完善项目级权限与项目管理入口

- 新增项目成员候选用户接口，避免 PM 读取全局用户列表 - 按项目角色和权限矩阵控制项目管理、成员、中心与审计入口 - 合并侧边栏管理后台入口，统一从项目管理进入成员等模块 - 加强成员管理安全约束，禁止 PM 修改自己、系统管理员或更高权限角色 - 修复多项目角色缓存串用问题，并补充前后端回归测试
2026-05-13 14:16:15 +08:00
parent ab1975d3c6
commit a17f4cc522
21 changed files with 452 additions and 134 deletions
@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const readProjectMembers = () => readFileSync(resolve(__dirname, "./ProjectMembers.vue"), "utf8");
+
+describe("ProjectMembers user directory access", () => {
+  it("does not load the admin-only global user directory", () => {
+    const source = readProjectMembers();
+
+    expect(source).not.toContain("fetchUsers");
+    expect(source).not.toContain("../../api/users");
+    expect(source).toContain('const canManageMembers = computed(() => permission.can("project.members.manage"));');
+    expect(source).toContain("if (!canManageMembers.value");
+    expect(source).toContain("return;");
+    expect(source).toContain('v-if="canManageMembers"');
+    expect(source).toContain("listMemberCandidates(projectId.value, { limit: 500 })");
+  });
+
+  it("uses the member API embedded user data when the global directory is unavailable", () => {
+    const source = readProjectMembers();
+
+    expect(source).toContain("users.value = members.value");
+    expect(source).toContain(".map((member) => member.user)");
+    expect(source).toContain("users.value.find((u) => u.id === m.user_id) || m.user");
+  });
+
+  it("prevents project managers from editing themselves or assigning higher roles", () => {
+    const source = readProjectMembers();
+
+    expect(source).toContain("const roleRank: Record<string, number>");
+    expect(source).toContain("if (row.user_id === auth.user?.id) return false;");
+    expect(source).toContain('if (row.user?.role === "ADMIN") return false;');
+    expect(source).toContain("const canAssignRole = (role: string)");
+    expect(source).toContain(':disabled="!canAssignRole(\'ADMIN\')"');
+    expect(source).toContain(':disabled="!canEditMember(scope.row)');
+  });
+});