Merge pull request #14 from database-playground/pan93412/dbp-88-任意使用者都能使用-ai

fix(chat): disallow users without "ai" scope to use AI

Author: pan93412

app/api/chat/route.ts

@@ -72,7 +72,7 @@ interface ChatRouteRequest {
 }
 
 export async function POST(req: Request) {
-  const authorized = await checkAuthorizedStatus();
+  const authorized = await checkAuthorizedStatus(["*", "ai"]);
   if (!authorized) {
     return new NextResponse("Unauthorized", { status: 401 });
   }

lib/auth.rsc.ts

@@ -17,17 +17,26 @@ export async function redirectIfAuthenticated(): Promise<void> {
   redirect("/");
 }
 
-export async function checkAuthorizedStatus(): Promise<boolean> {
+export async function checkAuthorizedStatus(requiredScopes?: string[]): Promise<boolean> {
   const token = await getAuthToken();
   if (!token) {
     return false;
   }
 
-  const loggedIn = await getAuthStatus(token)
-    .then(result => result.loggedIn)
-    .catch(() => false);
+  const authStatus = await getAuthStatus(token);
+
+  if (!authStatus.loggedIn || !authStatus.introspectResult?.active) {
+    return false;
+  }
+
+  // check if the token has the required scope
+  if (requiredScopes) {
+    for (const scope of requiredScopes) {
+      if (authStatus.introspectResult?.scope.includes(scope)) {
+        return true;
+      }
+    }
 
-  if (!loggedIn) {
     return false;
   }