feat: visual access control in FlowEditor (read-only mode for viewers)

app/server/api/canvas/[id].get.ts

@@ -8,18 +8,21 @@ export default defineEventHandler(async (event) => {
   const canvas = await prisma.canvas.findUnique({ where: { id } })
   if (!canvas) throw createError({ statusCode: 404, message: 'Canvas not found' })
 
-  if (canvas.isPublic) return canvas
+  const user = tryLazyEventHandler(event, () => requireAuth(event)) || { id: null, role: 'guest' }
 
-  const user = requireAuth(event)
-
-  if (canvas.ownerId === user.id) return canvas
-
-  if (canvas.groupId) {
+  // Определение роли
+  let userRole = 'viewer'
+  if (user.id === canvas.ownerId) userRole = 'owner'
+  else if (user.role === 'admin') userRole = 'admin'
+  else if (canvas.groupId) {
     const membership = await prisma.groupMember.findUnique({
-      where: { userId_groupId: { userId: user.id, groupId: canvas.groupId } }
+      where: { userId_groupId: { userId: user.id as string, groupId: canvas.groupId } }
     })
-    if (membership) return canvas
+    if (membership) userRole = membership.role
+    else if (!canvas.isPublic) throw createError({ statusCode: 403, message: 'Access denied' })
+  } else if (!canvas.isPublic) {
+    throw createError({ statusCode: 403, message: 'Access denied' })
   }
 
-  throw createError({ statusCode: 403, message: 'Access denied' })
+  return { canvas, role: userRole }
 })