提交管理员操作一切

Modules/Store.Users/Services/UserAccessPolicy.cs

@@ -0,0 +1,18 @@
+using Store.Users.Entities;
+
+namespace Store.Users.Services;
+
+/// <summary>统一账户管理范围：管理员管理全部，主账号管理本人及直属子账号。</summary>
+internal static class UserAccessPolicy
+{
+    public static bool IsAdmin(UserEntity actor) => actor.SaLevel == 1;
+
+    public static bool Owns(UserEntity actor, UserEntity target) => actor.IsMainUser
+        && string.Equals(target.ParentUserName, actor.UserName, StringComparison.OrdinalIgnoreCase);
+
+    public static bool CanRead(UserEntity actor, UserEntity target) =>
+        IsAdmin(actor) || actor.Id == target.Id || Owns(actor, target);
+
+    public static bool CanManage(UserEntity actor, UserEntity target) =>
+        IsAdmin(actor) || (!IsAdmin(target) && actor.IsMainUser && (actor.Id == target.Id || Owns(actor, target)));
+}