处理后台跳转错误

backend/blueprints/auth.py

@@ -5,7 +5,7 @@ from flask import Blueprint, request, redirect, url_for, session, jsonify
 from werkzeug.security import check_password_hash
 
 from utils.db import get_db
-from utils.auth import login_required, is_session_user_valid
+from utils.auth import login_required, is_session_user_valid, is_current_user_admin
 from utils.render import render_html
 
 auth = Blueprint('auth', __name__, url_prefix='')
@@ -13,7 +13,7 @@ auth = Blueprint('auth', __name__, url_prefix='')
 
 @auth.route('/login', methods=['GET', 'POST'])
 def login():
-    if session.get('user_id') and is_session_user_valid():
+    if session.get('user_id') and is_session_user_valid() and is_current_user_admin():
         return redirect(url_for('main.admin_page'))
     if request.method == 'POST':
         data = request.get_json() if request.is_json else request.form
@@ -35,6 +35,11 @@ def login():
                 session.permanent = True
                 session['user_id'] = row['id']
                 session['username'] = username
+                if not row.get('is_admin'):
+                    session.clear()
+                    if request.is_json:
+                        return jsonify({'success': False, 'error': '需要管理员权限'}), 403
+                    return render_html('login.html', error='需要管理员权限')
                 if request.is_json:
                     return jsonify({'success': True, 'redirect': url_for('main.admin_page')})
                 return redirect(url_for('main.admin_page'))
@@ -61,7 +66,7 @@ def api_auth_check():
             cur.execute("SELECT machine, is_admin FROM users WHERE id = %s", (session['user_id'],))
             row = cur.fetchone()
         conn.close()
-        if not row:
+        if not row or not row.get('is_admin'):
             return jsonify({'logged_in': False})
     except Exception:
         return jsonify({'logged_in': False})