fix(ai-analysis): 收紧分析接口权限来源

apps/server/src/common/auth/permission.service.spec.ts

@@ -114,6 +114,22 @@ describe('PermissionService', () => {
     await expect(service.assertCan(null, 'product:create')).rejects.toBeInstanceOf(UnauthorizedException);
     await expect(service.assertCan(currentUser({ roleId: 'role-dev' }), 'product:delete')).rejects.toBeInstanceOf(ForbiddenException);
   });
+
+  it('resolves configured role permissions for the current user', async () => {
+    appDataFindUnique.mockResolvedValue({
+      value: {
+        roles: [
+          { id: 'role-dev', permissions: ['project:view'] },
+        ],
+      },
+    });
+
+    await expect(service.resolveUserPermissions(currentUser({ roleId: 'role-dev' }))).resolves.toEqual(['project:view']);
+  });
+
+  it('returns no permissions for anonymous users', async () => {
+    await expect(service.resolveUserPermissions(null)).resolves.toEqual([]);
+  });
 });
 
 function currentUser(overrides: Partial<CurrentUser>): CurrentUser {

apps/server/src/common/auth/permission.service.ts

@@ -117,6 +117,11 @@ const VERSION_WORK_MUTATION_PERMISSIONS = new Set([
 export class PermissionService {
   constructor(private readonly prisma: PrismaService) {}
 
+  async resolveUserPermissions(user: CurrentUser | null | undefined): Promise<string[]> {
+    if (!user) return [];
+    return this.resolveRolePermissions(user.roleId);
+  }
+
   async can(user: CurrentUser | null | undefined, permission: string, scope: ResourceScope = {}): Promise<boolean> {
     if (!user) return false;
     if ((SYSTEM_ROLE_PERMISSIONS[user.roleId] ?? []).includes('*')) return true;