fix: harden permission-gated UI — minimum-org endpoint, modal/Popconfirm fail-closed on revocation

fix: close permission review gaps
2026-07-23 14:27:58 +08:00 · 2026-07-23 14:15:52 +08:00 · 2026-07-23 12:34:37 +08:00
17 changed files with 399 additions and 237 deletions
--- a/apps/admin/src/auth/permission-state.integration.test.tsx
+++ b/apps/admin/src/auth/permission-state.integration.test.tsx
@@ -54,14 +54,12 @@ describe('permission state', () => {
    expect(container?.textContent).toContain('编辑学生');
  });

-  it('fails closed after profile refresh failure', async () => {
+  it('stays fail-closed while profile verification is retried after a failure', async () => {
    writePermissions(['student:edit']);
    beginPermissionVerification();
-    clearPermissions('ready');

-    expect(readPermissionState()).toEqual({ permissions: [], status: 'ready' });
+    expect(readPermissionState()).toEqual({ permissions: [], status: 'loading' });
    await renderPermissionButton();
    expect(container?.textContent).not.toContain('编辑学生');
-    expect(localStorage.getItem('permissions')).toBeNull();
  });
 });
--- a/apps/admin/src/components/JinshujuMatchModal.tsx
+++ b/apps/admin/src/components/JinshujuMatchModal.tsx
@@ -312,8 +312,9 @@ interface MatchModalProps {
 }

 const JinshujuMatchModal: React.FC<MatchModalProps> = ({ open, onClose, onApplied }) => {
-  const { hasPermission } = usePermission();
+  const { hasPermission, hasAllPermissions, permissionsReady } = usePermission();
  const canTriggerSync = hasPermission('sync:trigger');
+  const canEnterModal = permissionsReady && hasAllPermissions('sync:read', 'sync:trigger');
  const [step, setStep] = useState<'connection' | 'rule' | 'match' | 'applying'>('connection');
  const [loading, setLoading] = useState(false);
  const [selectedRuleId, setSelectedRuleId] = useState<number | undefined>();
@@ -334,8 +335,22 @@ const JinshujuMatchModal: React.FC<MatchModalProps> = ({ open, onClose, onApplie

  // Load rules on open
  useEffect(() => {
-    if (open) loadRules();
-  }, [open]);
+    if (open && canEnterModal) loadRules();
+  }, [open, canEnterModal]);
+
+  // Close and reset when permission is lost
+  const enteredRef = useRef(false);
+  useEffect(() => {
+    if (canEnterModal) {
+      enteredRef.current = true;
+      return;
+    }
+    if (enteredRef.current) {
+      enteredRef.current = false;
+      reset();
+      onClose();
+    }
+  }, [canEnterModal, onClose]);

  const loadRules = async () => {
    try {
@@ -347,6 +362,7 @@ const JinshujuMatchModal: React.FC<MatchModalProps> = ({ open, onClose, onApplie
  };

  const handleConnectionNext = async () => {
+    if (!canTriggerSync) return;
    try {
      const values = await credForm.validateFields();
      setLoading(true);
@@ -366,6 +382,7 @@ const JinshujuMatchModal: React.FC<MatchModalProps> = ({ open, onClose, onApplie
  };

  const handlePreview = async () => {
+    if (!canTriggerSync) return;
    try {
      const values = await credForm.validateFields();
      setLoading(true);
@@ -689,7 +706,7 @@ const JinshujuMatchModal: React.FC<MatchModalProps> = ({ open, onClose, onApplie
  return (
    <Modal
      title="同步金数据"
-      open={open}
+      open={open && canEnterModal}
      onCancel={handleClose}
      width={step === 'match' || step === 'applying' ? 900 : 640}
      maskClosable={false}
--- a/apps/admin/src/components/StudentProfileContent/index.tsx
+++ b/apps/admin/src/components/StudentProfileContent/index.tsx
@@ -1401,9 +1401,12 @@ const StudentProfileContent: React.FC<StudentProfileContentProps> = ({
  onClose,
 }) => {
  const { hasPermission, hasAnyPermission } = usePermission();
-  const canViewOrganizations = hasPermission('organization:view');
-  const canChooseOrganization =
-    canViewOrganizations && hasAnyPermission('student:create', 'student:edit');
+  const canLoadOrganizations = hasAnyPermission(
+    'organization:view',
+    'student:create',
+    'student:edit',
+  );
+  const canChooseOrganization = hasAnyPermission('student:create', 'student:edit');
  const [aggregateData, setAggregateData] = useState<StudentProfileAggregate | null>(null);
  const [organizations, setOrganizations] = useState<Array<{ id: number; name: string }>>([]);
  const [loading, setLoading] = useState(false);
@@ -1426,17 +1429,17 @@ const StudentProfileContent: React.FC<StudentProfileContentProps> = ({
  }, [fetchData]);

  useEffect(() => {
-    if (!canViewOrganizations) {
+    if (!canLoadOrganizations) {
      setOrganizations([]);
      return;
    }
    api
-      .get('/organizations', { params: { includeArchived: 'false' } })
+      .get('/organizations/options')
      .then((res: unknown) => {
-        setOrganizations(res as Array<{ id: number; name: string }>);
+        setOrganizations(res as Array<{ id: number; name: string; isHost?: boolean }>);
      })
      .catch(() => {});
-  }, [canViewOrganizations]);
+  }, [canLoadOrganizations]);

  const handlePreviewReport = useCallback(async () => {
    try {
@@ -1451,7 +1454,11 @@ const StudentProfileContent: React.FC<StudentProfileContentProps> = ({
    }
  }, [studentId]);

-  const handleViewSensitive = useViewSensitive(studentId, '学生档案');
+  const handleViewSensitive = useViewSensitive(
+    studentId,
+    '学生档案',
+    hasPermission('log:create'),
+  );

  const tabItems = useMemo(() => {
    if (!aggregateData) return [];
--- a/apps/admin/src/hooks/useViewSensitive.ts
+++ b/apps/admin/src/hooks/useViewSensitive.ts
@@ -1,4 +1,4 @@
-import { useCallback } from 'react';
+import { useCallback, useEffect, useRef } from 'react';
 import { Modal } from 'antd';
 import api from '../api';
 import { message } from '../ui/app-message';
@@ -9,16 +9,35 @@ import { message } from '../ui/app-message';
 *
 * @param studentId - The student whose data is being viewed
 * @param module - Audit module label (e.g. '学生管理', '学生档案')
+ * @param canLog - Whether the current user has log:create; when false any
+ *   already-open confirm modal is destroyed.
 */
-export function useViewSensitive(studentId: number, module: string) {
+export function useViewSensitive(studentId: number, module: string, canLog: boolean) {
+  const canLogRef = useRef(canLog);
+  const modalRef = useRef<ReturnType<typeof Modal.confirm> | null>(null);
+  canLogRef.current = canLog;
+
+  useEffect(() => {
+    if (!canLogRef.current && modalRef.current) {
+      modalRef.current.destroy();
+      modalRef.current = null;
+    }
+    return () => {
+      modalRef.current?.destroy();
+      modalRef.current = null;
+    };
+  }, []);
+
  return useCallback(
    (field: string, value: string) => {
-      Modal.confirm({
+      if (!canLogRef.current) return;
+      modalRef.current = Modal.confirm({
        title: '查看敏感信息',
        content: `您即将查看 "${field}" 的完整信息。此操作将被记录。`,
        okText: '确认查看',
        cancelText: '取消',
        onOk: async () => {
+          if (!canLogRef.current) return;
          try {
            await api.post('/operation-logs/audit', {
              module,
@@ -37,6 +56,9 @@ export function useViewSensitive(studentId: number, module: string) {
            okText: '关闭',
          });
        },
+        afterClose: () => {
+          modalRef.current = null;
+        },
      });
    },
    [studentId, module],
--- a/apps/admin/src/layouts/MainLayout.tsx
+++ b/apps/admin/src/layouts/MainLayout.tsx
@@ -86,25 +86,57 @@ const MainLayout: React.FC = () => {

  useEffect(() => {
    let cancelled = false;
-    beginPermissionVerification();
-    api
-      .get<{ id: number; username: string; permissions: string[]; roles?: string[] }>(
-        '/auth/profile',
-      )
-      .then((profile) => {
-        if (cancelled) return;
-        writePermissions(profile.permissions || []);
-        const cachedUser = JSON.parse(localStorage.getItem('user') || '{}');
-        const nextUser = { ...cachedUser, ...profile };
-        localStorage.setItem('user', JSON.stringify(nextUser));
-        setUser(nextUser);
-      })
-      .catch(() => {
-        if (!cancelled) clearPermissions('ready');
-        // The API interceptor handles expired/invalid sessions.
-      });
+    let retryTimer: number | undefined;
+    let verificationInFlight = false;
+
+    const verifyPermissions = () => {
+      if (cancelled || verificationInFlight || !localStorage.getItem('token')) return;
+      if (retryTimer !== undefined) {
+        window.clearTimeout(retryTimer);
+        retryTimer = undefined;
+      }
+      verificationInFlight = true;
+      beginPermissionVerification();
+      api
+        .get<{ id: number; username: string; permissions: string[]; roles?: string[] }>(
+          '/auth/profile',
+        )
+        .then((profile) => {
+          if (cancelled) return;
+          verificationInFlight = false;
+          writePermissions(profile.permissions || []);
+          const cachedUser = JSON.parse(localStorage.getItem('user') || '{}');
+          const nextUser = { ...cachedUser, ...profile };
+          localStorage.setItem('user', JSON.stringify(nextUser));
+          setUser(nextUser);
+        })
+        .catch(() => {
+          verificationInFlight = false;
+          if (cancelled || !localStorage.getItem('token')) return;
+          retryTimer = window.setTimeout(verifyPermissions, 5_000);
+        });
+    };
+
+    const handleStorage = (event: StorageEvent) => {
+      if (event.key !== 'token' && event.key !== 'permissions') return;
+      beginPermissionVerification();
+      window.location.reload();
+    };
+    const handleOnline = () => verifyPermissions();
+    const handleVisibilityChange = () => {
+      if (document.visibilityState === 'visible') verifyPermissions();
+    };
+
+    verifyPermissions();
+    window.addEventListener('storage', handleStorage);
+    window.addEventListener('online', handleOnline);
+    document.addEventListener('visibilitychange', handleVisibilityChange);
    return () => {
      cancelled = true;
+      if (retryTimer !== undefined) window.clearTimeout(retryTimer);
+      window.removeEventListener('storage', handleStorage);
+      window.removeEventListener('online', handleOnline);
+      document.removeEventListener('visibilitychange', handleVisibilityChange);
    };
  }, []);

--- a/apps/admin/src/pages/Attendance/index.tsx
+++ b/apps/admin/src/pages/Attendance/index.tsx
@@ -1146,9 +1146,9 @@ const AdminAttendanceArchive: React.FC<{ canEdit: boolean }> = ({ canEdit }) =>
              value={studentSearch}
              onChange={(event) => setStudentSearch(event.target.value)}
            />
-            <Button icon={<ExportOutlined />} onClick={handleExport}>
+            <PermissionButton permission="attendance:export" icon={<ExportOutlined />} onClick={handleExport}>
              导出
-            </Button>
+            </PermissionButton>
          </div>
        </header>
        <div className="student-legend">
--- a/apps/admin/src/pages/Exams/detail.tsx
+++ b/apps/admin/src/pages/Exams/detail.tsx
@@ -27,8 +27,8 @@ interface ExamDetail extends ExamItem {
 }

 const PhoneCell: React.FC<{ row: ScoreRow }> = ({ row }) => {
-  const reveal = useViewSensitive(row.studentId, '考试管理');
  const { hasPermission } = usePermission();
+  const reveal = useViewSensitive(row.studentId, '考试管理', hasPermission('log:create'));
  if (!row.phone) return <>-</>;
  return (
    <Space size={4}>
--- a/apps/admin/src/pages/Occupancies/index.tsx
+++ b/apps/admin/src/pages/Occupancies/index.tsx
@@ -38,8 +38,11 @@ import { usePermission } from '../../hooks/usePermission';
 const { RangePicker } = DatePicker;

 const OccupanciesPage: React.FC = () => {
-  const { hasPermission } = usePermission();
-  const canCheckIn = hasPermission('occupancy:checkin');
+  const { hasPermission, permissionsReady } = usePermission();
+  const canCheckIn = permissionsReady && hasPermission('occupancy:checkin');
+  const canCheckOut = permissionsReady && hasPermission('occupancy:checkout');
+  const canTransfer = permissionsReady && hasPermission('occupancy:transfer');
+  const canDelete = permissionsReady && hasPermission('occupancy:delete');
  const [data, setData] = useState<any[]>([]);
  const [students, setStudents] = useState<any[]>([]);
  const [rooms, setRooms] = useState<any[]>([]);
@@ -69,6 +72,12 @@ const OccupanciesPage: React.FC = () => {
  const selectedCheckInRoomId = Form.useWatch('roomId', checkInForm);
  const selectedTransferRoomId = Form.useWatch('newRoomId', transferForm);

+  // Close modals when the user loses the required permission
+  useEffect(() => { if (!canCheckIn) { setCheckInModal(false); checkInForm.resetFields(); } }, [canCheckIn, checkInForm]);
+  useEffect(() => { if (!canCheckOut && checkOutModal) { setCheckOutModal(null); checkOutForm.resetFields(); } }, [canCheckOut, checkOutModal, checkOutForm]);
+  useEffect(() => { if (!canCheckOut) { setBatchCheckOutModal(false); batchCheckOutForm.resetFields(); } }, [canCheckOut, batchCheckOutForm]);
+  useEffect(() => { if (!canTransfer && transferModal) { setTransferModal(null); transferForm.resetFields(); } }, [canTransfer, transferModal, transferForm]);
+
  const activeOccupancyByStudentId = useMemo(() => {
    const map = new Map<number, any>();
    data.forEach((item) => {
@@ -372,27 +381,28 @@ const OccupanciesPage: React.FC = () => {
          ) : (
            <Space>
              <Tag>已退宿</Tag>
-              <Popconfirm
-                title="确定归档此记录？"
-                onConfirm={async () => {
-                  try {
-                    await api.delete(`/occupancies/${record.id}`);
-                    message.success('归档成功');
-                    fetchData();
-                  } catch (e: any) {
-                    message.error(e?.message || '归档失败');
-                  }
-                }}
-              >
-                <PermissionButton
-                  permission="occupancy:delete"
-                  size="small"
-                  danger
-                  icon={<InboxOutlined />}
+              {canDelete ? (
+                <Popconfirm
+                  title="确定归档此记录？"
+                  onConfirm={async () => {
+                    try {
+                      await api.delete(`/occupancies/${record.id}`);
+                      message.success('归档成功');
+                      fetchData();
+                    } catch (e: any) {
+                      message.error(e?.message || '归档失败');
+                    }
+                  }}
                >
-                  归档
-                </PermissionButton>
-              </Popconfirm>
+                  <Button
+                    size="small"
+                    danger
+                    icon={<InboxOutlined />}
+                  >
+                    归档
+                  </Button>
+                </Popconfirm>
+              ) : null}
            </Space>
          ),
      },
@@ -585,23 +595,24 @@ const OccupanciesPage: React.FC = () => {
                  批量退宿
                </PermissionButton>
              ) : (
-                <Popconfirm
-                  title={`确定归档选中的 ${selectedRowKeys.length} 条入住记录？在住记录会自动跳过`}
-                  onConfirm={handleBatchDelete}
-                  okText="归档"
-                  cancelText="取消"
-                >
-                  <PermissionButton
-                    permission="occupancy:delete"
-                    danger
-                    size="small"
-                    icon={<InboxOutlined />}
-                    style={{ marginLeft: 12 }}
-                    loading={batchLoading}
+                canDelete ? (
+                  <Popconfirm
+                    title={`确定归档选中的 ${selectedRowKeys.length} 条入住记录？在住记录会自动跳过`}
+                    onConfirm={handleBatchDelete}
+                    okText="归档"
+                    cancelText="取消"
                  >
-                    批量归档
-                  </PermissionButton>
-                </Popconfirm>
+                    <Button
+                      danger
+                      size="small"
+                      icon={<InboxOutlined />}
+                      style={{ marginLeft: 12 }}
+                      loading={batchLoading}
+                    >
+                      批量归档
+                    </Button>
+                  </Popconfirm>
+                ) : null
              )}
              <Button size="small" onClick={() => setSelectedRowKeys([])} style={{ marginLeft: 8 }}>
                取消选择
@@ -629,8 +640,8 @@ const OccupanciesPage: React.FC = () => {
      />
      <Modal
        title="入住登记"
-        open={checkInModal}
-        onOk={handleCheckIn}
+        open={checkInModal && canCheckIn}
+        onOk={canCheckIn ? handleCheckIn : undefined}
        onCancel={() => {
          setCheckInModal(false);
          setAvailableBeds([]);
@@ -804,8 +815,8 @@ const OccupanciesPage: React.FC = () => {
      {/* 退宿弹窗 */}
      <Modal
        title={`退宿 - ${checkOutModal?.student?.name}`}
-        open={!!checkOutModal}
-        onOk={handleCheckOut}
+        open={!!checkOutModal && canCheckOut}
+        onOk={canCheckOut ? handleCheckOut : undefined}
        onCancel={() => setCheckOutModal(null)}
        okText="确认退宿"
        confirmLoading={saving}
@@ -861,8 +872,8 @@ const OccupanciesPage: React.FC = () => {
      {/* 批量退宿弹窗 */}
      <Modal
        title={`批量退宿（${selectedRowKeys.length} 人）`}
-        open={batchCheckOutModal}
-        onOk={handleBatchCheckOut}
+        open={batchCheckOutModal && canCheckOut}
+        onOk={canCheckOut ? handleBatchCheckOut : undefined}
        onCancel={() => setBatchCheckOutModal(false)}
        okText="确认批量退宿"
        width={500}
@@ -938,7 +949,7 @@ const OccupanciesPage: React.FC = () => {
      {/* 换房弹窗 */}
      <Modal
        title={`换房 - ${transferModal?.student?.name}`}
-        open={!!transferModal}
+        open={!!transferModal && canTransfer}
        onOk={handleTransfer}
        onCancel={() => {
          setTransferModal(null);
--- a/apps/admin/src/pages/Rooms/index.tsx
+++ b/apps/admin/src/pages/Rooms/index.tsx
@@ -85,12 +85,15 @@ function parseRoomNumber(input: string) {
 }

 const RoomsPage: React.FC = () => {
-  const { hasPermission } = usePermission();
-  const canEditRooms = hasPermission('room:edit');
+  const { hasPermission, permissionsReady } = usePermission();
+  const canEditRooms = permissionsReady && hasPermission('room:edit');
+  const canCreateRooms = permissionsReady && hasPermission('room:create');
+  const canDeleteRooms = permissionsReady && hasPermission('room:delete');
  const [data, setData] = useState<any[]>([]);
  const [loading, setLoading] = useState(false);
  const [modalOpen, setModalOpen] = useState(false);
  const [editing, setEditing] = useState<any>(null);
+  const canSaveRoom = editing ? canEditRooms : canCreateRooms;
  const [showArchived, setShowArchived] = useState(false);
  const [archivedCount, setArchivedCount] = useState(0);
  const [searchText, setSearchText] = useState('');
@@ -114,6 +117,9 @@ const RoomsPage: React.FC = () => {
  const [savingLocker, setSavingLocker] = useState(false);
  const [batchLoading, setBatchLoading] = useState(false);

+  // Close modals when the required permission is lost
+  useEffect(() => { if (!canSaveRoom && modalOpen) { setModalOpen(false); setEditing(null); form.resetFields(); } }, [canSaveRoom, modalOpen, form]);
+
  const handleBatchDelete = async () => {
    setBatchLoading(true);
    try {
@@ -522,16 +528,17 @@ const RoomsPage: React.FC = () => {
          return (
            <Space>
              {r.status === 'archived' ? (
-                <Popconfirm title="确定恢复此宿舍？" onConfirm={() => handleRestore(r.id)}>
-                  <PermissionButton
-                    permission="room:edit"
-                    size="small"
-                    icon={<UndoOutlined />}
-                    type="link"
-                  >
-                    恢复
-                  </PermissionButton>
-                </Popconfirm>
+                canEditRooms ? (
+                  <Popconfirm title="确定恢复此宿舍？" onConfirm={() => handleRestore(r.id)}>
+                    <Button
+                      size="small"
+                      icon={<UndoOutlined />}
+                      type="link"
+                    >
+                      恢复
+                    </Button>
+                  </Popconfirm>
+                ) : null
              ) : (
                <>
                  <PermissionButton
@@ -559,15 +566,16 @@ const RoomsPage: React.FC = () => {
                  >
                    编辑
                  </PermissionButton>
-                  <Popconfirm title="确定归档？" onConfirm={() => handleArchive(r.id)}>
-                    <PermissionButton
-                      permission="room:delete"
-                      size="small"
-                      icon={<InboxOutlined />}
-                    >
-                      归档
-                    </PermissionButton>
-                  </Popconfirm>
+                  {canDeleteRooms ? (
+                    <Popconfirm title="确定归档？" onConfirm={() => handleArchive(r.id)}>
+                      <Button
+                        size="small"
+                        icon={<InboxOutlined />}
+                      >
+                        归档
+                      </Button>
+                    </Popconfirm>
+                  ) : null}
                </>
              )}
            </Space>
@@ -638,23 +646,24 @@ const RoomsPage: React.FC = () => {
          </Button>
        </Space>
        <Space wrap className="responsive-toolbar__group">
-          <Popconfirm
-            title={`确定批量归档选中的 ${selectedRowKeys.length} 间宿舍？（有在住人员的会跳过）`}
-            onConfirm={handleBatchDelete}
-            okText="归档"
-            cancelText="取消"
-            disabled={selectedRowKeys.length === 0}
-          >
-            <PermissionButton
-              permission="room:delete"
-              danger
-              icon={<InboxOutlined />}
+          {canDeleteRooms ? (
+            <Popconfirm
+              title={`确定批量归档选中的 ${selectedRowKeys.length} 间宿舍？（有在住人员的会跳过）`}
+              onConfirm={handleBatchDelete}
+              okText="归档"
+              cancelText="取消"
              disabled={selectedRowKeys.length === 0}
-              loading={batchLoading}
            >
-              批量归档
-            </PermissionButton>
-          </Popconfirm>
+              <Button
+                danger
+                icon={<InboxOutlined />}
+                disabled={selectedRowKeys.length === 0}
+                loading={batchLoading}
+              >
+                批量归档
+              </Button>
+            </Popconfirm>
+          ) : null}
          <PermissionButton
            permission="room:create"
            type="primary"
@@ -732,8 +741,8 @@ const RoomsPage: React.FC = () => {

      <Modal
        title={editing ? '编辑宿舍' : '添加宿舍'}
-        open={modalOpen}
-        onOk={handleSave}
+        open={modalOpen && canSaveRoom}
+        onOk={canSaveRoom ? handleSave : undefined}
        onCancel={() => {
          setModalOpen(false);
          setEditing(null);
@@ -994,20 +1003,19 @@ const RoomsPage: React.FC = () => {
                            >
                              编辑
                            </PermissionButton>
-                            {r.status !== 'occupied' && (
+                            {r.status !== 'occupied' && canEditRooms && (
                              <Popconfirm
                                title="确定归档？"
                                onConfirm={() => handleDeleteBed(r.id)}
                              >
-                                <PermissionButton
-                                  permission="room:edit"
+                                <Button
                                  size="small"
                                  type="link"
                                  danger
                                  disabled={drawerRoom?.status === 'archived'}
                                >
                                  归档
-                                </PermissionButton>
+                                </Button>
                              </Popconfirm>
                            )}
                          </Space>
@@ -1147,20 +1155,19 @@ const RoomsPage: React.FC = () => {
                            >
                              编辑
                            </PermissionButton>
-                            {r.status !== 'occupied' && (
+                            {r.status !== 'occupied' && canEditRooms && (
                              <Popconfirm
                                title="确定归档？"
                                onConfirm={() => handleDeleteLocker(r.id)}
                              >
-                                <PermissionButton
-                                  permission="room:edit"
+                                <Button
                                  size="small"
                                  type="link"
                                  danger
                                  disabled={drawerRoom?.status === 'archived'}
                                >
                                  归档
-                                </PermissionButton>
+                                </Button>
                              </Popconfirm>
                            )}
                          </Space>
--- a/apps/admin/src/pages/Students/index.tsx
+++ b/apps/admin/src/pages/Students/index.tsx
@@ -85,15 +85,24 @@ interface StudentFilterLookups {

 const StudentsPage: React.FC = () => {
  const { modal } = App.useApp();
-  const { hasPermission, hasAnyPermission } = usePermission();
+  const { hasPermission, hasAnyPermission, hasAllPermissions } = usePermission();
  const canViewOrganizations = hasPermission('organization:view');
-  const canChooseOrganization =
-    canViewOrganizations && hasAnyPermission('student:create', 'student:edit');
+  const canLoadOrganizations = hasAnyPermission(
+    'organization:view',
+    'student:create',
+    'student:edit',
+  );
+  const canChooseOrganization = hasAnyPermission('student:create', 'student:edit');
+  const canCreateStudent = hasPermission('student:create');
+  const canEditStudent = hasPermission('student:edit');
+  const canDeleteStudent = hasPermission('student:delete');
+  const canSyncJinshuju = hasAllPermissions('sync:read', 'sync:trigger');
  const [data, setData] = useState<any[]>([]);
  const [loading, setLoading] = useState(false);
  const [modalOpen, setModalOpen] = useState(false);
  const [organizations, setOrganizations] = useState<any[]>([]);
  const [editing, setEditing] = useState<any>(null);
+  const canSaveStudent = editing ? canEditStudent : canCreateStudent;
  const [searchName, setSearchName] = useState('');
  const [filterStatus, setFilterStatus] = useState<string | undefined>(undefined);
  const [filterOrganizationId, setFilterOrganizationId] = useState<number | undefined>(undefined);
@@ -118,13 +127,40 @@ const StudentsPage: React.FC = () => {

  const [jinshujuOpen, setJinshujuOpen] = useState(false);

+  // Sensitive info modal — command-style; destroy when log:create is lost or comp unmounts.
+  // Close the student form modal when the user loses the required permission.
+  useEffect(() => {
+    if (!canSaveStudent && modalOpen) {
+      setModalOpen(false);
+      setEditing(null);
+      form.resetFields();
+    }
+  }, [canSaveStudent, modalOpen, form]);
+
+  // Close sensitive modal when log:create is lost (imperative ref already set above).
+  const logCreateRef = React.useRef(hasPermission('log:create'));
+  const sensitiveModalRef = React.useRef<ReturnType<typeof modal.confirm> | null>(null);
+  logCreateRef.current = hasPermission('log:create');
+  useEffect(() => {
+    if (!logCreateRef.current && sensitiveModalRef.current) {
+      sensitiveModalRef.current.destroy();
+      sensitiveModalRef.current = null;
+    }
+    return () => {
+      sensitiveModalRef.current?.destroy();
+      sensitiveModalRef.current = null;
+    };
+  }, []);
+
  const handleViewSensitive = (studentId: number, field: string, value: string) => {
-    modal.confirm({
+    if (!logCreateRef.current) return;
+    sensitiveModalRef.current = modal.confirm({
      title: '查看敏感信息',
      content: `您即将查看 "${field}" 的完整信息。此操作将被记录。`,
      okText: '确认查看',
      cancelText: '取消',
      onOk: async () => {
+        if (!logCreateRef.current) return;
        try {
          await api.post('/operation-logs/audit', {
            module: '学生管理',
@@ -142,6 +178,9 @@ const StudentsPage: React.FC = () => {
          message.error('审计日志记录失败，请稍后重试');
        }
      },
+      afterClose: () => {
+        sensitiveModalRef.current = null;
+      },
    });
  };

@@ -194,16 +233,25 @@ const StudentsPage: React.FC = () => {
  }, [fetchData]);

  useEffect(() => {
+    if (!canLoadOrganizations) {
+      setOrganizations([]);
+      setFilterOrganizationId(undefined);
+      return;
+    }
    if (canViewOrganizations) {
      api
        .get('/organizations', { params: { includeArchived: 'false' } })
        .then((res: unknown) => {
-          setOrganizations(res as Array<{ id: number; name: string }>);
+          setOrganizations(res as Array<{ id: number; name: string; isHost?: boolean }>);
        })
        .catch(() => {});
    } else {
-      setOrganizations([]);
-      setFilterOrganizationId(undefined);
+      api
+        .get('/organizations/options')
+        .then((res: unknown) => {
+          setOrganizations(res as Array<{ id: number; name: string; isHost?: boolean }>);
+        })
+        .catch(() => {});
    }
    api
      .get<StudentFilterLookups>('/students/filter-lookups')
@@ -212,7 +260,7 @@ const StudentsPage: React.FC = () => {
        setTeacherOptions(res.teachers || []);
      })
      .catch(() => {});
-  }, [canViewOrganizations]);
+  }, [canLoadOrganizations]);
  const handleSave = async () => {
    const values = await form.validateFields();
    setSaving(true);
@@ -614,21 +662,18 @@ const StudentsPage: React.FC = () => {
        render: (_: any, record: any) => (
          <Space>
            {record.status === 'archived' ? (
-              <Popconfirm
-                title="确定恢复此学生？恢复后将重新出现在学生列表中。"
-                onConfirm={() => handleRestore(record.id)}
-                okText="恢复"
-                cancelText="取消"
-              >
-                <PermissionButton
-                  permission="student:edit"
-                  size="small"
-                  icon={<UndoOutlined />}
-                  type="link"
+              canEditStudent ? (
+                <Popconfirm
+                  title="确定恢复此学生？恢复后将重新出现在学生列表中。"
+                  onConfirm={() => handleRestore(record.id)}
+                  okText="恢复"
+                  cancelText="取消"
                >
-                  恢复
-                </PermissionButton>
-              </Popconfirm>
+                  <Button size="small" icon={<UndoOutlined />} type="link">
+                    恢复
+                  </Button>
+                </Popconfirm>
+              ) : null
            ) : (
              <>
                <PermissionButton
@@ -650,20 +695,21 @@ const StudentsPage: React.FC = () => {
                >
                  编辑
                </PermissionButton>
-                <Popconfirm
-                  title="归档后不会删除数据，可随时恢复。确定归档？"
-                  onConfirm={() => handleArchive(record.id)}
-                  okText="归档"
-                  cancelText="取消"
-                >
-                  <PermissionButton
-                    permission="student:delete"
-                    size="small"
+                {canDeleteStudent ? (
+                  <Popconfirm
+                    title="归档后不会删除数据，可随时恢复。确定归档？"
+                    onConfirm={() => handleArchive(record.id)}
+                    okText="归档"
+                    cancelText="取消"
+                  >
+                    <Button
+                      size="small"
                    icon={<InboxOutlined />}
                  >
                    归档
-                  </PermissionButton>
+                  </Button>
                </Popconfirm>
+              ) : null}
              </>
            )}
          </Space>
@@ -765,23 +811,24 @@ const StudentsPage: React.FC = () => {
          </Button>
        </Space>
        <Space wrap className="responsive-toolbar__group">
-          <Popconfirm
-            title={`确定批量归档选中的 ${selectedRowKeys.length} 名学生？（数据保留，可恢复）`}
-            onConfirm={handleBatchDelete}
-            okText="归档"
-            cancelText="取消"
-            disabled={selectedRowKeys.length === 0}
-          >
-            <PermissionButton
-              permission="student:delete"
-              danger
-              icon={<InboxOutlined />}
+          {canDeleteStudent ? (
+            <Popconfirm
+              title={`确定批量归档选中的 ${selectedRowKeys.length} 名学生？（数据保留，可恢复）`}
+              onConfirm={handleBatchDelete}
+              okText="归档"
+              cancelText="取消"
              disabled={selectedRowKeys.length === 0}
-              loading={batchLoading}
            >
-              批量归档
-            </PermissionButton>
-          </Popconfirm>
+              <Button
+                danger
+                icon={<InboxOutlined />}
+                disabled={selectedRowKeys.length === 0}
+                loading={batchLoading}
+              >
+                批量归档
+              </Button>
+            </Popconfirm>
+          ) : null}
          <PermissionButton
            permission="student:create"
            type="primary"
@@ -814,13 +861,11 @@ const StudentsPage: React.FC = () => {
              </Upload>
            </>
          ) : null}
-          <PermissionButton
-            permission="sync:read"
-            icon={<CloudUploadOutlined />}
-            onClick={() => setJinshujuOpen(true)}
-          >
-            同步金数据
-          </PermissionButton>
+          {canSyncJinshuju ? (
+            <Button icon={<CloudUploadOutlined />} onClick={() => setJinshujuOpen(true)}>
+              同步金数据
+            </Button>
+          ) : null}
          <PermissionButton
            permission="student:view"
            icon={<DownloadOutlined />}
@@ -929,8 +974,8 @@ const StudentsPage: React.FC = () => {
        title={editing ? '编辑学生' : '添加学生'}
        className="student-form-modal"
        width={720}
-        open={modalOpen}
-        onOk={handleSave}
+        open={modalOpen && canSaveStudent}
+        onOk={canSaveStudent ? handleSave : undefined}
        onCancel={() => {
          setModalOpen(false);
          setEditing(null);
@@ -1007,7 +1052,7 @@ const StudentsPage: React.FC = () => {
        </Form>
      </Modal>

-      {hasPermission('sync:read') ? (
+      {canSyncJinshuju ? (
        <JinshujuMatchModal
          open={jinshujuOpen}
          onClose={() => setJinshujuOpen(false)}
--- a/apps/server/src/organizations/organizations.controller.spec.ts
+++ b/apps/server/src/organizations/organizations.controller.spec.ts
@@ -0,0 +1,23 @@
+import 'reflect-metadata';
+import { PERMISSION_KEY } from '../auth/decorators/permission.decorator';
+import { OrganizationsController } from './organizations.controller';
+
+describe('OrganizationsController permissions', () => {
+  it('allows student editors to use the options endpoint without full entity exposure', () => {
+    expect(
+      Reflect.getMetadata(PERMISSION_KEY, OrganizationsController.prototype.findOptions),
+    ).toEqual(['organization:view', 'student:create', 'student:edit']);
+  });
+
+  it('keeps the full entity list restricted to organization viewers only', () => {
+    expect(Reflect.getMetadata(PERMISSION_KEY, OrganizationsController.prototype.findAll)).toEqual([
+      'organization:view',
+    ]);
+  });
+
+  it('keeps organization detail restricted to organization viewers', () => {
+    expect(Reflect.getMetadata(PERMISSION_KEY, OrganizationsController.prototype.findOne)).toEqual([
+      'organization:view',
+    ]);
+  });
+});
--- a/apps/server/src/organizations/organizations.controller.ts
+++ b/apps/server/src/organizations/organizations.controller.ts
@@ -25,6 +25,12 @@ export class OrganizationsController {
    private logService: OperationLogsService,
  ) {}

+  @Get('options')
+  @RequirePermission('organization:view', 'student:create', 'student:edit')
+  findOptions() {
+    return this.service.findOptions();
+  }
+
  @Get()
  @RequirePermission('organization:view')
  findAll(
--- a/apps/server/src/organizations/organizations.service.spec.ts
+++ b/apps/server/src/organizations/organizations.service.spec.ts
@@ -27,4 +27,21 @@ describe('OrganizationsService — host organization rules', () => {
    await expect(service.remove(1)).rejects.toBeInstanceOf(BadRequestException);
    expect(repo.update).not.toHaveBeenCalled();
  });
+
+  it('findOptions returns only id, name, isHost for active organizations', async () => {
+    const orgs = [
+      { id: 1, name: '本机构', isHost: true },
+      { id: 2, name: '分校', isHost: false },
+    ];
+    repo.find.mockResolvedValue(orgs as Organization[]);
+
+    const result = await service.findOptions();
+
+    expect(repo.find).toHaveBeenCalledWith({
+      select: ['id', 'name', 'isHost'],
+      where: { status: 'active' },
+      order: { isHost: 'DESC', name: 'ASC' },
+    });
+    expect(result).toEqual(orgs);
+  });
 });
--- a/apps/server/src/organizations/organizations.service.ts
+++ b/apps/server/src/organizations/organizations.service.ts
@@ -30,6 +30,14 @@ export class OrganizationsService {
    return this.repo.find({ where, order: { isHost: 'DESC', name: 'ASC' } });
  }

+  async findOptions() {
+    return this.repo.find({
+      select: ['id', 'name', 'isHost'] as const,
+      where: { status: 'active' },
+      order: { isHost: 'DESC' as const, name: 'ASC' as const },
+    });
+  }
+
  async findOne(id: number) {
    const organization = await this.repo.findOne({ where: { id } });
    if (!organization) throw new NotFoundException('机构不存在');
--- a/apps/server/src/students/dto/student.dto.ts
+++ b/apps/server/src/students/dto/student.dto.ts
@@ -33,9 +33,8 @@ export class CreateStudentDto {
  @IsString()
  emergencyPhone?: string;

-  @IsOptional()
  @IsInt()
-  organizationId?: number;
+  organizationId: number;

  @IsOptional()
  @IsString()
--- a/apps/server/src/students/students.lifecycle.spec.ts
+++ b/apps/server/src/students/students.lifecycle.spec.ts
@@ -43,21 +43,6 @@ describe('StudentsService — archive lifecycle boundaries', () => {
    expect(repo.save).not.toHaveBeenCalled();
  });

-  it('defaults a new student to the active host organization when none is supplied', async () => {
-    const repo = {
-      create: jest.fn((value) => value),
-      save: jest.fn(async (value) => ({ ...value, id: 1 })),
-    };
-    const organizationRepo = {
-      findOne: jest.fn().mockResolvedValue({ id: 7, isHost: true, status: 'active' }),
-    };
-
-    await expect(createService(repo, organizationRepo).create({ name: '张三' })).resolves.toEqual(
-      expect.objectContaining({ organizationId: 7 }),
-    );
-    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ organizationId: 7 }));
-  });
-
  it('returns not found for a missing student', async () => {
    const repo = { findOne: jest.fn().mockResolvedValue(null) };
    await expect(createService(repo).findOne(404)).rejects.toBeInstanceOf(NotFoundException);
@@ -65,13 +50,11 @@ describe('StudentsService — archive lifecycle boundaries', () => {

  it('builds export archive maps from profile and result rows', async () => {
    const profileRepo = {
-      find: jest.fn().mockResolvedValue([
-        {
-          studentId: 1,
-          targetCollege: '北京大学',
-          collegeSchool: '北京职业技术学院',
-        },
-      ]),
+      find: jest.fn().mockResolvedValue([{
+        studentId: 1,
+        targetCollege: '北京大学',
+        collegeSchool: '北京职业技术学院',
+      }]),
    };
    const resultRepo = {
      find: jest.fn().mockResolvedValue([{ studentId: 1, admissionStatus: 'pending' }]),
--- a/apps/server/src/students/students.service.ts
+++ b/apps/server/src/students/students.service.ts
@@ -164,9 +164,8 @@ export class StudentsService {
  }

  async create(dto: CreateStudentDto) {
-    const organizationId = dto.organizationId || (await this.getHostOrganizationId());
-    await this.assertActiveOrganization(organizationId);
-    return this.repo.save(this.repo.create({ ...dto, organizationId }));
+    await this.assertActiveOrganization(dto.organizationId);
+    return this.repo.save(this.repo.create(dto));
  }

  async update(id: number, dto: UpdateStudentDto) {
@@ -315,9 +314,7 @@ export class StudentsService {
    };
  }

-  private normalizeImportData(
-    importData: StudentWorkbookImport | StudentImportRow[],
-  ): StudentWorkbookImport {
+  private normalizeImportData(importData: StudentWorkbookImport | StudentImportRow[]): StudentWorkbookImport {
    if (Array.isArray(importData)) {
      return { students: importData, enrollments: [], examScores: [], learningRecords: [] };
    }
@@ -373,24 +370,18 @@ export class StudentsService {
    if (!phone) return imported;

    const enrollmentByClassName = new Map<string, StudentEnrollment>();
-    for (const enrollmentRow of data.enrollments.filter(
-      (item) => this.normalizePhone(item.phone) === phone,
-    )) {
+    for (const enrollmentRow of data.enrollments.filter((item) => this.normalizePhone(item.phone) === phone)) {
      const enrollment = await this.upsertEnrollmentFromImport(studentId, enrollmentRow);
      if (!enrollment) continue;
      if (enrollment.className) enrollmentByClassName.set(enrollment.className, enrollment);
      imported++;
    }
-    for (const examRow of data.examScores.filter(
-      (item) => this.normalizePhone(item.phone) === phone,
-    )) {
+    for (const examRow of data.examScores.filter((item) => this.normalizePhone(item.phone) === phone)) {
      if (await this.upsertExamScoreFromImport(studentId, examRow, enrollmentByClassName)) {
        imported++;
      }
    }
-    for (const learningRow of data.learningRecords.filter(
-      (item) => this.normalizePhone(item.phone) === phone,
-    )) {
+    for (const learningRow of data.learningRecords.filter((item) => this.normalizePhone(item.phone) === phone)) {
      if (await this.upsertLearningRecordFromImport(studentId, learningRow)) {
        imported++;
      }
@@ -399,9 +390,7 @@ export class StudentsService {
  }

  private async upsertProfileFromImport(studentId: number, row: StudentImportRow) {
-    const entity =
-      (await this.profileRepo.findOne({ where: { studentId } })) ||
-      this.profileRepo.create({ studentId });
+    const entity = (await this.profileRepo.findOne({ where: { studentId } })) || this.profileRepo.create({ studentId });
    if (row.targetCollege?.trim()) entity.targetCollege = row.targetCollege.trim();
    if (row.targetMajor?.trim()) entity.targetMajor = row.targetMajor.trim();
    if (row.collegeSchool?.trim()) entity.collegeSchool = row.collegeSchool.trim();
@@ -414,12 +403,9 @@ export class StudentsService {
  }

  private async upsertResultFromImport(studentId: number, row: StudentImportRow) {
-    const entity =
-      (await this.resultRepo.findOne({ where: { studentId } })) ||
-      this.resultRepo.create({ studentId });
+    const entity = (await this.resultRepo.findOne({ where: { studentId } })) || this.resultRepo.create({ studentId });
    if (row.cultureFinalScore !== undefined) entity.cultureFinalScore = row.cultureFinalScore;
-    if (row.professionalFinalScore !== undefined)
-      entity.professionalFinalScore = row.professionalFinalScore;
+    if (row.professionalFinalScore !== undefined) entity.professionalFinalScore = row.professionalFinalScore;
    if (row.admissionStatus?.trim()) entity.admissionStatus = row.admissionStatus.trim();
    if (row.admittedCollege?.trim()) entity.admittedCollege = row.admittedCollege.trim();
    if (row.admittedMajor?.trim()) entity.admittedMajor = row.admittedMajor.trim();
@@ -637,9 +623,10 @@ export class StudentsService {

    // ---- Filters ----
    if (query?.keyword) {
-      qb.andWhere('(student.name LIKE :keyword OR student.studentNo LIKE :keyword)', {
-        keyword: `%${query.keyword}%`,
-      });
+      qb.andWhere(
+        '(student.name LIKE :keyword OR student.studentNo LIKE :keyword)',
+        { keyword: `%${query.keyword}%` },
+      );
    }
    if (query?.organizationId) {
      qb.andWhere('student.organizationId = :orgId', { orgId: query.organizationId });
Author	SHA1	Message	Date
wangziqi	7bd9a284be	fix: harden permission-gated UI — minimum-org endpoint, modal/Popconfirm fail-closed on revocation	2026-07-23 14:27:58 +08:00
wangziqi	3ac99b808e	fix: harden permission-gated UI — minimum-org endpoint, modal/Popconfirm fail-closed on revocation	2026-07-23 14:15:52 +08:00
wangziqi	f39136d9ce	fix: close permission review gaps	2026-07-23 12:34:37 +08:00