update oauth

apps/frontend/lib/admin-access.ts

@@ -0,0 +1,41 @@
+import { PublicUser } from '@/lib/api';
+
+export const ROLE_LABELS: Record<string, string> = {
+  admin: 'Администратор',
+  moderator: 'Модератор',
+  manager: 'Менеджер',
+  'super-admin': 'Супер-админ'
+};
+
+export function getPrimaryRoleLabel(user: PublicUser): string {
+  if (user.isSuperAdmin) return ROLE_LABELS['super-admin'];
+  const slugs = user.roles ?? [];
+  if (slugs.includes('admin')) return ROLE_LABELS.admin;
+  for (const slug of slugs) {
+    if (ROLE_LABELS[slug]) return ROLE_LABELS[slug];
+  }
+  return slugs[0] ?? 'Админ';
+}
+
+export function getAdminLandingPath(user: PublicUser): string {
+  if (user.canViewUsers || user.canManageUsers) return '/admin/users';
+  if (user.canViewOAuth || user.canManageOAuth) return '/admin/oauth';
+  if (user.canManageSettings) return '/admin/settings';
+  if (user.canManageRoles) return '/admin/rbac';
+  return '/admin/oauth';
+}
+
+export function canAccessAdminSection(user: PublicUser, section: 'users' | 'oauth' | 'settings' | 'rbac') {
+  switch (section) {
+    case 'users':
+      return Boolean(user.canViewUsers || user.canManageUsers);
+    case 'oauth':
+      return Boolean(user.canViewOAuth || user.canManageOAuth);
+    case 'settings':
+      return Boolean(user.canManageSettings);
+    case 'rbac':
+      return Boolean(user.canManageRoles);
+    default:
+      return false;
+  }
+}