fix(partner): skip unauthorized home APIs for sub-accounts

Gate dashboard/stores/orders by permission and move dashboard auth to method level so leaderboard stays open without toasting 403s.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/h5-partner/src/pages/HomePage.tsx

@@ -3,7 +3,13 @@ import { Link, useNavigate } from 'react-router-dom';
 import type { PartnerLeaderboardEntry } from '@dukang/shared-types';
 import { isLoggedIn, request } from '../lib/api';
 import { fetchPartnerLeaderboard } from '../lib/leaderboard';
-import { getPartnerNavKind, hasWarehouseAccess } from '../lib/partnerAccess';
+import {
+  canAccessPartnerDashboard,
+  canAccessPartnerOrders,
+  canAccessPartnerStores,
+  getPartnerNavKind,
+  hasWarehouseAccess,
+} from '../lib/partnerAccess';
 import { usePartnerSession } from '../contexts/PartnerSessionContext';
 
 function fmtMoney(n: number) {
@@ -136,6 +142,9 @@ export default function HomePage() {
   const isPrimary = navKind === 'primary';
   const isWarehouse = navKind === 'warehouse_staff';
   const warehouseOk = hasWarehouseAccess(account);
+  const canOrders = canAccessPartnerOrders(account) && warehouseOk && (isPrimary || isWarehouse);
+  const canDashboard = canAccessPartnerDashboard(account) && !isWarehouse;
+  const canStores = canAccessPartnerStores(account) && !isWarehouse;
 
   const [dash, setDash] = useState<Record<string, unknown> | null>(null);
   const [stores, setStores] = useState<Array<Record<string, unknown>>>([]);
@@ -148,20 +157,34 @@ export default function HomePage() {
 
   useEffect(() => {
     if (!isLoggedIn()) { navigate('/login'); return; }
-    if ((isWarehouse || isPrimary) && warehouseOk) {
-      request<{ list: Array<Record<string, unknown>> }>('PARTNER_H5', '/partner/orders')
+    // 等 session 带上账号后再按权限发请求，避免无权限接口弹错
+    if (!account) return;
+
+    if (canOrders) {
+      request<{ list: Array<Record<string, unknown>> }>('PARTNER_H5', '/partner/orders', { silent: true })
         .then((data) => setOrders(Array.isArray(data.list) ? data.list : []))
         .catch(() => setOrders([]));
     } else {
       setOrders([]);
     }
-    if (!isWarehouse) {
-      request<Record<string, unknown>>('PARTNER_H5', '/partner/dashboard').then(setDash).catch(() => {});
-      request<Array<Record<string, unknown>>>('PARTNER_H5', '/partner/stores').then(setStores).catch(() => []);
+
+    if (canDashboard) {
+      request<Record<string, unknown>>('PARTNER_H5', '/partner/dashboard', { silent: true })
+        .then(setDash)
+        .catch(() => setDash(null));
     } else {
-      request<Record<string, unknown>>('PARTNER_H5', '/partner/dashboard').then(setDash).catch(() => {});
+      setDash(null);
     }
-    // 主账号与全部子账号均可查看同团队贡献榜
+
+    if (canStores) {
+      request<Array<Record<string, unknown>>>('PARTNER_H5', '/partner/stores', { silent: true })
+        .then((data) => setStores(Array.isArray(data) ? data : []))
+        .catch(() => setStores([]));
+    } else {
+      setStores([]);
+    }
+
+    // 主账号与全部子账号均可查看同团队贡献榜（后端不校验业务权限点）
     fetchPartnerLeaderboard('month')
       .then((data) => {
         setLeaderboardEntries(data.list.slice(0, LEADERBOARD_PREVIEW_LIMIT));
@@ -169,7 +192,7 @@ export default function HomePage() {
       .catch(() => {
         setLeaderboardEntries([]);
       });
-  }, [navigate, isWarehouse, isPrimary, warehouseOk]);
+  }, [navigate, account, canOrders, canDashboard, canStores]);
 
   const storeCount = Number(dash?.storeCount || stores.length || 0);
   const orderStats = useMemo(() => summarizeOrders(orders), [orders]);
@@ -248,7 +271,7 @@ export default function HomePage() {
           <p className="headline-md" style={{ marginBottom: 8 }}>订单管理</p>
         )}
 
-        {(isPrimary || isWarehouse) && warehouseOk && (
+        {canOrders && (
           <OrderSummarySection
             title={isWarehouse ? '今日订单' : undefined}
             todayCount={orderStats.todayCount}
@@ -270,7 +293,7 @@ export default function HomePage() {
           </section>
         )}
 
-        {!isWarehouse && (
+        {canStores && (
           <>
             <section className="partner-bento-card" style={{ marginBottom: 16 }}>
               <div className="partner-bento-header">