@wecode-team/cms-supabase-api 0.1.40 → 0.1.43

package/dist/index.js

@@ -1040,8 +1040,8 @@ function _defineProperty(e, r, t) {
   }) : e[r] = t, e;
 }
 
-function ownKeys$2(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread$2(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$2(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$2(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+function ownKeys$3(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread$3(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$3(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$3(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 function _createForOfIteratorHelper$2(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray$3(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t["return"] || t["return"](); } finally { if (u) throw o; } } }; }
 function _unsupportedIterableToArray$3(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray$3(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray$3(r, a) : void 0; } }
 function _arrayLikeToArray$3(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
@@ -2096,7 +2096,7 @@ var DynamicTableService = /*#__PURE__*/function () {
               throw error;
             case 2:
               return _context14.abrupt("return", (data || []).map(function (item) {
-                return _objectSpread$2({
+                return _objectSpread$3({
                   id: item.id,
                   label: item[displayField] || "ID: ".concat(item.id)
                 }, item);
@@ -2209,8 +2209,8 @@ function getDynamicTableService() {
   return defaultService$1;
 }
 
-function ownKeys$1(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread$1(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$1(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$1(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+function ownKeys$2(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread$2(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$2(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$2(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 var AuthService = /*#__PURE__*/function () {
   function AuthService() {
     _classCallCheck(this, AuthService);
@@ -2387,7 +2387,7 @@ var AuthService = /*#__PURE__*/function () {
         return _regeneratorRuntime.wrap(function (_context4) {
           while (1) switch (_context4.prev = _context4.next) {
             case 0:
-              finalUserData = _objectSpread$1({
+              finalUserData = _objectSpread$2({
                 tableName: this.defaultTableName
               }, userData);
               _context4.prev = 1;
@@ -2445,7 +2445,7 @@ var AuthService = /*#__PURE__*/function () {
             case 0:
               updateData = _args5.length > 1 && _args5[1] !== undefined ? _args5[1] : {};
               // 设置默认值
-              finalUpdateData = _objectSpread$1({
+              finalUpdateData = _objectSpread$2({
                 tableName: this.defaultTableName
               }, updateData);
               _context5.prev = 1;
@@ -4227,8 +4227,8 @@ var _excluded = ["id", "created_at", "updated_at"],
 function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n2 = 0, F = function F() {}; return { s: F, n: function n() { return _n2 >= r.length ? { done: !0 } : { done: !1, value: r[_n2++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t["return"] || t["return"](); } finally { if (u) throw o; } } }; }
 function _unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0; } }
 function _arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
-function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+function ownKeys$1(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread$1(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$1(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$1(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 function normalizeJsonLikeFields(schemaFields, payload) {
   if (!schemaFields || schemaFields.length === 0) return payload;
   var jsonLikeFieldNames = new Set(schemaFields.filter(function (f) {
@@ -4237,7 +4237,7 @@ function normalizeJsonLikeFields(schemaFields, payload) {
     return f.name;
   }));
   if (jsonLikeFieldNames.size === 0) return payload;
-  var normalized = _objectSpread({}, payload);
+  var normalized = _objectSpread$1({}, payload);
   for (var _i = 0, _Object$entries = Object.entries(payload); _i < _Object$entries.length; _i++) {
     var _Object$entries$_i = _slicedToArray(_Object$entries[_i], 2),
       key = _Object$entries$_i[0],
@@ -5333,6 +5333,8 @@ var AuthUtils = /*#__PURE__*/function () {
   }]);
 }();
 
+function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 function getRoleFromSupabaseUser$2(user) {
   var _user$app_metadata, _user$user_metadata;
   var appRole = user === null || user === void 0 || (_user$app_metadata = user.app_metadata) === null || _user$app_metadata === void 0 ? void 0 : _user$app_metadata.role;
@@ -5357,68 +5359,225 @@ function toSupabaseEmail(account, sessionId) {
   var sid = normalizeSessionId(sessionId);
   return "".concat(sid, "_").concat(localPart, "@").concat(domain);
 }
+function buildAdminMetadata(existingMetadata, sessionId, account) {
+  return _objectSpread(_objectSpread({}, existingMetadata || {}), {}, {
+    role: "admin",
+    session_id: normalizeSessionId(sessionId),
+    original_username: account
+  });
+}
+function findAuthUserByEmail(_x, _x2) {
+  return _findAuthUserByEmail.apply(this, arguments);
+}
+function _findAuthUserByEmail() {
+  _findAuthUserByEmail = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee2(supabase, email) {
+    var normalizedEmail, page, _yield$supabase$auth$2, data, error, users, matchedUser;
+    return _regeneratorRuntime.wrap(function (_context2) {
+      while (1) switch (_context2.prev = _context2.next) {
+        case 0:
+          normalizedEmail = email.trim().toLowerCase();
+          page = 1;
+        case 1:
+          if (!(page <= 10)) {
+            _context2.next = 6;
+            break;
+          }
+          _context2.next = 2;
+          return supabase.auth.admin.listUsers({
+            page: page,
+            perPage: 200
+          });
+        case 2:
+          _yield$supabase$auth$2 = _context2.sent;
+          data = _yield$supabase$auth$2.data;
+          error = _yield$supabase$auth$2.error;
+          if (!error) {
+            _context2.next = 3;
+            break;
+          }
+          throw error;
+        case 3:
+          users = (data === null || data === void 0 ? void 0 : data.users) || [];
+          matchedUser = users.find(function (user) {
+            var _user$email;
+            return ((_user$email = user.email) === null || _user$email === void 0 ? void 0 : _user$email.trim().toLowerCase()) === normalizedEmail;
+          });
+          if (!matchedUser) {
+            _context2.next = 4;
+            break;
+          }
+          return _context2.abrupt("return", matchedUser);
+        case 4:
+          if (!(users.length < 200)) {
+            _context2.next = 5;
+            break;
+          }
+          return _context2.abrupt("return", null);
+        case 5:
+          page += 1;
+          _context2.next = 1;
+          break;
+        case 6:
+          return _context2.abrupt("return", null);
+        case 7:
+        case "end":
+          return _context2.stop();
+      }
+    }, _callee2);
+  }));
+  return _findAuthUserByEmail.apply(this, arguments);
+}
+function insertAdminRegistryRow(_x3, _x4, _x5, _x6) {
+  return _insertAdminRegistryRow.apply(this, arguments);
+}
+function _insertAdminRegistryRow() {
+  _insertAdminRegistryRow = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee3(supabase, sessionId, userId, account) {
+    return _regeneratorRuntime.wrap(function (_context3) {
+      while (1) switch (_context3.prev = _context3.next) {
+        case 0:
+          _context3.next = 1;
+          return supabase.from("_cms_admin_registry").insert({
+            session_id: normalizeSessionId(sessionId),
+            user_id: userId,
+            email: account
+          });
+        case 1:
+          return _context3.abrupt("return", _context3.sent);
+        case 2:
+        case "end":
+          return _context3.stop();
+      }
+    }, _callee3);
+  }));
+  return _insertAdminRegistryRow.apply(this, arguments);
+}
+function promoteExistingUserToSessionAdmin(_x7, _x8, _x9, _x0) {
+  return _promoteExistingUserToSessionAdmin.apply(this, arguments);
+}
+function _promoteExistingUserToSessionAdmin() {
+  _promoteExistingUserToSessionAdmin = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee4(supabase, email, sessionId, account) {
+    var existingUser, _yield$supabase$auth$3, updatedData, updateError, insertRes;
+    return _regeneratorRuntime.wrap(function (_context4) {
+      while (1) switch (_context4.prev = _context4.next) {
+        case 0:
+          _context4.next = 1;
+          return findAuthUserByEmail(supabase, email);
+        case 1:
+          existingUser = _context4.sent;
+          if (existingUser) {
+            _context4.next = 2;
+            break;
+          }
+          return _context4.abrupt("return", {
+            success: false,
+            message: "用户名已存在，但未能找到对应用户"
+          });
+        case 2:
+          _context4.next = 3;
+          return supabase.auth.admin.updateUserById(existingUser.id, {
+            app_metadata: buildAdminMetadata(existingUser.app_metadata, sessionId, account),
+            user_metadata: buildAdminMetadata(existingUser.user_metadata, sessionId, account)
+          });
+        case 3:
+          _yield$supabase$auth$3 = _context4.sent;
+          updatedData = _yield$supabase$auth$3.data;
+          updateError = _yield$supabase$auth$3.error;
+          if (!(updateError || !(updatedData !== null && updatedData !== void 0 && updatedData.user))) {
+            _context4.next = 4;
+            break;
+          }
+          return _context4.abrupt("return", {
+            success: false,
+            message: (updateError === null || updateError === void 0 ? void 0 : updateError.message) || "管理员账号升级失败"
+          });
+        case 4:
+          _context4.next = 5;
+          return insertAdminRegistryRow(supabase, sessionId, updatedData.user.id, account);
+        case 5:
+          insertRes = _context4.sent;
+          if (!insertRes.error) {
+            _context4.next = 6;
+            break;
+          }
+          return _context4.abrupt("return", {
+            success: false,
+            message: "管理员已被创建，请使用已有账号登录"
+          });
+        case 6:
+          return _context4.abrupt("return", {
+            success: true,
+            user: updatedData.user
+          });
+        case 7:
+        case "end":
+          return _context4.stop();
+      }
+    }, _callee4);
+  }));
+  return _promoteExistingUserToSessionAdmin.apply(this, arguments);
+}
 function getUserSessionId(user) {
   var _user$user_metadata2;
   return normalizeSessionId(user === null || user === void 0 || (_user$user_metadata2 = user.user_metadata) === null || _user$user_metadata2 === void 0 ? void 0 : _user$user_metadata2.session_id);
 }
-function getEffectiveRoleForSession(_x, _x2) {
+function getEffectiveRoleForSession(_x1, _x10) {
   return _getEffectiveRoleForSession.apply(this, arguments);
 } // POST - 用户登录
 function _getEffectiveRoleForSession() {
-  _getEffectiveRoleForSession = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee2(user, sessionId) {
+  _getEffectiveRoleForSession = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee5(user, sessionId) {
     var supabase, sid, role, ok;
-    return _regeneratorRuntime.wrap(function (_context2) {
-      while (1) switch (_context2.prev = _context2.next) {
+    return _regeneratorRuntime.wrap(function (_context5) {
+      while (1) switch (_context5.prev = _context5.next) {
         case 0:
           supabase = getSupabase();
           sid = normalizeSessionId(sessionId);
           role = getRoleFromSupabaseUser$2(user) || "user";
           if (!(role !== "admin")) {
-            _context2.next = 1;
+            _context5.next = 1;
             break;
           }
-          return _context2.abrupt("return", role);
+          return _context5.abrupt("return", role);
         case 1:
           if (!(getUserSessionId(user) !== sid)) {
-            _context2.next = 2;
+            _context5.next = 2;
             break;
           }
-          return _context2.abrupt("return", "user");
+          return _context5.abrupt("return", "user");
         case 2:
-          _context2.next = 3;
+          _context5.next = 3;
           return isUserSessionAdmin(supabase, sid, user.id);
         case 3:
-          ok = _context2.sent;
-          return _context2.abrupt("return", ok ? "admin" : "user");
+          ok = _context5.sent;
+          return _context5.abrupt("return", ok ? "admin" : "user");
         case 4:
         case "end":
-          return _context2.stop();
+          return _context5.stop();
       }
-    }, _callee2);
+    }, _callee5);
   }));
   return _getEffectiveRoleForSession.apply(this, arguments);
 }
-function login(_x3, _x4) {
+function login(_x11, _x12) {
   return _login.apply(this, arguments);
 }
 // GET - 是否允许注册（首次进入需要创建管理员账号）
 function _login() {
-  _login = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee3(c, tableName) {
-    var _data$session, body, username, password, supabase, sessionId, email, _yield$supabase$auth$2, data, error, token, user, role, _t3;
-    return _regeneratorRuntime.wrap(function (_context3) {
-      while (1) switch (_context3.prev = _context3.next) {
+  _login = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee6(c, tableName) {
+    var _data$session, body, username, password, supabase, sessionId, email, _yield$supabase$auth$4, data, error, token, user, role, _t3;
+    return _regeneratorRuntime.wrap(function (_context6) {
+      while (1) switch (_context6.prev = _context6.next) {
         case 0:
-          _context3.prev = 0;
-          _context3.next = 1;
+          _context6.prev = 0;
+          _context6.next = 1;
           return c.req.json();
         case 1:
-          body = _context3.sent;
+          body = _context6.sent;
           username = body.username, password = body.password; // 验证必填字段
           if (!(!username || !password)) {
-            _context3.next = 2;
+            _context6.next = 2;
             break;
           }
-          return _context3.abrupt("return", c.json({
+          return _context6.abrupt("return", c.json({
             success: false,
             message: "用户名和密码不能为空"
           }, 200));
@@ -5427,43 +5586,43 @@ function _login() {
           supabase = getSupabase();
           sessionId = extractSessionIdFromAuthTableName(tableName);
           if (username.includes("@")) {
-            _context3.next = 3;
+            _context6.next = 3;
             break;
           }
-          return _context3.abrupt("return", c.json({
+          return _context6.abrupt("return", c.json({
             success: false,
             message: "请输入邮箱格式的用户名"
           }, 200));
         case 3:
           email = toSupabaseEmail(username, sessionId);
-          _context3.next = 4;
+          _context6.next = 4;
           return supabase.auth.signInWithPassword({
             email: email,
             password: password
           });
         case 4:
-          _yield$supabase$auth$2 = _context3.sent;
-          data = _yield$supabase$auth$2.data;
-          error = _yield$supabase$auth$2.error;
+          _yield$supabase$auth$4 = _context6.sent;
+          data = _yield$supabase$auth$4.data;
+          error = _yield$supabase$auth$4.error;
           if (!(error || !(data !== null && data !== void 0 && (_data$session = data.session) !== null && _data$session !== void 0 && _data$session.access_token) || !(data !== null && data !== void 0 && data.user))) {
-            _context3.next = 5;
+            _context6.next = 5;
             break;
           }
-          return _context3.abrupt("return", c.json({
+          return _context6.abrupt("return", c.json({
             success: false,
             message: (error === null || error === void 0 ? void 0 : error.message) || "登录失败"
           }, 200));
         case 5:
           token = data.session.access_token;
           user = data.user;
-          _context3.next = 6;
+          _context6.next = 6;
           return ensureAdminRegistryTable(supabase);
         case 6:
-          _context3.next = 7;
+          _context6.next = 7;
           return getEffectiveRoleForSession(user, sessionId);
         case 7:
-          role = _context3.sent;
-          return _context3.abrupt("return", c.json({
+          role = _context6.sent;
+          return _context6.abrupt("return", c.json({
             success: true,
             message: "登录成功",
             data: {
@@ -5477,44 +5636,44 @@ function _login() {
             }
           }, 200));
         case 8:
-          _context3.prev = 8;
-          _t3 = _context3["catch"](0);
+          _context6.prev = 8;
+          _t3 = _context6["catch"](0);
           console.error("登录失败:", _t3);
-          return _context3.abrupt("return", c.json({
+          return _context6.abrupt("return", c.json({
             success: false,
             message: "登录失败",
             error: _t3.message
           }, 500));
         case 9:
         case "end":
-          return _context3.stop();
+          return _context6.stop();
       }
-    }, _callee3, null, [[0, 8]]);
+    }, _callee6, null, [[0, 8]]);
   }));
   return _login.apply(this, arguments);
 }
-function signupStatus(_x5, _x6) {
+function signupStatus(_x13, _x14) {
   return _signupStatus.apply(this, arguments);
 }
 // POST - 首次注册管理员（每个 session_id 只允许一个）
 function _signupStatus() {
-  _signupStatus = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee4(c, tableName) {
+  _signupStatus = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee7(c, tableName) {
     var supabase, sessionId, ok, row, data, _t4;
-    return _regeneratorRuntime.wrap(function (_context4) {
-      while (1) switch (_context4.prev = _context4.next) {
+    return _regeneratorRuntime.wrap(function (_context7) {
+      while (1) switch (_context7.prev = _context7.next) {
         case 0:
-          _context4.prev = 0;
+          _context7.prev = 0;
           supabase = getSupabase();
           sessionId = extractSessionIdFromAuthTableName(tableName);
-          _context4.next = 1;
+          _context7.next = 1;
           return ensureAdminRegistryTable(supabase);
         case 1:
-          ok = _context4.sent;
+          ok = _context7.sent;
           if (ok) {
-            _context4.next = 2;
+            _context7.next = 2;
             break;
           }
-          return _context4.abrupt("return", c.json({
+          return _context7.abrupt("return", c.json({
             success: false,
             message: "缺少表 _cms_admin_registry，请先在 Supabase SQL 编辑器手动创建",
             data: {
@@ -5522,58 +5681,58 @@ function _signupStatus() {
             }
           }, 200));
         case 2:
-          _context4.next = 3;
+          _context7.next = 3;
           return getSessionAdminRow(supabase, sessionId);
         case 3:
-          row = _context4.sent;
+          row = _context7.sent;
           data = {
             session_id: sessionId,
             hasAdmin: !!row,
             allowSignup: !row
           };
-          return _context4.abrupt("return", c.json({
+          return _context7.abrupt("return", c.json({
             success: true,
             data: data
           }, 200));
         case 4:
-          _context4.prev = 4;
-          _t4 = _context4["catch"](0);
+          _context7.prev = 4;
+          _t4 = _context7["catch"](0);
           console.error("获取注册状态失败:", _t4);
-          return _context4.abrupt("return", c.json({
+          return _context7.abrupt("return", c.json({
             success: false,
             message: "获取注册状态失败",
             error: _t4.message
           }, 500));
         case 5:
         case "end":
-          return _context4.stop();
+          return _context7.stop();
       }
-    }, _callee4, null, [[0, 4]]);
+    }, _callee7, null, [[0, 4]]);
   }));
   return _signupStatus.apply(this, arguments);
 }
-function signup(_x7, _x8) {
+function signup(_x15, _x16) {
   return _signup.apply(this, arguments);
 }
 // POST - 验证token
 function _signup() {
-  _signup = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee5(c, tableName) {
-    var _body$username, _data$session2, body, account, password, supabase, sessionId, email, ok, existing, _yield$supabase$auth$3, data, error, insertRes, token, user, role, _t5;
-    return _regeneratorRuntime.wrap(function (_context5) {
-      while (1) switch (_context5.prev = _context5.next) {
+  _signup = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee8(c, tableName) {
+    var _body$username, _data$session2, body, account, password, supabase, sessionId, email, ok, existing, _yield$supabase$auth$5, data, error, promoted, insertRes, token, user, role, _t5;
+    return _regeneratorRuntime.wrap(function (_context8) {
+      while (1) switch (_context8.prev = _context8.next) {
         case 0:
-          _context5.prev = 0;
-          _context5.next = 1;
+          _context8.prev = 0;
+          _context8.next = 1;
           return c.req.json();
         case 1:
-          body = _context5.sent;
+          body = _context8.sent;
           account = (_body$username = body.username) === null || _body$username === void 0 ? void 0 : _body$username.trim();
           password = body.password;
           if (!(!account || !password)) {
-            _context5.next = 2;
+            _context8.next = 2;
             break;
           }
-          return _context5.abrupt("return", c.json({
+          return _context8.abrupt("return", c.json({
             success: false,
             message: "账号和密码不能为空"
           }, 200));
@@ -5581,24 +5740,24 @@ function _signup() {
           supabase = getSupabase();
           sessionId = extractSessionIdFromAuthTableName(tableName);
           if (account.includes("@")) {
-            _context5.next = 3;
+            _context8.next = 3;
             break;
           }
-          return _context5.abrupt("return", c.json({
+          return _context8.abrupt("return", c.json({
             success: false,
             message: "请输入邮箱格式的用户名"
           }, 200));
         case 3:
           email = toSupabaseEmail(account, sessionId);
-          _context5.next = 4;
+          _context8.next = 4;
           return ensureAdminRegistryTable(supabase);
         case 4:
-          ok = _context5.sent;
+          ok = _context8.sent;
           if (ok) {
-            _context5.next = 5;
+            _context8.next = 5;
             break;
           }
-          return _context5.abrupt("return", c.json({
+          return _context8.abrupt("return", c.json({
             success: false,
             message: "缺少表 _cms_admin_registry，请先在 Supabase SQL 编辑器手动创建",
             data: {
@@ -5606,20 +5765,20 @@ function _signup() {
             }
           }, 200));
         case 5:
-          _context5.next = 6;
+          _context8.next = 6;
           return getSessionAdminRow(supabase, sessionId);
         case 6:
-          existing = _context5.sent;
+          existing = _context8.sent;
           if (!existing) {
-            _context5.next = 7;
+            _context8.next = 7;
             break;
           }
-          return _context5.abrupt("return", c.json({
+          return _context8.abrupt("return", c.json({
             success: false,
             message: "该 session 已存在管理员账号，请直接登录"
           }, 200));
         case 7:
-          _context5.next = 8;
+          _context8.next = 8;
           return supabase.auth.signUp({
             // Supabase Auth 这里仍使用 email 字段；不在服务端强制校验格式，由 Supabase 返回错误信息
             email: email,
@@ -5633,60 +5792,69 @@ function _signup() {
             }
           });
         case 8:
-          _yield$supabase$auth$3 = _context5.sent;
-          data = _yield$supabase$auth$3.data;
-          error = _yield$supabase$auth$3.error;
+          _yield$supabase$auth$5 = _context8.sent;
+          data = _yield$supabase$auth$5.data;
+          error = _yield$supabase$auth$5.error;
           if (!(error || !(data !== null && data !== void 0 && data.user))) {
-            _context5.next = 10;
+            _context8.next = 12;
             break;
           }
           if (!isSupabaseUserAlreadyExistsError(error)) {
-            _context5.next = 9;
+            _context8.next = 11;
+            break;
+          }
+          _context8.next = 9;
+          return promoteExistingUserToSessionAdmin(supabase, email, sessionId, account);
+        case 9:
+          promoted = _context8.sent;
+          if (promoted.success) {
+            _context8.next = 10;
             break;
           }
-          return _context5.abrupt("return", c.json({
+          return _context8.abrupt("return", c.json({
             success: false,
-            message: "用户名已存在"
+            message: promoted.message
           }, 200));
-        case 9:
-          return _context5.abrupt("return", c.json({
+        case 10:
+          return _context8.abrupt("return", c.json({
+            success: true,
+            message: "管理员账号已启用，请登录"
+          }, 200));
+        case 11:
+          return _context8.abrupt("return", c.json({
             success: false,
             message: (error === null || error === void 0 ? void 0 : error.message) || "注册失败"
           }, 200));
-        case 10:
+        case 12:
           if ((_data$session2 = data.session) !== null && _data$session2 !== void 0 && _data$session2.access_token) {
-            _context5.next = 11;
+            _context8.next = 13;
             break;
           }
-          return _context5.abrupt("return", c.json({
+          return _context8.abrupt("return", c.json({
             success: true,
             message: "注册成功，请完成邮箱验证后登录"
           }, 200));
-        case 11:
-          _context5.next = 12;
-          return supabase.from("_cms_admin_registry").insert({
-            session_id: normalizeSessionId(sessionId),
-            user_id: data.user.id,
-            email: account
-          });
-        case 12:
-          insertRes = _context5.sent;
+        case 13:
+          _context8.next = 14;
+          return insertAdminRegistryRow(supabase, sessionId, data.user.id, account);
+        case 14:
+          insertRes = _context8.sent;
           if (!insertRes.error) {
-            _context5.next = 13;
+            _context8.next = 15;
             break;
           }
-          return _context5.abrupt("return", c.json({
+          return _context8.abrupt("return", c.json({
             success: false,
             message: "管理员已被创建，请使用已有账号登录"
           }, 200));
-        case 13:
+        case 15:
           token = data.session.access_token;
           user = data.user;
-          _context5.next = 14;
+          _context8.next = 16;
           return getEffectiveRoleForSession(user, sessionId);
-        case 14:
-          role = _context5.sent;
-          return _context5.abrupt("return", c.json({
+        case 16:
+          role = _context8.sent;
+          return _context8.abrupt("return", c.json({
             success: true,
             message: "注册成功",
             data: {
@@ -5699,151 +5867,151 @@ function _signup() {
               }
             }
           }, 200));
-        case 15:
-          _context5.prev = 15;
-          _t5 = _context5["catch"](0);
+        case 17:
+          _context8.prev = 17;
+          _t5 = _context8["catch"](0);
           console.error("注册失败:", _t5);
-          return _context5.abrupt("return", c.json({
+          return _context8.abrupt("return", c.json({
             success: false,
             message: "注册失败",
             error: _t5.message
           }, 500));
-        case 16:
+        case 18:
         case "end":
-          return _context5.stop();
+          return _context8.stop();
       }
-    }, _callee5, null, [[0, 15]]);
+    }, _callee8, null, [[0, 17]]);
   }));
   return _signup.apply(this, arguments);
 }
-function verifyAuth(_x9, _x0) {
+function verifyAuth(_x17, _x18) {
   return _verifyAuth.apply(this, arguments);
 }
 // GET - 获取当前用户信息
 function _verifyAuth() {
-  _verifyAuth = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee6(c, tableName) {
-    var authHeader, token, supabase, _yield$supabase$auth$4, data, error, sessionId, role, decoded, message, responseMessage, _t6, _t7;
-    return _regeneratorRuntime.wrap(function (_context6) {
-      while (1) switch (_context6.prev = _context6.next) {
+  _verifyAuth = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee9(c, tableName) {
+    var authHeader, token, supabase, _yield$supabase$auth$6, data, error, sessionId, role, decoded, message, responseMessage, _t6, _t7;
+    return _regeneratorRuntime.wrap(function (_context9) {
+      while (1) switch (_context9.prev = _context9.next) {
         case 0:
-          _context6.prev = 0;
+          _context9.prev = 0;
           authHeader = c.req.header('Authorization');
           token = AuthUtils.extractTokenFromHeader(authHeader || null);
           if (token) {
-            _context6.next = 1;
+            _context9.next = 1;
             break;
           }
-          return _context6.abrupt("return", c.json({
+          return _context9.abrupt("return", c.json({
             success: false,
             message: "缺少认证信息"
           }, 200));
         case 1:
-          _context6.prev = 1;
+          _context9.prev = 1;
           supabase = getSupabase();
-          _context6.next = 2;
+          _context9.next = 2;
           return supabase.auth.getUser(token);
         case 2:
-          _yield$supabase$auth$4 = _context6.sent;
-          data = _yield$supabase$auth$4.data;
-          error = _yield$supabase$auth$4.error;
+          _yield$supabase$auth$6 = _context9.sent;
+          data = _yield$supabase$auth$6.data;
+          error = _yield$supabase$auth$6.error;
           if (!(error || !(data !== null && data !== void 0 && data.user))) {
-            _context6.next = 3;
+            _context9.next = 3;
             break;
           }
           throw new Error('INVALID_TOKEN');
         case 3:
           sessionId = extractSessionIdFromAuthTableName(tableName);
-          _context6.next = 4;
+          _context9.next = 4;
           return ensureAdminRegistryTable(supabase);
         case 4:
-          _context6.next = 5;
+          _context9.next = 5;
           return getEffectiveRoleForSession(data.user, sessionId);
         case 5:
-          role = _context6.sent;
+          role = _context9.sent;
           decoded = {
             id: data.user.id,
             role: role,
             session_id: sessionId
           };
-          return _context6.abrupt("return", c.json({
+          return _context9.abrupt("return", c.json({
             success: true,
             message: "认证有效",
             data: decoded
           }));
         case 6:
-          _context6.prev = 6;
-          _t6 = _context6["catch"](1);
+          _context9.prev = 6;
+          _t6 = _context9["catch"](1);
           message = _t6.message;
           responseMessage = message === 'TOKEN_EXPIRED' ? "登录已过期，请重新登录" : "认证信息无效";
-          return _context6.abrupt("return", c.json({
+          return _context9.abrupt("return", c.json({
             success: false,
             message: responseMessage
           }, 200));
         case 7:
-          _context6.prev = 7;
-          _t7 = _context6["catch"](0);
+          _context9.prev = 7;
+          _t7 = _context9["catch"](0);
           console.error("验证认证失败:", _t7);
-          return _context6.abrupt("return", c.json({
+          return _context9.abrupt("return", c.json({
             success: false,
             message: "验证认证失败",
             error: _t7.message
           }, 500));
         case 8:
         case "end":
-          return _context6.stop();
+          return _context9.stop();
       }
-    }, _callee6, null, [[0, 7], [1, 6]]);
+    }, _callee9, null, [[0, 7], [1, 6]]);
   }));
   return _verifyAuth.apply(this, arguments);
 }
-function getCurrentUser(_x1, _x10) {
+function getCurrentUser(_x19, _x20) {
   return _getCurrentUser.apply(this, arguments);
 }
 // 中间件：验证 Supabase JWT token
 function _getCurrentUser() {
-  _getCurrentUser = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee7(c, tableName) {
-    var authHeader, token, supabase, _yield$supabase$auth$5, data, error, user, sessionId, role, _t8;
-    return _regeneratorRuntime.wrap(function (_context7) {
-      while (1) switch (_context7.prev = _context7.next) {
+  _getCurrentUser = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee0(c, tableName) {
+    var authHeader, token, supabase, _yield$supabase$auth$7, data, error, user, sessionId, role, _t8;
+    return _regeneratorRuntime.wrap(function (_context0) {
+      while (1) switch (_context0.prev = _context0.next) {
         case 0:
-          _context7.prev = 0;
+          _context0.prev = 0;
           authHeader = c.req.header('Authorization');
           token = AuthUtils.extractTokenFromHeader(authHeader || null);
           if (token) {
-            _context7.next = 1;
+            _context0.next = 1;
             break;
           }
-          return _context7.abrupt("return", c.json({
+          return _context0.abrupt("return", c.json({
             success: false,
             message: "缺少认证信息"
           }, 200));
         case 1:
           supabase = getSupabase();
-          _context7.next = 2;
+          _context0.next = 2;
           return supabase.auth.getUser(token);
         case 2:
-          _yield$supabase$auth$5 = _context7.sent;
-          data = _yield$supabase$auth$5.data;
-          error = _yield$supabase$auth$5.error;
+          _yield$supabase$auth$7 = _context0.sent;
+          data = _yield$supabase$auth$7.data;
+          error = _yield$supabase$auth$7.error;
           if (!(error || !(data !== null && data !== void 0 && data.user))) {
-            _context7.next = 3;
+            _context0.next = 3;
             break;
           }
-          return _context7.abrupt("return", c.json({
+          return _context0.abrupt("return", c.json({
             success: false,
             message: "认证信息无效"
           }, 200));
         case 3:
           user = data.user;
           sessionId = extractSessionIdFromAuthTableName(tableName);
-          _context7.next = 4;
+          _context0.next = 4;
           return ensureAdminRegistryTable(supabase);
         case 4:
-          _context7.next = 5;
+          _context0.next = 5;
           return getEffectiveRoleForSession(user, sessionId);
         case 5:
-          role = _context7.sent;
-          return _context7.abrupt("return", c.json({
+          role = _context0.sent;
+          return _context0.abrupt("return", c.json({
             success: true,
             message: "获取用户信息成功",
             data: {
@@ -5856,19 +6024,19 @@ function _getCurrentUser() {
             }
           }, 200));
         case 6:
-          _context7.prev = 6;
-          _t8 = _context7["catch"](0);
+          _context0.prev = 6;
+          _t8 = _context0["catch"](0);
           console.error("获取用户信息失败:", _t8);
-          return _context7.abrupt("return", c.json({
+          return _context0.abrupt("return", c.json({
             success: false,
             message: "获取用户信息失败",
             error: _t8.message
           }, 500));
         case 7:
         case "end":
-          return _context7.stop();
+          return _context0.stop();
       }
-    }, _callee7, null, [[0, 6]]);
+    }, _callee0, null, [[0, 6]]);
   }));
   return _getCurrentUser.apply(this, arguments);
 }
@@ -5942,7 +6110,7 @@ function requireAuth(handler) {
         }
       }, _callee, null, [[0, 5], [1, 4]]);
     }));
-    return function (_x11) {
+    return function (_x21) {
       return _ref.apply(this, arguments);
     };
   }();
@@ -6074,6 +6242,10 @@ function _uploadToOss() {
   return _uploadToOss.apply(this, arguments);
 }
 
+var AUTH_REQUIRED = "CMS_AUTH_REQUIRED";
+var AUTH_INVALID = "CMS_AUTH_INVALID";
+var CMS_FORBIDDEN = "CMS_FORBIDDEN";
+var CMS_SESSION_MISMATCH = "CMS_SESSION_MISMATCH";
 function getRoleFromSupabaseUser$1(user) {
   var _user$app_metadata, _user$user_metadata;
   var appRole = user === null || user === void 0 || (_user$app_metadata = user.app_metadata) === null || _user$app_metadata === void 0 ? void 0 : _user$app_metadata.role;
@@ -6094,7 +6266,8 @@ var requireJwtAuth = /*#__PURE__*/function () {
           }
           return _context.abrupt("return", c.json({
             success: false,
-            message: "缺少认证信息"
+            message: "缺少认证信息",
+            error: AUTH_REQUIRED
           }, 200));
         case 1:
           _context.prev = 1;
@@ -6111,7 +6284,8 @@ var requireJwtAuth = /*#__PURE__*/function () {
           }
           return _context.abrupt("return", c.json({
             success: false,
-            message: "认证信息无效"
+            message: "认证信息无效",
+            error: AUTH_INVALID
           }, 200));
         case 3:
           auth = {
@@ -6129,7 +6303,8 @@ var requireJwtAuth = /*#__PURE__*/function () {
           _context["catch"](1);
           return _context.abrupt("return", c.json({
             success: false,
-            message: "认证信息无效"
+            message: "认证信息无效",
+            error: AUTH_INVALID
           }, 200));
         case 6:
         case "end":
@@ -6156,7 +6331,8 @@ var requireAdminRole = /*#__PURE__*/function () {
           }
           return _context2.abrupt("return", c.json({
             success: false,
-            message: "缺少认证信息"
+            message: "缺少认证信息",
+            error: AUTH_REQUIRED
           }, 200));
         case 1:
           if (!(role !== "admin")) {
@@ -6165,7 +6341,8 @@ var requireAdminRole = /*#__PURE__*/function () {
           }
           return _context2.abrupt("return", c.json({
             success: false,
-            message: "权限不足：你不是管理员"
+            message: "权限不足：你不是管理员",
+            error: CMS_FORBIDDEN
           }, 200));
         case 2:
           // session_id 维度权限：必须带 session_id，且与用户 metadata 一致，并且命中 registry
@@ -6179,7 +6356,8 @@ var requireAdminRole = /*#__PURE__*/function () {
           }
           return _context2.abrupt("return", c.json({
             success: false,
-            message: "权限不足：session_id 不匹配"
+            message: "权限不足：session_id 不匹配",
+            error: CMS_SESSION_MISMATCH
           }, 200));
         case 3:
           supabase = getSupabase();
@@ -6206,7 +6384,8 @@ var requireAdminRole = /*#__PURE__*/function () {
           }
           return _context2.abrupt("return", c.json({
             success: false,
-            message: "权限不足：你不是该 session 的管理员"
+            message: "权限不足：你不是该 session 的管理员",
+            error: CMS_FORBIDDEN
           }, 200));
         case 7:
           _context2.next = 8;