fix: align permission navigation and page access

apps/server/src/expenses/expenses.controller.ts

@@ -72,6 +72,12 @@ export class ExpensesController {
     private logService: OperationLogsService,
   ) {}
 
+  @Get('lookups')
+  @RequirePermission('expense:create', 'expense:edit')
+  getFormLookups() {
+    return this.service.getFormLookups();
+  }
+
   @Post('room')
   @RequirePermission('expense:create')
   async createRoomExpense(@Body() dto: CreateRoomExpenseDto, @Request() req: any) {

apps/server/src/expenses/expenses.lookups.spec.ts

@@ -0,0 +1,25 @@
+import { ExpensesService } from './expenses.service';
+
+describe('ExpensesService permission-scoped lookups', () => {
+  it('returns only minimal room and student fields needed by expense forms', async () => {
+    const roomRepo = {
+      find: jest.fn().mockResolvedValue([{ id: 1, roomNumber: '101', building: 'A' }]),
+    };
+    const studentRepo = {
+      find: jest.fn().mockResolvedValue([{ id: 2, name: '张三', studentNo: 'S2' }]),
+    };
+    const service = new ExpensesService(
+      {} as never,
+      {} as never,
+      roomRepo as never,
+      studentRepo as never,
+    );
+
+    await expect(service.getFormLookups()).resolves.toEqual({
+      rooms: [{ id: 1, roomNumber: '101', building: 'A' }],
+      students: [{ id: 2, name: '张三', studentNo: 'S2' }],
+    });
+    expect(roomRepo.find).toHaveBeenCalledWith(expect.objectContaining({ select: ['id', 'roomNumber', 'building'] }));
+    expect(studentRepo.find).toHaveBeenCalledWith(expect.objectContaining({ select: ['id', 'name', 'studentNo'] }));
+  });
+});

apps/server/src/expenses/expenses.service.ts

@@ -22,6 +22,21 @@ export class ExpensesService {
     @InjectRepository(Student) private studentRepo: Repository<Student>,
   ) {}
 
+  async getFormLookups() {
+    const [rooms, students] = await Promise.all([
+      this.roomRepo.find({
+        select: ['id', 'roomNumber', 'building'],
+        order: { building: 'ASC', roomNumber: 'ASC' },
+      }),
+      this.studentRepo.find({
+        select: ['id', 'name', 'studentNo'],
+        where: { status: 'active' },
+        order: { name: 'ASC' },
+      }),
+    ]);
+    return { rooms, students };
+  }
+
   // 宿舍费用
   async createRoomExpense(dto: CreateRoomExpenseDto, userId?: number) {
     const room = await this.roomRepo.findOne({ where: { id: dto.roomId } });