feat(auth): 实现平台超管与多租户角色权限深度隔离、前端动态路由白名单及DeepSeek配额守卫

admin/tests/permission-isolation.test.ts

@@ -0,0 +1,70 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { routes, filterRoutesByRole } from '../src/routes';
+
+test('1. 平台超级管理员 (Super Admin) 应拥有包含平台总控与全局财务大屏的完整菜单', () => {
+  const adminRoutes = filterRoutesByRole(routes, {
+    isSuper: true,
+    role: 'super_admin',
+  });
+
+  const keys = adminRoutes.map((r) => r.key);
+  assert.ok(keys.includes('platform'), '超管必须拥有 platform 平台总控菜单');
+  assert.ok(keys.includes('dashboard'), '超管必须拥有 dashboard 菜单');
+
+  const dashboardRoute = adminRoutes.find((r) => r.key === 'dashboard');
+  const dashChildrenKeys = dashboardRoute?.children?.map((c) => c.key) || [];
+  assert.ok(
+    dashChildrenKeys.includes('dashboard/financial'),
+    '超管必须拥有 dashboard/financial 全局财务大屏'
+  );
+});
+
+test('2. 租户企业管理员 (Tenant Owner) 必须完全物理剔除【平台总控】与【全局财务大屏】', () => {
+  const tenantRoutes = filterRoutesByRole(routes, {
+    isSuper: false,
+    role: 'tenant_owner',
+  });
+
+  const keys = tenantRoutes.map((r) => r.key);
+  assert.ok(!keys.includes('platform'), '普通租户侧边栏绝对不得出现 platform 平台总控');
+
+  const dashboardRoute = tenantRoutes.find((r) => r.key === 'dashboard');
+  const dashChildrenKeys = dashboardRoute?.children?.map((c) => c.key) || [];
+  assert.ok(
+    !dashChildrenKeys.includes('dashboard/financial'),
+    '普通租户绝不得访问或看到 dashboard/financial 全局财务大屏'
+  );
+
+  // 但租户必须能看到自己的名片、线索、自身订阅账单
+  assert.ok(keys.includes('card'), '租户必须有名片微官网菜单');
+  assert.ok(keys.includes('crm'), '租户必须有 CRM 菜单');
+  assert.ok(keys.includes('settings-biz'), '租户必须有 企业设置 菜单');
+
+  const settingsRoute = tenantRoutes.find((r) => r.key === 'settings-biz');
+  const settingsKeys = settingsRoute?.children?.map((c) => c.key) || [];
+  assert.ok(
+    settingsKeys.includes('settings/billing'),
+    '租户必须能访问自身的订阅账单 settings/billing'
+  );
+});
+
+test('3. 租户一线销售员 (Sales Rep) 必须进一步限制企业高层设置与敏感人事交接', () => {
+  const repRoutes = filterRoutesByRole(routes, {
+    isSuper: false,
+    role: 'sales_rep',
+  });
+
+  const keys = repRoutes.map((r) => r.key);
+  assert.ok(!keys.includes('platform'), '销售员不得看到 platform');
+
+  const teamRoute = repRoutes.find((r) => r.key === 'team');
+  const teamKeys = teamRoute?.children?.map((c) => c.key) || [];
+  assert.ok(!teamKeys.includes('team/handover'), '销售员不得看到离职交接');
+  assert.ok(!teamKeys.includes('team/brand-kit'), '销售员不得篡改企业统一品牌规范');
+
+  const settingsRoute = repRoutes.find((r) => r.key === 'settings-biz');
+  const settingsKeys = settingsRoute?.children?.map((c) => c.key) || [];
+  assert.ok(!settingsKeys.includes('settings/tenant'), '销售员不得修改企业主域名与证书');
+  assert.ok(!settingsKeys.includes('settings/billing'), '销售员不得查看企业订阅账单');
+});