后端修改权限和折叠功能

server/dukang-api/src/common/system-config/system-config.service.ts

@@ -63,16 +63,23 @@ export class SystemConfigService implements OnModuleInit {
     return loadAppConfig(this.getMergedEnv());
   }
 
-  async getForm(): Promise<SystemConfigFormResponse> {
+  async getForm(allowedGroups?: string[] | null): Promise<SystemConfigFormResponse> {
     if (!this.tableReady) {
       throw new Error('system_config 表未就绪，请在 server/dukang-api 执行 npx prisma db push');
     }
+    const groups =
+      allowedGroups == null
+        ? SYSTEM_CONFIG_GROUPS
+        : SYSTEM_CONFIG_GROUPS.filter((g) => allowedGroups.includes(g.key));
+    const allowedGroupSet = new Set(groups.map((g) => g.key));
+    const fields = SYSTEM_CONFIG_FIELDS.filter((f) => allowedGroupSet.has(f.group));
+
     const rows = await this.prisma.systemConfig.findMany();
     const dbMap = new Map(rows.map((r) => [r.configKey, r.value]));
     const values: Record<string, string> = {};
     const configuredSecrets: string[] = [];
 
-    for (const field of SYSTEM_CONFIG_FIELDS) {
+    for (const field of fields) {
       const fromDb = dbMap.get(field.key);
       const fromEnv = process.env[field.key];
       const raw = fromDb ?? fromEnv ?? '';
@@ -85,8 +92,8 @@ export class SystemConfigService implements OnModuleInit {
     }
 
     return {
-      groups: SYSTEM_CONFIG_GROUPS,
-      fields: SYSTEM_CONFIG_FIELDS,
+      groups,
+      fields,
       values,
       configuredSecrets,
       envFilePath: resolveEnvFilePath(),
@@ -95,18 +102,24 @@ export class SystemConfigService implements OnModuleInit {
     };
   }
 
-  async update(dto: SystemConfigUpdateRequest): Promise<{
+  async update(
+    dto: SystemConfigUpdateRequest,
+    allowedGroups?: string[] | null,
+  ): Promise<{
     updatedKeys: string[];
     requiresRestartKeys: string[];
   }> {
     const updatedKeys: string[] = [];
     const requiresRestartKeys: string[] = [];
     const overlay: Record<string, string> = {};
+    const allowedGroupSet =
+      allowedGroups == null ? null : new Set(allowedGroups);
 
     for (const [key, rawValue] of Object.entries(dto.values ?? {})) {
       if (!SYSTEM_CONFIG_KEY_SET.has(key)) continue;
       const meta = getSystemConfigField(key);
       if (!meta) continue;
+      if (allowedGroupSet && !allowedGroupSet.has(meta.group)) continue;
 
       let value = String(rawValue ?? '').trim();
       if (meta.secret && (!value || value === SECRET_PLACEHOLDER)) {