From e46757487bb478775e570b9d26bdf6070eb1ab4a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E3=80=82?= <wanzi@deMacBook-Pro.local>
Date: Wed, 8 Jul 2026 17:14:54 +0800
Subject: [PATCH] =?UTF-8?q?fix(auth):=20=E5=85=81=E8=AE=B8=E7=89=88?=
 =?UTF-8?q?=E6=9C=AC=E5=B7=A5=E4=BD=9C=E5=8A=A8=E6=80=81=E8=AF=81=E6=8D=AE?=
 =?UTF-8?q?=E5=86=99=E5=85=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 apps/server/src/common/auth/permission.service.spec.ts | 9 +++++++++
 apps/server/src/common/auth/permission.service.ts      | 6 ++++++
 2 files changed, 15 insertions(+)

diff --git a/apps/server/src/common/auth/permission.service.spec.ts b/apps/server/src/common/auth/permission.service.spec.ts
index 64135de..95d070c 100644
--- a/apps/server/src/common/auth/permission.service.spec.ts
+++ b/apps/server/src/common/auth/permission.service.spec.ts
@@ -56,6 +56,15 @@ describe('PermissionService', () => {
     })).resolves.toBe(true);
   });
 
+  it('allows a project member to write version-scoped work activity evidence', async () => {
+    versionFindUnique.mockResolvedValue({ id: 'version-1', projectId: 'project-1', members: [] });
+    projectMemberFindUnique.mockResolvedValue({ projectId: 'project-1', userId: 'dev-1', role: 'member' });
+
+    await expect(service.can(currentUser({ id: 'dev-1', roleId: 'role-dev' }), 'work-activity:manage', {
+      versionId: 'version-1',
+    })).resolves.toBe(true);
+  });
+
   it('denies users who have a global role permission but are outside the resource scope', async () => {
     versionFindUnique.mockResolvedValue({ id: 'version-1', projectId: 'project-1', members: [] });
     projectMemberFindUnique.mockResolvedValue(null);
diff --git a/apps/server/src/common/auth/permission.service.ts b/apps/server/src/common/auth/permission.service.ts
index c454b87..ee0376a 100644
--- a/apps/server/src/common/auth/permission.service.ts
+++ b/apps/server/src/common/auth/permission.service.ts
@@ -27,6 +27,7 @@ const SYSTEM_ROLE_PERMISSIONS: Record<string, string[]> = {
     'overtime:view', 'member:view', 'role:view',
     'version.research:view', 'version.ui_plan:view', 'version.devtask:view',
     'version.testcase:view', 'version.bug:view',
+    'work-activity:manage',
   ],
   'role-dev': [
     ...VIEW_ONLY,
@@ -35,6 +36,7 @@ const SYSTEM_ROLE_PERMISSIONS: Record<string, string[]> = {
     'version.research:view', 'version.product_plan:view', 'version.ui_plan:view', 'version.testcase:view',
     'xiaobao.warning:view',
     'overtime:view', 'overtime:create',
+    'work-activity:manage',
   ],
   'role-test': [
     ...VIEW_ONLY,
@@ -43,6 +45,7 @@ const SYSTEM_ROLE_PERMISSIONS: Record<string, string[]> = {
     'version.research:view', 'version.product_plan:view', 'version.ui_plan:view', 'version.devtask:view',
     'xiaobao.warning:view',
     'overtime:view', 'overtime:create',
+    'work-activity:manage',
   ],
   'role-design': [
     ...VIEW_ONLY,
@@ -51,6 +54,7 @@ const SYSTEM_ROLE_PERMISSIONS: Record<string, string[]> = {
     'version.testcase:view', 'version.bug:view',
     'xiaobao.warning:view',
     'overtime:view', 'overtime:create',
+    'work-activity:manage',
   ],
   'role-lead': [
     ...VIEW_ONLY,
@@ -60,6 +64,7 @@ const SYSTEM_ROLE_PERMISSIONS: Record<string, string[]> = {
     'version.bug:view', 'version.bug:create', 'version.bug:edit', 'version.bug:delete',
     'xiaobao.warning:view',
     'overtime:view', 'overtime:create', 'overtime:export',
+    'work-activity:manage',
   ],
 };
 
@@ -79,6 +84,7 @@ const PROJECT_ROLE_PERMISSIONS: Record<string, string[]> = {
     'version.bug:view', 'version.bug:create', 'version.bug:edit',
     'overtime:view', 'overtime:create',
     'xiaobao.warning:view',
+    'work-activity:manage',
   ],
   viewer: [
     'project:view',