fix(ai-analysis): 收紧分析接口权限来源

apps/server/src/common/auth/permission.service.spec.ts

@@ -114,6 +114,22 @@ describe('PermissionService', () => {
     await expect(service.assertCan(null, 'product:create')).rejects.toBeInstanceOf(UnauthorizedException);
     await expect(service.assertCan(currentUser({ roleId: 'role-dev' }), 'product:delete')).rejects.toBeInstanceOf(ForbiddenException);
   });
+
+  it('resolves configured role permissions for the current user', async () => {
+    appDataFindUnique.mockResolvedValue({
+      value: {
+        roles: [
+          { id: 'role-dev', permissions: ['project:view'] },
+        ],
+      },
+    });
+
+    await expect(service.resolveUserPermissions(currentUser({ roleId: 'role-dev' }))).resolves.toEqual(['project:view']);
+  });
+
+  it('returns no permissions for anonymous users', async () => {
+    await expect(service.resolveUserPermissions(null)).resolves.toEqual([]);
+  });
 });
 
 function currentUser(overrides: Partial<CurrentUser>): CurrentUser {