【安全加密】GM命令权限分级：审计日志与越权告警的双闸门

local CMD_LEVEL = { query_lv = 1, add_item = 2, send_gold = 3 }
local function checkGmPerm(actor, cmd)
    local player = class(actor)
    local perm = tonumber(getplayvar(actor, 2, "GM_PERM") or "0")
    local need = CMD_LEVEL[cmd]
    if need == nil then
        setsysvar("GM_UNKNOWN", cmd)
        return false
    end
    if perm < need then
        setsysvarex("GM_DENY_" .. player:GetName(), cmd, 1)
        return false
    end
    return true
end

local function execGm(actor, cmd, param, confirm)
    local player = class(actor)
    if not checkGmPerm(actor, cmd) then
        sendmsg(actor, 0, "权限不足，已记录本次尝试")
        return
    end
    if CMD_LEVEL[cmd] >= 3 and confirm ~= "OK" .. os.date("%d") then
        sendmsg(actor, 0, "资金类命令需当日确认码")
        return
    end
    setsysvarex("GM_AUDIT", os.date("%m%d%H%M") .. "|" .. player:GetName() .. "|" .. cmd, 1)
    gmexecute(actor, "@" .. cmd .. " " .. param)
end