mm_power 1.0.1 → 1.0.3

package/lib/power.js

@@ -0,0 +1,1969 @@
+require('mm_helper');
+const { kvStoreAdmin } = require('mm_kv_store');
+
+/**
+ * 鉴权类
+ * @class
+ */
+class Power {
+  /**
+   * 创建鉴权实例
+   * @param {Object} config 配置
+   */
+  constructor(config) {
+    this.config = {
+      // 用户ID字段名
+      user_id: 'user_id',
+      // 管理员级别字段名
+      gm: 'gm',
+      // VIP级别字段名
+      vip: 'vip',
+      // 商家级别字段名
+      mc: 'mc',
+      // 管理组权限字段名
+      admins: 'admins',
+      // 用户组权限字段名
+      groups: 'groups',
+      // 登录状态字段名
+      login: 'login',
+      // 权限生效开始时间字段名
+      time_start: 'time_start',
+      // 权限生效结束时间字段名
+      time_end: 'time_end'
+    };
+    this._stores = {}; // 数据键值存储实例缓存（路由/角色/用户组/管理组/缓存）
+    this._loader = null; // 异步加载器
+    this.setConfig(config || {});
+  }
+
+  /**
+   * 获取指定名称的键值存储实例（数据经 mm_kv_store 读写）
+   * @param {string} name 存储名称：routes / roles / groups / admins / cache
+   * @returns {Object} KvStore 键值存储实例
+   */
+  _store(name) {
+    if (!this._stores[name]) {
+      const scope = `mm_power:${this.config.name || 'os'}:${name}`;
+      this._stores[name] = kvStoreAdmin(scope);
+    }
+    return this._stores[name];
+  }
+
+  /**
+   * 用给定对象整体替换存储内容
+   * @param {string} name 存储名称
+   * @param {Object} data 键值数据
+   * @returns {void}
+   */
+  _setAll(name, data) {
+    const store = this._store(name);
+    store.clear();
+    for (const key in data) {
+      if (Object.prototype.hasOwnProperty.call(data, key)) {
+        store.set(key, data[key]);
+      }
+    }
+  }
+
+  /**
+   * 转换用户数据到内部标准格式
+   * @param {Object} userData 原始用户数据
+   * @returns {Object} 转换后的标准格式用户数据
+   */
+  _transformUser(userData) {
+    if (!userData) return null;
+
+    // 如果已经是标准格式，直接返回
+    if (this._isStandardFormat(userData)) {
+      return userData;
+    }
+
+    const transformed = this._mapStandardFields(userData);
+    this._handleUndefined(userData, transformed);
+    this._copyOtherFields(userData, transformed);
+
+    return transformed;
+  }
+
+  /**
+   *
+   */
+  _isStandardFormat(userData) {
+    return userData.user_id !== undefined &&
+      userData.admins !== undefined &&
+      userData.groups !== undefined;
+  }
+
+  /**
+   *
+   */
+  _mapStandardFields(userData) {
+    const transformed = {};
+
+    // 映射标准字段
+    transformed.user_id = userData[this.config.user_id];
+    transformed.gm = userData[this.config.gm];
+    transformed.vip = userData[this.config.vip];
+    transformed.mc = userData[this.config.mc];
+    transformed.admins = userData[this.config.admins];
+    transformed.groups = userData[this.config.groups];
+    transformed.login = userData[this.config.login];
+    transformed.time_start = userData[this.config.time_start];
+    transformed.time_end = userData[this.config.time_end];
+
+    return transformed;
+  }
+
+  /**
+   *
+   */
+  _handleUndefined(userData, transformed) {
+    // 如果映射后的字段是undefined，但原始数据中存在同名字段，则使用原始数据
+    if (transformed.admins === undefined && userData.admins !== undefined) {
+      transformed.admins = userData.admins;
+    }
+    if (transformed.groups === undefined && userData.groups !== undefined) {
+      transformed.groups = userData.groups;
+    }
+    if (transformed.user_id === undefined && userData.user_id !== undefined) {
+      transformed.user_id = userData.user_id;
+    }
+  }
+
+  /**
+   *
+   */
+  _copyOtherFields(userData, transformed) {
+    // 复制其他字段
+    for (const key in userData) {
+      if (!(key in transformed) && userData.hasOwnProperty(key)) {
+        transformed[key] = userData[key];
+      }
+    }
+  }
+}
+
+/**
+ * 设置异步配置加载器
+ * @param {Function} loader 异步加载器
+ */
+Power.prototype.setLoader = function (loader) {
+  if (typeof loader !== 'function') {
+    throw new TypeError('加载器必须是函数');
+  }
+  this._loader = loader;
+};
+
+/**
+ * 异步加载配置
+ * @param {string} type 配置类型
+ * @param {string} key 配置键
+ * @returns {Promise<Object>} 配置
+ */
+Power.prototype._loadConfig = async function (type, key) {
+  if (!this._loader) {
+    throw new Error('异步加载器未设置');
+  }
+
+  const cache_key = `${type}:${key}`;
+  const cached = this._store('cache').get(cache_key);
+  if (cached) {
+    return cached;
+  }
+
+  const config = await this._loader(type, key);
+  this._store('cache').set(cache_key, config);
+  return config;
+};
+
+/**
+ * 异步设置配置
+ * @param {Object} config 配置
+ * @returns {Promise<void>}
+ */
+Power.prototype.setConfigAsync = async function (config) {
+  if (!config) {
+    throw new TypeError('配置是必需的');
+  }
+  if (typeof config !== 'object') {
+    throw new TypeError('配置必须是对象');
+  }
+  Object.assign(this.config, config);
+};
+
+/**
+ * 异步设置路由权限配置
+ * @param {Object} routes 路由配置
+ * @returns {Promise<void>}
+ */
+Power.prototype.setRoutesAsync = async function (routes) {
+  if (!routes) {
+    throw new TypeError('路由是必需的');
+  }
+  if (typeof routes !== 'object') {
+    throw new TypeError('路由必须是对象');
+  }
+  this._setAll('routes', routes);
+};
+
+/**
+ * 异步设置角色权限配置
+ * @param {Object} roles 角色配置
+ * @returns {Promise<void>}
+ */
+Power.prototype.setRolesAsync = async function (roles) {
+  if (!roles) {
+    throw new TypeError('角色是必需的');
+  }
+  if (typeof roles !== 'object') {
+    throw new TypeError('角色必须是对象');
+  }
+  this._setAll('roles', roles);
+};
+
+/**
+ * 异步设置用户组配置
+ * @param {Object} groups 用户组配置
+ * @returns {Promise<void>}
+ */
+Power.prototype.setGroupsAsync = async function (groups) {
+  if (!groups) {
+    throw new TypeError('用户组是必需的');
+  }
+  if (typeof groups !== 'object') {
+    throw new TypeError('用户组必须是对象');
+  }
+  this._setAll('groups', groups);
+};
+
+/**
+ * 异步设置管理组配置
+ * @param {Object} admins 管理组配置
+ * @returns {Promise<void>}
+ */
+Power.prototype.setAdminsAsync = async function (admins) {
+  if (!admins) {
+    throw new TypeError('管理组是必需的');
+  }
+  if (typeof admins !== 'object') {
+    throw new TypeError('管理组必须是对象');
+  }
+  this._setAll('admins', admins);
+};
+
+/**
+ * 异步检查管理组权限
+ * @param {Object} user 用户
+ * @param {string} admin 管理组
+ * @returns {Promise<string>} 结果
+ */
+Power.prototype._checkAdminLevel = function (options, user) {
+  if (!options.gm || !user.gm) {
+    return null;
+  }
+
+  if (user.gm < options.gm) {
+    return `管理级别不足: ${user.gm} < ${options.gm}`;
+  }
+
+  return null;
+};
+
+/**
+ * 异步检查用户是否属于指定组
+ * @param {Object} user 用户
+ * @param {string} admin 管理组
+ * @returns {Promise<string>} 结果
+ */
+Power.prototype.checkAdminAsync = async function (user, admin) {
+  if (!user) {
+    throw new TypeError('用户是必需的');
+  }
+  if (!admin) {
+    throw new TypeError('管理组是必需的');
+  }
+
+  // 如果user是字符串，则认为是用户ID，需要通过getUserAsync获取用户对象
+  const userObj = await this._getUserIfNeeded(user);
+  if (typeof user === 'string' && !userObj) {
+    return '用户不存在';
+  }
+
+  // 转换用户数据到内部标准格式
+  const std_user = this._transformUser(userObj);
+
+  // 异步加载管理组配置
+  const options = await this._loadConfig('admins', admin);
+  if (!options) {
+    return `管理组配置不存在: ${admin}`;
+  }
+
+  // 检查各项权限
+  const checks = [
+    () => this._checkUserInAdmin(std_user, admin),
+    () => this._checkAdminTime(options, admin),
+    () => this._checkAdminIp(options, std_user),
+    () => this._checkAdminLevel(options, std_user)
+  ];
+
+  for (const check of checks) {
+    const result = check();
+    if (result) {
+      return result;
+    }
+  }
+
+  return '';
+};
+
+Power.prototype._getUserIfNeeded = async function (user) {
+  if (typeof user === 'string') {
+    return await this.getUserAsync(user);
+  }
+  return user;
+};
+
+Power.prototype._checkUserInAdmin = function (user, admin) {
+  if (!user.admins || !user.admins.includes(admin)) {
+    return `用户不属于管理组: ${admin}`;
+  }
+  return null;
+};
+
+/**
+ * 异步检查管理组权限（支持多个管理组）
+ * @param {Object} user 用户
+ * @param {string|Array} admins 管理组
+ * @param {number} way 检查方式
+ * @returns {Promise<string>} 结果
+ */
+Power.prototype.checkAdminsAsync = async function (user, admins, way = 0) {
+  if (!user) {
+    throw new TypeError('用户是必需的');
+  }
+  if (!admins) {
+    throw new TypeError('管理组是必需的');
+  }
+
+  // 如果user是字符串，则认为是用户ID
+  const userObj = await this._getUserIfNeeded(user);
+  if (typeof user === 'string' && !userObj) {
+    return '用户不存在';
+  }
+
+  const grps = Array.isArray(admins) ? admins : [admins];
+
+  switch (way) {
+    case 1:
+      return await this._checkAllAdminsAsync(userObj, grps);
+    case 2:
+      return await this._checkAnyAdminAsync(userObj, grps);
+    default:
+      return await this._checkFirstAdmin(userObj, grps);
+  }
+};
+
+Power.prototype._checkAllAdminsAsync = async function (userObj, grps) {
+  // 必须拥有所有管理组权限
+  for (const grp of grps) {
+    const res = await this.checkAdminAsync(userObj, grp);
+    if (res) {
+      return res;
+    }
+  }
+  return '';
+};
+
+Power.prototype._checkAnyAdminAsync = async function (userObj, grps) {
+  // 拥有任一管理组权限即可
+  for (const grp of grps) {
+    const res = await this.checkAdminAsync(userObj, grp);
+    if (!res) {
+      return '';
+    }
+  }
+  return `缺少任一管理组权限: ${grps.join(', ')}`;
+};
+
+Power.prototype._checkFirstAdmin = async function (userObj, grps) {
+  // 默认检查第一个管理组
+  if (grps.length > 0) {
+    return await this.checkAdminAsync(userObj, grps[0]);
+  }
+  return '';
+};
+
+/**
+ * 设置配置
+ * @param {Object} config 配置
+ */
+Power.prototype.setConfig = function (config) {
+  if (!config) {
+    throw new TypeError('配置是必需的');
+  }
+  if (typeof config !== 'object') {
+    throw new TypeError('配置必须是对象');
+  }
+  Object.assign(this.config, config);
+};
+
+/**
+ * 设置路由权限配置
+ * @param {Object} routes 路由配置
+ */
+Power.prototype.setRoutes = function (routes) {
+  if (!routes) {
+    throw new TypeError('路由是必需的');
+  }
+  if (typeof routes !== 'object') {
+    throw new TypeError('路由必须是对象');
+  }
+  this._setAll('routes', routes);
+};
+
+/**
+ * 设置角色权限配置
+ * @param {Object} roles 角色配置
+ */
+Power.prototype.setRoles = function (roles) {
+  if (!roles) {
+    throw new TypeError('角色是必需的');
+  }
+  if (typeof roles !== 'object') {
+    throw new TypeError('角色必须是对象');
+  }
+  this._setAll('roles', roles);
+};
+
+/**
+ * 设置用户组配置
+ * @param {Object} groups 用户组配置
+ */
+Power.prototype.setGroups = function (groups) {
+  if (!groups) {
+    throw new TypeError('用户组是必需的');
+  }
+  if (typeof groups !== 'object') {
+    throw new TypeError('用户组必须是对象');
+  }
+  this._setAll('groups', groups);
+};
+
+/**
+ * 设置管理组配置
+ * @param {Object} admins 管理组配置
+ */
+Power.prototype.setAdmins = function (admins) {
+  if (!admins) {
+    throw new TypeError('管理组是必需的');
+  }
+  if (typeof admins !== 'object') {
+    throw new TypeError('管理组必须是对象');
+  }
+  this._setAll('admins', admins);
+};
+
+/**
+ * 检查管理组权限
+ * @param {Object} user 用户
+ * @param {string} admin 管理组
+ * @returns {string} 结果
+ */
+Power.prototype.checkAdmin = function (user, admin) {
+  if (!user) {
+    throw new TypeError('用户是必需的');
+  }
+  if (!admin) {
+    throw new TypeError('管理组是必需的');
+  }
+
+  // 转换用户数据到内部标准格式
+  const stdUser = this._transformUser(user);
+
+  // 检查用户是否属于该管理组
+  if (!stdUser.admins || !stdUser.admins.includes(admin)) {
+    return `用户不属于管理组: ${admin}`;
+  }
+
+  // 获取管理组配置
+  const options = this._store('admins').get(admin);
+  if (!options) {
+    return `管理组配置不存在: ${admin}`;
+  }
+
+  return this._checkAdminDetails(options, stdUser, admin);
+};
+
+/**
+ * 检查管理组详细权限
+ * @param {Object} options 管理组配置
+ * @param {Object} stdUser 标准用户对象
+ * @param {string} admin 管理组
+ * @returns {string} 结果
+ */
+Power.prototype._checkAdminDetails = function (options, stdUser, admin) {
+  // 检查时间范围权限
+  const time_result = this._checkAdminTime(options, admin);
+  if (time_result) {
+    return time_result;
+  }
+
+  // 检查IP白名单
+  const ip_result = this._checkAdminIp(options, stdUser);
+  if (ip_result) {
+    return ip_result;
+  }
+
+  // 检查管理级别
+  const level_result = this._checkAdminLevel(options, stdUser);
+  if (level_result) {
+    return level_result;
+  }
+
+  return '';
+};
+
+/**
+ * 检查管理组时间范围权限
+ * @param {Object} options 管理组配置
+ * @param {string} admin 管理组
+ * @returns {string} 结果
+ */
+Power.prototype._checkAdminTime = function (options, admin) {
+  if (!options.time_start || !options.time_end) {
+    return null;
+  }
+
+  const now = new Date();
+  const start = new Date(options.time_start);
+  const end = new Date(options.time_end);
+
+  if (now < start || now > end) {
+    return `管理组时间范围权限不足: ${admin}`;
+  }
+
+  return null;
+};
+
+/**
+ * 检查管理组IP白名单权限
+ * @param {Object} options 管理组配置
+ * @param {Object} user 用户
+ * @returns {string} 结果
+ */
+Power.prototype._checkAdminIp = function (options, user) {
+  if (!options.ip_whitelist || !user.ip) {
+    return null;
+  }
+
+  if (!options.ip_whitelist.includes(user.ip)) {
+    return `IP不在管理组白名单内: ${user.ip}`;
+  }
+
+  return null;
+};
+
+/**
+ * 检查管理级别权限
+ * @param {Object} options 管理组配置
+ * @param {Object} user 用户
+ * @returns {string} 结果
+ */
+Power.prototype._checkAdminLevel = function (options, user) {
+  if (!options.gm || !user.gm) {
+    return null;
+  }
+
+  if (user.gm < options.gm) {
+    return `管理级别不足: ${user.gm} < ${options.gm}`;
+  }
+
+  return null;
+};
+
+/**
+ * 检查管理组权限（支持多个管理组）
+ * @param {Object} user 用户
+ * @param {string|Array} admins 管理组
+ * @param {number} way 检查方式
+ * @returns {string} 结果
+ */
+Power.prototype.checkAdmins = function (user, admins, way = 0) {
+  if (!user) {
+    throw new TypeError('用户是必需的');
+  }
+  if (!admins) {
+    throw new TypeError('管理组是必需的');
+  }
+
+  // 转换用户数据到内部标准格式
+  const std_user = this._transformUser(user);
+
+  const grps = Array.isArray(admins) ? admins : [admins];
+
+  if (way === 1) {
+    return this._checkAllAdmins(std_user, grps);
+  } else if (way === 2) {
+    return this._checkAnyAdmin(std_user, grps);
+  } else {
+    return this._checkFirstAdmin(std_user, grps);
+  }
+};
+
+/**
+ * 检查所有管理组权限
+ * @param {Object} user 用户
+ * @param {Array} grps 管理组列表
+ * @returns {string} 结果
+ */
+Power.prototype._checkAllAdmins = function (user, grps) {
+  for (const grp of grps) {
+    const res = this.checkAdmin(user, grp);
+    if (res) {
+      return res;
+    }
+  }
+  return '';
+};
+
+/**
+ * 检查任一管理组权限
+ * @param {Object} user 用户
+ * @param {Array} grps 管理组列表
+ * @returns {string} 结果
+ */
+Power.prototype._checkAnyAdmin = function (user, grps) {
+  let has_perm = false;
+  for (const grp of grps) {
+    const res = this.checkAdmin(user, grp);
+    if (!res) {
+      has_perm = true;
+      break;
+    }
+  }
+  if (!has_perm) {
+    return `缺少任一管理组权限: ${grps.join(', ')}`;
+  }
+  return '';
+};
+
+/**
+ * 检查第一个管理组权限
+ * @param {Object} user 用户
+ * @param {Array} grps 管理组列表
+ * @returns {string} 结果
+ */
+Power.prototype._checkFirstAdmin = function (user, grps) {
+  if (grps.length > 0) {
+    return this.checkAdmin(user, grps[0]);
+  }
+  return '';
+};
+
+/**
+ * 检查字段权限
+ * @param {Object} user 用户
+ * @param {Object} power 权限
+ * @param {Function} func 函数
+ * @param {number} way 方式
+ * @returns {string} 结果
+ */
+Power.prototype.checkField = function (
+  user,
+  power = {
+    vip: 0,
+    gm: 0,
+    mc: 0
+  },
+  func,
+  way = 0
+) {
+  if (!user) {
+    throw new TypeError('用户是必需的');
+  }
+
+  // 转换用户数据到内部标准格式
+  const std_user = this._transformUser(user);
+
+  this._initUserFields(std_user);
+
+  if (way === 1) {
+    return this._checkAllFields(std_user, power);
+  } else if (way === 2) {
+    return this._checkAnyFields(std_user, power);
+  } else {
+    return this._checkDefaultFields(std_user, power);
+  }
+};
+
+/**
+ * 初始化用户字段
+ * @param {Object} user 用户
+ */
+Power.prototype._initUserFields = function (user) {
+  if (!user.vip) {
+    user.vip = 0;
+  }
+  if (!user.gm) {
+    user.gm = 0;
+  }
+  if (!user.mc) {
+    user.mc = 0;
+  }
+};
+
+/**
+ * 检查所有字段权限
+ * @param {Object} user 用户
+ * @param {Object} power 权限
+ * @returns {string} 结果
+ */
+Power.prototype._checkAllFields = function (user, power) {
+  if (user.gm < power.gm) {
+    return 'gm等级不足';
+  }
+  if (user.mc < power.mc) {
+    return 'mc等级不足';
+  }
+  if (user.vip < power.vip) {
+    return 'vip等级不足';
+  }
+  return '';
+};
+
+/**
+ * 检查任一字段权限
+ * @param {Object} user 用户
+ * @param {Object} power 权限
+ * @returns {string} 结果
+ */
+Power.prototype._checkAnyFields = function (user, power) {
+  if (user.vip < power.vip && user.gm < power.gm && user.mc < power.mc) {
+    return 'vip等级、gm等级、mc等级不足';
+  }
+  return '';
+};
+
+/**
+ * 检查默认字段权限
+ * @param {Object} user 用户
+ * @param {Object} power 权限
+ * @returns {string} 结果
+ */
+Power.prototype._checkDefaultFields = function (user, power) {
+  if (user.gm < power.gm) {
+    if (user.vip < power.vip && user.mc < power.mc) {
+      return 'vip等级、mc等级不足';
+    }
+  }
+  return '';
+};
+
+/**
+ * 获取用户
+ * @param {string} user_id 用户ID
+ * @returns {Object} 用户
+ */
+Power.prototype.getUser = async function (user_id) {
+  return {
+    vip: 2,
+    gm: 5,
+    mc: 3,
+    admin: '',
+    group: 'vip'
+  };
+};
+
+/**
+ * 检查权限
+ * @param {string} user_id 用户ID
+ * @param {Function} func 函数
+ * @param {number} way 方式
+ * @returns {string} 结果
+ */
+Power.prototype.check = async function (
+  user_id,
+  power = {},
+  func = null,
+  way = 0
+) {
+  const user = await this.getUser(user_id);
+  if (!user) {
+    return '用户不存在';
+  }
+  const result = this.checkField(user, power, func, way);
+  if (result) {
+    return result;
+  }
+  const result2 = this.checkPath(user, power, func, way);
+  if (result2) {
+    return result2;
+  }
+  const result3 = this.checkMethod(user, power, func, way);
+  if (result3) {
+    return result3;
+  }
+  return '';
+};
+
+/**
+ * 检查路径权限
+ * @param {Object} user 用户
+ * @param {Object} power 权限
+ * @param {Function} func 函数
+ * @param {number} way 方式
+ * @returns {string} 结果
+ */
+Power.prototype.checkPath = function (user, power = {}, func = null, way = 0) {
+  if (!user) {
+    throw new TypeError('用户是必需的');
+  }
+
+  // 转换用户数据到内部标准格式
+  const std_user = this._transformUser(user);
+
+  if (power.path) {
+    const user_paths = std_user.paths || [];
+    const required_paths = Array.isArray(power.path)
+      ? power.path
+      : [power.path];
+
+    if (way === 1) {
+      return this._checkAllPaths(user_paths, required_paths);
+    } else if (way === 2) {
+      return this._checkAnyPath(user_paths, required_paths);
+    } else {
+      return this._checkFirstPath(user_paths, required_paths);
+    }
+  }
+
+  if (func) {
+    return func(std_user, power, 'checkPath');
+  }
+  return '';
+};
+
+/**
+ * 检查所有路径权限
+ * @param {Array} user_paths 用户路径列表
+ * @param {Array} required_paths 所需路径列表
+ * @returns {string} 结果
+ */
+Power.prototype._checkAllPaths = function (user_paths, required_paths) {
+  for (const path of required_paths) {
+    if (!user_paths.includes(path)) {
+      return `缺少路径权限: ${path}`;
+    }
+  }
+  return '';
+};
+
+/**
+ * 检查任一路径权限
+ * @param {Array} user_paths 用户路径列表
+ * @param {Array} required_paths 所需路径列表
+ * @returns {string} 结果
+ */
+Power.prototype._checkAnyPath = function (user_paths, required_paths) {
+  let has_access = false;
+  for (const path of required_paths) {
+    if (user_paths.includes(path)) {
+      has_access = true;
+      break;
+    }
+  }
+  if (!has_access) {
+    return '无任何路径权限';
+  }
+  return '';
+};
+
+/**
+ * 检查第一个路径权限
+ * @param {Array} user_paths 用户路径列表
+ * @param {Array} required_paths 所需路径列表
+ * @returns {string} 结果
+ */
+Power.prototype._checkFirstPath = function (user_paths, required_paths) {
+  if (required_paths.length > 0 && !user_paths.includes(required_paths[0])) {
+    return `缺少路径权限: ${required_paths[0]}`;
+  }
+  return '';
+};
+
+/**
+ * 检查方法权限
+ * @param {Object} user 用户
+ * @param {Object} power 权限
+ * @param {Function} func 函数
+ * @param {number} way 方式
+ * @returns {string} 结果
+ */
+Power.prototype.checkMethod = function (
+  user,
+  power = {},
+  func = null,
+  way = 0
+) {
+  if (!user) {
+    throw new TypeError('用户是必需的');
+  }
+
+  // 转换用户数据到内部标准格式
+  const std_user = this._transformUser(user);
+
+  if (power.method) {
+    const method_result = this._checkMethodWay(std_user, power, way);
+    if (method_result) {
+      return method_result;
+    }
+  }
+
+  if (func) {
+    return func(std_user, power, 'checkMethod');
+  }
+  return '';
+};
+
+/**
+ * 检查方法权限方式
+ * @param {Object} user 用户
+ * @param {Object} power 权限
+ * @param {number} way 方式
+ * @returns {string} 结果
+ */
+Power.prototype._checkMethodWay = function (user, power, way) {
+  const user_methods = user.methods || [];
+  const required_methods = Array.isArray(power.method)
+    ? power.method
+    : [power.method];
+
+  if (way === 1) {
+    return this._checkAllMethods(user_methods, required_methods);
+  } else if (way === 2) {
+    return this._checkAnyMethod(user_methods, required_methods);
+  } else {
+    return this._checkFirstMethod(user_methods, required_methods);
+  }
+};
+
+/**
+ * 检查所有方法权限
+ * @param {Array} user_methods 用户方法
+ * @param {Array} required_methods 要求方法
+ * @returns {string} 结果
+ */
+Power.prototype._checkAllMethods = function (user_methods, required_methods) {
+  for (const method of required_methods) {
+    if (!user_methods.includes(method.toUpperCase())) {
+      return `缺少方法权限: ${method}`;
+    }
+  }
+  return null;
+};
+
+/**
+ * 检查任一方法权限
+ * @param {Array} user_methods 用户方法
+ * @param {Array} required_methods 要求方法
+ * @returns {string} 结果
+ */
+Power.prototype._checkAnyMethod = function (user_methods, required_methods) {
+  let has_access = false;
+  for (const method of required_methods) {
+    if (user_methods.includes(method.toUpperCase())) {
+      has_access = true;
+      break;
+    }
+  }
+  if (!has_access) {
+    return '无任何方法权限';
+  }
+  return null;
+};
+
+/**
+ * 检查第一个方法权限
+ * @param {Array} user_methods 用户方法
+ * @param {Array} required_methods 要求方法
+ * @returns {string} 结果
+ */
+Power.prototype._checkFirstMethod = function (user_methods, required_methods) {
+  if (
+    required_methods.length > 0 &&
+    !user_methods.includes(required_methods[0].toUpperCase())
+  ) {
+    return `缺少方法权限: ${required_methods[0]}`;
+  }
+  return null;
+};
+
+/**
+ * 检查角色权限
+ * @param {Object} user 用户
+ * @param {string} role 角色
+ * @returns {string} 结果
+ */
+Power.prototype.checkRole = function (user, role) {
+  if (!user) {
+    throw new TypeError('用户是必需的');
+  }
+  if (!role) {
+    throw new TypeError('角色是必需的');
+  }
+
+  // 转换用户数据到内部标准格式
+  const std_user = this._transformUser(user);
+
+  const user_roles = std_user.roles || [];
+  if (!user_roles.includes(role)) {
+    return `缺少角色权限: ${role}`;
+  }
+
+  // 检查角色层级
+  const role_cfg = this._store('roles').get(role);
+  if (role_cfg) {
+    const required_level = role_cfg.level || 0;
+    const user_level = std_user.level || 0;
+    if (user_level < required_level) {
+      return `角色等级不足: ${role}`;
+    }
+  }
+
+  return '';
+};
+
+/**
+ * 检查用户组权限
+ * @param {Object} user 用户
+ * @param {string} group 用户组
+ * @returns {string} 结果
+ */
+Power.prototype.checkGroup = function (user, group) {
+  if (!user) {
+    throw new TypeError('用户是必需的');
+  }
+  if (!group) {
+    throw new TypeError('用户组是必需的');
+  }
+
+  // 转换用户数据到内部标准格式
+  const std_user = this._transformUser(user);
+
+  const user_groups = std_user.groups || [];
+  if (!user_groups.includes(group)) {
+    return `缺少用户组权限: ${group}`;
+  }
+
+  // 检查用户组权限
+  const options = this._store('groups').get(group);
+  if (options) {
+    const time_result = this._checkGroupTime(options, group);
+    if (time_result) {
+      return time_result;
+    }
+
+    const ip_result = this._checkGroupIp(options, std_user);
+    if (ip_result) {
+      return ip_result;
+    }
+  }
+
+  return '';
+};
+
+/**
+ * 检查用户组时间范围权限
+ * @param {Object} options 用户组配置
+ * @param {string} group 用户组
+ * @returns {string} 结果
+ */
+Power.prototype._checkGroupTime = function (options, group) {
+  if (!options.time_start || !options.time_end) {
+    return null;
+  }
+
+  const now = new Date();
+  const start = new Date(options.time_start);
+  const end = new Date(options.time_end);
+  if (now < start || now > end) {
+    return `用户组时间范围限制: ${group}`;
+  }
+
+  return null;
+};
+
+/**
+ * 检查用户组IP白名单权限
+ * @param {Object} options 用户组配置
+ * @param {Object} user 用户
+ * @returns {string} 结果
+ */
+Power.prototype._checkGroupIp = function (options, user) {
+  if (!options.ip_whitelist || !user.ip) {
+    return null;
+  }
+
+  const allowed_ips = options.ip_whitelist;
+  if (!allowed_ips.includes(user.ip)) {
+    return `IP不在白名单内: ${user.ip}`;
+  }
+
+  return null;
+};
+
+/**
+ * 检查路由权限
+ * @param {Object} user 用户
+ * @param {string} path 路径
+ * @param {string} method 方法
+ * @returns {string} 结果
+ */
+Power.prototype._findRouteConfig = function (path) {
+  const routes = this._store('routes').list();
+  for (const route_path in routes) {
+    if (this._matchRoute(path, route_path)) {
+      return routes[route_path];
+    }
+  }
+  return null;
+};
+
+Power.prototype._checkMethod = function (route_cfg, method) {
+  const method_cfg = route_cfg.methods || {};
+  const allowed_methods = method_cfg[method.toUpperCase()] || method_cfg['*'];
+
+  if (!allowed_methods) {
+    return `方法不允许: ${method}`;
+  }
+  return allowed_methods;
+};
+
+Power.prototype._checkRole = function (user, allowed_methods) {
+  if (!allowed_methods.roles) {
+    return null;
+  }
+
+  const req_roles = Array.isArray(allowed_methods.roles)
+    ? allowed_methods.roles
+    : [allowed_methods.roles];
+
+  for (const role of req_roles) {
+    if (this.checkRole(user, role) === '') {
+      return null;
+    }
+  }
+
+  return `缺少所需角色权限: ${req_roles.join(', ')}`;
+};
+
+Power.prototype._checkGroup = function (user, allowed_methods) {
+  if (!allowed_methods.groups) {
+    return null;
+  }
+
+  const req_groups = Array.isArray(allowed_methods.groups)
+    ? allowed_methods.groups
+    : [allowed_methods.groups];
+
+  for (const group of req_groups) {
+    if (this.checkGroup(user, group) === '') {
+      return null;
+    }
+  }
+
+  return `缺少所需用户组权限: ${req_groups.join(', ')}`;
+};
+
+Power.prototype._checkAdminPerm = function (user, allowed_methods) {
+  if (!allowed_methods.admins) {
+    return null;
+  }
+
+  const req_admins = Array.isArray(allowed_methods.admins)
+    ? allowed_methods.admins
+    : [allowed_methods.admins];
+
+  for (const admin of req_admins) {
+    if (this.checkAdmin(user, admin) === '') {
+      return null;
+    }
+  }
+
+  return `缺少所需管理组权限: ${req_admins.join(', ')}`;
+};
+
+Power.prototype._checkDataScope = function (user, allowed_methods) {
+  if (!allowed_methods.scope || !user.scope) {
+    return null;
+  }
+
+  const user_scope = user.scope;
+  const req_scope = allowed_methods.scope;
+
+  if (!this._checkDataScope(user_scope, req_scope)) {
+    return '数据范围权限不足';
+  }
+
+  return null;
+};
+
+Power.prototype.checkRoute = function (user, path, method = 'GET') {
+  if (!user) {
+    throw new TypeError('用户是必需的');
+  }
+  if (!path) {
+    throw new TypeError('路径是必需的');
+  }
+
+  // 转换用户数据到内部标准格式
+  const std_user = this._transformUser(user);
+
+  // 查找路由配置
+  const route_cfg = this._findRouteConfig(path);
+  if (!route_cfg) {
+    return ''; // 无路由配置，默认允许
+  }
+
+  // 检查方法权限
+  const method_result = this._checkMethod(route_cfg, method);
+  if (typeof method_result === 'string') {
+    return method_result;
+  }
+  const allowed_methods = method_result;
+
+  // 检查所有权限类型
+  const result = this._checkAllRoutePerms(std_user, allowed_methods);
+  if (result) {
+    return result;
+  }
+
+  return '';
+};
+
+/**
+ * 检查所有路由权限
+ * @param {Object} user 用户
+ * @param {Object} allowed_methods 允许的方法
+ * @returns {string} 结果
+ */
+Power.prototype._checkAllRoutePerms = function (user, allowed_methods) {
+  const checks = [
+    () => this._checkRole(user, allowed_methods),
+    () => this._checkGroup(user, allowed_methods),
+    () => this._checkAdminPerm(user, allowed_methods),
+    () => this._checkDataScope(user, allowed_methods)
+  ];
+
+  for (const check of checks) {
+    const result = check();
+    if (result) {
+      return result;
+    }
+  }
+  return null;
+};
+
+/**
+ * 异步检查角色权限
+ * @param {Object} user 用户
+ * @param {string} role 角色
+ * @returns {Promise<string>} 结果
+ */
+Power.prototype.checkRoleAsync = async function (user, role) {
+  if (!user) {
+    throw new TypeError('用户是必需的');
+  }
+  if (!role) {
+    throw new TypeError('角色是必需的');
+  }
+
+  // 如果user是字符串，则认为是用户ID，需要通过getUserAsync获取用户对象
+  let userObj = user;
+  if (typeof user === 'string') {
+    userObj = await this.getUserAsync(user);
+    if (!userObj) {
+      return '用户不存在';
+    }
+  }
+
+  // 转换用户数据到内部标准格式
+  const std_user = this._transformUser(userObj);
+
+  const user_roles = std_user.roles || [];
+  if (!user_roles.includes(role)) {
+    return `缺少角色权限: ${role}`;
+  }
+
+  // 异步加载角色配置
+  const role_config = await this._loadConfig('roles', role);
+  if (role_config) {
+    const required_level = role_config.level || 0;
+    const user_level = std_user.level || 0;
+    if (user_level < required_level) {
+      return `角色等级不足: ${role}`;
+    }
+  }
+
+  return '';
+};
+
+/**
+ * 异步检查用户组权限
+ * @param {Object} user 用户
+ * @param {string} group 用户组
+ * @returns {Promise<string>} 结果
+ */
+Power.prototype.checkGroupAsync = async function (user, group) {
+  if (!user) {
+    throw new TypeError('用户是必需的');
+  }
+  if (!group) {
+    throw new TypeError('用户组是必需的');
+  }
+
+  // 如果user是字符串，则认为是用户ID，需要通过getUserAsync获取用户对象
+  let userObj = user;
+  if (typeof user === 'string') {
+    userObj = await this.getUserAsync(user);
+    if (!userObj) {
+      return '用户不存在';
+    }
+  }
+
+  // 转换用户数据到内部标准格式
+  const std_user = this._transformUser(userObj);
+
+  const user_groups = std_user.groups || [];
+  if (!user_groups.includes(group)) {
+    return `缺少用户组权限: ${group}`;
+  }
+
+  // 异步加载用户组配置
+  const options = await this._loadConfig('groups', group);
+  if (options) {
+    return await this._checkGrpDtlAsync(options, std_user, group);
+  }
+
+  return '';
+};
+
+/**
+ * 异步检查用户组详细权限
+ * @param {Object} options 用户组配置
+ * @param {Object} std_user 标准用户对象
+ * @param {string} group 用户组
+ * @returns {Promise<string>} 结果
+ */
+Power.prototype._checkGrpDtlAsync = async function (options, std_user, group) {
+  const time_result = await this._checkGroupTimeAsync(options, group);
+  if (time_result) {
+    return time_result;
+  }
+
+  const ip_result = this._checkGroupIpAsync(options, std_user);
+  if (ip_result) {
+    return ip_result;
+  }
+
+  return '';
+};
+
+/**
+ * 异步检查用户组时间范围权限
+ * @param {Object} options 用户组配置
+ * @param {string} group 用户组
+ * @returns {Promise<string>} 结果
+ */
+Power.prototype._checkGroupTimeAsync = async function (options, group) {
+  // 检查是否存在时间配置
+  if (!options.time_start && !options.time_end) {
+    return '';
+  }
+
+  const now = new Date();
+  const start = options.time_start ? new Date(options.time_start) : null;
+  const end = options.time_end ? new Date(options.time_end) : null;
+
+  // 检查开始时间
+  if (start && now < start) {
+    return `用户组时间范围限制: ${group}`;
+  }
+
+  // 检查结束时间
+  if (end && now > end) {
+    return `用户组时间范围限制: ${group}`;
+  }
+
+  return '';
+};
+
+/**
+ * 异步检查用户组IP白名单权限
+ * @param {Object} options 用户组配置
+ * @param {Object} user 用户
+ * @returns {Promise<string|null>} 结果
+ */
+Power.prototype._checkGroupIpAsync = async function (options, user) {
+  if (!options.ip_whitelist || !user.ip) {
+    return '';
+  }
+
+  const allowed_ips = options.ip_whitelist;
+  if (!allowed_ips.includes(user.ip)) {
+    return `IP不在白名单内: ${user.ip}`;
+  }
+
+  return '';
+};
+
+/**
+ * 异步检查路由权限
+ * @param {Object} user 用户
+ * @param {string} path 路径
+ * @param {string} method 方法
+ * @returns {Promise<string>} 结果
+ */
+Power.prototype._checkRoleAsync = async function (user, allowed_methods) {
+  if (!allowed_methods.roles) {
+    return null;
+  }
+
+  const req_roles = Array.isArray(allowed_methods.roles)
+    ? allowed_methods.roles
+    : [allowed_methods.roles];
+
+  for (const role of req_roles) {
+    const result = await this.checkRoleAsync(user, role);
+    if (result === '') {
+      return null;
+    }
+  }
+
+  return `缺少所需角色权限: ${req_roles.join(', ')}`;
+};
+
+Power.prototype._checkGroupAsync = async function (user, allowed_methods) {
+  if (!allowed_methods.groups) {
+    return null;
+  }
+
+  const req_groups = Array.isArray(allowed_methods.groups)
+    ? allowed_methods.groups
+    : [allowed_methods.groups];
+
+  for (const group of req_groups) {
+    const result = await this.checkGroupAsync(user, group);
+    if (result === '') {
+      return null;
+    }
+  }
+
+  return `缺少所需用户组权限: ${req_groups.join(', ')}`;
+};
+
+Power.prototype._checkAdminAsyncPerm = async function (user, allowed_methods) {
+  if (!allowed_methods.admins) {
+    return null;
+  }
+
+  const req_admins = Array.isArray(allowed_methods.admins)
+    ? allowed_methods.admins
+    : [allowed_methods.admins];
+
+  for (const admin of req_admins) {
+    const result = await this.checkAdminAsync(user, admin);
+    if (result === '') {
+      return null;
+    }
+  }
+
+  return `缺少所需管理组权限: ${req_admins.join(', ')}`;
+};
+
+Power.prototype.checkRouteAsync = async function (user, path, method = 'GET') {
+  if (!user) {
+    throw new TypeError('用户是必需的');
+  }
+  if (!path) {
+    throw new TypeError('路径是必需的');
+  }
+
+  // 如果user是字符串，则认为是用户ID，需要通过getUserAsync获取用户对象
+  const userObj = await this._getUserIfNeeded(user);
+  if (typeof user === 'string' && !userObj) {
+    return '用户不存在';
+  }
+
+  // 转换用户数据到内部标准格式
+  const std_user = this._transformUser(userObj);
+
+  // 查找匹配的路由配置
+  const route_cfg = this._findRouteConfig(path);
+  if (!route_cfg) {
+    return ''; // 无路由配置，默认允许
+  }
+
+  // 检查方法权限
+  const method_result = this._checkMethod(route_cfg, method);
+  if (typeof method_result === 'string') {
+    return method_result;
+  }
+  const allowed_methods = method_result;
+
+  // 异步检查所有权限类型
+  const result = await this._checkRouteAsync(std_user, allowed_methods);
+  if (result) {
+    return result;
+  }
+
+  return '';
+};
+
+/**
+ * 异步检查所有路由权限
+ * @param {Object} user 用户
+ * @param {Object} allowed_methods 允许的方法
+ * @returns {Promise<string>} 结果
+ */
+Power.prototype._checkRouteAsync = async function (user, allowed_methods) {
+  const checks = [
+    () => this._checkRoleAsyncWrap(user, allowed_methods),
+    () => this._checkGroupAsyncWrap(user, allowed_methods),
+    () => this._checkAdmAsyncPW(user, allowed_methods),
+    () => this._checkDataScope(user, allowed_methods)
+  ];
+
+  for (const check of checks) {
+    const result = await check();
+    if (result) {
+      return result;
+    }
+  }
+  return null;
+};
+
+Power.prototype._checkRoleAsyncWrap = async function (user, allowed_methods) {
+  return await this._checkRoleAsync(user, allowed_methods);
+};
+
+Power.prototype._checkGroupAsyncWrap = async function (user, allowed_methods) {
+  return await this._checkGroupAsync(user, allowed_methods);
+};
+
+Power.prototype._checkAdmAsyncPW = async function (user, allowed_methods) {
+  return await this._checkAdminAsyncPerm(user, allowed_methods);
+};
+
+/**
+ * 异步获取用户
+ * @param {string} user_id 用户ID
+ * @returns {Promise<Object>} 用户
+ */
+Power.prototype.getUserAsync = async function (user_id) {
+  if (!this._loader) {
+    throw new Error('异步加载器未设置');
+  }
+
+  const cache_key = `user:${user_id}`;
+  const cached = this._store('cache').get(cache_key);
+  if (cached) {
+    return cached;
+  }
+
+  const user = await this._loader('user', user_id);
+  this._store('cache').set(cache_key, user);
+  return user;
+};
+
+/**
+ * 异步检查权限
+ * @param {string} user_id 用户ID
+ * @param {Object} power 权限
+ * @param {Function} func 函数
+ * @param {number} way 方式
+ * @returns {Promise<string>} 结果
+ */
+Power.prototype.checkAsync = async function (
+  user_id,
+  power = {},
+  func = null,
+  way = 0
+) {
+  const user = await this.getUserAsync(user_id);
+  if (!user) {
+    return '用户不存在';
+  }
+
+  const std_user = this._transformUser(user);
+  return await this._checkAllAsyncPerms(std_user, power);
+};
+
+/**
+ * 异步检查所有权限
+ * @param {Object} user 用户
+ * @param {Object} power 权限
+ * @returns {Promise<string>} 结果
+ */
+Power.prototype._checkAllAsyncPerms = async function (user, power) {
+  const checks = [
+    { method: '_checkAsyncPath', async: true },
+    { method: '_checkAsyncRole', async: true },
+    { method: '_checkAsyncGroup', async: true },
+    { method: '_checkAsyncAdmin', async: true },
+    { method: '_checkAsyncPower', async: false }
+  ];
+
+  for (const check of checks) {
+    const result = check.async
+      ? await this[check.method](user, power)
+      : this[check.method](user, power);
+    if (result) {
+      return result;
+    }
+  }
+
+  return '';
+};
+
+/**
+ * 异步检查路径权限
+ * @param {Object} user 用户
+ * @param {Object} power 权限
+ * @returns {Promise<string>} 结果
+ */
+Power.prototype._checkAsyncPath = async function (user, power) {
+  if (power.path) {
+    const path_result = await this.checkRouteAsync(
+      user,
+      power.path,
+      power.method || 'GET'
+    );
+    if (path_result !== '') {
+      return path_result;
+    }
+  }
+  return null;
+};
+
+/**
+ * 异步检查角色权限
+ * @param {Object} user 用户
+ * @param {Object} power 权限
+ * @returns {Promise<string>} 结果
+ */
+Power.prototype._checkAsyncRole = async function (user, power) {
+  if (power.role) {
+    const role_result = await this.checkRoleAsync(user, power.role);
+    if (role_result !== '') {
+      return role_result;
+    }
+  }
+  return null;
+};
+
+/**
+ * 异步检查用户组权限
+ * @param {Object} user 用户
+ * @param {Object} power 权限
+ * @returns {Promise<string>} 结果
+ */
+Power.prototype._checkAsyncGroup = async function (user, power) {
+  if (power.group) {
+    const group_result = await this.checkGroupAsync(user, power.group);
+    if (group_result !== '') {
+      return group_result;
+    }
+  }
+  return null;
+};
+
+/**
+ * 异步检查管理组权限
+ * @param {Object} user 用户
+ * @param {Object} power 权限
+ * @returns {Promise<string>} 结果
+ */
+Power.prototype._checkAsyncAdmin = async function (user, power) {
+  if (power.admin) {
+    const admin_result = await this.checkAdminsAsync(
+      user,
+      power.admin,
+      power.way || 0
+    );
+    if (admin_result !== '') {
+      return admin_result;
+    }
+  }
+  return null;
+};
+
+/**
+ * 异步检查字段权限
+ * @param {Object} user 用户
+ * @param {Object} power 权限
+ * @returns {string} 结果
+ */
+Power.prototype._checkAsyncPower = function (user, power) {
+  if (power.power) {
+    const power_result = this.checkField(user, power.power);
+    if (power_result !== '') {
+      return power_result;
+    }
+  }
+  return null;
+};
+
+/**
+ * 匹配路由路径
+ * @param {string} request_path 请求路径
+ * @param {string} config_path 配置路径
+ * @returns {boolean} 是否匹配
+ */
+Power.prototype._matchRoute = function (request_path, config_path) {
+  if (config_path === '*') return true;
+  if (config_path === request_path) return true;
+
+  // 支持通配符匹配
+  if (config_path.includes('*')) {
+    const regex = new RegExp('^' + config_path.replace(/\*/g, '.*') + '$');
+    return regex.test(request_path);
+  }
+
+  return false;
+};
+
+/**
+ * 检查数据范围权限
+ * @param {Object} user_scope 用户数据范围
+ * @param {Object} required_scope 要求数据范围
+ * @returns {boolean} 是否有权限
+ */
+Power.prototype._checkDataScope = function (user_scope, required_scope) {
+  // 检查部门权限
+  if (required_scope.dept_ids) {
+    const user_depts = user_scope.dept_ids || [];
+    const required_depts = Array.isArray(required_scope.dept_ids)
+      ? required_scope.dept_ids
+      : [required_scope.dept_ids];
+
+    let has_dept = false;
+    for (const dept of required_depts) {
+      if (user_depts.includes(dept)) {
+        has_dept = true;
+        break;
+      }
+    }
+    if (!has_dept) return false;
+  }
+
+  // 检查数据权限级别
+  if (required_scope.level && user_scope.level) {
+    if (user_scope.level < required_scope.level) {
+      return false;
+    }
+  }
+
+  return true;
+};
+
+/**
+ * 获取路由允许的用户组
+ * @param {string} path 路径
+ * @param {string} method 方法
+ * @returns {Array} 允许的用户组列表
+ */
+Power.prototype.getRouteGroups = function (path, method = 'GET') {
+  const route_config = this._findRouteConfig(path);
+
+  if (!route_config) {
+    return [];
+  }
+
+  const method_config = route_config.methods || {};
+  const allowed_methods =
+    method_config[method.toUpperCase()] || method_config['*'];
+
+  if (!allowed_methods || !allowed_methods.groups) {
+    return [];
+  }
+
+  return Array.isArray(allowed_methods.groups)
+    ? allowed_methods.groups
+    : [allowed_methods.groups];
+};
+
+/**
+ * 获取路由允许的角色
+ * @param {string} path 路径
+ * @param {string} method 方法
+ * @returns {Array} 允许的角色列表
+ */
+Power.prototype.getRouteRoles = function (path, method = 'GET') {
+  const route_config = this._findRouteConfig(path);
+
+  if (!route_config) {
+    return [];
+  }
+
+  const method_config = route_config.methods || {};
+  const allowed_methods =
+    method_config[method.toUpperCase()] || method_config['*'];
+
+  if (!allowed_methods || !allowed_methods.roles) {
+    return [];
+  }
+
+  return Array.isArray(allowed_methods.roles)
+    ? allowed_methods.roles
+    : [allowed_methods.roles];
+};
+
+/**
+ * 综合权限检查
+ * @param {Object} user 用户
+ * @param {Object} options 选项
+ * @returns {string} 结果
+ */
+Power.prototype.checkAll = function (user, options = {}) {
+  if (!user) {
+    throw new TypeError('user is required');
+  }
+
+  const {
+    path,
+    method = 'GET',
+    role,
+    group,
+    admin,
+    power = {},
+    func = null,
+    way = 0
+  } = options;
+
+  // 检查所有权限类型
+  const result = this._checkAllPerms(user, {
+    path,
+    method,
+    role,
+    group,
+    admin,
+    power,
+    func,
+    way
+  });
+  if (result) {
+    return result;
+  }
+
+  return '';
+};
+
+/**
+ * 检查所有权限类型
+ * @param {Object} user 用户
+ * @param {Object} options 选项
+ * @returns {string} 结果
+ */
+Power.prototype._checkAllPerms = function (user, options) {
+  const checks = [
+    () => this._checkRoutePerm(user, options),
+    () => this._checkRolePerm(user, options),
+    () => this._checkGroupPerm(user, options),
+    () => this._checkAdminPerm(user, options),
+    () => this._checkFieldPerm(user, options)
+  ];
+
+  for (const check of checks) {
+    const result = check();
+    if (result) {
+      return result;
+    }
+  }
+  return null;
+};
+
+/**
+ * 检查路由权限
+ * @param {Object} user 用户
+ * @param {Object} options 选项
+ * @returns {string} 结果
+ */
+Power.prototype._checkRoutePerm = function (user, options) {
+  if (options.path) {
+    const route_result = this.checkRoute(user, options.path, options.method);
+    if (route_result) {
+      return route_result;
+    }
+  }
+  return null;
+};
+
+/**
+ * 检查角色权限
+ * @param {Object} user 用户
+ * @param {Object} options 选项
+ * @returns {string} 结果
+ */
+Power.prototype._checkRolePerm = function (user, options) {
+  if (options.role) {
+    const role_result = this.checkRole(user, options.role);
+    if (role_result) {
+      return role_result;
+    }
+  }
+  return null;
+};
+
+/**
+ * 检查用户组权限
+ * @param {Object} user 用户
+ * @param {Object} options 选项
+ * @returns {string} 结果
+ */
+Power.prototype._checkGroupPerm = function (user, options) {
+  if (options.group) {
+    const group_result = this.checkGroup(user, options.group);
+    if (group_result) {
+      return group_result;
+    }
+  }
+  return null;
+};
+
+/**
+ * 检查管理组权限
+ * @param {Object} user 用户
+ * @param {Object} options 选项
+ * @returns {string} 结果
+ */
+Power.prototype._checkAdminPerm = function (user, options) {
+  if (options.admin) {
+    const admin_result = this.checkAdmins(user, options.admin, options.way);
+    if (admin_result) {
+      return admin_result;
+    }
+  }
+  return null;
+};
+
+/**
+ * 检查字段权限
+ * @param {Object} user 用户
+ * @param {Object} options 选项
+ * @returns {string} 结果
+ */
+Power.prototype._checkFieldPerm = function (user, options) {
+  const field_result = this.checkField(
+    user,
+    options.power,
+    options.func,
+    options.way
+  );
+  if (field_result) {
+    return field_result;
+  }
+  return null;
+};
+
+module.exports = Power;