fix(auth): 完善权限控制与强制改密流程

clinical-web/src/views/management/documents/index.vue

@@ -21,6 +21,7 @@ import type {
 import type { SigningTaskRecord, SigningTemplate } from '@/api/workbench/types'
 import NewSigningTaskDialog from '@/components/signing/NewSigningTaskDialog.vue'
 import { useAppStore } from '@/stores/app'
+import { useLoginStore } from '@/stores/login'
 import { demoCampuses, demoDepartments } from '@/utils/mock-document-library'
 import { mockFlags } from '@/utils/mock-flags'
 import { clearMockState } from '@/utils/mock-storage'
@@ -53,8 +54,29 @@ import type {
  */
 const router = useRouter()
 const appStore = useAppStore()
+const loginStore = useLoginStore()
 
 const useMockLibrary = mockFlags.documents
+const canCreateTemplate = computed(
+  () =>
+    !loginStore.isReadOnly &&
+    (useMockLibrary ||
+      loginStore.hasWritePermission(['sign:template:create', 'sign:template:version:create'])),
+)
+const canEditTemplate = computed(
+  () =>
+    !loginStore.isReadOnly &&
+    (useMockLibrary || loginStore.hasWritePermission('sign:template:version:create')),
+)
+const canArchiveTemplate = computed(
+  () =>
+    !loginStore.isReadOnly &&
+    (useMockLibrary || loginStore.hasWritePermission('sign:template:archive')),
+)
+const canInitiateSigning = computed(
+  () =>
+    !loginStore.isReadOnly && (useMockLibrary || loginStore.hasWritePermission('sign:task:create')),
+)
 /** 真实模式下的加载状态：区分"正在加载"与"确实没有模板" */
 const libraryLoading = ref(false)
 const libraryError = ref('')
@@ -320,6 +342,10 @@ async function handlePreview(template: DocumentTemplate) {
 }
 
 function showAddMessage() {
+  if (!canCreateTemplate.value) {
+    ElMessage.warning('当前账号没有创建文书模板的权限')
+    return
+  }
   // Word 自维护方案：新增文书直接进入 Word 编辑器（粘贴/导入 .docx）。
   wordEditingTemplate.value = null
   wordEditorVisible.value = true
@@ -341,6 +367,11 @@ function closeWordEditor() {
  * 保存后还会把模板正文冲掉。
  */
 async function showEditMessage(template: DocumentTemplate) {
+  if (!canEditTemplate.value) {
+    ElMessage.warning('当前账号没有创建模板版本的权限')
+    return
+  }
+
   if (useMockLibrary || template.contentHtml) {
     wordEditingTemplate.value = template
     wordEditorVisible.value = true
@@ -448,6 +479,11 @@ function toVersionPayload(form: TemplateEditorForm) {
 }
 
 async function saveTemplate(form: TemplateEditorForm) {
+  if ((!form.id && !canCreateTemplate.value) || (form.id && !canEditTemplate.value)) {
+    ElMessage.warning('当前账号没有保存此文书的权限')
+    return
+  }
+
   if (useMockLibrary) {
     if (form.id) {
       updateLocalTemplate(form)
@@ -490,6 +526,11 @@ async function saveTemplate(form: TemplateEditorForm) {
  * 语义上等于下架，已签署文书仍可追溯。
  */
 async function removeTemplate(template: DocumentTemplate) {
+  if (!canArchiveTemplate.value) {
+    ElMessage.warning('当前账号没有下架文书的权限')
+    return
+  }
+
   const confirmed = await ElMessageBox.confirm(
     useMockLibrary
       ? `确定删除文书「${template.name}」？删除后不可恢复。`
@@ -571,6 +612,11 @@ async function toSigningTemplate(template: DocumentTemplate): Promise<SigningTem
 }
 
 async function openSigningDialog(template: DocumentTemplate) {
+  if (!canInitiateSigning.value) {
+    ElMessage.warning('当前账号没有发起签署任务的权限')
+    return
+  }
+
   closePreview()
 
   try {
@@ -660,6 +706,8 @@ onMounted(() => {
       v-model="filters.keyword"
       :total="filteredTemplates.length"
       :show-reset="useMockLibrary"
+      :can-create="canCreateTemplate"
+      :can-export="useMockLibrary"
       @add="showAddMessage"
       @export="showExportMessage"
       @reset="resetMockData"
@@ -684,6 +732,9 @@ onMounted(() => {
         v-for="template in filteredTemplates"
         :key="template.id"
         :template="template"
+        :can-edit="canEditTemplate"
+        :can-initiate="canInitiateSigning"
+        :can-remove="canArchiveTemplate"
         @preview="handlePreview"
         @edit="showEditMessage"
         @initiate="openSigningDialog"