fix(auth): 完善权限控制与强制改密流程

clinical-web/src/views/management/reports/components/ReportFilterBar.vue

@@ -23,6 +23,7 @@ defineProps<{
   methodOptions: ReportSelectOption<ReportMethodFilter>[]
   exportLoading: boolean
   exportStatus: string
+  canExport: boolean
 }>()
 
 const emit = defineEmits<{
@@ -149,7 +150,13 @@ function handleKeywordChange(event: Event) {
 
       <span class="filter-spacer" />
       <span v-if="exportStatus" class="export-status" role="status">{{ exportStatus }}</span>
-      <button type="button" class="export-button" :disabled="exportLoading" @click="emit('export')">
+      <button
+        v-if="canExport"
+        type="button"
+        class="export-button"
+        :disabled="exportLoading"
+        @click="emit('export')"
+      >
         {{ exportLoading ? '导出中…' : '导出' }}
       </button>
     </div>

clinical-web/src/views/management/reports/index.vue

@@ -21,6 +21,7 @@ import type {
   ReportTaskResponseDto,
   ReportTasksQueryDto,
 } from '@/api/management/types'
+import { useLoginStore } from '@/stores/login'
 
 import DepartmentDistributionChart from './components/DepartmentDistributionChart.vue'
 import ReportDetailTable from './components/ReportDetailTable.vue'
@@ -77,6 +78,12 @@ const exportDownloadLoading = ref(false)
 const exportJob = ref<ReportExportJobResponseDto | null>(null)
 const exportErrorMessage = ref('')
 const router = useRouter()
+const loginStore = useLoginStore()
+const canExportReport = computed(
+  () =>
+    !loginStore.isReadOnly &&
+    (isReportsMockEnabled || loginStore.hasWritePermission('report:signing:export')),
+)
 
 let reportRequestId = 0
 let taskRequestId = 0
@@ -850,6 +857,11 @@ function handleRetryTasks() {
 }
 
 async function handleExport() {
+  if (!canExportReport.value) {
+    ElMessage.warning('当前账号没有导出签署报表的权限')
+    return
+  }
+
   if (exportLoading.value) {
     return
   }
@@ -1056,6 +1068,7 @@ onUnmounted(() => {
       :method-options="methodOptions"
       :export-loading="exportLoading"
       :export-status="exportStatusText"
+      :can-export="canExportReport"
       @update:period="updatePeriod"
       @update:campus="updateCampus"
       @update:department="updateDepartment"