fix: align permission-gated UI actions

2026-07-23 11:32:13 +08:00
parent adf738288f
commit c98d37307e
28 changed files with 1340 additions and 718 deletions
--- a/apps/admin/src/pages/AiConfig/index.tsx
+++ b/apps/admin/src/pages/AiConfig/index.tsx
@@ -13,7 +13,6 @@ import {
  Spin,
  Alert,
  Typography,
-  Tooltip,
  Space,
 } from 'antd';
 import {
@@ -442,27 +441,16 @@ const AiConfigPage: React.FC = () => {

        {/* Actions */}
        <div className={styles.actions}>
-          <Tooltip title={!canWrite ? '当前角色无写入权限' : undefined}>
-            <Button
-              type="primary"
-              icon={<SaveOutlined />}
-              onClick={handleSave}
-              loading={saving}
-              disabled={!canWrite}
-            >
+          {canWrite ? (
+            <Button type="primary" icon={<SaveOutlined />} onClick={handleSave} loading={saving}>
              保存配置
            </Button>
-          </Tooltip>
-          <Tooltip title={!canTest ? '当前角色无测试权限' : undefined}>
-            <Button
-              icon={<ApiOutlined />}
-              onClick={handleTest}
-              loading={testing}
-              disabled={!canTest}
-            >
+          ) : null}
+          {canTest ? (
+            <Button icon={<ApiOutlined />} onClick={handleTest} loading={testing}>
              测试连接
            </Button>
-          </Tooltip>
+          ) : null}
        </div>
      </Form>

--- a/apps/admin/src/pages/Attendance/LessonAttendanceDetail.tsx
+++ b/apps/admin/src/pages/Attendance/LessonAttendanceDetail.tsx
@@ -10,6 +10,7 @@ import {
  type LessonAttendanceFilter,
 } from './attendance-workspace';
 import type { LessonAttendanceRecord, LessonAttendanceSchedule } from './types';
+import { usePermission } from '../../hooks/usePermission';

 interface LessonAttendanceSession {
  id: number;
@@ -76,6 +77,8 @@ const LessonAttendanceDetail: React.FC<LessonAttendanceDetailProps> = ({
  className,
  onClose,
 }) => {
+  const { hasAnyPermission } = usePermission();
+  const canEditAttendance = hasAnyPermission('attendance:edit', 'attendance:self-edit');
  const [loadedSchedule, setLoadedSchedule] = useState<LessonAttendanceSchedule | null>(null);
  const [session, setSession] = useState<LessonAttendanceSession | null>(null);
  const [records, setRecords] = useState<LessonAttendanceRecord[]>([]);
@@ -215,6 +218,7 @@ const LessonAttendanceDetail: React.FC<LessonAttendanceDetailProps> = ({
            dataIndex: 'status',
            width: 230,
            render: (value: string, record) => {
+              if (!canEditAttendance) return <AttendanceStatus status={value} />;
              const checkedIn = value === 'present' || value === 'late';
              return (
                <div className="attendance-marking-actions">
--- a/apps/admin/src/pages/Attendance/index.tsx
+++ b/apps/admin/src/pages/Attendance/index.tsx
@@ -240,13 +240,13 @@ const AttendancePage: React.FC = () => {
  const experience = getAttendanceExperience(permissions, roles);

  if (experience === 'teacher') {
-    return <TeacherAttendanceWorkspace />;
+    return <TeacherAttendanceWorkspace canCreate={hasPermission('attendance:create')} />;
  }

  return <AdminAttendanceArchive canEdit={hasPermission('attendance:edit')} />;
 };

-const TeacherAttendanceWorkspace: React.FC = () => {
+const TeacherAttendanceWorkspace: React.FC<{ canCreate: boolean }> = ({ canCreate }) => {
  const [loading, setLoading] = useState(true);
  const [workspace, setWorkspace] = useState<TeacherWorkspaceData | null>(null);
  const [selectedSchedule, setSelectedSchedule] = useState<TodaySchedule | null>(null);
@@ -355,7 +355,7 @@ const TeacherAttendanceWorkspace: React.FC = () => {
                  phase={phase}
                  className={classNameById.get(schedule.classId) || `班级 ${schedule.classId}`}
                  index={index + 1}
-                  onOpen={() => openAttendance(schedule)}
+                  onOpen={canCreate ? () => openAttendance(schedule) : undefined}
                />
              );
            })}
@@ -363,15 +363,17 @@ const TeacherAttendanceWorkspace: React.FC = () => {
        )}
      </Spin>

-      <LessonAttendanceDetail
-        schedule={selectedSchedule}
-        className={
-          selectedSchedule
-            ? classNameById.get(selectedSchedule.classId) || `班级 ${selectedSchedule.classId}`
-            : ''
-        }
-        onClose={() => setSelectedSchedule(null)}
-      />
+      {canCreate ? (
+        <LessonAttendanceDetail
+          schedule={selectedSchedule}
+          className={
+            selectedSchedule
+              ? classNameById.get(selectedSchedule.classId) || `班级 ${selectedSchedule.classId}`
+              : ''
+          }
+          onClose={() => setSelectedSchedule(null)}
+        />
+      ) : null}
    </div>
  );
 };
@@ -381,7 +383,7 @@ const LessonCard: React.FC<{
  phase: SchedulePhase;
  className: string;
  index: number;
-  onOpen: () => void;
+  onOpen?: () => void;
 }> = ({ schedule, phase, className, index, onOpen }) => {
  const phaseMeta = {
    upcoming: { label: '待上课', icon: <ClockCircleOutlined />, tone: 'upcoming' },
@@ -412,11 +414,11 @@ const LessonCard: React.FC<{
          <Tooltip title="课程尚未开始">
            <Button disabled>等待上课</Button>
          </Tooltip>
-        ) : (
+        ) : onOpen ? (
          <Button type="primary" onClick={onOpen}>
            {phase === 'ongoing' ? '查看当前考勤' : '拉取 / 查看考勤'} <ArrowRightOutlined />
          </Button>
-        )}
+        ) : null}
      </div>
    </article>
  );
--- a/apps/admin/src/pages/ClassroomRentals/index.tsx
+++ b/apps/admin/src/pages/ClassroomRentals/index.tsx
@@ -37,7 +37,7 @@ export const unavailableDatesCacheKey = (classroomId: number, date: Dayjs) =>
  `${classroomId}:${date.format('YYYY-MM')}`;

 const ClassroomRentalsPage: React.FC = () => {
-  const { hasAnyPermission } = usePermission();
+  const { hasPermission, hasAnyPermission } = usePermission();
  const [data, setData] = useState<any[]>([]);
  const [classrooms, setClassrooms] = useState<any[]>([]);
  const [organizations, setOrganizations] = useState<any[]>([]);
@@ -446,11 +446,13 @@ const ClassroomRentalsPage: React.FC = () => {
                  下载
                </Button>
              </Tooltip>
-              <Popconfirm title="移除合同文件？" onConfirm={() => handleDeleteContract(r.id)}>
-                <Button size="small" danger icon={<StopOutlined />} aria-label="移除合同文件" />
-              </Popconfirm>
+              {hasPermission('rental:edit') ? (
+                <Popconfirm title="移除合同文件？" onConfirm={() => handleDeleteContract(r.id)}>
+                  <Button size="small" danger icon={<StopOutlined />} aria-label="移除合同文件" />
+                </Popconfirm>
+              ) : null}
            </Space>
-          ) : (
+          ) : hasPermission('rental:edit') ? (
            <Upload
              accept="application/pdf"
              showUploadList={false}
@@ -479,6 +481,8 @@ const ClassroomRentalsPage: React.FC = () => {
                上传PDF
              </Button>
            </Upload>
+          ) : (
+            '-'
          ),
      },
      {
@@ -538,7 +542,7 @@ const ClassroomRentalsPage: React.FC = () => {
        ),
      },
    ],
-    [classrooms, organizations],
+    [classrooms, organizations, hasPermission],
  );

  return (
--- a/apps/admin/src/pages/Classrooms/index.tsx
+++ b/apps/admin/src/pages/Classrooms/index.tsx
@@ -25,6 +25,7 @@ import api from '../../api';
 import PermissionButton from '../../components/PermissionButton';
 import EditableCell from '../../components/EditableCell';
 import { message } from '../../ui/app-message';
+import { usePermission } from '../../hooks/usePermission';

 const statusMap: Record<string, { text: string; color: string }> = {
  available: { text: '可用', color: 'green' },
@@ -48,6 +49,7 @@ const typeColor: Record<string, string> = {
 };

 const ClassroomsPage: React.FC = () => {
+  const { hasPermission } = usePermission();
  const [data, setData] = useState<any[]>([]);
  const [loading, setLoading] = useState(false);
  const [modalOpen, setModalOpen] = useState(false);
@@ -402,27 +404,29 @@ const ClassroomsPage: React.FC = () => {
          >
            导出报表
          </PermissionButton>
-          <Upload
-            accept=".xlsx,.xls"
-            showUploadList={false}
-            customRequest={async ({ file, onSuccess, onError }: any) => {
-              const formData = new FormData();
-              formData.append('file', file);
-              try {
-                const res: any = await api.post('/classrooms/import', formData, {
-                  headers: { 'Content-Type': 'multipart/form-data' },
-                });
-                message.success(res.message);
-                onSuccess?.(res);
-                fetchData();
-              } catch (e: any) {
-                message.error(e?.message || '导入失败');
-                onError?.(e);
-              }
-            }}
-          >
-            <Button icon={<UploadOutlined />}>导入Excel</Button>
-          </Upload>
+          {hasPermission('classroom:create') ? (
+            <Upload
+              accept=".xlsx,.xls"
+              showUploadList={false}
+              customRequest={async ({ file, onSuccess, onError }: any) => {
+                const formData = new FormData();
+                formData.append('file', file);
+                try {
+                  const res: any = await api.post('/classrooms/import', formData, {
+                    headers: { 'Content-Type': 'multipart/form-data' },
+                  });
+                  message.success(res.message);
+                  onSuccess?.(res);
+                  fetchData();
+                } catch (e: any) {
+                  message.error(e?.message || '导入失败');
+                  onError?.(e);
+                }
+              }}
+            >
+              <Button icon={<UploadOutlined />}>导入Excel</Button>
+            </Upload>
+          ) : null}
          <PermissionButton
            permission="classroom:view"
            icon={<DownloadOutlined />}
--- a/apps/admin/src/pages/Exams/detail.tsx
+++ b/apps/admin/src/pages/Exams/detail.tsx
@@ -8,6 +8,7 @@ import EditableCell from '../../components/EditableCell';
 import { useViewSensitive } from '../../hooks/useViewSensitive';
 import { maskPhone } from '../../utils/sensitive';
 import { message } from '../../ui/app-message';
+import { usePermission } from '../../hooks/usePermission';
 import type { ExamItem } from './types';
 import './style.css';

@@ -21,12 +22,29 @@ interface ScoreRow {
  rank: number | null;
 }

-interface ExamDetail extends ExamItem { scores: ScoreRow[] }
+interface ExamDetail extends ExamItem {
+  scores: ScoreRow[];
+}

 const PhoneCell: React.FC<{ row: ScoreRow }> = ({ row }) => {
  const reveal = useViewSensitive(row.studentId, '考试管理');
+  const { hasPermission } = usePermission();
  if (!row.phone) return <>-</>;
-  return <Space size={4}><span>{maskPhone(row.phone)}</span><Tooltip title="查看完整手机号"><Button type="text" size="small" icon={<EyeOutlined />} onClick={() => reveal('手机号', row.phone)} /></Tooltip></Space>;
+  return (
+    <Space size={4}>
+      <span>{maskPhone(row.phone)}</span>
+      {hasPermission('log:create') ? (
+        <Tooltip title="查看完整手机号">
+          <Button
+            type="text"
+            size="small"
+            icon={<EyeOutlined />}
+            onClick={() => reveal('手机号', row.phone)}
+          />
+        </Tooltip>
+      ) : null}
+    </Space>
+  );
 };

 const ExamDetailPage: React.FC = () => {
@@ -37,12 +55,18 @@ const ExamDetailPage: React.FC = () => {

  const load = useCallback(async () => {
    setLoading(true);
-    try { setDetail(await api.get<ExamDetail>(`/exams/${id}`)); }
-    catch (error) { message.error((error as { message?: string })?.message || '加载考试失败'); }
-    finally { setLoading(false); }
+    try {
+      setDetail(await api.get<ExamDetail>(`/exams/${id}`));
+    } catch (error) {
+      message.error((error as { message?: string })?.message || '加载考试失败');
+    } finally {
+      setLoading(false);
+    }
  }, [id]);

-  useEffect(() => { void load(); }, [load]);
+  useEffect(() => {
+    void load();
+  }, [load]);
  const saveScore = async (row: ScoreRow, value: number | undefined) => {
    await api.put(`/exams/${id}/scores/${row.id}`, { score: value ?? null });
    message.success('成绩已保存');
@@ -52,7 +76,11 @@ const ExamDetailPage: React.FC = () => {
  const columns = useMemo<ColumnsType<ScoreRow>>(() => {
    if (!detail) return [];
    const fixed = [
-      { title: '手机号*', width: 155, render: (_: unknown, row: ScoreRow) => <PhoneCell row={row} /> },
+      {
+        title: '手机号*',
+        width: 155,
+        render: (_: unknown, row: ScoreRow) => <PhoneCell row={row} />,
+      },
      { title: '姓名', dataIndex: 'name', width: 100 },
      { title: '考试类型*', width: 110, render: () => detail.examType },
      { title: '考试名称', width: 170, render: () => detail.examName },
@@ -60,32 +88,84 @@ const ExamDetailPage: React.FC = () => {
    ];
    return [
      ...fixed,
-      { title: '成绩*', dataIndex: 'score', width: 100, render: (value: number | null, row: ScoreRow) => <EditableCell<number | undefined> value={value ?? undefined} editor="money" min={0} max={999.99} permission="exam:view" onSave={(next) => saveScore(row, next)}>{value ?? '-'}</EditableCell> },
-      { title: '班级均分', dataIndex: 'classAvg', width: 110, render: (value: number | null) => value ?? '-' },
-      { title: '排名', dataIndex: 'rank', width: 80, render: (value: number | null) => value ?? '-' },
+      {
+        title: '成绩*',
+        dataIndex: 'score',
+        width: 100,
+        render: (value: number | null, row: ScoreRow) => (
+          <EditableCell<number | undefined>
+            value={value ?? undefined}
+            editor="money"
+            min={0}
+            max={999.99}
+            permission="exam:view"
+            onSave={(next) => saveScore(row, next)}
+          >
+            {value ?? '-'}
+          </EditableCell>
+        ),
+      },
+      {
+        title: '班级均分',
+        dataIndex: 'classAvg',
+        width: 110,
+        render: (value: number | null) => value ?? '-',
+      },
+      {
+        title: '排名',
+        dataIndex: 'rank',
+        width: 80,
+        render: (value: number | null) => value ?? '-',
+      },
      { title: '考试日期', width: 110, render: () => detail.examDate },
      { title: '关联报读（班级名）', width: 180, render: () => detail.className },
    ];
  }, [detail]);

-  if (loading && !detail) return <div className="exam-detail-loading"><Spin size="large" /></div>;
+  if (loading && !detail)
+    return (
+      <div className="exam-detail-loading">
+        <Spin size="large" />
+      </div>
+    );
  if (!detail) return <Empty description="考试不存在或无权访问" />;

  const average = detail.scores.find((row) => row.classAvg !== null)?.classAvg ?? null;
  return (
    <div className="exam-detail-page">
-      <div className="exam-detail-header"><Space><Button icon={<ArrowLeftOutlined />} onClick={() => navigate('/exams')}>返回</Button><h2>{detail.examName}</h2></Space></div>
+      <div className="exam-detail-header">
+        <Space>
+          <Button icon={<ArrowLeftOutlined />} onClick={() => navigate('/exams')}>
+            返回
+          </Button>
+          <h2>{detail.examName}</h2>
+        </Space>
+      </div>
      <Card className="exam-summary">
        <Descriptions column={{ xs: 1, sm: 2, lg: 5 }}>
          <Descriptions.Item label="考试类型">{detail.examType}</Descriptions.Item>
          <Descriptions.Item label="科目">{detail.subject}</Descriptions.Item>
          <Descriptions.Item label="考试班级">{detail.className}</Descriptions.Item>
          <Descriptions.Item label="考试日期">{detail.examDate}</Descriptions.Item>
-          <Descriptions.Item label="录入进度">{detail.enteredScores}/{detail.totalStudents}，均分 {average ?? '-'}</Descriptions.Item>
+          <Descriptions.Item label="录入进度">
+            {detail.enteredScores}/{detail.totalStudents}，均分 {average ?? '-'}
+          </Descriptions.Item>
        </Descriptions>
      </Card>
      <Card title="成绩表">
-        <Table<ScoreRow> columns={columns} dataSource={detail.scores} rowKey="id" loading={loading} scroll={{ x: 1310 }} pagination={{ defaultPageSize: 30, showSizeChanger: true, pageSizeOptions: [30, 50, 100] }} locale={{ emptyText: <Empty description="暂无学生名单" /> }} />
+        <Table<ScoreRow>
+          columns={columns}
+          dataSource={detail.scores}
+          rowKey="id"
+          loading={loading}
+          scroll={{ x: 1310 }}
+          pagination={{
+            defaultPageSize: 30,
+            showSizeChanger: true,
+            pageSizeOptions: [30, 50, 100],
+          }}
+          locale={{ emptyText: <Empty description="暂无学生名单" /> }}
+        />
      </Card>
    </div>
  );
--- a/apps/admin/src/pages/Expenses/index.tsx
+++ b/apps/admin/src/pages/Expenses/index.tsx
@@ -29,6 +29,7 @@ import PermissionButton from '../../components/PermissionButton';
 import EditableCell from '../../components/EditableCell';
 import { downloadBlob } from '../../utils/download';
 import { message } from '../../ui/app-message';
+import { usePermission } from '../../hooks/usePermission';

 const { RangePicker } = DatePicker;

@@ -38,6 +39,7 @@ const isFormValidationError = (error: unknown) =>
  Array.isArray((error as { errorFields?: unknown }).errorFields);

 const ExpensesPage: React.FC = () => {
+  const { hasPermission } = usePermission();
  const [roomExpenses, setRoomExpenses] = useState<any[]>([]);
  const [personalExpenses, setPersonalExpenses] = useState<any[]>([]);
  const [rooms, setRooms] = useState<any[]>([]);
@@ -574,33 +576,35 @@ const ExpensesPage: React.FC = () => {
                      onChange={(v) => setRoomTypeFilter(v)}
                      options={typeOptions}
                    />
-                    <Upload
-                      accept=".xlsx,.xls"
-                      showUploadList={false}
-                      customRequest={async ({ file, onSuccess, onError }: any) => {
-                        const formData = new FormData();
-                        formData.append('file', file);
-                        try {
-                          const res: any = await api.post('/expenses/utility/import', formData);
-                          if (res.errors?.length > 0) {
-                            Modal.warning({
-                              title: res.message,
-                              content: res.errors.join('\n'),
-                              width: 500,
-                            });
-                          } else {
-                            message.success(res.message);
+                    {hasPermission('expense:create') ? (
+                      <Upload
+                        accept=".xlsx,.xls"
+                        showUploadList={false}
+                        customRequest={async ({ file, onSuccess, onError }: any) => {
+                          const formData = new FormData();
+                          formData.append('file', file);
+                          try {
+                            const res: any = await api.post('/expenses/utility/import', formData);
+                            if (res.errors?.length > 0) {
+                              Modal.warning({
+                                title: res.message,
+                                content: res.errors.join('\n'),
+                                width: 500,
+                              });
+                            } else {
+                              message.success(res.message);
+                            }
+                            onSuccess?.(res);
+                            fetchData();
+                          } catch (e: any) {
+                            message.error(e?.message || '导入失败');
+                            onError?.(e);
                          }
-                          onSuccess?.(res);
-                          fetchData();
-                        } catch (e: any) {
-                          message.error(e?.message || '导入失败');
-                          onError?.(e);
-                        }
-                      }}
-                    >
-                      <Button icon={<UploadOutlined />}>导入水电费Excel</Button>
-                    </Upload>
+                        }}
+                      >
+                        <Button icon={<UploadOutlined />}>导入水电费Excel</Button>
+                      </Upload>
+                    ) : null}
                    <PermissionButton
                      permission="expense:view"
                      icon={<DownloadOutlined />}
@@ -697,27 +701,29 @@ const ExpensesPage: React.FC = () => {
                      onChange={(v) => setPersonalTypeFilter(v)}
                      options={personalTypeOptions}
                    />
-                    <Upload
-                      accept=".xlsx,.xls"
-                      showUploadList={false}
-                      customRequest={async ({ file, onSuccess, onError }: any) => {
-                        try {
-                          const formData = new FormData();
-                          formData.append('file', file);
-                          const res: any = await api.post('/expenses/personal/import', formData);
-                          message.success(res.message || '导入完成');
-                          if (res.errors?.length)
-                            res.errors.forEach((e: string) => message.warning(e));
-                          fetchData();
-                          onSuccess?.(res);
-                        } catch (e: any) {
-                          message.error(e?.message || '导入失败');
-                          onError?.(e);
-                        }
-                      }}
-                    >
-                      <Button icon={<UploadOutlined />}>导入个人附加费</Button>
-                    </Upload>
+                    {hasPermission('expense:create') ? (
+                      <Upload
+                        accept=".xlsx,.xls"
+                        showUploadList={false}
+                        customRequest={async ({ file, onSuccess, onError }: any) => {
+                          try {
+                            const formData = new FormData();
+                            formData.append('file', file);
+                            const res: any = await api.post('/expenses/personal/import', formData);
+                            message.success(res.message || '导入完成');
+                            if (res.errors?.length)
+                              res.errors.forEach((e: string) => message.warning(e));
+                            fetchData();
+                            onSuccess?.(res);
+                          } catch (e: any) {
+                            message.error(e?.message || '导入失败');
+                            onError?.(e);
+                          }
+                        }}
+                      >
+                        <Button icon={<UploadOutlined />}>导入个人附加费</Button>
+                      </Upload>
+                    ) : null}
                    <PermissionButton
                      permission="expense:view"
                      icon={<DownloadOutlined />}
--- a/apps/admin/src/pages/IntegrationConfig/index.tsx
+++ b/apps/admin/src/pages/IntegrationConfig/index.tsx
@@ -111,7 +111,8 @@ interface DeleteAttendanceGroupsResponse {
 }

 const IntegrationConfigPage: React.FC = () => {
-  const { hasAllPermissions } = usePermission();
+  const { hasPermission, hasAllPermissions } = usePermission();
+  const canCreateClass = hasPermission('class:create');
  const [loading, setLoading] = useState(false);
  const [saving, setSaving] = useState(false);
  const [testing, setTesting] = useState(false);
@@ -458,12 +459,14 @@ const IntegrationConfigPage: React.FC = () => {
                >
                  加入选中的班级
                </Button>
-                <Button
-                  disabled={checkedKeys.filter((k) => String(k).startsWith('user-')).length === 0}
-                  onClick={() => setClassModalOpen(true)}
-                >
-                  创建班级
-                </Button>
+                {canCreateClass ? (
+                  <Button
+                    disabled={checkedKeys.filter((k) => String(k).startsWith('user-')).length === 0}
+                    onClick={() => setClassModalOpen(true)}
+                  >
+                    创建班级
+                  </Button>
+                ) : null}
              </Space>
            }
          >
@@ -485,9 +488,11 @@ const IntegrationConfigPage: React.FC = () => {
                  title="班级列表"
                  size="small"
                  extra={
-                    <Button size="small" onClick={() => setClassModalOpen(true)}>
-                      + 创建班级
-                    </Button>
+                    canCreateClass ? (
+                      <Button size="small" onClick={() => setClassModalOpen(true)}>
+                        + 创建班级
+                      </Button>
+                    ) : null
                  }
                >
                  <List
@@ -514,45 +519,47 @@ const IntegrationConfigPage: React.FC = () => {
            </Row>

            {/* Create class Modal */}
-            <Modal
-              title="创建班级"
-              open={classModalOpen}
-              onOk={handleCreateClass}
-              onCancel={() => {
-                setClassModalOpen(false);
-                classForm.resetFields();
-              }}
-              confirmLoading={importing}
-              destroyOnClose
-            >
-              <Form form={classForm} layout="vertical">
-                <Form.Item name="name" label="班级名称" rules={[{ required: true }]}>
-                  <Input />
-                </Form.Item>
-                <Form.Item name="code" label="班级编码" rules={[{ required: true }]}>
-                  <Input placeholder="如 CS2024-01" />
-                </Form.Item>
-                <Form.Item name="classType" label="班型" rules={[{ required: true }]}>
-                  <Select
-                    options={[
-                      { value: 'culture', label: '文化课' },
-                      { value: 'professional', label: '专业课' },
-                      { value: 'bootcamp', label: '集训营' },
-                      { value: 'sprint', label: '冲刺班' },
-                    ]}
-                  />
-                </Form.Item>
-                <Form.Item name="startDate" label="开班日期">
-                  <DatePicker style={{ width: '100%' }} />
-                </Form.Item>
-                <Form.Item name="endDate" label="结束日期">
-                  <DatePicker style={{ width: '100%' }} />
-                </Form.Item>
-                <Form.Item name="notes" label="备注">
-                  <Input.TextArea rows={2} />
-                </Form.Item>
-              </Form>
-            </Modal>
+            {canCreateClass ? (
+              <Modal
+                title="创建班级"
+                open={classModalOpen}
+                onOk={handleCreateClass}
+                onCancel={() => {
+                  setClassModalOpen(false);
+                  classForm.resetFields();
+                }}
+                confirmLoading={importing}
+                destroyOnClose
+              >
+                <Form form={classForm} layout="vertical">
+                  <Form.Item name="name" label="班级名称" rules={[{ required: true }]}>
+                    <Input />
+                  </Form.Item>
+                  <Form.Item name="code" label="班级编码" rules={[{ required: true }]}>
+                    <Input placeholder="如 CS2024-01" />
+                  </Form.Item>
+                  <Form.Item name="classType" label="班型" rules={[{ required: true }]}>
+                    <Select
+                      options={[
+                        { value: 'culture', label: '文化课' },
+                        { value: 'professional', label: '专业课' },
+                        { value: 'bootcamp', label: '集训营' },
+                        { value: 'sprint', label: '冲刺班' },
+                      ]}
+                    />
+                  </Form.Item>
+                  <Form.Item name="startDate" label="开班日期">
+                    <DatePicker style={{ width: '100%' }} />
+                  </Form.Item>
+                  <Form.Item name="endDate" label="结束日期">
+                    <DatePicker style={{ width: '100%' }} />
+                  </Form.Item>
+                  <Form.Item name="notes" label="备注">
+                    <Input.TextArea rows={2} />
+                  </Form.Item>
+                </Form>
+              </Modal>
+            ) : null}
          </Drawer>
        )}
        <Modal
--- a/apps/admin/src/pages/Login/index.tsx
+++ b/apps/admin/src/pages/Login/index.tsx
@@ -4,7 +4,7 @@ import { Form, Input, Button, Card, Typography } from 'antd';
 import { UserOutlined, LockOutlined } from '@ant-design/icons';
 import api from '../../api';
 import { message } from '../../ui/app-message';
-import { writePermissions } from '../../auth/permission-store';
+import { clearPermissions, writePermissions } from '../../auth/permission-store';
 import { findRoleAwareLandingPath } from '../../auth/menu-policy';

 const { Title } = Typography;
@@ -15,6 +15,7 @@ const LoginPage: React.FC = () => {

  const onFinish = useCallback(
    async (values: any) => {
+      clearPermissions();
      setLoading(true);
      try {
        const res: any = await api.post('/auth/login', values);
@@ -66,11 +67,7 @@ const LoginPage: React.FC = () => {
            name="username"
            rules={[{ required: true, message: '请输入用户名' }]}
          >
-            <Input
-              prefix={<UserOutlined />}
-              placeholder="用户名"
-              autoComplete="username"
-            />
+            <Input prefix={<UserOutlined />} placeholder="用户名" autoComplete="username" />
          </Form.Item>
          <Form.Item
            label="密码"
--- a/apps/admin/src/pages/Occupancies/index.tsx
+++ b/apps/admin/src/pages/Occupancies/index.tsx
@@ -33,10 +33,13 @@ import { maskPhone, maskIdNumber } from '../../utils/sensitive';
 import PermissionButton from '../../components/PermissionButton';
 import { message } from '../../ui/app-message';
 import { buildCheckInPayload, buildTransferPayload } from './occupancy-form';
+import { usePermission } from '../../hooks/usePermission';

 const { RangePicker } = DatePicker;

 const OccupanciesPage: React.FC = () => {
+  const { hasPermission } = usePermission();
+  const canCheckIn = hasPermission('occupancy:checkin');
  const [data, setData] = useState<any[]>([]);
  const [students, setStudents] = useState<any[]>([]);
  const [rooms, setRooms] = useState<any[]>([]);
@@ -93,7 +96,12 @@ const OccupanciesPage: React.FC = () => {
    [data, selectedRowKeys],
  );
  const latestSelectedCheckInDate = useMemo(
-    () => selectedBatchRecords.map((item) => item.checkInDate).filter(Boolean).sort().at(-1),
+    () =>
+      selectedBatchRecords
+        .map((item) => item.checkInDate)
+        .filter(Boolean)
+        .sort()
+        .at(-1),
    [selectedBatchRecords],
  );
  const latestSelectedBillingStartDate = useMemo(
@@ -106,7 +114,8 @@ const OccupanciesPage: React.FC = () => {
    [selectedBatchRecords],
  );

-  const dateNotBefore = (start: string | Dayjs | null | undefined, messageText: string) =>
+  const dateNotBefore =
+    (start: string | Dayjs | null | undefined, messageText: string) =>
    (_: unknown, value?: Dayjs | null) => {
      if (!value || !start) return Promise.resolve();
      const startDate = dayjs.isDayjs(start) ? start : dayjs(start);
@@ -457,46 +466,77 @@ const OccupanciesPage: React.FC = () => {
          >
            入住登记
          </PermissionButton>
-          <Upload
-            accept=".xlsx,.xls"
-            showUploadList={false}
-            customRequest={async ({ file, onSuccess, onError }: any) => {
-              const formData = new FormData();
-              formData.append('file', file);
-              const params = new URLSearchParams();
-              if (autoDeposit) {
-                params.set('autoDeposit', 'true');
-                params.set('depositAmount', String(depositAmount));
-              }
-              try {
-                const res: any = await api.post(
-                  `/occupancies/import?${params.toString()}`,
-                  formData,
-                  { headers: { 'Content-Type': 'multipart/form-data' } },
-                );
-                if (res.errors?.length > 0) {
-                  Modal.warning({
-                    title: res.message,
-                    content: res.errors.join('\n'),
-                    width: 500,
-                  });
-                } else {
-                  message.success(res.message);
-                }
-                onSuccess?.(res);
-                fetchData();
-              } catch (e: any) {
-                message.error(e?.message || '导入失败');
-                onError?.(e);
-              }
-            }}
-          >
-            <Tooltip title="按手机号关联学生，并自动创建缺失的学生、宿舍和入住记录">
-              <Button type="primary" ghost icon={<UploadOutlined />}>
-                导入入住名单
-              </Button>
-            </Tooltip>
-          </Upload>
+          {canCheckIn ? (
+            <>
+              <Upload
+                accept=".xlsx,.xls"
+                showUploadList={false}
+                customRequest={async ({ file, onSuccess, onError }: any) => {
+                  const formData = new FormData();
+                  formData.append('file', file);
+                  const params = new URLSearchParams();
+                  if (autoDeposit) {
+                    params.set('autoDeposit', 'true');
+                    params.set('depositAmount', String(depositAmount));
+                  }
+                  try {
+                    const res: any = await api.post(
+                      `/occupancies/import?${params.toString()}`,
+                      formData,
+                      { headers: { 'Content-Type': 'multipart/form-data' } },
+                    );
+                    if (res.errors?.length > 0) {
+                      Modal.warning({
+                        title: res.message,
+                        content: res.errors.join('\n'),
+                        width: 500,
+                      });
+                    } else {
+                      message.success(res.message);
+                    }
+                    onSuccess?.(res);
+                    fetchData();
+                  } catch (e: any) {
+                    message.error(e?.message || '导入失败');
+                    onError?.(e);
+                  }
+                }}
+              >
+                <Tooltip title="按手机号关联学生，并自动创建缺失的学生、宿舍和入住记录">
+                  <Button type="primary" ghost icon={<UploadOutlined />}>
+                    导入入住名单
+                  </Button>
+                </Tooltip>
+              </Upload>
+              <span style={{ display: 'inline-flex', alignItems: 'center', gap: 6, fontSize: 13 }}>
+                <Switch size="small" checked={autoDeposit} onChange={setAutoDeposit} />
+                导入时自动收押金
+                {autoDeposit && (
+                  <Space.Compact>
+                    <InputNumber
+                      size="small"
+                      min={0}
+                      value={depositAmount}
+                      onChange={(v) => setDepositAmount(v || 500)}
+                      style={{ width: 60 }}
+                    />
+                    <span
+                      style={{
+                        padding: '0 8px',
+                        display: 'flex',
+                        alignItems: 'center',
+                        border: '1px solid #d9d9d9',
+                        backgroundColor: '#fafafa',
+                        fontSize: 12,
+                      }}
+                    >
+                      元
+                    </span>
+                  </Space.Compact>
+                )}
+              </span>
+            </>
+          ) : null}
          <PermissionButton
            permission="occupancy:view"
            icon={<DownloadOutlined />}
@@ -521,33 +561,6 @@ const OccupanciesPage: React.FC = () => {
          >
            导出记录
          </PermissionButton>
-          <span style={{ display: 'inline-flex', alignItems: 'center', gap: 6, fontSize: 13 }}>
-            <Switch size="small" checked={autoDeposit} onChange={setAutoDeposit} />
-            导入时自动收押金
-            {autoDeposit && (
-              <Space.Compact>
-                <InputNumber
-                  size="small"
-                  min={0}
-                  value={depositAmount}
-                  onChange={(v) => setDepositAmount(v || 500)}
-                  style={{ width: 60 }}
-                />
-                <span
-                  style={{
-                    padding: '0 8px',
-                    display: 'flex',
-                    alignItems: 'center',
-                    border: '1px solid #d9d9d9',
-                    backgroundColor: '#fafafa',
-                    fontSize: 12,
-                  }}
-                >
-                  元
-                </span>
-              </Space.Compact>
-            )}
-          </span>
        </Space>
      </div>
      {selectedRowKeys.length > 0 && (
@@ -642,7 +655,11 @@ const OccupanciesPage: React.FC = () => {
                .filter((s: any) => s.status === 'active')
                .map((s: any) => {
                  const activeOccupancy = activeOccupancyByStudentId.get(s.id);
-                  const identifier = s.idNumber ? maskIdNumber(s.idNumber) : s.phone ? maskPhone(s.phone) : '';
+                  const identifier = s.idNumber
+                    ? maskIdNumber(s.idNumber)
+                    : s.phone
+                      ? maskPhone(s.phone)
+                      : '';
                  return {
                    value: s.id,
                    label: `${s.name} (${identifier})${activeOccupancy ? ` · 已入住${activeOccupancy.room?.roomNumber ? ` ${activeOccupancy.room.roomNumber}` : ''}` : ''}`,
@@ -668,18 +685,25 @@ const OccupanciesPage: React.FC = () => {
              }))}
            />
          </Form.Item>
-          <Form.Item name="checkInDate" label="入住日期" rules={[{ required: true, message: '请选择入住日期' }]}>
+          <Form.Item
+            name="checkInDate"
+            label="入住日期"
+            rules={[{ required: true, message: '请选择入住日期' }]}
+          >
            <DatePicker style={{ width: '100%' }} placeholder="选择入住日期" format="YYYY-MM-DD" />
          </Form.Item>
          <Form.Item
            name="billingStartDate"
            label="计费起始日"
-            dependencies={["checkInDate"]}
+            dependencies={['checkInDate']}
            extra="默认与入住日期相同，可调整（如学生要求从次日开始计费）"
            rules={[
              { required: true, message: '请选择计费起始日' },
              ({ getFieldValue }) => ({
-                validator: dateNotBefore(getFieldValue('checkInDate'), '计费起始日不能早于入住日期'),
+                validator: dateNotBefore(
+                  getFieldValue('checkInDate'),
+                  '计费起始日不能早于入住日期',
+                ),
              }),
            ]}
          >
@@ -689,7 +713,11 @@ const OccupanciesPage: React.FC = () => {
              format="YYYY-MM-DD"
            />
          </Form.Item>
-          <Form.Item name="stayType" label="入住类型" rules={[{ required: true, message: '请选择入住类型' }]}>
+          <Form.Item
+            name="stayType"
+            label="入住类型"
+            rules={[{ required: true, message: '请选择入住类型' }]}
+          >
            <Select
              options={[
                { value: 'short', label: '短租' },
@@ -714,7 +742,9 @@ const OccupanciesPage: React.FC = () => {
            <Select
              placeholder={selectedCheckInRoomId ? '请选择床位' : '请先选择房间'}
              loading={availableResourcesLoading}
-              disabled={!selectedCheckInRoomId || availableResourcesLoading || availableBeds.length === 0}
+              disabled={
+                !selectedCheckInRoomId || availableResourcesLoading || availableBeds.length === 0
+              }
              options={availableBeds.map((b) => ({
                value: b.id,
                label: b.bedNumber,
@@ -732,7 +762,9 @@ const OccupanciesPage: React.FC = () => {
              allowClear
              placeholder="可选分配柜子"
              loading={availableResourcesLoading}
-              disabled={!selectedCheckInRoomId || availableResourcesLoading || availableLockers.length === 0}
+              disabled={
+                !selectedCheckInRoomId || availableResourcesLoading || availableLockers.length === 0
+              }
              options={availableLockers.map((l) => ({
                value: l.id,
                label: l.lockerNumber,
@@ -792,12 +824,14 @@ const OccupanciesPage: React.FC = () => {
          <Form.Item
            name="billingEndDate"
            label="计费截止日"
-            dependencies={["checkOutDate"]}
+            dependencies={['checkOutDate']}
            extra="默认与退宿日期相同"
            rules={[
              ({ getFieldValue }) => ({
                validator: dateNotBefore(
-                  checkOutModal?.billingStartDate || checkOutModal?.checkInDate || getFieldValue('checkOutDate'),
+                  checkOutModal?.billingStartDate ||
+                    checkOutModal?.checkInDate ||
+                    getFieldValue('checkOutDate'),
                  '计费截止日不能早于计费起始日',
                ),
              }),
@@ -948,7 +982,11 @@ const OccupanciesPage: React.FC = () => {
            <Select
              placeholder={selectedTransferRoomId ? '请选择目标床位' : '请先选择目标宿舍'}
              loading={transferResourcesLoading}
-              disabled={!selectedTransferRoomId || transferResourcesLoading || transferAvailableBeds.length === 0}
+              disabled={
+                !selectedTransferRoomId ||
+                transferResourcesLoading ||
+                transferAvailableBeds.length === 0
+              }
              options={transferAvailableBeds.map((bed) => ({
                value: bed.id,
                label: bed.bedNumber,
@@ -966,7 +1004,11 @@ const OccupanciesPage: React.FC = () => {
              allowClear
              placeholder="可选分配目标宿舍柜子"
              loading={transferResourcesLoading}
-              disabled={!selectedTransferRoomId || transferResourcesLoading || transferAvailableLockers.length === 0}
+              disabled={
+                !selectedTransferRoomId ||
+                transferResourcesLoading ||
+                transferAvailableLockers.length === 0
+              }
              options={transferAvailableLockers.map((locker) => ({
                value: locker.id,
                label: locker.lockerNumber,
@@ -979,7 +1021,9 @@ const OccupanciesPage: React.FC = () => {
            label="换房日期"
            rules={[
              { required: true, message: '请选择换房日期' },
-              { validator: dateNotBefore(transferModal?.checkInDate, '换房日期不能早于原入住日期') },
+              {
+                validator: dateNotBefore(transferModal?.checkInDate, '换房日期不能早于原入住日期'),
+              },
            ]}
          >
            <DatePicker style={{ width: '100%' }} placeholder="选择换房日期" format="YYYY-MM-DD" />
@@ -987,12 +1031,14 @@ const OccupanciesPage: React.FC = () => {
          <Form.Item
            name="oldBillingEndDate"
            label="旧房计费截止日"
-            dependencies={["transferDate"]}
+            dependencies={['transferDate']}
            extra="默认为换房当天"
            rules={[
              ({ getFieldValue }) => ({
                validator: dateNotBefore(
-                  transferModal?.billingStartDate || transferModal?.checkInDate || getFieldValue('transferDate'),
+                  transferModal?.billingStartDate ||
+                    transferModal?.checkInDate ||
+                    getFieldValue('transferDate'),
                  '旧房计费截止日不能早于计费起始日',
                ),
              }),
@@ -1007,11 +1053,14 @@ const OccupanciesPage: React.FC = () => {
          <Form.Item
            name="newBillingStartDate"
            label="新房计费起始日"
-            dependencies={["transferDate"]}
+            dependencies={['transferDate']}
            extra="默认为换房次日"
            rules={[
              ({ getFieldValue }) => ({
-                validator: dateNotBefore(getFieldValue('transferDate'), '新房计费起始日不能早于换房日期'),
+                validator: dateNotBefore(
+                  getFieldValue('transferDate'),
+                  '新房计费起始日不能早于换房日期',
+                ),
              }),
            ]}
          >
--- a/apps/admin/src/pages/RoomVisual/index.tsx
+++ b/apps/admin/src/pages/RoomVisual/index.tsx
@@ -464,7 +464,11 @@ const RoomVisualPage: React.FC = () => {
                  )}
                </div>
                {detailRoom.occupants.map((o: any) => (
-                  <Card key={o.occupancyId} size="small" style={{ marginBottom: 8, borderRadius: 8 }}>
+                  <Card
+                    key={o.occupancyId}
+                    size="small"
+                    style={{ marginBottom: 8, borderRadius: 8 }}
+                  >
                    <div
                      style={{
                        display: 'flex',
@@ -502,24 +506,25 @@ const RoomVisualPage: React.FC = () => {
                          <span style={{ color: '#86868b', fontSize: 12 }}>
                            {presentOccupancyIds.includes(o.occupancyId) ? '在寝' : '缺勤'}
                          </span>
-                          <Switch
-                            checked={presentOccupancyIds.includes(o.occupancyId)}
-                            disabled={!hasPermission('room:inspect')}
-                            checkedChildren="在寝"
-                            unCheckedChildren="缺勤"
-                            onChange={(checked) =>
-                              setPresentOccupancyIds((current) =>
-                                togglePresentOccupancy(current, o.occupancyId, checked),
-                              )
-                            }
-                          />
+                          {hasPermission('room:inspect') ? (
+                            <Switch
+                              checked={presentOccupancyIds.includes(o.occupancyId)}
+                              checkedChildren="在寝"
+                              unCheckedChildren="缺勤"
+                              onChange={(checked) =>
+                                setPresentOccupancyIds((current) =>
+                                  togglePresentOccupancy(current, o.occupancyId, checked),
+                                )
+                              }
+                            />
+                          ) : null}
                        </Space>
                      )}
                    </div>
                    <div style={{ color: '#86868b', fontSize: 12, marginTop: 4 }}>
                      <CalendarOutlined style={{ marginRight: 4 }} />
-                      床位：{o.bedNumber || '未分配'} |{' '}
-                      入住：{o.checkInDate} | 计费起：{o.billingStartDate}
+                      床位：{o.bedNumber || '未分配'} | 入住：{o.checkInDate} | 计费起：
+                      {o.billingStartDate}
                      {o.supervisor && (
                        <span style={{ marginLeft: 8 }}>负责人：{o.supervisor}</span>
                      )}
--- a/apps/admin/src/pages/Rooms/index.tsx
+++ b/apps/admin/src/pages/Rooms/index.tsx
@@ -31,6 +31,7 @@ import { downloadBlob } from '../../utils/download';
 import PermissionButton from '../../components/PermissionButton';
 import EditableCell from '../../components/EditableCell';
 import { message } from '../../ui/app-message';
+import { usePermission } from '../../hooks/usePermission';

 const statusMap: Record<string, { text: string; color: string }> = {
  available: { text: '可入住', color: 'green' },
@@ -84,6 +85,8 @@ function parseRoomNumber(input: string) {
 }

 const RoomsPage: React.FC = () => {
+  const { hasPermission } = usePermission();
+  const canEditRooms = hasPermission('room:edit');
  const [data, setData] = useState<any[]>([]);
  const [loading, setLoading] = useState(false);
  const [modalOpen, setModalOpen] = useState(false);
@@ -664,33 +667,35 @@ const RoomsPage: React.FC = () => {
          >
            添加宿舍
          </PermissionButton>
-          <Upload
-            accept=".xlsx,.xls"
-            showUploadList={false}
-            customRequest={async (options: UploadRequestOption<{ message?: string }>) => {
-              const { file, onSuccess, onError } = options;
-              if (typeof file === 'string') {
-                message.error('不支持字符串文件');
-                return;
-              }
-              try {
-                const formData = new FormData();
-                formData.append('file', file);
-                const res = await api.post<{ message?: string }>('/rooms/import', formData, {
-                  headers: { 'Content-Type': 'multipart/form-data' },
-                });
-                message.success(res.message || '导入成功');
-                onSuccess?.(res);
-                fetchData();
-              } catch (e: unknown) {
-                const err = e as { message?: string };
-                message.error(err?.message || '导入失败');
-                onError?.(e as UploadRequestError);
-              }
-            }}
-          >
-            <Button icon={<UploadOutlined />}>导入Excel</Button>
-          </Upload>
+          {hasPermission('room:create') ? (
+            <Upload
+              accept=".xlsx,.xls"
+              showUploadList={false}
+              customRequest={async (options: UploadRequestOption<{ message?: string }>) => {
+                const { file, onSuccess, onError } = options;
+                if (typeof file === 'string') {
+                  message.error('不支持字符串文件');
+                  return;
+                }
+                try {
+                  const formData = new FormData();
+                  formData.append('file', file);
+                  const res = await api.post<{ message?: string }>('/rooms/import', formData, {
+                    headers: { 'Content-Type': 'multipart/form-data' },
+                  });
+                  message.success(res.message || '导入成功');
+                  onSuccess?.(res);
+                  fetchData();
+                } catch (e: unknown) {
+                  const err = e as { message?: string };
+                  message.error(err?.message || '导入失败');
+                  onError?.(e as UploadRequestError);
+                }
+              }}
+            >
+              <Button icon={<UploadOutlined />}>导入Excel</Button>
+            </Upload>
+          ) : null}
          <PermissionButton
            permission="room:view"
            icon={<DownloadOutlined />}
@@ -854,56 +859,58 @@ const RoomsPage: React.FC = () => {
              label: `床位管理 (${beds.length})`,
              children: (
                <div>
-                  <div style={{ marginBottom: 12, display: 'flex', gap: 8 }}>
-                    <Button
-                      type="primary"
-                      size="small"
-                      icon={<PlusOutlined />}
-                      disabled={drawerRoom?.status === 'archived' || remainingBedSlots === 0}
-                      onClick={() => {
-                        setBedEditing(null);
-                        bedForm.resetFields();
-                        setBedModalOpen(true);
-                      }}
-                    >
-                      添加床位
-                    </Button>
-                    <Popconfirm
-                      title={remainingBedSlots > 0 ? '批量生成床位' : '床位已达到额定人数'}
-                      description={
-                        remainingBedSlots > 0 ? (
-                          <InputNumber
-                            min={1}
-                            max={remainingBedSlots}
-                            defaultValue={defaultBatchBedCount}
-                            id="batch-bed-count"
-                            style={{ width: 80 }}
-                          />
-                        ) : (
-                          '如需增加床位，请先调整宿舍额定人数'
-                        )
-                      }
-                      onConfirm={() => {
-                        const input = document.getElementById(
-                          'batch-bed-count',
-                        ) as HTMLInputElement;
-                        handleBatchBeds(
-                          input
-                            ? parseInt(input.value) || defaultBatchBedCount
-                            : defaultBatchBedCount,
-                        );
-                      }}
-                      okText="生成"
-                      disabled={drawerRoom?.status === 'archived' || remainingBedSlots === 0}
-                    >
+                  {canEditRooms ? (
+                    <div style={{ marginBottom: 12, display: 'flex', gap: 8 }}>
                      <Button
+                        type="primary"
                        size="small"
+                        icon={<PlusOutlined />}
+                        disabled={drawerRoom?.status === 'archived' || remainingBedSlots === 0}
+                        onClick={() => {
+                          setBedEditing(null);
+                          bedForm.resetFields();
+                          setBedModalOpen(true);
+                        }}
+                      >
+                        添加床位
+                      </Button>
+                      <Popconfirm
+                        title={remainingBedSlots > 0 ? '批量生成床位' : '床位已达到额定人数'}
+                        description={
+                          remainingBedSlots > 0 ? (
+                            <InputNumber
+                              min={1}
+                              max={remainingBedSlots}
+                              defaultValue={defaultBatchBedCount}
+                              id="batch-bed-count"
+                              style={{ width: 80 }}
+                            />
+                          ) : (
+                            '如需增加床位，请先调整宿舍额定人数'
+                          )
+                        }
+                        onConfirm={() => {
+                          const input = document.getElementById(
+                            'batch-bed-count',
+                          ) as HTMLInputElement;
+                          handleBatchBeds(
+                            input
+                              ? parseInt(input.value) || defaultBatchBedCount
+                              : defaultBatchBedCount,
+                          );
+                        }}
+                        okText="生成"
                        disabled={drawerRoom?.status === 'archived' || remainingBedSlots === 0}
                      >
-                        批量生成
-                      </Button>
-                    </Popconfirm>
-                  </div>
+                        <Button
+                          size="small"
+                          disabled={drawerRoom?.status === 'archived' || remainingBedSlots === 0}
+                        >
+                          批量生成
+                        </Button>
+                      </Popconfirm>
+                    </div>
+                  ) : null}
                  <Table
                    dataSource={beds}
                    rowKey="id"
@@ -1016,45 +1023,47 @@ const RoomsPage: React.FC = () => {
              label: `柜子管理 (${lockers.length})`,
              children: (
                <div>
-                  <div style={{ marginBottom: 12, display: 'flex', gap: 8 }}>
-                    <Button
-                      type="primary"
-                      size="small"
-                      icon={<PlusOutlined />}
-                      disabled={drawerRoom?.status === 'archived'}
-                      onClick={() => {
-                        setLockerEditing(null);
-                        lockerForm.resetFields();
-                        setLockerModalOpen(true);
-                      }}
-                    >
-                      添加柜子
-                    </Button>
-                    <Popconfirm
-                      title="批量生成柜子"
-                      description={
-                        <InputNumber
-                          min={1}
-                          max={20}
-                          defaultValue={4}
-                          id="batch-locker-count"
-                          style={{ width: 80 }}
-                        />
-                      }
-                      onConfirm={() => {
-                        const input = document.getElementById(
-                          'batch-locker-count',
-                        ) as HTMLInputElement;
-                        handleBatchLockers(input ? parseInt(input.value) || 4 : 4);
-                      }}
-                      okText="生成"
-                      disabled={drawerRoom?.status === 'archived'}
-                    >
-                      <Button size="small" disabled={drawerRoom?.status === 'archived'}>
-                        批量生成
+                  {canEditRooms ? (
+                    <div style={{ marginBottom: 12, display: 'flex', gap: 8 }}>
+                      <Button
+                        type="primary"
+                        size="small"
+                        icon={<PlusOutlined />}
+                        disabled={drawerRoom?.status === 'archived'}
+                        onClick={() => {
+                          setLockerEditing(null);
+                          lockerForm.resetFields();
+                          setLockerModalOpen(true);
+                        }}
+                      >
+                        添加柜子
                      </Button>
-                    </Popconfirm>
-                  </div>
+                      <Popconfirm
+                        title="批量生成柜子"
+                        description={
+                          <InputNumber
+                            min={1}
+                            max={20}
+                            defaultValue={4}
+                            id="batch-locker-count"
+                            style={{ width: 80 }}
+                          />
+                        }
+                        onConfirm={() => {
+                          const input = document.getElementById(
+                            'batch-locker-count',
+                          ) as HTMLInputElement;
+                          handleBatchLockers(input ? parseInt(input.value) || 4 : 4);
+                        }}
+                        okText="生成"
+                        disabled={drawerRoom?.status === 'archived'}
+                      >
+                        <Button size="small" disabled={drawerRoom?.status === 'archived'}>
+                          批量生成
+                        </Button>
+                      </Popconfirm>
+                    </div>
+                  ) : null}
                  <Table
                    dataSource={lockers}
                    rowKey="id"
@@ -1168,8 +1177,8 @@ const RoomsPage: React.FC = () => {

      <Modal
        title={bedEditing ? '编辑床位' : '添加床位'}
-        open={bedModalOpen}
-        onOk={handleSaveBed}
+        open={bedModalOpen && canEditRooms}
+        onOk={canEditRooms ? handleSaveBed : undefined}
        onCancel={() => {
          setBedModalOpen(false);
          setBedEditing(null);
@@ -1198,8 +1207,8 @@ const RoomsPage: React.FC = () => {

      <Modal
        title={lockerEditing ? '编辑柜子' : '添加柜子'}
-        open={lockerModalOpen}
-        onOk={handleSaveLocker}
+        open={lockerModalOpen && canEditRooms}
+        onOk={canEditRooms ? handleSaveLocker : undefined}
        onCancel={() => {
          setLockerModalOpen(false);
          setLockerEditing(null);
--- a/apps/admin/src/pages/Students/index.tsx
+++ b/apps/admin/src/pages/Students/index.tsx
@@ -38,6 +38,7 @@ import EditableCell from '../../components/EditableCell';
 import JinshujuMatchModal from '../../components/JinshujuMatchModal';
 import { maskIdNumber, maskPhone } from '../../utils/sensitive';
 import { message } from '../../ui/app-message';
+import { usePermission } from '../../hooks/usePermission';

 const statusMap: Record<string, { text: string; color: string }> = {
  active: { text: '在读', color: 'green' },
@@ -84,6 +85,10 @@ interface StudentFilterLookups {

 const StudentsPage: React.FC = () => {
  const { modal } = App.useApp();
+  const { hasPermission, hasAnyPermission } = usePermission();
+  const canViewOrganizations = hasPermission('organization:view');
+  const canChooseOrganization =
+    canViewOrganizations && hasAnyPermission('student:create', 'student:edit');
  const [data, setData] = useState<any[]>([]);
  const [loading, setLoading] = useState(false);
  const [modalOpen, setModalOpen] = useState(false);
@@ -189,12 +194,17 @@ const StudentsPage: React.FC = () => {
  }, [fetchData]);

  useEffect(() => {
-    api
-      .get('/organizations', { params: { includeArchived: 'false' } })
-      .then((res: unknown) => {
-        setOrganizations(res as Array<{ id: number; name: string }>);
-      })
-      .catch(() => {});
+    if (canViewOrganizations) {
+      api
+        .get('/organizations', { params: { includeArchived: 'false' } })
+        .then((res: unknown) => {
+          setOrganizations(res as Array<{ id: number; name: string }>);
+        })
+        .catch(() => {});
+    } else {
+      setOrganizations([]);
+      setFilterOrganizationId(undefined);
+    }
    api
      .get<StudentFilterLookups>('/students/filter-lookups')
      .then((res) => {
@@ -202,7 +212,7 @@ const StudentsPage: React.FC = () => {
        setTeacherOptions(res.teachers || []);
      })
      .catch(() => {});
-  }, []);
+  }, [canViewOrganizations]);
  const handleSave = async () => {
    const values = await form.validateFields();
    setSaving(true);
@@ -417,15 +427,17 @@ const StudentsPage: React.FC = () => {
          return (
            <span style={{ display: 'inline-flex', alignItems: 'center', whiteSpace: 'nowrap' }}>
              <span style={{ marginRight: 4 }}>{maskPhone(v)}</span>
-              <Button
-                type="link"
-                size="small"
-                style={{ padding: '8px 4px', flex: 'none' }}
-                onClick={() => handleViewSensitive(record.id, '电话', v)}
-                title="点击查看完整号码"
-              >
-                <EyeOutlined style={{ fontSize: 12, color: '#999' }} />
-              </Button>
+              {hasPermission('log:create') ? (
+                <Button
+                  type="link"
+                  size="small"
+                  style={{ padding: '8px 4px', flex: 'none' }}
+                  onClick={() => handleViewSensitive(record.id, '电话', v)}
+                  title="点击查看完整号码"
+                >
+                  <EyeOutlined style={{ fontSize: 12, color: '#999' }} />
+                </Button>
+              ) : null}
            </span>
          );
        },
@@ -454,15 +466,17 @@ const StudentsPage: React.FC = () => {
          return (
            <span style={{ display: 'inline-flex', alignItems: 'center', whiteSpace: 'nowrap' }}>
              <span style={{ marginRight: 4 }}>{maskIdNumber(v)}</span>
-              <Button
-                type="link"
-                size="small"
-                style={{ padding: '8px 4px', flex: 'none' }}
-                onClick={() => handleViewSensitive(record.id, '身份证号', v)}
-                title="点击查看完整号码"
-              >
-                <EyeOutlined style={{ fontSize: 12, color: '#999' }} />
-              </Button>
+              {hasPermission('log:create') ? (
+                <Button
+                  type="link"
+                  size="small"
+                  style={{ padding: '8px 4px', flex: 'none' }}
+                  onClick={() => handleViewSensitive(record.id, '身份证号', v)}
+                  title="点击查看完整号码"
+                >
+                  <EyeOutlined style={{ fontSize: 12, color: '#999' }} />
+                </Button>
+              ) : null}
            </span>
          );
        },
@@ -506,15 +520,17 @@ const StudentsPage: React.FC = () => {
          return (
            <span style={{ display: 'inline-flex', alignItems: 'center', whiteSpace: 'nowrap' }}>
              <span style={{ marginRight: 4 }}>{maskPhone(v)}</span>
-              <Button
-                type="link"
-                size="small"
-                style={{ padding: '8px 4px', flex: 'none' }}
-                onClick={() => handleViewSensitive(record.id, '紧急联系人电话', v)}
-                title="点击查看完整号码"
-              >
-                <EyeOutlined style={{ fontSize: 12, color: '#999' }} />
-              </Button>
+              {hasPermission('log:create') ? (
+                <Button
+                  type="link"
+                  size="small"
+                  style={{ padding: '8px 4px', flex: 'none' }}
+                  onClick={() => handleViewSensitive(record.id, '紧急联系人电话', v)}
+                  title="点击查看完整号码"
+                >
+                  <EyeOutlined style={{ fontSize: 12, color: '#999' }} />
+                </Button>
+              ) : null}
            </span>
          );
        },
@@ -523,28 +539,33 @@ const StudentsPage: React.FC = () => {
        title: '所属机构',
        dataIndex: 'organization',
        width: 100,
-        render: (organization: { name?: string } | null, record: any) => (
-          <EditableCell
-            value={record.organizationId}
-            editor="select"
-            options={organizations.map((item) => ({ value: item.id, label: item.name }))}
-            permission="student:edit"
-            disabled={record.status === 'archived'}
-            required
-            onSave={(next) => saveCell(record, 'organizationId', next)}
-          >
-            {organization?.name ? (
-              <Tag
-                color="purple"
-                style={{ maxWidth: '100%', overflow: 'hidden', textOverflow: 'ellipsis' }}
-              >
-                {organization.name}
-              </Tag>
-            ) : (
-              '-'
-            )}
-          </EditableCell>
-        ),
+        render: (organization: { name?: string } | null, record: any) =>
+          canChooseOrganization ? (
+            <EditableCell
+              value={record.organizationId}
+              editor="select"
+              options={organizations.map((item) => ({ value: item.id, label: item.name }))}
+              permission="student:edit"
+              disabled={record.status === 'archived'}
+              required
+              onSave={(next) => saveCell(record, 'organizationId', next)}
+            >
+              {organization?.name ? (
+                <Tag
+                  color="purple"
+                  style={{ maxWidth: '100%', overflow: 'hidden', textOverflow: 'ellipsis' }}
+                >
+                  {organization.name}
+                </Tag>
+              ) : (
+                '-'
+              )}
+            </EditableCell>
+          ) : organization?.name ? (
+            <Tag color="purple">{organization.name}</Tag>
+          ) : (
+            '-'
+          ),
      },
      {
        title: '负责人',
@@ -649,7 +670,15 @@ const StudentsPage: React.FC = () => {
        ),
      },
    ],
-    [handleViewSensitive, openDrawer, showArchived, organizations, saveCell],
+    [
+      handleViewSensitive,
+      openDrawer,
+      showArchived,
+      organizations,
+      saveCell,
+      hasPermission,
+      canChooseOrganization,
+    ],
  );

  return (
@@ -679,21 +708,23 @@ const StudentsPage: React.FC = () => {
                </Select.Option>
              ))}
          </Select>
-          <Select
-            placeholder="所属机构"
-            allowClear
-            style={{ width: 140 }}
-            value={filterOrganizationId}
-            onChange={(v) => {
-              setFilterOrganizationId(v);
-            }}
-          >
-            {organizations.map((t: { id: number; name: string }) => (
-              <Select.Option key={t.id} value={t.id}>
-                {t.name}
-              </Select.Option>
-            ))}
-          </Select>
+          {canViewOrganizations ? (
+            <Select
+              placeholder="所属机构"
+              allowClear
+              style={{ width: 140 }}
+              value={filterOrganizationId}
+              onChange={(v) => {
+                setFilterOrganizationId(v);
+              }}
+            >
+              {organizations.map((t: { id: number; name: string }) => (
+                <Select.Option key={t.id} value={t.id}>
+                  {t.name}
+                </Select.Option>
+              ))}
+            </Select>
+          ) : null}
          <Select
            placeholder="所属班级"
            allowClear
@@ -765,22 +796,26 @@ const StudentsPage: React.FC = () => {
          >
            添加学生
          </PermissionButton>
-          <Upload
-            accept=".xlsx,.xls"
-            showUploadList={false}
-            customRequest={handleCreateStudentsImport}
-          >
-            <Button icon={<UploadOutlined />}>导入Excel</Button>
-          </Upload>
-          <Upload
-            accept=".xlsx,.xls"
-            showUploadList={false}
-            customRequest={handleUpdateExistingStudentsImport}
-          >
-            <Button icon={<SwapOutlined />}>更新已有学生资料</Button>
-          </Upload>
+          {hasPermission('student:import') ? (
+            <>
+              <Upload
+                accept=".xlsx,.xls"
+                showUploadList={false}
+                customRequest={handleCreateStudentsImport}
+              >
+                <Button icon={<UploadOutlined />}>导入Excel</Button>
+              </Upload>
+              <Upload
+                accept=".xlsx,.xls"
+                showUploadList={false}
+                customRequest={handleUpdateExistingStudentsImport}
+              >
+                <Button icon={<SwapOutlined />}>更新已有学生资料</Button>
+              </Upload>
+            </>
+          ) : null}
          <PermissionButton
-            permission="student:edit"
+            permission="sync:read"
            icon={<CloudUploadOutlined />}
            onClick={() => setJinshujuOpen(true)}
          >
@@ -934,23 +969,27 @@ const StudentsPage: React.FC = () => {
          <Form.Item name="emergencyPhone" label="紧急联系人电话">
            <Input />
          </Form.Item>
-          <Form.Item
-            name="organizationId"
-            label="所属机构"
-            rules={[{ required: true, message: '请选择所属机构' }]}
-          >
-            <Select
-              showSearch
-              optionFilterProp="label"
-              placeholder="选择所属机构"
-              options={organizations.map(
-                (organization: { id: number; name: string; isHost?: boolean }) => ({
-                  value: organization.id,
-                  label: organization.isHost ? `${organization.name}（本机构）` : organization.name,
-                }),
-              )}
-            />
-          </Form.Item>
+          {canChooseOrganization ? (
+            <Form.Item
+              name="organizationId"
+              label="所属机构"
+              rules={[{ required: true, message: '请选择所属机构' }]}
+            >
+              <Select
+                showSearch
+                optionFilterProp="label"
+                placeholder="选择所属机构"
+                options={organizations.map(
+                  (organization: { id: number; name: string; isHost?: boolean }) => ({
+                    value: organization.id,
+                    label: organization.isHost
+                      ? `${organization.name}（本机构）`
+                      : organization.name,
+                  }),
+                )}
+              />
+            </Form.Item>
+          ) : null}
          <Form.Item name="supervisor" label="负责人/班主任">
            <Input />
          </Form.Item>
@@ -968,11 +1007,16 @@ const StudentsPage: React.FC = () => {
        </Form>
      </Modal>

-      <JinshujuMatchModal
-        open={jinshujuOpen}
-        onClose={() => setJinshujuOpen(false)}
-        onApplied={() => { setJinshujuOpen(false); fetchData(); }}
-      />
+      {hasPermission('sync:read') ? (
+        <JinshujuMatchModal
+          open={jinshujuOpen}
+          onClose={() => setJinshujuOpen(false)}
+          onApplied={() => {
+            setJinshujuOpen(false);
+            fetchData();
+          }}
+        />
+      ) : null}
      <Drawer
        title={null}
        open={drawerOpen}
--- a/apps/admin/src/pages/Teachers/index.tsx
+++ b/apps/admin/src/pages/Teachers/index.tsx
@@ -1,10 +1,12 @@
 import React, { useEffect, useState, useCallback, useMemo } from 'react';
-import { Table, Input, Button, Modal, Form, Select, DatePicker, Tag, Space } from 'antd';
+import { Table, Input, Modal, Form, Select, DatePicker, Tag, Space } from 'antd';
 import { EditOutlined } from '@ant-design/icons';
 import dayjs from 'dayjs';
 import api from '../../api';
 import { message } from '../../ui/app-message';
 import EditableCell from '../../components/EditableCell';
+import PermissionButton from '../../components/PermissionButton';
+import { usePermission } from '../../hooks/usePermission';

 interface TeacherRow {
  id: number;
@@ -50,6 +52,8 @@ const ROLE_TYPE_LABELS: Record<string, string> = {
 const DEFAULT_PAGE_SIZE = 20;

 const TeachersPage: React.FC = () => {
+  const { hasPermission } = usePermission();
+  const canEditTeachers = hasPermission('teacher:edit');
  const [data, setData] = useState<TeacherRow[]>([]);
  const [loading, setLoading] = useState(false);
  const [total, setTotal] = useState(0);
@@ -190,7 +194,8 @@ const TeachersPage: React.FC = () => {
        key: 'actions',
        width: 100,
        render: (_: unknown, r: TeacherRow) => (
-          <Button
+          <PermissionButton
+            permission="teacher:edit"
            size="small"
            icon={<EditOutlined />}
            onClick={() => {
@@ -203,11 +208,11 @@ const TeachersPage: React.FC = () => {
            }}
          >
            档案
-          </Button>
+          </PermissionButton>
        ),
      },
    ],
-    [saveProfileCell],
+    [saveProfileCell, form],
  );

  return (
@@ -263,8 +268,8 @@ const TeachersPage: React.FC = () => {
      />
      <Modal
        title={`编辑档案 — ${profileModal?.name || ''}`}
-        open={!!profileModal}
-        onOk={handleSaveProfile}
+        open={!!profileModal && canEditTeachers}
+        onOk={canEditTeachers ? handleSaveProfile : undefined}
        onCancel={() => setProfileModal(null)}
        okText="保存"
        confirmLoading={saving}