优化

src/core/auth/auth.test.ts

@@ -43,8 +43,6 @@ function token(overrides: Record<string, unknown> = {}) {
     user_id: '1000001',
     username: 'platform_admin',
     app_code: 'PLATFORM',
-    roles: ['PLATFORM_ADMIN'],
-    permissions: ['platform:warehouse:list', 'platform:order:list'],
     exp: Math.floor(Date.now() / 1000) + 1800,
     ...overrides,
   }
@@ -75,7 +73,7 @@ describe('admin auth session', () => {
     mocks.refreshHandler = null
   })
 
-  it('intersects JWT permissions with the current authenticated permission snapshot', async () => {
+  it('loads permissions from the current authorization endpoint when the JWT only contains identity', async () => {
     mocks.post.mockResolvedValue(loginResponse())
     mocks.listCurrentPlatformPermissionCodes.mockResolvedValue(['platform:warehouse:list'])
     const auth = useAuthStore()
@@ -134,7 +132,7 @@ describe('admin auth session', () => {
     localStorage.setItem('cc-admin-refresh-token', 'refresh-old')
     localStorage.setItem('cc-admin-permission-codes', '["platform:warehouse:list"]')
     const refreshedToken = token({
-      permissions: ['platform:warehouse:list', 'platform:firstleg:inbound:list'],
+      token_version: 2,
     })
     mocks.post.mockResolvedValue(loginResponse(refreshedToken, 'refresh-rotated'))
     mocks.listCurrentPlatformPermissionCodes.mockResolvedValue([

src/core/auth/auth.ts

@@ -39,7 +39,6 @@ function sessionFromToken(token: string) {
       account: claims.username || '',
       roles: claims.roles ?? [],
     } satisfies CurrentUser,
-    permissions: claims.permissions ?? [],
   }
 }
 
@@ -58,7 +57,7 @@ export const useAuthStore = defineStore('admin-auth', () => {
       const cachedPermissions = JSON.parse(localStorage.getItem(PERMISSION_CODES_KEY) || '[]') as unknown
       if (!Array.isArray(cachedPermissions)) throw new Error('权限缓存格式无效')
       user.value = session.user
-      permissions.value = session.permissions.filter((code) => cachedPermissions.includes(code))
+      permissions.value = cachedPermissions.filter((code): code is string => typeof code === 'string')
       isServerSession.value = true
     } catch (error) {
       token.value = ''
@@ -98,8 +97,7 @@ export const useAuthStore = defineStore('admin-auth', () => {
       const activePermissionCodes = await listCurrentPlatformPermissionCodes()
       ensureCurrentGeneration(expectedGeneration)
       permissionResources.value = []
-      const activePermissionCodeSet = new Set(activePermissionCodes)
-      applyPermissionCodes(session.permissions.filter((code) => activePermissionCodeSet.has(code)))
+      applyPermissionCodes(activePermissionCodes)
     } catch (error) {
       ensureCurrentGeneration(expectedGeneration)
       throw error
@@ -138,7 +136,9 @@ export const useAuthStore = defineStore('admin-auth', () => {
       token.value = storedToken
       refreshToken.value = storedRefreshToken
       user.value = session.user
-      permissions.value = session.permissions.filter((code) => Array.isArray(cachedPermissions) && cachedPermissions.includes(code))
+      permissions.value = Array.isArray(cachedPermissions)
+        ? cachedPermissions.filter((code): code is string => typeof code === 'string')
+        : []
       permissionResources.value = []
       isServerSession.value = true
     } catch {