fix and update

apps/sso-core/src/domain/access.service.ts

@@ -14,6 +14,7 @@ export interface UserAccessContext {
   canViewUsers: boolean;
   canManageSettings: boolean;
   canViewUserDocuments: boolean;
+  canVerifyUsers: boolean;
 }
 
 function hasAnyPermission(permissions: string[], ...slugs: string[]) {
@@ -40,7 +41,8 @@ export class AccessService {
           'users.manage.all',
           'settings.manage',
           'rbac.manage',
-          'documents.view_others'
+          'documents.view_others',
+          'users.verify'
         ],
         canAccessAdmin: true,
         canManageRoles: true,
@@ -51,7 +53,8 @@ export class AccessService {
         canManageAllUsers: true,
         canViewUsers: true,
         canManageSettings: true,
-        canViewUserDocuments: true
+        canViewUserDocuments: true,
+        canVerifyUsers: true
       };
     }
 
@@ -98,7 +101,8 @@ export class AccessService {
       canManageAllUsers,
       canViewUsers,
       canManageSettings: permissions.includes('settings.manage'),
-      canViewUserDocuments: permissions.includes('documents.view_others')
+      canViewUserDocuments: permissions.includes('documents.view_others'),
+      canVerifyUsers: permissions.includes('users.verify')
     };
   }
 
@@ -124,6 +128,18 @@ export class AccessService {
     }
   }
 
+  async assertCanVerifyUsers(actorUserId: string) {
+    const actor = await this.prisma.user.findUnique({ where: { id: actorUserId } });
+    if (!actor) {
+      throw new NotFoundException('Пользователь не найден');
+    }
+    if (actor.isSuperAdmin) return;
+    const access = await this.getUserAccess(actorUserId, false);
+    if (!access.canVerifyUsers) {
+      throw new ForbiddenException('Недостаточно прав для верификации пользователей');
+    }
+  }
+
   async assertSuperAdmin(actorUserId: string) {
     const actor = await this.prisma.user.findUnique({ where: { id: actorUserId } });
     if (!actor?.isSuperAdmin) {