BUG FIX && 权限验证

src/modules/auth/components/register-form.tsx

@@ -2,24 +2,44 @@
 
 import * as React from "react"
 import Link from "next/link"
+import { useRouter } from "next/navigation"
+import { toast } from "sonner"
 import { Button } from "@/shared/components/ui/button"
 import { Input } from "@/shared/components/ui/input"
 import { Label } from "@/shared/components/ui/label"
 import { cn } from "@/shared/lib/utils"
 import { Loader2, Github } from "lucide-react"
+import type { ActionState } from "@/shared/types/action-state"
 
-type RegisterFormProps = React.HTMLAttributes<HTMLDivElement>
+type RegisterFormProps = React.HTMLAttributes<HTMLDivElement> & {
+  registerAction: (formData: FormData) => Promise<ActionState>
+}
 
-export function RegisterForm({ className, ...props }: RegisterFormProps) {
+export function RegisterForm({ className, registerAction, ...props }: RegisterFormProps) {
   const [isLoading, setIsLoading] = React.useState<boolean>(false)
+  const router = useRouter()
 
   async function onSubmit(event: React.SyntheticEvent) {
     event.preventDefault()
     setIsLoading(true)
 
-    setTimeout(() => {
+    try {
+      const form = event.currentTarget as HTMLFormElement
+      const formData = new FormData(form)
+      const res = await registerAction(formData)
+
+      if (res.success) {
+        toast.success(res.message || "Account created")
+        router.push("/login")
+        router.refresh()
+      } else {
+        toast.error(res.message || "Failed to create account")
+      }
+    } catch {
+      toast.error("Failed to create account")
+    } finally {
       setIsLoading(false)
-    }, 3000)
+    }
   }
 
   return (
@@ -38,6 +58,7 @@ export function RegisterForm({ className, ...props }: RegisterFormProps) {
             <Label htmlFor="name">Full Name</Label>
             <Input
               id="name"
+              name="name"
               placeholder="John Doe"
               type="text"
               autoCapitalize="words"
@@ -50,6 +71,7 @@ export function RegisterForm({ className, ...props }: RegisterFormProps) {
             <Label htmlFor="email">Email</Label>
             <Input
               id="email"
+              name="email"
               placeholder="name@example.com"
               type="email"
               autoCapitalize="none"
@@ -62,6 +84,7 @@ export function RegisterForm({ className, ...props }: RegisterFormProps) {
             <Label htmlFor="password">Password</Label>
             <Input
               id="password"
+              name="password"
               type="password"
               autoComplete="new-password"
               disabled={isLoading}

src/modules/classes/actions.ts

@@ -1,8 +1,11 @@
 "use server";
 
 import { revalidatePath } from "next/cache"
+import { and, eq, sql } from "drizzle-orm"
 import { auth } from "@/auth"
 
+import { db } from "@/shared/db"
+import { grades } from "@/shared/db/schema"
 import type { ActionState } from "@/shared/types/action-state"
 import {
   createAdminClass,
@@ -44,6 +47,26 @@ export async function createTeacherClassAction(
     return { success: false, message: "Grade is required" }
   }
 
+  const session = await auth()
+  if (!session?.user) return { success: false, message: "Unauthorized" }
+
+  const role = String(session.user.role ?? "")
+  if (role !== "admin") {
+    const userId = String(session.user.id ?? "").trim()
+    if (!userId) return { success: false, message: "Unauthorized" }
+
+    const normalizedGradeId = typeof gradeId === "string" ? gradeId.trim() : ""
+    const normalizedGradeName = grade.trim().toLowerCase()
+    const where = normalizedGradeId
+      ? and(eq(grades.id, normalizedGradeId), eq(grades.gradeHeadId, userId))
+      : and(eq(grades.gradeHeadId, userId), sql`LOWER(${grades.name}) = ${normalizedGradeName}`)
+
+    const [ownedGrade] = await db.select({ id: grades.id }).from(grades).where(where).limit(1)
+    if (!ownedGrade) {
+      return { success: false, message: "Only admins and grade heads can create classes" }
+    }
+  }
+
   try {
     const id = await createTeacherClass({
       schoolName: typeof schoolName === "string" ? schoolName : null,
@@ -311,6 +334,11 @@ export async function createAdminClassAction(
   prevState: ActionState<string> | undefined,
   formData: FormData
 ): Promise<ActionState<string>> {
+  const session = await auth()
+  if (!session?.user?.id || String(session.user.role ?? "") !== "admin") {
+    return { success: false, message: "Unauthorized" }
+  }
+
   const schoolName = formData.get("schoolName")
   const schoolId = formData.get("schoolId")
   const name = formData.get("name")

src/modules/classes/components/my-classes-grid.tsx

@@ -50,7 +50,7 @@ import {
   updateTeacherClassAction,
 } from "../actions"
 
-export function MyClassesGrid({ classes }: { classes: TeacherClass[] }) {
+export function MyClassesGrid({ classes, canCreateClass }: { classes: TeacherClass[]; canCreateClass: boolean }) {
   const router = useRouter()
   const [isWorking, setIsWorking] = useState(false)
   const [createOpen, setCreateOpen] = useState(false)
@@ -133,12 +133,13 @@ export function MyClassesGrid({ classes }: { classes: TeacherClass[] }) {
         <Dialog
           open={createOpen}
           onOpenChange={(open) => {
+            if (!canCreateClass) return
             if (isWorking) return
             setCreateOpen(open)
           }}
         >
           <DialogTrigger asChild>
-            <Button className="gap-2" disabled={isWorking}>
+            <Button className="gap-2" disabled={isWorking || !canCreateClass}>
               <Plus className="size-4" />
               New class
             </Button>
@@ -209,7 +210,7 @@ export function MyClassesGrid({ classes }: { classes: TeacherClass[] }) {
             title="No classes yet"
             description="Create your first class to start managing students and schedules."
             icon={Users}
-            action={{ label: "Create class", onClick: () => setCreateOpen(true) }}
+            action={canCreateClass ? { label: "Create class", onClick: () => setCreateOpen(true) } : undefined}
             className="h-[360px] bg-card sm:col-span-2 lg:col-span-3"
           />
         ) : filteredClasses.length === 0 ? (