更新

backend/auth/roles.py

@@ -0,0 +1,31 @@
+from typing import Iterable
+
+ROLE_ADMIN = "admin"
+ROLE_OPERATOR = "operator"
+ROLE_VIEWER = "viewer"
+
+ALL_ROLES = (ROLE_ADMIN, ROLE_OPERATOR, ROLE_VIEWER)
+
+ROLE_LABELS = {
+    ROLE_ADMIN: "管理员",
+    ROLE_OPERATOR: "运营",
+    ROLE_VIEWER: "只读",
+}
+
+
+def is_admin(role: str) -> bool:
+    return role == ROLE_ADMIN
+
+
+def can_write(role: str) -> bool:
+    return role in (ROLE_ADMIN, ROLE_OPERATOR)
+
+
+def can_manage_users(role: str) -> bool:
+    return role == ROLE_ADMIN
+
+
+def ensure_role(role: str) -> str:
+    if role not in ALL_ROLES:
+        raise ValueError(f"无效角色: {role}")
+    return role