fix(platform): harden auth and build integration

2026-06-08 18:17:42 +08:00
parent 57b97a0bfe
commit 7ed1e2603b
3 changed files with 15 additions and 5 deletions
@@ -89,7 +89,11 @@ export const useAuthStore = defineStore('auth', {
      (s) =>
      (widgetId: string): 'hidden' | 'readonly' | 'interactive' => {
        const grant = s.effectivePermissions?.visibleWidgets.find((w) => w.widgetId === widgetId)
-        return grant?.visibility ?? 'interactive'
+        if (grant) return grant.visibility
+        // fail-safe：未显式授权的控件不再默认放开为 interactive（曾导致受限账号越权）。
+        // 超级管理员（allowedOps 含 '*'）默认 interactive；其余账号默认 readonly（可见不可改）。
+        const ops = s.effectivePermissions?.allowedOps ?? []
+        return ops.includes('*') ? 'interactive' : 'readonly'
      },
    /**
     * 当前用户在当前 scope 下是否可访问指定页面（route.name）。