fix(权限): 修复版本详情写入权限校验

apps/web/lib/version-members.test.ts

@@ -1,7 +1,7 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 
-import { addVersionMembers, filterVersionMemberCandidates, inferVersionMemberRole } from './version-members';
+import { addVersionMembers, canWriteVersionWork, filterVersionMemberCandidates, inferVersionMemberRole } from './version-members';
 
 test('filterVersionMemberCandidates searches people and excludes already added members', () => {
   const result = filterVersionMemberCandidates(
@@ -63,3 +63,45 @@ test('addVersionMembers infers each selected person role from department', () =>
     { name: 'QA', role: 'testing' },
   ]);
 });
+
+test('canWriteVersionWork requires role permission and version membership', () => {
+  const devRole = { id: 'role-dev', name: '开发', permissions: ['version.devtask:manage'] } as any;
+  const testRole = { id: 'role-test', name: '测试', permissions: ['version.testcase:manage'] } as any;
+  const adminRole = { id: 'role-admin', name: '超管', permissions: ['*'] } as any;
+  const versionMembers = [{ name: 'Dev One', role: 'frontend' as const }];
+
+  assert.equal(canWriteVersionWork({
+    role: devRole,
+    permission: 'version.devtask:manage',
+    currentUserName: 'Dev One',
+    versionMembers,
+  }), true);
+
+  assert.equal(canWriteVersionWork({
+    role: devRole,
+    permission: 'version.devtask:manage',
+    currentUserName: 'Outside Dev',
+    versionMembers,
+  }), false);
+
+  assert.equal(canWriteVersionWork({
+    role: testRole,
+    permission: 'version.devtask:manage',
+    currentUserName: 'Dev One',
+    versionMembers,
+  }), false);
+
+  assert.equal(canWriteVersionWork({
+    role: devRole,
+    permission: 'version.devtask:manage',
+    currentUserName: 'Dev One',
+    versionMembers: [],
+  }), false);
+
+  assert.equal(canWriteVersionWork({
+    role: adminRole,
+    permission: 'version.devtask:manage',
+    currentUserName: 'Admin',
+    versionMembers: [],
+  }), true);
+});

apps/web/lib/version-members.ts

@@ -56,3 +56,23 @@ export function addVersionMembers(
 
   return [...currentMembers, ...additions];
 }
+
+export function isVersionMemberName(currentUserName: string | undefined, versionMembers: VersionMember[]): boolean {
+  const name = currentUserName?.trim();
+  if (!name) return false;
+  return versionMembers.some((member) => member.name === name);
+}
+
+export function canWriteVersionWork(input: {
+  role?: { permissions?: string[] } | null;
+  permission: string;
+  currentUserName?: string;
+  versionMembers: VersionMember[];
+  readOnly?: boolean;
+}): boolean {
+  if (input.readOnly) return false;
+  const permissions = input.role?.permissions ?? [];
+  if (permissions.includes('*')) return true;
+  if (!permissions.includes(input.permission)) return false;
+  return isVersionMemberName(input.currentUserName, input.versionMembers);
+}