Ruolo campus: accesso limitato a /campus, landing dedicata

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/lib/auth.ts

@@ -5,7 +5,7 @@ import { randomBytes } from 'node:crypto';
 export const SESSION_COOKIE = 'session';
 const SESSION_DAYS = 7;
 
-export type Role = 'admin' | 'superuser' | 'user';
+export type Role = 'admin' | 'superuser' | 'user' | 'campus';
 
 export function hashPassword(plain: string): string {
   return bcrypt.hashSync(plain, 12);
@@ -58,6 +58,7 @@ const RULES: [RegExp, Role[]][] = [
   [/^\/api\/admin\/users(\/|$)/, ['admin']],
   [/^\/admin\/content(\/|$)/, ['admin', 'superuser']],
   [/^\/api\/admin\/content(\/|$)/, ['admin', 'superuser']],
+  [/^\/campus(\/|$)/, ['admin', 'campus']],
 ];
 
 export function canAccessAdminPath(role: string, pathname: string): boolean {
@@ -65,6 +66,8 @@ export function canAccessAdminPath(role: string, pathname: string): boolean {
   for (const [re, roles] of RULES) {
     if (re.test(pathname)) return roles.includes(role as Role);
   }
+  // campus vede solo la sua sezione (coperta da RULES) e il logout
+  if (role === 'campus') return pathname === '/admin/logout';
   return true; // blog, upload, logout, showtags: tutti i loggati
 }
 
@@ -105,10 +108,11 @@ export function randomPassword(): string {
 }
 
 export function isRole(v: unknown): v is Role {
-  return v === 'admin' || v === 'superuser' || v === 'user';
+  return v === 'admin' || v === 'superuser' || v === 'user' || v === 'campus';
 }
 
 export function landingFor(role: string): string {
   if (role === 'superuser') return '/admin/content';
+  if (role === 'campus') return '/campus';
   return '/admin';
 }

src/middleware.ts

@@ -6,7 +6,8 @@ export const onRequest = defineMiddleware((context, next) => {
   const { pathname } = context.url;
   const isProtected =
     (pathname.startsWith('/admin') && pathname !== '/admin/login') ||
-    pathname.startsWith('/api/admin');
+    pathname.startsWith('/api/admin') ||
+    pathname.startsWith('/campus');
   if (!isProtected) return next();
 
   const token = context.cookies.get(SESSION_COOKIE)?.value;

src/pages/admin/users.astro

@@ -16,6 +16,7 @@ const me = Astro.locals.user!;
     <select class="afield" name="role">
       <option value="user">user</option>
       <option value="superuser">superuser</option>
+      <option value="campus">campus</option>
       <option value="admin">admin</option>
     </select>
     <button class="abtn" type="submit">Crea</button>
@@ -31,7 +32,7 @@ const me = Astro.locals.user!;
           <td>{u.username}{u.id === me.id && ' (tu)'}</td>
           <td>
             <select class="role-sel" data-id={u.id}>
-              {['user', 'superuser', 'admin'].map((r) => <option value={r} selected={u.role === r}>{r}</option>)}
+              {['user', 'superuser', 'campus', 'admin'].map((r) => <option value={r} selected={u.role === r}>{r}</option>)}
             </select>
           </td>
           <td>