fix(权限): 修复版本详情写入权限校验

apps/web/lib/version-members.test.ts

@@ -1,7 +1,7 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 
-import { addVersionMembers, filterVersionMemberCandidates, inferVersionMemberRole } from './version-members';
+import { addVersionMembers, canWriteVersionWork, filterVersionMemberCandidates, inferVersionMemberRole } from './version-members';
 
 test('filterVersionMemberCandidates searches people and excludes already added members', () => {
   const result = filterVersionMemberCandidates(
@@ -63,3 +63,45 @@ test('addVersionMembers infers each selected person role from department', () =>
     { name: 'QA', role: 'testing' },
   ]);
 });
+
+test('canWriteVersionWork requires role permission and version membership', () => {
+  const devRole = { id: 'role-dev', name: '开发', permissions: ['version.devtask:manage'] } as any;
+  const testRole = { id: 'role-test', name: '测试', permissions: ['version.testcase:manage'] } as any;
+  const adminRole = { id: 'role-admin', name: '超管', permissions: ['*'] } as any;
+  const versionMembers = [{ name: 'Dev One', role: 'frontend' as const }];
+
+  assert.equal(canWriteVersionWork({
+    role: devRole,
+    permission: 'version.devtask:manage',
+    currentUserName: 'Dev One',
+    versionMembers,
+  }), true);
+
+  assert.equal(canWriteVersionWork({
+    role: devRole,
+    permission: 'version.devtask:manage',
+    currentUserName: 'Outside Dev',
+    versionMembers,
+  }), false);
+
+  assert.equal(canWriteVersionWork({
+    role: testRole,
+    permission: 'version.devtask:manage',
+    currentUserName: 'Dev One',
+    versionMembers,
+  }), false);
+
+  assert.equal(canWriteVersionWork({
+    role: devRole,
+    permission: 'version.devtask:manage',
+    currentUserName: 'Dev One',
+    versionMembers: [],
+  }), false);
+
+  assert.equal(canWriteVersionWork({
+    role: adminRole,
+    permission: 'version.devtask:manage',
+    currentUserName: 'Admin',
+    versionMembers: [],
+  }), true);
+});