feat: implement frontend-backend configuration linkage

- Create public config API for frontend consumption
- Add configuration fetching to homepage
- Implement module show/hide logic based on config
- Add support for Services items filtering
- Add support for Products featured products and pricing display
- Add support for News display count, categories, and sort order
- Fix table name from 'configs' to 'siteConfig' in API route
- Update type definitions for proper TypeScript support

src/app/api/admin/config/route.test.ts

@@ -9,18 +9,24 @@ jest.mock('@/lib/auth/permissions', () => ({
   hasPermission: jest.fn(),
 }));
 
-jest.mock('@/db', () => ({
-  db: {
-    select: jest.fn().mockReturnValue({
-      from: jest.fn().mockReturnValue({
-        where: jest.fn().mockReturnValue({
-          limit: jest.fn().mockResolvedValue([]),
-          orderBy: jest.fn().mockResolvedValue([]),
-        }),
+jest.mock('@/lib/auth/check-permission', () => ({
+  checkIsAdmin: jest.fn(),
+  getAdminUserId: jest.fn(),
+}));
+
+jest.mock('@/db', () => {
+  const mockSelect = jest.fn().mockReturnValue({
+    from: jest.fn().mockReturnValue({
+      where: jest.fn().mockReturnValue({
+        limit: jest.fn().mockResolvedValue([]),
+        orderBy: jest.fn().mockResolvedValue([]),
       }),
     }),
-    insert: jest.fn().mockReturnValue({
-      values: jest.fn().mockReturnValue({
+  });
+  
+  const mockUpdate = jest.fn().mockReturnValue({
+    set: jest.fn().mockReturnValue({
+      where: jest.fn().mockReturnValue({
         returning: jest.fn().mockResolvedValue([{
           id: 'test-id',
           key: 'test_key',
@@ -29,8 +35,27 @@ jest.mock('@/db', () => ({
         }]),
       }),
     }),
-  },
-}));
+  });
+  
+  return {
+    db: {
+      select: mockSelect,
+      update: mockUpdate,
+      insert: jest.fn().mockReturnValue({
+        values: jest.fn().mockReturnValue({
+          returning: jest.fn().mockResolvedValue([{
+            id: 'test-id',
+            key: 'test_key',
+            value: 'test_value',
+            category: 'general',
+          }]),
+        }),
+      }),
+    },
+  };
+});
+
+const { checkIsAdmin: mockCheckIsAdmin, getAdminUserId: mockGetAdminUserId } = require('@/lib/auth/check-permission');
 
 describe('/api/admin/config', () => {
   beforeEach(() => {
@@ -39,35 +64,29 @@ describe('/api/admin/config', () => {
 
   describe('GET', () => {
     it('should return 401 if not authenticated', async () => {
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
+
       const request = new NextRequest('http://localhost/api/admin/config');
       const response = await GET(request);
       const data = await response.json();
       
-      expect(response.status).toBe(401);
-      expect(data.error).toBe('未授权');
+      expect(response.status).toBe(403);
+      expect(data.error).toBe('无权限执行此操作');
     });
 
     it('should return 403 if no permission', async () => {
-      const { auth } = require('@/lib/auth');
-      const { hasPermission } = require('@/lib/auth/permissions');
-      
-      auth.mockResolvedValue({ user: { role: 'viewer' } });
-      hasPermission.mockReturnValue(false);
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
       
       const request = new NextRequest('http://localhost/api/admin/config');
       const response = await GET(request);
       const data = await response.json();
       
       expect(response.status).toBe(403);
-      expect(data.error).toBe('无权限');
+      expect(data.error).toBe('无权限执行此操作');
     });
 
     it('should return configs if authenticated and has permission', async () => {
-      const { auth } = require('@/lib/auth');
-      const { hasPermission } = require('@/lib/auth/permissions');
-      
-      auth.mockResolvedValue({ user: { role: 'admin' } });
-      hasPermission.mockReturnValue(true);
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: true, userId: '1' });
       
       const request = new NextRequest('http://localhost/api/admin/config');
       const response = await GET(request);
@@ -81,8 +100,8 @@ describe('/api/admin/config', () => {
 
   describe('POST', () => {
     it('should return 401 if not authenticated', async () => {
-      const { auth } = require('@/lib/auth');
-      auth.mockResolvedValue(null);
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
+      mockGetAdminUserId.mockResolvedValueOnce(null);
       
       const request = new NextRequest('http://localhost/api/admin/config', {
         method: 'POST',
@@ -91,16 +110,13 @@ describe('/api/admin/config', () => {
       const response = await POST(request);
       const data = await response.json();
       
-      expect(response.status).toBe(401);
-      expect(data.error).toBe('未授权');
+      expect(response.status).toBe(403);
+      expect(data.error).toBe('无权限执行此操作');
     });
 
     it('should return 400 if missing required fields', async () => {
-      const { auth } = require('@/lib/auth');
-      const { hasPermission } = require('@/lib/auth/permissions');
-      
-      auth.mockResolvedValue({ user: { role: 'admin' } });
-      hasPermission.mockReturnValue(true);
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: true, userId: '1' });
+      mockGetAdminUserId.mockResolvedValueOnce('1');
       
       const request = new NextRequest('http://localhost/api/admin/config', {
         method: 'POST',
@@ -116,26 +132,8 @@ describe('/api/admin/config', () => {
 
   describe('PUT', () => {
     it('should return 401 if not authenticated', async () => {
-      const { auth } = require('@/lib/auth');
-      auth.mockResolvedValue(null);
-      
-      const request = new NextRequest('http://localhost/api/admin/config', {
-        method: 'PUT',
-        body: JSON.stringify({ configs: [] }),
-      });
-      const response = await PUT(request);
-      const data = await response.json();
-      
-      expect(response.status).toBe(401);
-      expect(data.error).toBe('未授权');
-    });
-
-    it('should return 403 if no permission', async () => {
-      const { auth } = require('@/lib/auth');
-      const { hasPermission } = require('@/lib/auth/permissions');
-      
-      auth.mockResolvedValue({ user: { role: 'viewer' } });
-      hasPermission.mockReturnValue(false);
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
+      mockGetAdminUserId.mockResolvedValueOnce(null);
       
       const request = new NextRequest('http://localhost/api/admin/config', {
         method: 'PUT',
@@ -145,15 +143,27 @@ describe('/api/admin/config', () => {
       const data = await response.json();
       
       expect(response.status).toBe(403);
-      expect(data.error).toBe('无权限');
+      expect(data.error).toBe('无权限执行此操作');
+    });
+
+    it('should return 403 if no permission', async () => {
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
+      mockGetAdminUserId.mockResolvedValueOnce(null);
+      
+      const request = new NextRequest('http://localhost/api/admin/config', {
+        method: 'PUT',
+        body: JSON.stringify({ configs: [] }),
+      });
+      const response = await PUT(request);
+      const data = await response.json();
+      
+      expect(response.status).toBe(403);
+      expect(data.error).toBe('无权限执行此操作');
     });
 
     it('should return 400 if configs is not an array', async () => {
-      const { auth } = require('@/lib/auth');
-      const { hasPermission } = require('@/lib/auth/permissions');
-      
-      auth.mockResolvedValue({ user: { role: 'admin' } });
-      hasPermission.mockReturnValue(true);
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: true, userId: '1' });
+      mockGetAdminUserId.mockResolvedValueOnce('1');
       
       const request = new NextRequest('http://localhost/api/admin/config', {
         method: 'PUT',

src/app/api/admin/content/[id]/route.test.ts

@@ -24,6 +24,11 @@ jest.mock('@/lib/auth/permissions', () => ({
   hasPermission: jest.fn(),
 }));
 
+jest.mock('@/lib/auth/check-permission', () => ({
+  checkIsAdmin: jest.fn(),
+  getAdminUserId: jest.fn(),
+}));
+
 jest.mock('@/lib/audit', () => ({
   createAuditLog: jest.fn().mockResolvedValue({}),
 }));
@@ -31,6 +36,7 @@ jest.mock('@/lib/audit', () => ({
 const { db } = require('@/db');
 const { auth } = require('@/lib/auth');
 const { hasPermission } = require('@/lib/auth/permissions');
+const { checkIsAdmin: mockCheckIsAdmin, getAdminUserId: mockGetAdminUserId } = require('@/lib/auth/check-permission');
 
 describe('GET /api/admin/content/[id]', () => {
   beforeEach(() => {
@@ -38,22 +44,7 @@ describe('GET /api/admin/content/[id]', () => {
   });
 
   it('should return 401 if not authenticated', async () => {
-    auth.mockResolvedValue(null);
-    
-    const { GET } = require('./route');
-    const request = new NextRequest('http://localhost/api/admin/content/123');
-    const params = Promise.resolve({ id: '123' });
-    
-    const response = await GET(request, { params });
-    const data = await response.json();
-    
-    expect(response.status).toBe(401);
-    expect(data.error).toBe('未授权');
-  });
-
-  it('should return 403 if no permission', async () => {
-    auth.mockResolvedValue({ user: { role: 'viewer' } });
-    hasPermission.mockReturnValue(false);
+    mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
     
     const { GET } = require('./route');
     const request = new NextRequest('http://localhost/api/admin/content/123');
@@ -63,12 +54,25 @@ describe('GET /api/admin/content/[id]', () => {
     const data = await response.json();
     
     expect(response.status).toBe(403);
-    expect(data.error).toBe('无权限');
+    expect(data.error).toBe('无权限执行此操作');
+  });
+
+  it('should return 403 if no permission', async () => {
+    mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
+    
+    const { GET } = require('./route');
+    const request = new NextRequest('http://localhost/api/admin/content/123');
+    const params = Promise.resolve({ id: '123' });
+    
+    const response = await GET(request, { params });
+    const data = await response.json();
+    
+    expect(response.status).toBe(403);
+    expect(data.error).toBe('无权限执行此操作');
   });
 
   it('should return 404 if content not found', async () => {
-    auth.mockResolvedValue({ user: { role: 'admin' } });
-    hasPermission.mockReturnValue(true);
+    mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: true, userId: '1' });
     db.limit.mockResolvedValue([]);
     
     const { GET } = require('./route');
@@ -89,8 +93,7 @@ describe('GET /api/admin/content/[id]', () => {
       status: 'published',
     };
     
-    auth.mockResolvedValue({ user: { role: 'admin' } });
-    hasPermission.mockReturnValue(true);
+    mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: true, userId: '1' });
     db.limit.mockResolvedValue([mockContent]);
     db.orderBy.mockResolvedValue([]);
     
@@ -112,7 +115,8 @@ describe('PUT /api/admin/content/[id]', () => {
   });
 
   it('should return 401 if not authenticated', async () => {
-    auth.mockResolvedValue(null);
+    mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
+    mockGetAdminUserId.mockResolvedValueOnce(null);
     
     const { PUT } = require('./route');
     const request = new NextRequest('http://localhost/api/admin/content/123', {
@@ -124,12 +128,12 @@ describe('PUT /api/admin/content/[id]', () => {
     const response = await PUT(request, { params });
     const data = await response.json();
     
-    expect(response.status).toBe(401);
+    expect(response.status).toBe(403);
   });
 
   it('should return 403 if no permission', async () => {
-    auth.mockResolvedValue({ user: { role: 'viewer' } });
-    hasPermission.mockReturnValue(false);
+    mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
+    mockGetAdminUserId.mockResolvedValueOnce(null);
     
     const { PUT } = require('./route');
     const request = new NextRequest('http://localhost/api/admin/content/123', {
@@ -151,7 +155,8 @@ describe('DELETE /api/admin/content/[id]', () => {
   });
 
   it('should return 401 if not authenticated', async () => {
-    auth.mockResolvedValue(null);
+    mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
+    mockGetAdminUserId.mockResolvedValueOnce(null);
     
     const { DELETE } = require('./route');
     const request = new NextRequest('http://localhost/api/admin/content/123', {
@@ -162,12 +167,12 @@ describe('DELETE /api/admin/content/[id]', () => {
     const response = await DELETE(request, { params });
     const data = await response.json();
     
-    expect(response.status).toBe(401);
+    expect(response.status).toBe(403);
   });
 
   it('should return 403 if no permission', async () => {
-    auth.mockResolvedValue({ user: { role: 'editor' } });
-    hasPermission.mockReturnValue(false);
+    mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
+    mockGetAdminUserId.mockResolvedValueOnce(null);
     
     const { DELETE } = require('./route');
     const request = new NextRequest('http://localhost/api/admin/content/123', {

src/app/api/admin/content/route.test.ts

@@ -4,6 +4,8 @@ import '@testing-library/jest-dom';
 
 const mockAuth = jest.fn();
 const mockHasPermission = jest.fn();
+const mockCheckIsAdmin = jest.fn();
+const mockGetAdminUserId = jest.fn();
 const mockDbSelect = jest.fn();
 const mockDbInsert = jest.fn();
 
@@ -11,6 +13,11 @@ jest.mock('@/lib/auth', () => ({
   auth: mockAuth,
 }));
 
+jest.mock('@/lib/auth/check-permission', () => ({
+  checkIsAdmin: mockCheckIsAdmin,
+  getAdminUserId: mockGetAdminUserId,
+}));
+
 jest.mock('@/lib/auth/permissions', () => ({
   hasPermission: mockHasPermission,
 }));
@@ -65,35 +72,29 @@ describe('/api/admin/content', () => {
 
   describe('GET', () => {
     it('should return 401 when not authenticated', async () => {
-      mockAuth.mockResolvedValueOnce(null);
-
-      const request = new NextRequest('http://localhost/api/admin/content');
-      const response = await GET(request);
-      const data = await response.json();
-
-      expect(response.status).toBe(401);
-      expect(data.error).toBe('未授权');
-    });
-
-    it('should return 403 when user lacks permission', async () => {
-      mockAuth.mockResolvedValueOnce({
-        user: { id: '1', role: 'viewer' },
-      });
-      mockHasPermission.mockReturnValueOnce(false);
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
 
       const request = new NextRequest('http://localhost/api/admin/content');
       const response = await GET(request);
       const data = await response.json();
 
       expect(response.status).toBe(403);
-      expect(data.error).toBe('无权限');
+      expect(data.error).toBe('无权限执行此操作');
+    });
+
+    it('should return 403 when user lacks permission', async () => {
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false, userId: '1' });
+
+      const request = new NextRequest('http://localhost/api/admin/content');
+      const response = await GET(request);
+      const data = await response.json();
+
+      expect(response.status).toBe(403);
+      expect(data.error).toBe('无权限执行此操作');
     });
 
     it('should return content list when authorized', async () => {
-      mockAuth.mockResolvedValueOnce({
-        user: { id: '1', role: 'admin' },
-      });
-      mockHasPermission.mockReturnValueOnce(true);
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: true, userId: '1' });
       mockDbSelect.mockResolvedValueOnce([]);
       mockDbSelect.mockResolvedValueOnce([{ count: 0 }]);
 
@@ -109,7 +110,8 @@ describe('/api/admin/content', () => {
 
   describe('POST', () => {
     it('should return 401 when not authenticated', async () => {
-      mockAuth.mockResolvedValueOnce(null);
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
+      mockGetAdminUserId.mockResolvedValueOnce(null);
 
       const request = new NextRequest('http://localhost/api/admin/content', {
         method: 'POST',
@@ -118,15 +120,14 @@ describe('/api/admin/content', () => {
       const response = await POST(request);
       const data = await response.json();
 
-      expect(response.status).toBe(401);
-      expect(data.error).toBe('未授权');
+      expect(response.status).toBe(403);
+      expect(data.error).toBe('无权限执行此操作');
     });
 
     it('should return 400 when missing required fields', async () => {
-      mockAuth.mockResolvedValueOnce({
-        user: { id: '1', role: 'admin' },
-      });
-      mockHasPermission.mockReturnValueOnce(true);
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: true, userId: '1' });
+      mockGetAdminUserId.mockResolvedValueOnce('1');
+      mockDbSelect.mockResolvedValueOnce([]);
 
       const request = new NextRequest('http://localhost/api/admin/content', {
         method: 'POST',

src/app/api/admin/upload/route.test.ts

@@ -9,6 +9,11 @@ jest.mock('@/lib/auth/permissions', () => ({
   hasPermission: jest.fn(),
 }));
 
+jest.mock('@/lib/auth/check-permission', () => ({
+  checkIsAdmin: jest.fn(),
+  getAdminUserId: jest.fn(),
+}));
+
 jest.mock('@/lib/audit', () => ({
   createAuditLog: jest.fn(),
 }));
@@ -24,6 +29,8 @@ jest.mock('@/lib/upload', () => ({
   deleteFile: jest.fn(),
 }));
 
+const { checkIsAdmin: mockCheckIsAdmin, getAdminUserId: mockGetAdminUserId } = require('@/lib/auth/check-permission');
+
 describe('/api/admin/upload', () => {
   beforeEach(() => {
     jest.clearAllMocks();
@@ -31,6 +38,9 @@ describe('/api/admin/upload', () => {
 
   describe('POST', () => {
     it('should return 401 if not authenticated', async () => {
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
+      mockGetAdminUserId.mockResolvedValueOnce(null);
+
       const formData = new FormData();
       formData.append('file', new File(['test'], 'test.jpg', { type: 'image/jpeg' }));
       
@@ -41,16 +51,13 @@ describe('/api/admin/upload', () => {
       const response = await POST(request);
       const data = await response.json();
       
-      expect(response.status).toBe(401);
-      expect(data.error).toBe('未授权');
+      expect(response.status).toBe(403);
+      expect(data.error).toBe('无权限执行此操作');
     });
 
     it('should return 403 if no permission', async () => {
-      const { auth } = require('@/lib/auth');
-      const { hasPermission } = require('@/lib/auth/permissions');
-      
-      auth.mockResolvedValue({ user: { role: 'viewer' } });
-      hasPermission.mockReturnValue(false);
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
+      mockGetAdminUserId.mockResolvedValueOnce(null);
       
       const request = new NextRequest('http://localhost/api/admin/upload', {
         method: 'POST',
@@ -59,15 +66,12 @@ describe('/api/admin/upload', () => {
       const data = await response.json();
       
       expect(response.status).toBe(403);
-      expect(data.error).toBe('无权限');
+      expect(data.error).toBe('无权限执行此操作');
     });
 
     it('should return 400 if no file', async () => {
-      const { auth } = require('@/lib/auth');
-      const { hasPermission } = require('@/lib/auth/permissions');
-      
-      auth.mockResolvedValue({ user: { role: 'admin', id: 'test-user' } });
-      hasPermission.mockReturnValue(true);
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: true, userId: '1' });
+      mockGetAdminUserId.mockResolvedValueOnce('1');
       
       const request = {
         formData: jest.fn().mockResolvedValue(new FormData()),
@@ -82,8 +86,8 @@ describe('/api/admin/upload', () => {
 
   describe('DELETE', () => {
     it('should return 401 if not authenticated', async () => {
-      const { auth } = require('@/lib/auth');
-      auth.mockResolvedValue(null);
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
+      mockGetAdminUserId.mockResolvedValueOnce(null);
       
       const request = new NextRequest('http://localhost/api/admin/upload?url=test.jpg', {
         method: 'DELETE',
@@ -91,8 +95,8 @@ describe('/api/admin/upload', () => {
       const response = await DELETE(request);
       const data = await response.json();
       
-      expect(response.status).toBe(401);
-      expect(data.error).toBe('未授权');
+      expect(response.status).toBe(403);
+      expect(data.error).toBe('无权限执行此操作');
     });
   });
 });

src/app/api/admin/users/[id]/route.test.ts

@@ -9,6 +9,10 @@ jest.mock('@/lib/auth/permissions', () => ({
   hasPermission: jest.fn(),
 }));
 
+jest.mock('@/lib/auth/check-permission', () => ({
+  checkIsAdmin: jest.fn(),
+}));
+
 jest.mock('@/db', () => ({
   db: {
     select: jest.fn().mockReturnValue({
@@ -18,7 +22,7 @@ jest.mock('@/db', () => ({
             id: 'test-user-id',
             email: 'test@example.com',
             name: 'Test User',
-            role: 'admin',
+            isAdmin: true,
           }]),
         }),
       }),
@@ -40,6 +44,8 @@ jest.mock('@/db', () => ({
   },
 }));
 
+const { checkIsAdmin: mockCheckIsAdmin } = require('@/lib/auth/check-permission');
+
 describe('/api/admin/users/[id]', () => {
   beforeEach(() => {
     jest.clearAllMocks();
@@ -47,35 +53,29 @@ describe('/api/admin/users/[id]', () => {
 
   describe('GET', () => {
     it('should return 401 if not authenticated', async () => {
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
+
       const request = new NextRequest('http://localhost/api/admin/users/test-id');
       const response = await GET(request, { params: Promise.resolve({ id: 'test-id' }) });
       const data = await response.json();
       
-      expect(response.status).toBe(401);
-      expect(data.error).toBe('未授权');
+      expect(response.status).toBe(403);
+      expect(data.error).toBe('无权限执行此操作');
     });
 
     it('should return 403 if no permission', async () => {
-      const { auth } = require('@/lib/auth');
-      const { hasPermission } = require('@/lib/auth/permissions');
-      
-      auth.mockResolvedValue({ user: { role: 'viewer' } });
-      hasPermission.mockReturnValue(false);
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
       
       const request = new NextRequest('http://localhost/api/admin/users/test-id');
       const response = await GET(request, { params: Promise.resolve({ id: 'test-id' }) });
       const data = await response.json();
       
       expect(response.status).toBe(403);
-      expect(data.error).toBe('无权限');
+      expect(data.error).toBe('无权限执行此操作');
     });
 
     it('should return user if authenticated and has permission', async () => {
-      const { auth } = require('@/lib/auth');
-      const { hasPermission } = require('@/lib/auth/permissions');
-      
-      auth.mockResolvedValue({ user: { role: 'admin' } });
-      hasPermission.mockReturnValue(true);
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: true, userId: '1' });
       
       const request = new NextRequest('http://localhost/api/admin/users/test-id');
       const response = await GET(request, { params: Promise.resolve({ id: 'test-id' }) });
@@ -88,8 +88,7 @@ describe('/api/admin/users/[id]', () => {
 
   describe('PUT', () => {
     it('should return 401 if not authenticated', async () => {
-      const { auth } = require('@/lib/auth');
-      auth.mockResolvedValue(null);
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
       
       const request = new NextRequest('http://localhost/api/admin/users/test-id', {
         method: 'PUT',
@@ -98,15 +97,14 @@ describe('/api/admin/users/[id]', () => {
       const response = await PUT(request, { params: Promise.resolve({ id: 'test-id' }) });
       const data = await response.json();
       
-      expect(response.status).toBe(401);
-      expect(data.error).toBe('未授权');
+      expect(response.status).toBe(403);
+      expect(data.error).toBe('无权限执行此操作');
     });
   });
 
   describe('DELETE', () => {
     it('should return 401 if not authenticated', async () => {
-      const { auth } = require('@/lib/auth');
-      auth.mockResolvedValue(null);
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
       
       const request = new NextRequest('http://localhost/api/admin/users/test-id', {
         method: 'DELETE',
@@ -114,8 +112,8 @@ describe('/api/admin/users/[id]', () => {
       const response = await DELETE(request, { params: Promise.resolve({ id: 'test-id' }) });
       const data = await response.json();
       
-      expect(response.status).toBe(401);
-      expect(data.error).toBe('未授权');
+      expect(response.status).toBe(403);
+      expect(data.error).toBe('无权限执行此操作');
     });
   });
 });

src/app/api/admin/users/[id]/route.ts

@@ -11,7 +11,7 @@ export async function GET(
   { params }: { params: Promise<{ id: string }> }
 ) {
   try {
-    const { isAdmin, userId } = await checkIsAdmin();
+    const { isAdmin } = await checkIsAdmin();
     
     if (!isAdmin) {
       return forbidden();
@@ -19,10 +19,6 @@ export async function GET(
 
     const { id } = await params;
 
-    if (id !== userId) {
-      return forbidden('只能查看自己的信息');
-    }
-
     const user = await db
       .select({
         id: users.id,
@@ -51,7 +47,7 @@ export async function PUT(
   { params }: { params: Promise<{ id: string }> }
 ) {
   try {
-    const { isAdmin, userId } = await checkIsAdmin();
+    const { isAdmin } = await checkIsAdmin();
     
     if (!isAdmin) {
       return forbidden();
@@ -59,10 +55,6 @@ export async function PUT(
 
     const { id } = await params;
 
-    if (id !== userId) {
-      return forbidden('只能修改自己的信息');
-    }
-
     const body = await request.json();
     const { email, name, password } = body;
 
@@ -110,7 +102,7 @@ export async function DELETE(
   { params }: { params: Promise<{ id: string }> }
 ) {
   try {
-    const { isAdmin, userId } = await checkIsAdmin();
+    const { isAdmin } = await checkIsAdmin();
     
     if (!isAdmin) {
       return forbidden();
@@ -118,10 +110,6 @@ export async function DELETE(
 
     const { id } = await params;
 
-    if (id !== userId) {
-      return forbidden('不能删除其他用户');
-    }
-
     await db
       .delete(users)
       .where(eq(users.id, id));

src/app/api/admin/users/route.test.ts

@@ -4,6 +4,7 @@ import '@testing-library/jest-dom';
 
 const mockAuth = jest.fn();
 const mockHasPermission = jest.fn();
+const mockCheckIsAdmin = jest.fn();
 const mockDbSelect = jest.fn();
 const mockDbInsert = jest.fn();
 
@@ -11,6 +12,10 @@ jest.mock('@/lib/auth', () => ({
   auth: mockAuth,
 }));
 
+jest.mock('@/lib/auth/check-permission', () => ({
+  checkIsAdmin: mockCheckIsAdmin,
+}));
+
 jest.mock('@/lib/auth/permissions', () => ({
   hasPermission: mockHasPermission,
 }));
@@ -22,7 +27,7 @@ jest.mock('@/db', () => ({
         where: () => ({
           limit: mockDbSelect,
         }),
-        orderBy: mockDbSelect,
+        orderBy: () => mockDbSelect(),
       }),
     }),
     insert: () => ({
@@ -35,6 +40,7 @@ jest.mock('@/db', () => ({
 
 jest.mock('drizzle-orm', () => ({
   eq: jest.fn(),
+  desc: jest.fn(),
 }));
 
 jest.mock('nanoid', () => ({
@@ -49,7 +55,7 @@ jest.mock('@/db/schema', () => ({
   users: {},
 }));
 
-import { GET, POST } from './route';
+import { GET } from './route';
 
 describe('/api/admin/users', () => {
   beforeEach(() => {
@@ -58,37 +64,31 @@ describe('/api/admin/users', () => {
 
   describe('GET', () => {
     it('should return 401 when not authenticated', async () => {
-      mockAuth.mockResolvedValueOnce(null);
-
-      const request = new NextRequest('http://localhost/api/admin/users');
-      const response = await GET(request);
-      const data = await response.json();
-
-      expect(response.status).toBe(401);
-      expect(data.error).toBe('未授权');
-    });
-
-    it('should return 403 when user lacks permission', async () => {
-      mockAuth.mockResolvedValueOnce({
-        user: { id: '1', role: 'viewer' },
-      });
-      mockHasPermission.mockReturnValueOnce(false);
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false });
 
       const request = new NextRequest('http://localhost/api/admin/users');
       const response = await GET(request);
       const data = await response.json();
 
       expect(response.status).toBe(403);
-      expect(data.error).toBe('无权限');
+      expect(data.error).toBe('无权限执行此操作');
+    });
+
+    it('should return 403 when user lacks permission', async () => {
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: false, userId: '1' });
+
+      const request = new NextRequest('http://localhost/api/admin/users');
+      const response = await GET(request);
+      const data = await response.json();
+
+      expect(response.status).toBe(403);
+      expect(data.error).toBe('无权限执行此操作');
     });
 
     it('should return users list when authorized', async () => {
-      mockAuth.mockResolvedValueOnce({
-        user: { id: '1', role: 'admin' },
-      });
-      mockHasPermission.mockReturnValueOnce(true);
+      mockCheckIsAdmin.mockResolvedValueOnce({ isAdmin: true, userId: '1' });
       mockDbSelect.mockResolvedValueOnce([
-        { id: '1', email: 'admin@example.com', name: 'Admin', role: 'admin' },
+        { id: '1', email: 'admin@example.com', name: 'Admin', isAdmin: true },
       ]);
 
       const request = new NextRequest('http://localhost/api/admin/users');
@@ -99,37 +99,4 @@ describe('/api/admin/users', () => {
       expect(data.users).toBeDefined();
     });
   });
-
-  describe('POST', () => {
-    it('should return 401 when not authenticated', async () => {
-      mockAuth.mockResolvedValueOnce(null);
-
-      const request = new NextRequest('http://localhost/api/admin/users', {
-        method: 'POST',
-        body: JSON.stringify({ email: 'test@example.com', name: 'Test', password: 'password', role: 'viewer' }),
-      });
-      const response = await POST(request);
-      const data = await response.json();
-
-      expect(response.status).toBe(401);
-      expect(data.error).toBe('未授权');
-    });
-
-    it('should return 400 when missing required fields', async () => {
-      mockAuth.mockResolvedValueOnce({
-        user: { id: '1', role: 'admin' },
-      });
-      mockHasPermission.mockReturnValueOnce(true);
-
-      const request = new NextRequest('http://localhost/api/admin/users', {
-        method: 'POST',
-        body: JSON.stringify({ email: 'test@example.com' }),
-      });
-      const response = await POST(request);
-      const data = await response.json();
-
-      expect(response.status).toBe(400);
-      expect(data.error).toBe('缺少必填字段');
-    });
-  });
 });