Accept audit role in user administration

apps/aether-gateway/src/handlers/admin/users/batch.rs

@@ -503,7 +503,7 @@ fn normalize_selection_filters(
         .map(|value| value.trim().to_ascii_lowercase())
         .filter(|value| !value.is_empty() && value != "all")
     {
-        Some(role) if matches!(role.as_str(), "user" | "admin") => Some(role),
+        Some(role) if crate::roles::normalize_assignable_user_role(&role).is_some() => Some(role),
         Some(_) => return Err("role 参数不合法".to_string()),
         None => None,
     };

apps/aether-gateway/src/handlers/admin/users/shared.rs

@@ -225,16 +225,13 @@ pub(super) fn validate_admin_user_password(password: &str, policy: &str) -> Resu
 }
 
 pub(super) fn normalize_admin_user_role(value: Option<&str>) -> Result<String, String> {
-    match value
+    let role = value
         .map(str::trim)
         .filter(|value| !value.is_empty())
-        .unwrap_or("user")
-        .to_ascii_lowercase()
-        .as_str()
-    {
-        "user" => Ok("user".to_string()),
-        "admin" => Ok("admin".to_string()),
-        _ => Err("角色参数不合法".to_string()),
+        .unwrap_or("user");
+    match crate::roles::normalize_assignable_user_role(role) {
+        Some(role) => Ok(role.to_string()),
+        None => Err("角色参数不合法".to_string()),
     }
 }
 

apps/aether-gateway/src/state/runtime/auth/user_lifecycle.rs

@@ -66,7 +66,7 @@ impl AppState {
         role: &str,
     ) -> Result<Vec<String>, GatewayError> {
         let mut group_ids = normalized_user_group_ids(group_ids);
-        if role.trim().eq_ignore_ascii_case("admin") {
+        if crate::roles::can_access_admin_console(role) {
             if let Some(default_group_id) = self.configured_default_user_group_id().await? {
                 group_ids.remove(&default_group_id);
             }