agent-exec transport 91fa500d0ed8f7daca02bd46ba843a9a/b201c6aced99

src/api.ts

@@ -25,7 +25,9 @@ export interface UserRoleBinding {
   bindingId: string; userId: string; roleId: string; active: boolean; bindingVersion: number
   assignedBy: string; assignedAt: string; userStateVersion: number; authorityEpoch: number
 }
-export interface UserRoleView { binding?: UserRoleBinding; role?: RoleRecord }
+/** getUserRole 返回的角色摘要：实测不含 permissions，权限补齐由角色列表条目提供。 */
+export interface UserRoleSummary extends Omit<RoleRecord, 'permissions'> { permissions?: RolePermissionRecord[] }
+export interface UserRoleView { binding?: UserRoleBinding; role?: UserRoleSummary }
 /** Backend 计算的本人 project.create 联动（/api/me linkedCapabilities）。 */
 export interface LinkedCapabilities {
   projectCreate: boolean; source?: string; linkedActions: string[]; conflicts?: string[]; authorityEpoch: number
@@ -153,7 +155,8 @@ export const api = {
   // 管理员建号：可提供初始密码；省略密码时由服务端生成并仅返回一次。
   // isAdmin 仅超级管理员可用（R3/R4），普通管理员携带时由服务端拒绝。
   createAdminUser: (owner: string, name: string, password?: string, isAdmin?: boolean) => auth.fetch(`${BASE}/api/admin/users`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ owner, profile: { name }, ...(password ? { password } : {}), ...(isAdmin ? { isAdmin: true } : {}) }) }).then(r => json<{ userId: string; owner: string; passwordSet: boolean; mustChangePassword: boolean; initializationState: string; initialPassword?: string }>(r)),
-  adminIssueOneTimePassword: (owner: string) => auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(owner)}/one-time-password`, { method: 'POST' }).then(r => json<AdminIssuedOneTimePassword>(r)),
+  // 服务端严格解码 JSON 对象体：无 Content-Type 与请求体的 POST 会被拒为 400 EOF。
+  adminIssueOneTimePassword: (owner: string) => auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(owner)}/one-time-password`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: '{}' }).then(r => json<AdminIssuedOneTimePassword>(r)),
   searchAdminUsers: (request: { query: string; mode: 'exact' | 'fuzzy'; status: 'all' | 'enabled' | 'disabled'; fields: string[]; cursor?: string; limit?: number }) => {
     const params = new URLSearchParams({ query: request.query, mode: request.mode, status: request.status,
       fields: request.fields.join(','), limit: String(request.limit ?? 20) })

src/components/AccountUsersPanel.tsx

@@ -95,13 +95,20 @@ export function GrantChangePreview({ baseline, grants, labels, owner }: {
 
 /** 账号的创建能力来源与联动说明（角色默认与明确授权可并存）。 */
 export function ProjectCreateSourceNote({ role, grants }: {
-  role: { name: string; permissions: { actionId: string; allowed: boolean }[] } | null | undefined; grants: string[]
+  role: { name: string; permissions?: { actionId: string; allowed: boolean }[] } | null | undefined; grants: string[]
 }) {
   const sources = projectCreateSources(role, grants)
   if (sources.length === 0) return <p className="ad-hint">未获得创建项目能力：被加入项目后由成员关系提供基础协作</p>
   return <p className="ad-hint">创建项目来源：{sources.join(' + ')} · 联动形成本人创建项目的设置、成员、项目权限与文档职责管理资格</p>
 }
 
+/** getUserRole 的角色摘要不带 permissions：用已加载角色列表里同一 roleId 的条目补齐，
+ *  列表里也没有时按无角色默认权限处理（不新增请求，也不改写已有权限）。 */
+export function roleWithPermissions(role: UserRoleView['role'], roles: RoleRecord[]): UserRoleView['role'] {
+  if (!role || role.permissions) return role
+  return roles.find(item => item.roleId === role.roleId) ?? role
+}
+
 export function AccountUsersPanel() {
   const me = useStore(state => state.me)
   const allowed = (action: string) => !!me?.isAdmin || hasSystemAction(me?.systemActions, action)
@@ -326,7 +333,7 @@ export function AccountUsersPanel() {
         <button className="ad-mini" disabled={roleLoading || !roleTrail.length} onClick={() => { setRoleCursor(roleTrail[roleTrail.length - 1]); setRoleTrail(roleTrail.slice(0, -1)) }}>上一页角色</button>
         <button className="ad-mini" disabled={roleLoading || !nextRoleCursor} onClick={() => { setRoleTrail([...roleTrail, roleCursor]); setRoleCursor(nextRoleCursor) }}>下一页角色</button>
       </div>}
-      {(canViewRoles || canViewGrants) && <ProjectCreateSourceNote role={roleView?.role} grants={grantBaseline} />}
+      {(canViewRoles || canViewGrants) && <ProjectCreateSourceNote role={roleWithPermissions(roleView?.role, roles)} grants={grantBaseline} />}
       {canViewGrants && <Collapsible id={`system-grants-${selected.userId}`} trigger="明确系统权限">
         <GrantGroupEditor catalog={catalog} grants={grants} disabled={!canManageGrants || !policy.maintain || busy} onChange={setGrants} />
         <GrantChangePreview baseline={grantBaseline} grants={grants} labels={labels} owner={selected.owner} />

src/components/adminRdmSections.tsx

@@ -78,12 +78,18 @@ export function RdmMembersSection({ project }: { project: Project }) {
     setPicked([]); setPickedItems([]); knownPicks.current.clear()
     setCandRoleId(''); setCandMatch('fuzzy'); setCandFields('both'); setMemberQuery(''); setMemberRoleId('')
     setRoleOptions(null)
+  }, [project])
+
+  // rdm.role.options 受 member.manage 授权；未确认前先不发请求，避免普通成员被 403。
+  // 跟着 [project, manage.canManage] 重订：项目切换或权限放开后重发，迟到响应丢弃。
+  useEffect(() => {
+    if (!manage.canManage) return
     let live = true
     cmd<{ roles?: RdmProfRole[] }>('rdm.role.options', roleOptionsPayload(projectId))
       .then(out => { if (live) setRoleOptions(out.roles ?? []) })
       .catch(() => { if (live) setRoleOptions(null) })
     return () => { live = false }
-  }, [project])
+  }, [project, manage.canManage])
 
   useEffect(() => {
     setManageActions(null)

src/rolePermissions.ts

@@ -205,12 +205,13 @@ export function rebaseGrantDraft(baseline: string[], local: string[], server: st
   return [...next].sort()
 }
 
-/** 某账号 project.create 的实际来源（角色默认与明确系统授权可并存）。 */
+/** 某账号 project.create 的实际来源（角色默认与明确系统授权可并存）。
+ *  getUserRole 的角色摘要不带 permissions，缺失按「无角色默认权限」处理。 */
 export function projectCreateSources(
-  role: { name: string; permissions: { actionId: string; allowed: boolean }[] } | null | undefined, grants: string[],
+  role: { name: string; permissions?: { actionId: string; allowed: boolean }[] } | null | undefined, grants: string[],
 ): string[] {
   const sources: string[] = []
-  if (role?.permissions.some(item => item.actionId === PROJECT_CREATE_ACTION && item.allowed)) sources.push(`职位角色「${role.name}」`)
+  if (role?.permissions?.some(item => item.actionId === PROJECT_CREATE_ACTION && item.allowed)) sources.push(`职位角色「${role.name}」`)
   if (grants.includes(PROJECT_CREATE_ACTION)) sources.push('明确系统授权')
   return sources
 }

src/store.ts

@@ -1744,5 +1744,7 @@ export function mergeStartedRun(runs: Run[], run: Run): Run[] {
 export function eventTime(e: { ts?: string }, now = Date.now()): number {
   if (!e.ts) return now
   const t = Date.parse(e.ts)
-  return Number.isNaN(t) ? now : t
+  // 后端 0 值占位（0001-01-01T00:00:00Z 等）会让状态栏读到巨大耗时，回落 now 让「已工作」保持真实时钟。
+  if (Number.isNaN(t) || t <= 0) return now
+  return t
 }

test/admin-user-role-sources.test.tsx

@@ -0,0 +1,61 @@
+// 管理端用户面板两处缺陷的回归锁定：
+// (1) getUserRole 的 role 摘要不带 permissions（线上实测），projectCreateSources 不得因此抛异常；
+//     展示来源时用已加载角色列表里同一 roleId 的条目补齐权限，不新增请求。
+// (2) 一次性登录密码按服务端严格解码要求发送 JSON 对象体。
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { renderToStaticMarkup } from 'react-dom/server'
+import { api, type RoleRecord } from '../src/api'
+import { auth } from '../src/auth'
+import { ProjectCreateSourceNote, roleWithPermissions } from '../src/components/AccountUsersPanel'
+import { projectCreateSources } from '../src/rolePermissions'
+
+const listed: RoleRecord = {
+  roleId: 'role-pm', name: '项目经理', description: '研发', enabled: true, roleVersion: 3, bindingCount: 1,
+  permissions: [
+    { actionId: 'project.create', allowed: true, capAllowed: true, permissionVersion: 2 },
+    { actionId: 'document.read', allowed: true, capAllowed: true, permissionVersion: 1 },
+  ],
+}
+/** getUserRole 的真实响应形状：有角色字段、没有 permissions。 */
+const summary = { roleId: 'role-pm', name: '项目经理', description: '研发', enabled: true, roleVersion: 3, bindingCount: 1 }
+
+afterEach(() => vi.restoreAllMocks())
+
+describe('角色摘要缺少 permissions 时的创建能力来源', () => {
+  it('把缺失的 permissions 当作空集，不抛异常也不虚构角色来源', () => {
+    expect(projectCreateSources({ name: '项目经理' }, [])).toEqual([])
+    expect(projectCreateSources({ name: '项目经理' }, ['project.create'])).toEqual(['明确系统授权'])
+    expect(projectCreateSources({ ...summary, permissions: undefined }, [])).toEqual([])
+    expect(renderToStaticMarkup(<ProjectCreateSourceNote role={{ name: '项目经理' }} grants={[]} />))
+      .toContain('被加入项目后由成员关系提供基础协作')
+  })
+
+  it('用角色列表里同一 roleId 的权限补齐来源', () => {
+    const resolved = roleWithPermissions(summary, [listed])
+    expect(resolved?.permissions?.some(item => item.actionId === 'project.create')).toBe(true)
+    expect(renderToStaticMarkup(<ProjectCreateSourceNote role={resolved} grants={[]} />))
+      .toContain('创建项目来源：职位角色「项目经理」')
+  })
+
+  it('列表里没有对应条目时按无角色默认权限处理，角色自带权限时不被列表覆盖', () => {
+    expect(projectCreateSources(roleWithPermissions(summary, []), [])).toEqual([])
+    const denied = { ...listed, roleId: 'role-other', permissions: [{ actionId: 'project.create', allowed: false, capAllowed: false, permissionVersion: 1 }] }
+    expect(projectCreateSources(roleWithPermissions({ ...summary, permissions: denied.permissions }, [denied]), [])).toEqual([])
+  })
+})
+
+describe('管理员一次性登录密码请求体', () => {
+  it('发送 POST + JSON 对象体，避免服务端 400 EOF', async () => {
+    const issued = { owner: 'alice', id: 'otp_123', oneTimePassword: 'otp-0001', mustChangePassword: true }
+    const request = vi.spyOn(auth, 'fetch').mockResolvedValue(new Response(JSON.stringify(issued)))
+
+    const out = await api.adminIssueOneTimePassword('alice')
+
+    const [url, options] = request.mock.calls[0]
+    expect(url).toBe('/api/admin/users/alice/one-time-password')
+    expect(options?.method).toBe('POST')
+    expect(options?.headers).toEqual({ 'Content-Type': 'application/json' })
+    expect(JSON.parse(String(options?.body))).toEqual({})
+    expect(out).toEqual(issued)
+  })
+})

test/event-time.test.ts

@@ -0,0 +1,33 @@
+// eventTime 取事件上的服务端时间；后端 0 值占位（0001-01-01T00:00:00Z）
+// 不能让状态栏把「已工作」读成几百年的耗时——非正 epoch 一律回落到墙上时钟。
+import { describe, expect, it } from 'vitest'
+import { eventTime } from '../src/store'
+
+describe('eventTime', () => {
+  it('returns now when the timestamp is missing', () => {
+    const now = 1_700_000_000_000
+    expect(eventTime({}, now)).toBe(now)
+    expect(eventTime({ ts: '' }, now)).toBe(now)
+    expect(eventTime({ ts: undefined }, now)).toBe(now)
+  })
+
+  it('returns now for unparseable timestamps', () => {
+    const now = 1_700_000_000_000
+    expect(eventTime({ ts: 'not-a-date' }, now)).toBe(now)
+    expect(eventTime({ ts: '2026-13-40T99:99:99Z' }, now)).toBe(now)
+  })
+
+  it('returns now when the parsed time is not a positive epoch (zero-value placeholder)', () => {
+    // 0001-01-01T00:00:00Z is the Go/Unix zero time；过去不能解释为有效事件时间。
+    const now = 1_700_000_000_000
+    expect(eventTime({ ts: '0001-01-01T00:00:00Z' }, now)).toBe(now)
+    // Date.parse('1970-01-01T00:00:00Z') === 0，应被一并回落，否则状态栏会显示从 epoch 至今。
+    expect(eventTime({ ts: '1970-01-01T00:00:00Z' }, now)).toBe(now)
+  })
+
+  it('returns the parsed epoch for a real, parseable timestamp', () => {
+    const now = 1_700_000_000_000
+    expect(eventTime({ ts: '2024-01-02T03:04:05Z' }, now)).toBe(Date.parse('2024-01-02T03:04:05Z'))
+    expect(eventTime({ ts: '2026-10-12T10:00:00Z' }, now)).toBe(Date.parse('2026-10-12T10:00:00Z'))
+  })
+})

test/one-time-password.test.ts

@@ -21,7 +21,10 @@ describe('管理员一次性密码发放', () => {
 
     const out = await api.adminIssueOneTimePassword('alice')
     expect(fetchSpy).toHaveBeenCalledTimes(1)
-    expect(fetchSpy).toHaveBeenCalledWith('/api/admin/users/alice/one-time-password', { method: 'POST' })
+    // 服务端严格解码 JSON 对象体：无体无 Content-Type 会被拒为 400 EOF。
+    expect(fetchSpy).toHaveBeenCalledWith('/api/admin/users/alice/one-time-password', {
+      method: 'POST', headers: { 'Content-Type': 'application/json' }, body: '{}',
+    })
     expect(out).toEqual(response)
   })
 

test/rdm-members-options-gate.test.tsx

@@ -0,0 +1,264 @@
+// RdmMembersSection rdm.role.options 授权门控：rdm.perm.check 给出 member.manage
+// 未允许时，不得提前发 rdm.role.options（普通成员被 403）；允许后必须发。
+//
+// 测试在 node 环境下用最小化的 DOM mock 驱动 React 19 createRoot，让 useEffect 正常落槽；
+// 不去依赖 happy-dom/jsdom（受网络/包锁约束，allowed_paths 也限制仅 src + test）。
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createElement, type ReactNode } from 'react'
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { RdmMembersSection } from '../src/components/adminRdmSections'
+import { api } from '../src/api'
+import type { Project } from '../src/contracts'
+
+// 用 vi.mock 隔离 useStore：组件只用到 select(state).me，其它 store 字段触发不到，
+// 不会影响此处关注点（避免 host Store 启动监听器、送 SSE 等副作用污染测试）。
+vi.mock('../src/store', () => {
+  const state = {
+    me: { owner: 'bob', name: 'bob', auth: true },
+  }
+  return {
+    useStore: (select: (value: typeof state) => unknown) => select(state),
+    eventTime: (_e: { ts?: string }, now: number) => now,
+  }
+})
+
+// ---- 自定义 React DOM 桩：让 useEffect 在 node 环境落到 commit 阶段 ----
+// 服务端 React 不运行 useEffect；createRoot 需要一个 DOM-shaped container。
+// 这里只覆盖 react-dom-client 用到的几个关键入口（addEventListener、tagName、namespaceURI、
+// ownerDocument.defaultView.HTMLIFrameElement、activeElement、documentElement）。任何
+// 新字段缺失都会在第一处 React 调用时显式爆出，便于修复而不是静默吞下。
+class HTMLIFrameElement {}
+class MockDocument {
+  nodeType = 9
+  defaultView: any
+  HTMLIFrameElement = HTMLIFrameElement
+  activeElement: any = null
+  documentElement: any
+  constructor() {
+    this.defaultView = makeWindow()
+    this.defaultView.document = this
+    this.activeElement = null
+    this.documentElement = this
+  }
+  addEventListener() {}
+  removeEventListener() {}
+  dispatchEvent() {}
+  contains() { return false }
+  createElement(tag: string) {
+    const el = new MockElement()
+    el.tagName = tag
+    el.nodeName = tag
+    el.ownerDocument = this
+    if (renderObserver) renderObserver.append(tag)
+    return el
+  }
+  createElementNS(_ns: string, tag: string) { return this.createElement(tag) }
+  createTextNode() { return new MockElement() }
+}
+
+/** 创建 DOM 节点时把它们的 tag 累积下来，替代 innerHTML 读取（Mock 上 innerHTML 为空）。 */
+let renderObserver: { tags: string[]; reset(): void; append(t: string): void } | null = null
+class MockElement {
+  nodeType = 1
+  style: Record<string, string> = {}
+  attributes: Record<string, string> = {}
+  tagName = 'DIV'
+  nodeName = 'DIV'
+  namespaceURI = 'http://www.w3.org/1999/xhtml'
+  ownerDocument: any
+  childNodes: any[] = []
+  parentNode: any = null
+  appendChild(c: any) { this.childNodes.push(c); c.parentNode = this; return c }
+  removeChild(c: any) { const i = this.childNodes.indexOf(c); if (i >= 0) this.childNodes.splice(i, 1); c.parentNode = null; return c }
+  insertBefore(c: any, ref: any) {
+    const i = ref ? this.childNodes.indexOf(ref) : this.childNodes.length
+    this.childNodes.splice(i < 0 ? this.childNodes.length : i, 0, c)
+    c.parentNode = this
+    return c
+  }
+  contains(c: any) {
+    for (let n: any = c; n; n = n.parentNode) if (n === this) return true
+    return false
+  }
+  addEventListener() {}
+  removeEventListener() {}
+  dispatchEvent() {}
+  focus() {}
+  setAttribute(k: string, v: string) { this.attributes[k] = v }
+  removeAttribute(k: string) { delete this.attributes[k] }
+  cloneNode() { return new MockElement() }
+  /** React 写 `<select>` 时会读 `select.options`，给一个可索引的 length 让 updateOptions 不崩。 */
+  get options() {
+    return this.childNodes
+  }
+  /** React 写入 innerHTML；这里读为空即可（断言用别的字段）。 */
+  get innerHTML() { return '' }
+  get outerHTML() { return '' }
+  get textContent() { return '' }
+  set textContent(_v: string) { /* 允许 commit 阶段写入 */ }
+  get value() { return this.attributes.value ?? '' }
+  set value(v: string) { this.attributes.value = v }
+  get firstChild() { return this.childNodes[0] }
+  get lastChild() { return this.childNodes[this.childNodes.length - 1] }
+  get nextSibling() {
+    if (!this.parentNode) return null
+    const i = this.parentNode.childNodes.indexOf(this)
+    return this.parentNode.childNodes[i + 1] ?? null
+  }
+  get previousSibling() {
+    if (!this.parentNode) return null
+    const i = this.parentNode.childNodes.indexOf(this)
+    return this.parentNode.childNodes[i - 1] ?? null
+  }
+}
+function makeWindow() {
+  const w: any = {
+    event: undefined,
+    HTMLIFrameElement,
+    document: undefined as any,
+    navigator: { userAgent: 'node' },
+  }
+  return w
+}
+
+function makeContainer(): MockElement {
+  const doc = new MockDocument()
+  const el = doc.createElement('div') as MockElement
+  return el
+}
+
+function installDomGlobals() {
+  const win = makeWindow()
+  const doc = new MockDocument()
+  doc.defaultView = win
+  win.document = doc
+  ;(globalThis as any).window = win
+  ;(globalThis as any).document = doc
+  ;(globalThis as any).IS_REACT_ACT_ENVIRONMENT = true
+  ;(globalThis as any).MessageChannel = class { port1 = { postMessage() {} }; port2 = { onmessage: null as any, postMessage() {} } }
+  ;(globalThis as any).setImmediate = (cb: (...args: any[]) => void) => Promise.resolve().then(() => cb())
+}
+
+let _installed = false
+function ensureDomGlobals() {
+  if (_installed) return
+  installDomGlobals()
+  _installed = true
+}
+
+// ---- 用例辅助 ----
+
+const project: Project = {
+  id: 'host-1', owner: 'alice', name: '项目P', createdAt: '', updatedAt: '',
+  settings: { 'rdm.projectId': 'domain-7', 'rdm.state': 'ready' },
+}
+
+type CmdHandler = (id: string, params: Record<string, unknown>) => Promise<unknown> | unknown
+
+/** 直接劫持 api.rdmProjectCommand，用 handlers[id] 分别登记每个命令的响应。 */
+function spyCommandBus(handlers: Record<string, CmdHandler>) {
+  const calls: Array<[string, Record<string, unknown>]> = []
+  const original = api.rdmProjectCommand.bind(api)
+  const spy = vi.spyOn(api, 'rdmProjectCommand').mockImplementation(async (_proj: Project, id: string, params: Record<string, unknown> = {}) => {
+    const args: [string, Record<string, unknown>] = [id, params]
+    calls.push(args)
+    if (!handlers[id]) throw new Error(`unexpected command: ${id} (no handler registered)`)
+    return handlers[id](id, params)
+  })
+  return {
+    calls,
+    roleOptionsCalls: () => calls.filter(([id]) => id === 'rdm.role.options'),
+    permCheckCalls: () => calls.filter(([id]) => id === 'rdm.perm.check'),
+    memberListCalls: () => calls.filter(([id]) => id === 'rdm.project.member.list'),
+    restore: () => {
+      spy.mockRestore()
+      ;(api as any).rdmProjectCommand = original
+    },
+  }
+}
+
+let root: Root | null = null
+let container: MockElement | null = null
+
+beforeEach(() => {
+  ensureDomGlobals()
+  renderObserver = {
+    tags: [],
+    reset() { this.tags = [] },
+    append(t: string) { this.tags.push(t) },
+  }
+})
+afterEach(async () => {
+  if (root) {
+    await act(async () => root!.unmount())
+    root = null
+  }
+  container = null
+  renderObserver = null
+  vi.restoreAllMocks()
+})
+
+async function renderAndFlush(element: ReactNode, flushes: number = 3) {
+  container = makeContainer()
+  await act(async () => {
+    root = createRoot(container as any)
+    root!.render(element)
+  })
+  // 反复冲一轮 microtask flush，让 perm.check 的 .then 落进 commit。
+  for (let i = 0; i < flushes; i++) {
+    await act(async () => { await Promise.resolve() })
+  }
+}
+
+/** 助记：累计的 render 标签里「候选专业角色筛选」下拉 = 看到标 'select' + 紧邻的 option 角色字符串。 */
+function sawCandidateRoleFilter(): boolean {
+  if (!renderObserver) return false
+  // React 渲染时按 tag 序列创建 select/option；候选筛选断言只需确保 select 节点创建了。
+  return renderObserver.tags.includes('select')
+}
+
+describe('RdmMembersSection rdm.role.options 授权门控', () => {
+  it('member.manage 未被允许时不得请求 rdm.role.options（普通成员避免 403）', async () => {
+    const bus = spyCommandBus({
+      'rdm.perm.check': () => ({ actions: [{ action: 'member.manage', allowed: false }] }),
+      'rdm.project.member.list': () => ({ members: [], accountDirectoryAvailable: true }),
+    })
+
+    await renderAndFlush(createElement(RdmMembersSection, { project }))
+
+    expect(bus.permCheckCalls().length).toBe(1)
+    expect(bus.roleOptionsCalls().length).toBe(0)
+  })
+
+  it('member.manage 被允许后再请求 rdm.role.options，并把结果写回角色筛选', async () => {
+    const bus = spyCommandBus({
+      'rdm.perm.check': () => ({ actions: [{ action: 'member.manage', allowed: true }] }),
+      'rdm.role.options': () => ({ roles: [
+        { roleId: 'r-eng', name: '工程师' },
+        { roleId: 'r-qa', name: '测试' },
+      ] }),
+      'rdm.project.member.list': () => ({ members: [], accountDirectoryAvailable: true }),
+    })
+
+    await renderAndFlush(createElement(RdmMembersSection, { project }))
+
+    expect(bus.permCheckCalls().length).toBe(1)
+    expect(bus.roleOptionsCalls().length).toBe(1)
+  })
+
+  it('门控生效前的初始挂载阶段不出现专业角色筛选下拉（不提供误导选项）', async () => {
+    // 用一个永挂起的 perm.check 模拟「自省中」——此时页面上确实只见核对提示，
+    // 候选区不出现；这是顺带的渲染回归保单，防止门控未来误把 options 提前注入。
+    // memberManagementView 在 actions===null 时返回 canManage:false，rdm.role.options 因此不发请求；
+    // 同时 candRoleId 筛选（占位 select）也不应渲染——manage.canManage=false 时整个 ad-create 块被跳掉。
+    spyCommandBus({
+      'rdm.perm.check': () => new Promise<{ actions: { action: string; allowed: boolean }[] }>(() => {}),
+      'rdm.project.member.list': () => new Promise<any>(() => {}),
+    })
+
+    await renderAndFlush(createElement(RdmMembersSection, { project }))
+
+    expect(sawCandidateRoleFilter()).toBe(false)
+  })
+})