feat: 集成 AI 对话与只读查询工具

apps/server/src/rbac/rbac.seed.spec.ts

@@ -1,6 +1,61 @@
 import { RbacService } from './rbac.service';
 
 describe('RbacService seedData', () => {
+  it('seeds AI chat permission without auto-assigning it through the AI config group', async () => {
+    const permissions: any[] = [
+      { id: 1, code: 'ai:config:read', name: '查看 AI 配置', group: 'ai' },
+    ];
+    const systemAdminRole: any = {
+      id: 1,
+      name: '系统管理员',
+      code: 'system_admin',
+      description: '',
+      isSystem: true,
+      status: 1,
+      permissions: [permissions[0]],
+      users: [],
+    };
+    const permRepo = {
+      findOne: jest.fn(async ({ where }: any) =>
+        permissions.find((permission) => permission.code === where.code) ?? null,
+      ),
+      create: jest.fn((value: any) => ({ id: permissions.length + 1, ...value })),
+      save: jest.fn(async (value: any) => {
+        if (!permissions.some((permission) => permission.code === value.code)) permissions.push(value);
+        return value;
+      }),
+      find: jest.fn(async () => permissions),
+      remove: jest.fn(async (value: any) => value),
+    };
+    const roleRepo = {
+      findOne: jest.fn(async ({ where }: any) =>
+        where.code === 'system_admin' || where.name === '系统管理员' ? systemAdminRole : null,
+      ),
+      create: jest.fn((value: any) => ({ ...value, permissions: [] })),
+      save: jest.fn(async (value: any) => value),
+      find: jest.fn(async () => [systemAdminRole]),
+    };
+    const userRepo = { count: jest.fn(async () => 1), create: jest.fn(), save: jest.fn() };
+
+    const service = new RbacService(
+      permRepo as never,
+      roleRepo as never,
+      userRepo as never,
+      {} as never,
+      {} as never,
+      {} as never,
+      {} as never,
+      {} as never,
+    );
+
+    await service.seedData();
+
+    expect(permissions.some((permission) => permission.code === 'ai:chat:use')).toBe(true);
+    expect(systemAdminRole.permissions.map((permission: any) => permission.code)).not.toContain(
+      'ai:chat:use',
+    );
+  });
+
   it('migrates the legacy teacher role and replaces broad permissions with the teaching matrix', async () => {
     const permissions = [
       { id: 1, code: 'profile:view', name: '查看个人资料', group: 'profile' },

apps/server/src/rbac/rbac.service.ts

@@ -96,6 +96,7 @@ const PRESET_PERMISSIONS: Array<{ code: string; name: string; group: string }> =
   { code: 'ai:config:read', name: '查看 AI 配置', group: 'ai' },
   { code: 'ai:config:write', name: '修改 AI 配置', group: 'ai' },
   { code: 'ai:config:test', name: '测试 AI 连接', group: 'ai' },
+  { code: 'ai:chat:use', name: '使用 AI 助手', group: 'ai-chat' },
 ];
 
 const DEPRECATED_PERMISSION_CODES = [