From a9b89f72e9b82a7e219a85d7ea30254e70090e93 Mon Sep 17 00:00:00 2001
From: xiong <xiongyuxing@gongxue100.com>
Date: Thu, 30 Jul 2026 12:29:58 +0800
Subject: [PATCH] feat: add backfill for new permissions in super admin role
 during catalog seeding

---
 .../BuiltinBackofficeCatalogSeeder.cs         | 19 ++++++++++
 .../BuiltinBackofficeCatalogSeederTests.cs    | 36 +++++++++++++++++++
 2 files changed, 55 insertions(+)

diff --git a/Tiku.Infrastructure/Bootstrap/BuiltinBackofficeCatalogSeeder.cs b/Tiku.Infrastructure/Bootstrap/BuiltinBackofficeCatalogSeeder.cs
index 815f0cb..baf8890 100644
--- a/Tiku.Infrastructure/Bootstrap/BuiltinBackofficeCatalogSeeder.cs
+++ b/Tiku.Infrastructure/Bootstrap/BuiltinBackofficeCatalogSeeder.cs
@@ -209,6 +209,25 @@ public sealed class BuiltinBackofficeCatalogSeeder(TikuDbContext dbContext)
                 IsActive = true
             }));
 
+        var superAdminRoleId = await dbContext.PlatformBackendRoles.AsNoTracking()
+            .Where(role => role.Code == PlatformAdminBootstrapper.SuperAdminRoleCode && role.IsSystem)
+            .Select(role => (Guid?)role.Id)
+            .SingleOrDefaultAsync(cancellationToken);
+        if (superAdminRoleId.HasValue)
+        {
+            var boundPermissionCodes = await dbContext.PlatformBackendRolePermissions.AsNoTracking()
+                .Where(binding => binding.RoleId == superAdminRoleId.Value)
+                .Select(binding => binding.PermissionCode)
+                .ToHashSetAsync(StringComparer.Ordinal, cancellationToken);
+            dbContext.PlatformBackendRolePermissions.AddRange(BackendPermissions.Platform
+                .Where(code => !boundPermissionCodes.Contains(code))
+                .Select(code => new PlatformBackendRolePermission
+                {
+                    RoleId = superAdminRoleId.Value,
+                    PermissionCode = code
+                }));
+        }
+
         await dbContext.SaveChangesAsync(cancellationToken);
     }
 
diff --git a/Tiku.IntegrationTests/Bootstrap/BuiltinBackofficeCatalogSeederTests.cs b/Tiku.IntegrationTests/Bootstrap/BuiltinBackofficeCatalogSeederTests.cs
index 11f74bb..d0d47b5 100644
--- a/Tiku.IntegrationTests/Bootstrap/BuiltinBackofficeCatalogSeederTests.cs
+++ b/Tiku.IntegrationTests/Bootstrap/BuiltinBackofficeCatalogSeederTests.cs
@@ -95,6 +95,42 @@ public sealed class BuiltinBackofficeCatalogSeederTests
             !dbContext.BackendPermissions.Any(permission => permission.Code == menu.PermissionCode)));
     }
 
+    [Fact]
+    public async Task Seed_backfills_new_permissions_for_existing_system_super_admin()
+    {
+        using var database = PostgresTestDatabase.Create();
+        await using var dbContext = CreateDbContext(database.ConnectionString);
+        var seeder = new BuiltinBackofficeCatalogSeeder(dbContext);
+        await seeder.SeedAsync();
+        var role = new PlatformBackendRole
+        {
+            Code = PlatformAdminBootstrapper.SuperAdminRoleCode,
+            Name = "超级管理员",
+            Status = BackendRoleStatus.Active,
+            IsSystem = true
+        };
+        dbContext.PlatformBackendRoles.Add(role);
+        dbContext.PlatformBackendRolePermissions.Add(new PlatformBackendRolePermission
+        {
+            RoleId = role.Id,
+            PermissionCode = BackendPermissions.PlatformDashboardView
+        });
+        await dbContext.SaveChangesAsync();
+        dbContext.ChangeTracker.Clear();
+
+        await seeder.SeedAsync();
+        dbContext.ChangeTracker.Clear();
+        await seeder.SeedAsync();
+
+        var permissionCodes = await dbContext.PlatformBackendRolePermissions.AsNoTracking()
+            .Where(binding => binding.RoleId == role.Id)
+            .Select(binding => binding.PermissionCode)
+            .ToArrayAsync();
+        Assert.Equal(BackendPermissions.Platform.Count, permissionCodes.Length);
+        Assert.Contains(BackendPermissions.PlatformQuestionBankManage, permissionCodes);
+        Assert.Equal(BackendPermissions.Platform.Count, permissionCodes.Distinct(StringComparer.Ordinal).Count());
+    }
+
     private static TikuDbContext CreateDbContext(string connectionString)
     {
         var options = new DbContextOptionsBuilder<TikuDbContext>()