优化

src/modules/notifications/notifications.test.mjs

@@ -22,6 +22,8 @@ test('does not accept browser-selected customer or user scope in the API boundar
   assert.match(source, /category: query\.type/)
   assert.match(source, /method: 'PUT'/)
   assert.doesNotMatch(source, /method: 'POST'/)
+  assert.match(source, /summary: item\.summary \?\? ''/)
+  assert.doesNotMatch(source, /item\.body\.slice/)
 })
 
 test('keeps customer message actions first and covers the requested local states', async () => {
@@ -35,4 +37,24 @@ test('keeps customer message actions first and covers the requested local states
   assert.match(source, /暂无消息/)
   assert.doesNotMatch(source, /清空已读|删除消息/)
   assert.match(source, /Promise\.all\(\[load\(\), notifications\.refreshUnreadCount\(\)\]\)/)
+  assert.match(source, /auth\.hasPermission\('merchant:notification:read'\)/)
+  assert.match(source, /auth\.hasPermission\('merchant:notification:read-all'\)/)
+  assert.match(source, /v-if="canMarkAllRead"/)
+  assert.match(source, /v-if="canMarkRead && row\.status === 'UNREAD'"/)
+})
+
+test('keeps detail readable without read permission and isolates auto-read failures', async () => {
+  const source = await readFile(new URL('views/NotificationDetailView.vue', moduleRoot), 'utf8')
+  assert.match(source, /auth\.hasPermission\('merchant:notification:read'\)/)
+  assert.match(source, /!canMarkRead\.value\)return/)
+  assert.match(source, /readErrorMessage\.value=/)
+  assert.match(source, /v-if="readErrorMessage"/)
+  assert.match(source, /detail\.value=null;errorMessage\.value=/)
+})
+
+test('maps all three notification authorities into the client session', async () => {
+  const source = await readFile(new URL('../tenant-management/contracts.ts', moduleRoot), 'utf8')
+  for (const permission of ['merchant:notification:view', 'merchant:notification:read', 'merchant:notification:read-all']) {
+    assert.match(source, new RegExp(`'${permission}': \\['${permission}'\\]`))
+  }
 })