feat(admin): gate user/order/city delete behind assignable HQ permissions

Add users_delete, orders_delete, cities_delete; default HQ (incl. super admin) has none until explicitly granted.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/admin-web/src/pages/CitiesPage.tsx

@@ -17,7 +17,7 @@ import {
 } from 'antd';
 import type { ColumnsType } from 'antd/es/table';
 import { WAREHOUSE_MANAGER_LABELS, WarehouseManagerType } from '@dukang/shared-types';
-import { request, type Paginated } from '../lib/api';
+import { request, type HqProfile, type Paginated } from '../lib/api';
 import { parseProvinceCityCodes, type ParsedProvinceCity } from '../lib/china-region';
 import { ADMIN_OPTIONS_PAGE_SIZE, CITY_STATUS_LABELS, fmtTime } from '../lib/constants';
 import { useAdminList } from '../lib/useAdminList';
@@ -122,6 +122,12 @@ export default function CitiesPage() {
   const [deleteTarget, setDeleteTarget] = useState<Row | null>(null);
   const [deletePreview, setDeletePreview] = useState<CityDeletePreview | null>(null);
   const [confirmName, setConfirmName] = useState('');
+  const [profile, setProfile] = useState<HqProfile | null>(null);
+  const canDeleteCities = (profile?.permissionKeys ?? []).includes('cities_delete');
+
+  useEffect(() => {
+    request<HqProfile>('/admin/auth/me').then(setProfile).catch(() => {});
+  }, []);
 
   const loadPartners = useCallback(async (cityId: string) => {
     const res = await request<Paginated<PartnerOption>>(`/admin/partners?pageSize=${ADMIN_OPTIONS_PAGE_SIZE}&cityId=${cityId}`);
@@ -233,9 +239,11 @@ export default function CitiesPage() {
           <Button type="link" size="small" onClick={() => void openDetail(row)}>
             管理
           </Button>
-          <Button type="link" size="small" danger onClick={() => void openDelete(row)}>
-            删除
-          </Button>
+          {canDeleteCities ? (
+            <Button type="link" size="small" danger onClick={() => void openDelete(row)}>
+              删除
+            </Button>
+          ) : null}
         </Space>
       ),
     },
@@ -356,24 +364,26 @@ export default function CitiesPage() {
                         setDetail(refreshed);
                         void reload();
                       }}>保存</Button>
-                      <Button
-                        danger
-                        style={{ marginLeft: 8 }}
-                        onClick={() =>
-                          void openDelete({
-                            id: String(detail.id),
-                            code: String(detail.code),
-                            name: String(detail.name),
-                            province: String(detail.province),
-                            status: String(detail.status),
-                            storeCount: Number(detail.storeCount ?? 0),
-                            orderCount: Number(detail.orderCount ?? 0),
-                            createdAt: String(detail.createdAt ?? ''),
-                          })
-                        }
-                      >
-                        删除城市
-                      </Button>
+                      {canDeleteCities ? (
+                        <Button
+                          danger
+                          style={{ marginLeft: 8 }}
+                          onClick={() =>
+                            void openDelete({
+                              id: String(detail.id),
+                              code: String(detail.code),
+                              name: String(detail.name),
+                              province: String(detail.province),
+                              status: String(detail.status),
+                              storeCount: Number(detail.storeCount ?? 0),
+                              orderCount: Number(detail.orderCount ?? 0),
+                              createdAt: String(detail.createdAt ?? ''),
+                            })
+                          }
+                        >
+                          删除城市
+                        </Button>
+                      ) : null}
                     </Form>
                   </>
                 ),

apps/admin-web/src/pages/HqPermissionsPage.tsx

@@ -172,7 +172,8 @@ export default function HqPermissionsPage() {
     <div>
       <Typography.Title level={4}>权限分配</Typography.Title>
       <Typography.Paragraph type="secondary">
-        按角色配置基础权限；按用户可追加专属权限。最终生效权限 = 角色权限 ∪ 用户权限（超级管理员始终拥有全部权限）。
+        按角色配置基础权限；按用户可追加专属权限。最终生效权限 = 角色权限 ∪ 用户权限。
+        超级管理员默认拥有除「危险操作」外的全部权限；删除用户/订单/城市需在「按用户分配」中单独勾选（默认均无）。
         「系统设置」已拆分为各配置分组；「财务」对应门店/合伙人/酒厂账单。
       </Typography.Paragraph>
 
@@ -198,7 +199,11 @@ export default function HqPermissionsPage() {
                   </Form.Item>
                 </Form>
                 {role === 'SUPER_ADMIN' ? (
-                  <Alert type="info" showIcon message="超级管理员拥有全部权限，无需配置" />
+                  <Alert
+                    type="info"
+                    showIcon
+                    message="超级管理员基础权限固定（不含危险操作）。删除用户/订单/城市请到「按用户分配」为具体账号勾选。"
+                  />
                 ) : (
                   <>
                     <PermissionChecklist value={roleKeys} onChange={setRoleKeys} />
@@ -227,12 +232,10 @@ export default function HqPermissionsPage() {
                       value={accountId}
                       onChange={setAccountId}
                       optionFilterProp="label"
-                      options={accounts
-                        .filter((a) => a.adminRole !== 'SUPER_ADMIN')
-                        .map((a) => ({
-                          value: a.id,
-                          label: `${a.name} · ${a.loginName || a.phone} · ${ROLE_LABELS[a.adminRole] || a.adminRole}`,
-                        }))}
+                      options={accounts.map((a) => ({
+                        value: a.id,
+                        label: `${a.name} · ${a.loginName || a.phone} · ${ROLE_LABELS[a.adminRole] || a.adminRole}`,
+                      }))}
                     />
                   </Form.Item>
                 </Form>
@@ -252,7 +255,7 @@ export default function HqPermissionsPage() {
                       })}
                     </Space>
                     <Typography.Paragraph type="secondary">
-                      下方勾选为用户专属追加权限（保存后与角色权限合并生效）。
+                      下方勾选为用户专属追加权限（保存后与角色权限合并生效）。危险操作（删除用户/订单/城市）默认不授予，需在此勾选。
                     </Typography.Paragraph>
                     <PermissionChecklist value={accountKeys} onChange={setAccountKeys} />
                     <Space wrap style={{ marginTop: 12 }}>

apps/admin-web/src/pages/OrdersPage.tsx

@@ -18,7 +18,7 @@ import {
   message,
 } from 'antd';
 import type { ColumnsType } from 'antd/es/table';
-import { request, type AdminOrderItem, type AdminOrderRow, type Paginated } from '../lib/api';
+import { request, type AdminOrderItem, type AdminOrderRow, type HqProfile, type Paginated } from '../lib/api';
 import {
   ADMIN_OPTIONS_PAGE_SIZE,
   DELIVERY_PROVIDER_LABELS,
@@ -154,6 +154,7 @@ export default function OrdersPage() {
   const [form] = Form.useForm();
   const [shipForm] = Form.useForm();
   const [logisticsForm] = Form.useForm();
+  const [profile, setProfile] = useState<HqProfile | null>(null);
   const [data, setData] = useState<Paginated<AdminOrderRow> | null>(null);
   const [loading, setLoading] = useState(false);
   const [page, setPage] = useState(1);
@@ -174,12 +175,17 @@ export default function OrdersPage() {
   const [shipTarget, setShipTarget] = useState<OrderDetail | null>(null);
   const [shipMode, setShipMode] = useState<ShipMode>('EXPRESS');
   const [warehouses, setWarehouses] = useState<WarehouseOption[]>([]);
+  const canDeleteOrders = (profile?.permissionKeys ?? []).includes('orders_delete');
 
   const selectedOrders = useMemo(
     () => (data?.items ?? []).filter((row) => selectedRowKeys.includes(row.id)),
     [data?.items, selectedRowKeys],
   );
 
+  useEffect(() => {
+    request<HqProfile>('/admin/auth/me').then(setProfile).catch(() => {});
+  }, []);
+
   async function openRedeemDetail(redeemId: string) {
     setRedeemDetailLoading(true);
     setRedeemDrawerOpen(true);
@@ -454,13 +460,15 @@ export default function OrdersPage() {
     <div>
       <Space style={{ marginBottom: 16, width: '100%', justifyContent: 'space-between' }}>
         <Typography.Title level={4} style={{ margin: 0 }}>订单监控</Typography.Title>
-        <Button
-          danger
-          disabled={!selectedRowKeys.length}
-          onClick={() => setBatchDeleteOpen(true)}
-        >
-          批量删除{selectedRowKeys.length ? ` (${selectedRowKeys.length})` : ''}
-        </Button>
+        {canDeleteOrders ? (
+          <Button
+            danger
+            disabled={!selectedRowKeys.length}
+            onClick={() => setBatchDeleteOpen(true)}
+          >
+            批量删除{selectedRowKeys.length ? ` (${selectedRowKeys.length})` : ''}
+          </Button>
+        ) : null}
       </Space>
       <Form form={form} layout="inline" style={{ marginBottom: 16 }} onFinish={() => { setPage(1); void load(); }}>
         <Form.Item name="orderNo" label="订单号">
@@ -504,10 +512,10 @@ export default function OrdersPage() {
         columns={columns}
         dataSource={data?.items ?? []}
         scroll={{ x: 1500 }}
-        rowSelection={{
+        rowSelection={canDeleteOrders ? {
           selectedRowKeys,
           onChange: (keys) => setSelectedRowKeys(keys as string[]),
-        }}
+        } : undefined}
         pagination={{
           current: page,
           pageSize,

apps/admin-web/src/pages/UsersPage.tsx

@@ -18,7 +18,7 @@ import {
 } from 'antd';
 import type { ColumnsType } from 'antd/es/table';
 import { USER_SOURCE_TYPE_LABELS, type UserSourceType } from '@dukang/shared-types';
-import { request, type AdminUserRow, type Paginated } from '../lib/api';
+import { request, type AdminUserRow, type HqProfile, type Paginated } from '../lib/api';
 import { ORDER_STATUS_LABELS, fmtTime, maskPhone } from '../lib/constants';
 
 type UserOrderRow = {
@@ -66,6 +66,7 @@ export default function UsersPage() {
   const navigate = useNavigate();
   const location = useLocation();
   const [form] = Form.useForm();
+  const [profile, setProfile] = useState<HqProfile | null>(null);
   const [data, setData] = useState<Paginated<AdminUserRow> | null>(null);
   const [loading, setLoading] = useState(false);
   const [page, setPage] = useState(1);
@@ -82,6 +83,11 @@ export default function UsersPage() {
   const [batchPreviewLoading, setBatchPreviewLoading] = useState(false);
   const [batchDeleting, setBatchDeleting] = useState(false);
   const [batchRiskAck, setBatchRiskAck] = useState(false);
+  const canDeleteUsers = (profile?.permissionKeys ?? []).includes('users_delete');
+
+  useEffect(() => {
+    request<HqProfile>('/admin/auth/me').then(setProfile).catch(() => {});
+  }, []);
 
   const load = useCallback(async () => {
     setLoading(true);
@@ -309,13 +315,15 @@ export default function UsersPage() {
     <div>
       <Space style={{ marginBottom: 16, width: '100%', justifyContent: 'space-between' }}>
         <Typography.Title level={4} style={{ margin: 0 }}>用户监控</Typography.Title>
-        <Button
-          danger
-          disabled={!selectedRowKeys.length}
-          onClick={() => void openBatchDeleteModal()}
-        >
-          批量删除{selectedRowKeys.length ? ` (${selectedRowKeys.length})` : ''}
-        </Button>
+        {canDeleteUsers ? (
+          <Button
+            danger
+            disabled={!selectedRowKeys.length}
+            onClick={() => void openBatchDeleteModal()}
+          >
+            批量删除{selectedRowKeys.length ? ` (${selectedRowKeys.length})` : ''}
+          </Button>
+        ) : null}
       </Space>
       <Form form={form} layout="inline" style={{ marginBottom: 16 }} onFinish={() => { setPage(1); void load(); }}>
         <Form.Item name="phone" label="手机号">
@@ -353,11 +361,11 @@ export default function UsersPage() {
         columns={columns}
         dataSource={data?.items ?? []}
         scroll={{ x: 1500 }}
-        rowSelection={{
+        rowSelection={canDeleteUsers ? {
           selectedRowKeys,
           preserveSelectedRowKeys: true,
           onChange: (keys) => setSelectedRowKeys(keys as string[]),
-        }}
+        } : undefined}
         pagination={{
           current: page,
           pageSize,
@@ -375,9 +383,9 @@ export default function UsersPage() {
         width={640}
         open={drawerOpen}
         onClose={() => setDrawerOpen(false)}
-        extra={detail && (
+        extra={detail && canDeleteUsers ? (
           <Button danger onClick={openDeleteModal}>删除用户</Button>
-        )}
+        ) : undefined}
       >
         {detail && (
           <>