fix permissions and teacher attendance workflows

apps/server/src/auth/strategies/jwt.strategy.ts

@@ -1,12 +1,18 @@
-import { Injectable } from '@nestjs/common';
+import { Injectable, UnauthorizedException } from '@nestjs/common';
 import { PassportStrategy } from '@nestjs/passport';
 import { ExtractJwt, Strategy } from 'passport-jwt';
 import { ConfigService } from '@nestjs/config';
 import { Request } from 'express';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+import { User } from '../../entities/user.entity';
 
 @Injectable()
 export class JwtStrategy extends PassportStrategy(Strategy) {
-  constructor(config: ConfigService) {
+  constructor(
+    config: ConfigService,
+    @InjectRepository(User) private readonly userRepo: Repository<User>,
+  ) {
     super({
       jwtFromRequest: ExtractJwt.fromExtractors([
         // 1. Standard Bearer header (existing behavior)
@@ -25,12 +31,32 @@ export class JwtStrategy extends PassportStrategy(Strategy) {
     });
   }
 
-  async validate(payload: any) {
+  async validate(payload: { sub?: number; username?: string }) {
+    if (!payload.sub) throw new UnauthorizedException('登录状态无效');
+    const user = await this.userRepo.findOne({
+      where: { id: payload.sub },
+      relations: ['roles', 'roles.permissions'],
+    });
+    if (!user || !user.isActive || user.isArchived) {
+      throw new UnauthorizedException('账号已失效，请重新登录');
+    }
+
+    const permissions = new Set<string>();
+    const roles: string[] = [];
+    let isSuperAdmin = false;
+    for (const role of user.roles ?? []) {
+      if (role.status !== 1) continue;
+      roles.push(role.name);
+      if (role.name === '超管' || role.name === 'super_admin') isSuperAdmin = true;
+      for (const permission of role.permissions ?? []) permissions.add(permission.code);
+    }
+
     return {
-      id: payload.sub,
-      username: payload.username,
-      permissions: payload.permissions || [],
-      isSuperAdmin: payload.isSuperAdmin || false,
+      id: user.id,
+      username: user.username,
+      permissions: [...permissions],
+      isSuperAdmin,
+      roles,
     };
   }
 }