fix permissions and teacher attendance workflows

apps/server/src/auth/auth.service.spec.ts

@@ -0,0 +1,29 @@
+import * as bcrypt from 'bcryptjs';
+import { AuthService } from './auth.service';
+
+describe('AuthService — super admin identity', () => {
+  it('marks the preset 超管 role as super admin in the JWT payload', async () => {
+    const userRepo = {
+      findOne: jest.fn().mockResolvedValue({
+        id: 1,
+        username: 'admin',
+        name: '管理员',
+        passwordHash: await bcrypt.hash('secret', 4),
+        isActive: true,
+        roles: [{ name: '超管', status: 1 }],
+      }),
+      save: jest.fn(),
+    };
+    const jwtService = { sign: jest.fn().mockReturnValue('token') };
+    const rbacService = {
+      getUserPermissions: jest.fn().mockResolvedValue(['attendance:create']),
+    };
+    const service = new AuthService(userRepo as never, jwtService as never, rbacService as never);
+
+    await service.login({ username: 'admin', password: 'secret' }, '127.0.0.1');
+
+    expect(jwtService.sign).toHaveBeenCalledWith(
+      expect.objectContaining({ isSuperAdmin: true }),
+    );
+  });
+});