update oauth

apps/frontend/app/admin/oauth/page.tsx

@@ -1,7 +1,8 @@
 'use client';
 
 import { useCallback, useEffect, useState } from 'react';
-import { Copy, KeyRound, Loader2, LockKeyhole, Plus, RefreshCw } from 'lucide-react';
+import { useRouter } from 'next/navigation';
+import { Copy, KeyRound, Loader2, LockKeyhole, Plus, RefreshCw, UserRound } from 'lucide-react';
 import { AdminShell } from '@/components/id/admin-shell';
 import { useAuth } from '@/components/id/auth-provider';
 import { useToast } from '@/components/id/toast-provider';
@@ -10,9 +11,11 @@ import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/com
 import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@/components/ui/dialog';
 import { Input } from '@/components/ui/input';
 import { OAuthClient, OAuthScope, apiFetch } from '@/lib/api';
+import { getAdminLandingPath } from '@/lib/admin-access';
 
 export default function AdminOAuthPage() {
-  const { token } = useAuth();
+  const router = useRouter();
+  const { token, user } = useAuth();
   const { showToast } = useToast();
   const [clients, setClients] = useState<OAuthClient[]>([]);
   const [scopes, setScopes] = useState<OAuthScope[]>([]);
@@ -23,25 +26,30 @@ export default function AdminOAuthPage() {
   const [form, setForm] = useState({ name: '', redirectUris: '', type: 'CONFIDENTIAL', selectedScopes: ['openid', 'profile', 'email'] as string[] });
 
   const loadData = useCallback(async () => {
-    if (!token) return;
+    if (!token || !user?.canViewOAuth) return;
     setLoading(true);
     try {
-      const [clientsResponse, scopesResponse] = await Promise.all([
-        apiFetch<{ clients: OAuthClient[] }>('/admin/rbac/oauth-clients', {}, token),
-        apiFetch<{ scopes: OAuthScope[] }>('/admin/rbac/oauth-scopes', {}, token)
-      ]);
+      const clientsResponse = await apiFetch<{ clients: OAuthClient[] }>('/admin/rbac/oauth-clients', {}, token);
       setClients(clientsResponse.clients ?? []);
-      setScopes(scopesResponse.scopes ?? []);
+      if (user.canManageOAuth) {
+        const scopesResponse = await apiFetch<{ scopes: OAuthScope[] }>('/admin/rbac/oauth-scopes', {}, token);
+        setScopes(scopesResponse.scopes ?? []);
+      }
     } catch (error) {
       showToast(error instanceof Error ? error.message : 'Не удалось загрузить OAuth-приложения');
     } finally {
       setLoading(false);
     }
-  }, [showToast, token]);
+  }, [showToast, token, user?.canManageOAuth, user?.canViewOAuth]);
 
   useEffect(() => {
+    if (!user) return;
+    if (!user.canViewOAuth && !user.canManageOAuth) {
+      router.replace(getAdminLandingPath(user));
+      return;
+    }
     void loadData();
-  }, [loadData]);
+  }, [loadData, router, user]);
 
   async function handleCreate() {
     if (!token) return;
@@ -116,7 +124,7 @@ export default function AdminOAuthPage() {
           <h2 className="text-2xl font-medium">OAuth-приложения</h2>
           <p className="text-sm text-[#667085]">Создание клиентов как на oauth.yandex.ru: client_id, secret, redirect URI и scopes</p>
         </div>
-        <Button onClick={() => setDialogOpen(true)}>
+        <Button onClick={() => setDialogOpen(true)} disabled={!user?.canManageOAuth}>
           <Plus className="h-4 w-4" />
           Новое приложение
         </Button>
@@ -134,7 +142,17 @@ export default function AdminOAuthPage() {
               <CardHeader>
                 <LockKeyhole className="h-6 w-6" />
                 <CardTitle>{client.name}</CardTitle>
-                <CardDescription>{client.type === 'PUBLIC' ? 'Публичное приложение' : 'Confidential приложение'}</CardDescription>
+                <CardDescription>
+                  {client.type === 'PUBLIC' ? 'Публичное приложение' : 'Confidential приложение'}
+                  {client.createdByDisplayName ? (
+                    <span className="mt-1 flex items-center gap-1.5 text-xs text-[#667085]">
+                      <UserRound className="h-3.5 w-3.5" />
+                      Создал: {client.createdByDisplayName}
+                    </span>
+                  ) : client.createdById ? null : (
+                    <span className="mt-1 block text-xs text-[#667085]">Создатель не указан</span>
+                  )}
+                </CardDescription>
               </CardHeader>
               <CardContent className="space-y-3">
                 <div className="rounded-2xl bg-[#f4f5f8] p-4 text-sm">
@@ -161,17 +179,21 @@ export default function AdminOAuthPage() {
                   </div>
                   <p>{client.scopes.join(', ')}</p>
                 </div>
-                <div className="flex flex-wrap gap-2">
-                  {client.type !== 'PUBLIC' ? (
-                    <Button variant="secondary" size="sm" onClick={() => void handleRotateSecret(client.clientId)}>
-                      <RefreshCw className="h-4 w-4" />
-                      Новый secret
+                {client.canManage ? (
+                  <div className="flex flex-wrap gap-2">
+                    {client.type !== 'PUBLIC' ? (
+                      <Button variant="secondary" size="sm" onClick={() => void handleRotateSecret(client.clientId)}>
+                        <RefreshCw className="h-4 w-4" />
+                        Новый secret
+                      </Button>
+                    ) : null}
+                    <Button variant="secondary" size="sm" onClick={() => void handleToggleActive(client)}>
+                      {client.isActive ? 'Отключить' : 'Включить'}
                     </Button>
-                  ) : null}
-                  <Button variant="secondary" size="sm" onClick={() => void handleToggleActive(client)}>
-                    {client.isActive ? 'Отключить' : 'Включить'}
-                  </Button>
-                </div>
+                  </div>
+                ) : (
+                  <p className="text-xs text-[#667085]">Только просмотр — управление доступно создателю или администратору с полными правами</p>
+                )}
               </CardContent>
             </Card>
           ))}

apps/frontend/app/admin/page.tsx

@@ -1,5 +1,22 @@
-import { redirect } from 'next/navigation';
+'use client';
+
+import { useEffect } from 'react';
+import { useRouter } from 'next/navigation';
+import { useAuth } from '@/components/id/auth-provider';
+import { getAdminLandingPath } from '@/lib/admin-access';
 
 export default function AdminIndexPage() {
-  redirect('/admin/users');
+  const router = useRouter();
+  const { user, isLoading } = useAuth();
+
+  useEffect(() => {
+    if (isLoading || !user) return;
+    router.replace(getAdminLandingPath(user));
+  }, [isLoading, router, user]);
+
+  return (
+    <div className="flex min-h-[40vh] items-center justify-center text-[#667085]">
+      Перенаправление в админ-панель...
+    </div>
+  );
 }

apps/frontend/app/admin/users/page.tsx

@@ -1,6 +1,7 @@
 'use client';
 
 import { useCallback, useEffect, useMemo, useState } from 'react';
+import { useRouter } from 'next/navigation';
 import { Ban, Crown, FileText, KeyRound, Loader2, Search, ShieldPlus, UserCheck, UserCog } from 'lucide-react';
 import { UserDocumentsDialog } from '@/components/documents/user-documents-dialog';
 import { AdminShell } from '@/components/id/admin-shell';
@@ -11,6 +12,7 @@ import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@/components/u
 import { Input } from '@/components/ui/input';
 import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from '@/components/ui/table';
 import { AdminRole, AdminUser, apiFetch } from '@/lib/api';
+import { getAdminLandingPath } from '@/lib/admin-access';
 
 const statusLabels: Record<string, string> = {
   ACTIVE: 'Активен',
@@ -26,6 +28,7 @@ const roleLabels: Record<string, string> = {
 };
 
 export default function AdminUsersPage() {
+  const router = useRouter();
   const { token, user: currentUser } = useAuth();
   const { showToast } = useToast();
   const [users, setUsers] = useState<AdminUser[]>([]);
@@ -52,8 +55,16 @@ export default function AdminUsersPage() {
   }, [search, showToast, token]);
 
   useEffect(() => {
+    if (!currentUser) return;
+    if (!currentUser.canViewUsers && !currentUser.canManageUsers) {
+      router.replace(getAdminLandingPath(currentUser));
+    }
+  }, [currentUser, router]);
+
+  useEffect(() => {
+    if (!currentUser?.canViewUsers && !currentUser?.canManageUsers) return;
     void loadUsers();
-  }, [loadUsers]);
+  }, [currentUser?.canManageUsers, currentUser?.canViewUsers, loadUsers]);
 
   useEffect(() => {
     if (!token || !currentUser?.canManageRoles) return;