feat(admin): gate user/order/city delete behind assignable HQ permissions

Add users_delete, orders_delete, cities_delete; default HQ (incl. super admin) has none until explicitly granted.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/common/guards/hq-permission.guard.ts

@@ -7,10 +7,10 @@ import {
 } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import {
-  HQ_PERMISSION_CATALOG,
   HQ_ROLE_DEFAULT_PERMISSIONS,
   expandHqPermissionKeys,
   hasAnySystemSettingsPermission,
+  hqBasePermissionKeys,
   type HqPermissionKey,
 } from '@dukang/shared-types';
 import { PrismaService } from '../prisma/prisma.module';
@@ -35,30 +35,29 @@ export class HqPermissionsResolver {
     if (!account || account.status !== 'ACTIVE') {
       throw new ForbiddenException('HQ 账号不可用');
     }
+
+    const userRows = await this.prisma.hqAccountPermission.findMany({
+      where: { hqAccountId: actorId },
+      select: { permissionKey: true },
+    });
+    const userKeys = userRows.map((r) => r.permissionKey);
+
     if (account.adminRole === 'SUPER_ADMIN') {
-      return HQ_PERMISSION_CATALOG.map((p) => p.key);
+      // 超管默认拥有业务/管理权限，但不含危险操作；危险权限需按用户显式勾选
+      return expandHqPermissionKeys([...hqBasePermissionKeys(), ...userKeys]);
     }
 
-    const [roleRows, userRows] = await Promise.all([
-      this.prisma.hqRolePermission.findMany({
-        where: { adminRole: account.adminRole },
-        select: { permissionKey: true },
-      }),
-      this.prisma.hqAccountPermission.findMany({
-        where: { hqAccountId: actorId },
-        select: { permissionKey: true },
-      }),
-    ]);
+    const roleRows = await this.prisma.hqRolePermission.findMany({
+      where: { adminRole: account.adminRole },
+      select: { permissionKey: true },
+    });
 
     const roleKeys =
       roleRows.length > 0
         ? roleRows.map((r) => r.permissionKey)
         : [...(HQ_ROLE_DEFAULT_PERMISSIONS[account.adminRole] ?? [])];
 
-    return expandHqPermissionKeys([
-      ...roleKeys,
-      ...userRows.map((r) => r.permissionKey),
-    ]);
+    return expandHqPermissionKeys([...roleKeys, ...userKeys]);
   }
 }
 

server/dukang-api/src/modules/ops/admin-cities.controller.ts

@@ -1,6 +1,10 @@
 import { Body, Controller, Delete, Get, Param, Post, Put, Query, UseGuards } from '@nestjs/common';
 import { IsString, MinLength } from 'class-validator';
 import { HqAuthGuard } from '../../common/guards/hq-auth.guard';
+import {
+  HqPermissionGuard,
+  RequireHqPermissions,
+} from '../../common/guards/hq-permission.guard';
 import { HqOperation } from '../../common/hq-operation/hq-operation.decorator';
 import { HqOperationAction } from '../../common/hq-operation/hq-operation.constants';
 import { AdminCitiesService } from './admin-cities.service';
@@ -24,6 +28,8 @@ export class AdminCitiesController {
   }
 
   @Get(':id/delete-preview')
+  @UseGuards(HqPermissionGuard)
+  @RequireHqPermissions('cities_delete')
   deletePreview(@Param('id') id: string) {
     return this.service.deletePreview(BigInt(id));
   }
@@ -51,6 +57,8 @@ export class AdminCitiesController {
   }
 
   @Delete(':id')
+  @UseGuards(HqPermissionGuard)
+  @RequireHqPermissions('cities_delete')
   @HqOperation({
     action: HqOperationAction.CITY_DELETE,
     refType: 'CITY',

server/dukang-api/src/modules/ops/admin-hq-permissions.service.ts

@@ -4,6 +4,7 @@ import {
   HQ_ROLE_DEFAULT_PERMISSIONS,
   LEGACY_SYSTEM_SETTINGS_KEY,
   expandHqPermissionKeys,
+  hqBasePermissionKeys,
   type HqPermissionKey,
 } from '@dukang/shared-types';
 import { PrismaService } from '../../common/prisma/prisma.module';
@@ -49,7 +50,7 @@ export class AdminHqPermissionsService {
 
   async saveRolePermissions(role: string, permissionKeys: string[]) {
     if (role === 'SUPER_ADMIN') {
-      throw new BadRequestException('超级管理员拥有全部权限，无需配置');
+      throw new BadRequestException('超级管理员基础权限固定，危险操作请按用户单独授权');
     }
     assertPermissionKeys(permissionKeys);
     const normalized = expandHqPermissionKeys(permissionKeys);
@@ -73,24 +74,28 @@ export class AdminHqPermissionsService {
       select: { id: true, name: true, phone: true, loginName: true, adminRole: true, status: true },
     });
     if (!account) throw new NotFoundException('HQ 账号不存在');
+
+    const userPerms = await this.prisma.hqAccountPermission.findMany({
+      where: { hqAccountId: accountId },
+      select: { permissionKey: true },
+    });
+    const userPermissionKeys = expandHqPermissionKeys(userPerms.map((p) => p.permissionKey));
+
     if (account.adminRole === 'SUPER_ADMIN') {
+      const rolePermissionKeys = hqBasePermissionKeys();
+      const effectivePermissionKeys = [
+        ...new Set([...rolePermissionKeys, ...userPermissionKeys]),
+      ] as HqPermissionKey[];
       return serializeBigInt({
         account,
-        permissionKeys: HQ_PERMISSION_CATALOG.map((p) => p.key),
-        rolePermissionKeys: HQ_PERMISSION_CATALOG.map((p) => p.key),
-        userPermissionKeys: [],
-        effectivePermissionKeys: HQ_PERMISSION_CATALOG.map((p) => p.key),
+        permissionKeys: userPermissionKeys,
+        rolePermissionKeys,
+        userPermissionKeys,
+        effectivePermissionKeys,
       });
     }
 
-    const [rolePerms, userPerms] = await Promise.all([
-      this.getRolePermissions(account.adminRole),
-      this.prisma.hqAccountPermission.findMany({
-        where: { hqAccountId: accountId },
-        select: { permissionKey: true },
-      }),
-    ]);
-    const userPermissionKeys = expandHqPermissionKeys(userPerms.map((p) => p.permissionKey));
+    const rolePerms = await this.getRolePermissions(account.adminRole);
     const effectivePermissionKeys = [
       ...new Set([...rolePerms.permissionKeys, ...userPermissionKeys]),
     ] as HqPermissionKey[];
@@ -107,9 +112,6 @@ export class AdminHqPermissionsService {
   async saveAccountPermissions(accountId: bigint, permissionKeys: string[]) {
     const account = await this.prisma.hqAccount.findUnique({ where: { id: accountId } });
     if (!account) throw new NotFoundException('HQ 账号不存在');
-    if (account.adminRole === 'SUPER_ADMIN') {
-      throw new BadRequestException('超级管理员拥有全部权限，无需配置');
-    }
     assertPermissionKeys(permissionKeys);
     const normalized = expandHqPermissionKeys(permissionKeys);
     await this.prisma.$transaction([

server/dukang-api/src/modules/ops/admin-orders.controller.ts

@@ -1,6 +1,9 @@
 import { Body, Controller, Get, Param, Post, Put, Query, UseGuards } from '@nestjs/common';
 import { HqAuthGuard } from '../../common/guards/hq-auth.guard';
-import { SuperAdminGuard } from '../../common/guards/super-admin.guard';
+import {
+  HqPermissionGuard,
+  RequireHqPermissions,
+} from '../../common/guards/hq-permission.guard';
 import { HqOperation } from '../../common/hq-operation/hq-operation.decorator';
 import { HqOperationAction } from '../../common/hq-operation/hq-operation.constants';
 import { AdminOrdersService } from './admin-orders.service';
@@ -18,7 +21,8 @@ export class AdminOrdersController {
   }
 
   @Post('batch-delete')
-  @UseGuards(SuperAdminGuard)
+  @UseGuards(HqPermissionGuard)
+  @RequireHqPermissions('orders_delete')
   @HqOperation({
     action: HqOperationAction.ORDER_BATCH_DELETE,
     refType: 'ORDER',

server/dukang-api/src/modules/ops/admin-users.controller.ts

@@ -1,6 +1,9 @@
 import { Body, Controller, Delete, Get, Param, Post, Query, UseGuards } from '@nestjs/common';
 import { HqAuthGuard } from '../../common/guards/hq-auth.guard';
-import { SuperAdminGuard } from '../../common/guards/super-admin.guard';
+import {
+  HqPermissionGuard,
+  RequireHqPermissions,
+} from '../../common/guards/hq-permission.guard';
 import { HqOperation } from '../../common/hq-operation/hq-operation.decorator';
 import { HqOperationAction } from '../../common/hq-operation/hq-operation.constants';
 import { AdminUsersService } from './admin-users.service';
@@ -18,13 +21,15 @@ export class AdminUsersController {
   }
 
   @Post('batch-delete/preview')
-  @UseGuards(SuperAdminGuard)
+  @UseGuards(HqPermissionGuard)
+  @RequireHqPermissions('users_delete')
   previewBatchDelete(@Body() dto: BatchDeleteUsersDto) {
     return this.usersService.previewBatchDelete(dto.ids.map((id) => BigInt(id)));
   }
 
   @Post('batch-delete')
-  @UseGuards(SuperAdminGuard)
+  @UseGuards(HqPermissionGuard)
+  @RequireHqPermissions('users_delete')
   @HqOperation({
     action: HqOperationAction.USER_BATCH_DELETE,
     refType: 'USER',
@@ -44,7 +49,8 @@ export class AdminUsersController {
   }
 
   @Delete(':id')
-  @UseGuards(SuperAdminGuard)
+  @UseGuards(HqPermissionGuard)
+  @RequireHqPermissions('users_delete')
   @HqOperation({
     action: HqOperationAction.USER_DELETE,
     refType: 'USER',