fix: align permission navigation and page access

apps/server/src/deposits/deposits.controller.ts

@@ -32,6 +32,12 @@ export class DepositsController {
     @InjectRepository(Student) private studentRepo: Repository<Student>,
   ) {}
 
+  @Get('student-lookups')
+  @RequirePermission('deposit:create')
+  getStudentLookups() {
+    return this.service.getStudentLookups();
+  }
+
   @Get()
   @RequirePermission('deposit:view')
   findAll(@Query('studentId') studentId?: string, @Query('status') status?: string) {

apps/server/src/deposits/deposits.lookups.spec.ts

@@ -0,0 +1,15 @@
+import { DepositsService } from './deposits.service';
+
+describe('DepositsService permission-scoped lookups', () => {
+  it('returns only minimal student fields needed by deposit forms', async () => {
+    const studentRepo = {
+      find: jest.fn().mockResolvedValue([{ id: 2, name: '张三', studentNo: 'S2' }]),
+    };
+    const service = new DepositsService({} as never, {} as never, studentRepo as never);
+
+    await expect(service.getStudentLookups()).resolves.toEqual([
+      { id: 2, name: '张三', studentNo: 'S2' },
+    ]);
+    expect(studentRepo.find).toHaveBeenCalledWith(expect.objectContaining({ select: ['id', 'name', 'studentNo'] }));
+  });
+});

apps/server/src/deposits/deposits.service.ts

@@ -18,6 +18,14 @@ export class DepositsService {
     private studentRepo: Repository<Student>,
   ) {}
 
+  async getStudentLookups() {
+    return this.studentRepo.find({
+      select: ['id', 'name', 'studentNo'],
+      where: { status: 'active' },
+      order: { name: 'ASC' },
+    });
+  }
+
   async findAll(query?: { studentId?: number; status?: string }) {
     const qb = this.repo
       .createQueryBuilder('d')