login', '/signup']
 
export async function middleware(request: NextRequest) {
  const { pathname } = request.nextUrl
 
  // 公开路由直接放行
  if (publicPaths.some((p) => pathname === p || pathname.startsWith(`${p}/`))) {
    return NextResponse.next()
  }
 
  // 验证 session cookie（快速检查，不查数据库全量信息）
  const sessionCookie = request.cookies.get('session_token')?.value
  if (!sessionCookie) {
    return NextResponse.redirect(new URL('/login', request.url))
  }
 
  // 可选：验证 JWT 有效期（无需数据库查询）
  try {
    const { data: session } = await betterFetch('/api/auth/get-session', {
      headers: { cookie: request.headers.get('cookie') || '' },
      baseURL: request.nextUrl.origin,
    })
    if (!session) throw new Error('Invalid session')
  } catch {
    return NextResponse.redirect(new URL('/login', request.url))
  }
 
  return NextResponse.next()
}
 
export const config = { matcher: ['/((?!api|_next/static|favicon.ico).*)'] }

// lib/auth/session.ts
import { auth } from '@/lib/auth'
import { headers } from 'next/headers'
import { cache } from 'react'
 
// cache() 确保同一请求内只调用一次
export const getSession = cache(async () => {
  const session = await auth.api.getSession({ headers: await headers() })
  return session
})
 
// app/(dashboard)/page.tsx
export default async function DashboardPage() {
  const session = await getSession()
  if (!session) redirect('/login')
 
  return <h1>Welcome, {session.user.name}</h1>
}

// lib/auth/permissions.ts
 
// 所有可用权限，集中管理
const PERMISSIONS = {
  'project:read':    ['owner', 'admin', 'member', 'viewer'],
  'project:create':  ['owner', 'admin', 'member'],
  'project:delete':  ['owner', 'admin'],
  'member:invite':   ['owner', 'admin'],
  'member:remove':   ['owner', 'admin'],
  'billing:manage':  ['owner', 'admin'],
  'org:delete':      ['owner'],
  'org:transfer':    ['owner'],
} as const
 
type Permission = keyof typeof PERMISSIONS
type Role = 'owner' | 'admin' | 'member' | 'viewer'
 
export function hasPermission(role: Role, permission: Permission): boolean {
  return PERMISSIONS[permission].includes(role)
}
 
// 用于 Server Action 的权限守卫——不满足直接抛错
export async function requirePermission(permission: Permission) {
  const session = await getSession()
  if (!session) throw new Error('Unauthorized')
 
  const membership = await getCurrentMembership(session.user.id)
  if (!membership) throw new Error('Not a member of this organization')
 
  if (!hasPermission(membership.role as Role, permission)) {
    throw new Error(`Forbidden: requires ${permission}`)
  }
 
  return { session, membership }
}

// app/(dashboard)/projects/actions.ts
'use server'
 
import { requirePermission } from '@/lib/auth/permissions'
import { db } from '@/lib/db'
import { projects } from '@/lib/db/schema'
import { revalidatePath } from 'next/cache'
 
export async function deleteProject(projectId: string) {
  // 1. 权限守卫——不满足直接抛错，后续代码不会执行
  const { membership } = await requirePermission('project:delete')
 
  // 2. 业务逻辑
  await db.delete(projects).where(
    and(eq(projects.id, projectId), eq(projects.tenantId, membership.tenantId))
  )
 
  revalidatePath('/projects')
}

// components/dashboard/project-actions.tsx
import { getSession } from '@/lib/auth/session'
import { getCurrentMembership } from '@/lib/auth/membership'
import { hasPermission } from '@/lib/auth/permissions'
 
export async function ProjectActions({ projectId }: { projectId: string }) {
  const session = await getSession()
  const membership = await getCurrentMembership(session!.user.id)
  const role = membership!.role as Role
 
  return (
    <div>
      {hasPermission(role, 'project:create') && (
        <Button>Edit</Button>
      )}
      {hasPermission(role, 'project:delete') && (
        <Button variant="destructive">Delete</Button>
      )}
    </div>
  )
}

// app/(dashboard)/settings/members/actions.ts
'use server'
 
import { requirePermission } from '@/lib/auth/permissions'
import { db } from '@/lib/db'
import { invitations } from '@/lib/db/schema'
import { sendEmail } from '@/lib/email'
import { nanoid } from 'nanoid'
 
export async function inviteMember(formData: FormData) {
  const { membership } = await requirePermission('member:invite')
  const email = formData.get('email') as string
  const role = (formData.get('role') as string) || 'member'
 
  // 生成一次性邀请 Token（72 小时过期）
  const token = nanoid(32)
  const expiresAt = new Date(Date.now() + 72 * 60 * 60 * 1000)
 
  await db.insert(invitations).values({
    tenantId: membership.tenantId,
    email,
    role,
    token,
    expiresAt,
    invitedBy: membership.userId,
  })
 
  // 发送邀请邮件
  await sendEmail({
    to: email,
    subject: `You're invited to join ${membership.tenant.name}`,
    template: 'invitation',
    props: {
      inviteUrl: `${process.env.NEXT_PUBLIC_APP_URL}/invite/${token}`,
      orgName: membership.tenant.name,
    },
  })
 
  revalidatePath('/settings/members')
}

// app/(dashboard)/actions.ts
'use server'
 
import { cookies } from 'next/headers'
import { redirect } from 'next/navigation'
import { db } from '@/lib/db'
import { memberships } from '@/lib/db/schema'
import { and, eq } from 'drizzle-orm'
import { getSession } from '@/lib/auth/session'
 
const ORG_COOKIE = 'current_org_id'
 
export async function switchOrganization(orgId: string) {
  const session = await getSession()
  if (!session) throw new Error('Unauthorized')
 
  // 验证用户确实属于该组织（防止伪造 orgId）
  const [membership] = await db
    .select()
    .from(memberships)
    .where(and(eq(memberships.userId, session.user.id), eq(memberships.tenantId, orgId)))
 
  if (!membership) throw new Error('Not a member of this organization')
 
  // 写入 Cookie，后续请求自动携带
  const cookieStore = await cookies()
  cookieStore.set(ORG_COOKIE, orgId, {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'lax',
    maxAge: 60 * 60 * 24 * 365, // 1 年
  })
 
  redirect('/')
}
 
// 读取当前组织 ID（供其他模块使用）
export async function getCurrentOrgId(): Promise<string | null> {
  const cookieStore = await cookies()
  return cookieStore.get(ORG_COOKIE)?.value ?? null
}

// lib/auth/rate-limit.ts
import { Ratelimit } from '@upstash/ratelimit'
import { Redis } from '@upstash/redis'
 
const redis = Redis.fromEnv()
 
// 同一 IP 每分钟最多 10 次登录尝试
const ipLimiter = new Ratelimit({
  redis,
  limiter: Ratelimit.slidingWindow(10, '60 s'),
  prefix: 'login:ip',
})
 
// 同一邮箱每小时最多 5 次失败尝试
const emailLimiter = new Ratelimit({
  redis,
  limiter: Ratelimit.slidingWindow(5, '3600 s'),
  prefix: 'login:email',
})
 
export async function checkLoginRateLimit(ip: string, email: string) {
  const [ipResult, emailResult] = await Promise.all([
    ipLimiter.limit(ip),
    emailLimiter.limit(email),
  ])
 
  if (!ipResult.success) {
    throw new Error('Too many login attempts from this IP. Try again later.')
  }
  if (!emailResult.success) {
    throw new Error('Too many failed attempts for this email. Try again later.')
  }
}