「权限 × 状态 × 审计」联合约束机制

frontend/src/guards/actionGuard.ts

@@ -0,0 +1,49 @@
+import { usePermission } from "../utils/permission";
+import { canDoAction, type StateMachine } from "../state-machine";
+
+export interface ActionContext {
+  actorRole?: string | null;
+  requiredPermission?: string | null;
+  stateMachine?: StateMachine;
+  currentState?: string | null;
+  actionKey?: string | null;
+  target?: Record<string, any>;
+}
+
+export interface ActionDecision {
+  allowed: boolean;
+  reason?: string;
+  auditType: string;
+  severity: "normal" | "warning" | "violation";
+}
+
+export const evaluateAction = (context: ActionContext): ActionDecision => {
+  const permission = usePermission();
+  const { requiredPermission, stateMachine, currentState, actionKey } = context;
+
+  const isAdmin = context.actorRole === "ADMIN";
+
+  if (requiredPermission && !isAdmin && !permission.can(requiredPermission)) {
+    return {
+      allowed: false,
+      severity: "violation",
+      reason: "无权限执行该操作",
+      auditType: "UNAUTHORIZED_ACTION_ATTEMPT",
+    };
+  }
+
+  if (stateMachine && actionKey && currentState && !canDoAction(stateMachine, actionKey, currentState)) {
+    return {
+      allowed: false,
+      severity: "warning",
+      reason: "当前状态不允许该操作",
+      auditType: "INVALID_STATE_TRANSITION_ATTEMPT",
+    };
+  }
+
+  return {
+    allowed: true,
+    severity: "normal",
+    auditType: actionKey || requiredPermission || "ACTION_EXECUTED",
+  };
+};