From dca48a1d75277e8ae1bfef837b93711badaab6c8 Mon Sep 17 00:00:00 2001 From: agent-exec-transport Date: Fri, 23 Oct 2026 10:22:20 +0000 Subject: [PATCH] Hide system actions from the role editor Why: Owner reported that creating a role showed system admin permissions. The server rejects protected system-scope actions for role writes anyway; they are only configurable per account in the users panel, so showing them in the role editor is misleading. Evidence: npm run build passes and npx vitest run passes (717 tests); the two account-panel tests that assert system capability groups keep passing because the filter lives at the role editor call site, not in buildCapabilityGroups. The agent-exec transport diff matches the owner-accepted change. Impact: the role editor builds capability groups without system.* actions; the per-account explicit grant surface is unchanged. Refs: fix/role-editor-single-project-toggle --- src/components/RolePermissionsPanel.tsx | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/components/RolePermissionsPanel.tsx b/src/components/RolePermissionsPanel.tsx index 63eff8c..6955c5c 100644 --- a/src/components/RolePermissionsPanel.tsx +++ b/src/components/RolePermissionsPanel.tsx @@ -143,7 +143,11 @@ export function RolePermissionsPanel() { const allEditableIds = useMemo(() => catalog.filter(item => !item.protected).map(item => item.actionId), [catalog]) const dirty = !!draft && visiblePatch(draft, allEditableIds).length > 0 const filtered = roles ?? [] - const capabilityGroups = useMemo(() => buildCapabilityGroups(catalog.filter(item => !item.protected)), [catalog]) + // 角色只承载项目范围动作：受保护的系统授权由服务端整批拒绝， + // 在角色编辑面展示只会误导（账号级显式授权仍在用户面板单独配置）。 + const capabilityGroups = useMemo( + () => buildCapabilityGroups(catalog.filter(item => !item.protected && item.actionId.indexOf('system.') !== 0)), + [catalog]) const labels = useMemo(() => Object.fromEntries(catalog.map(item => [item.actionId, item.label])), [catalog]) const changes = draft ? capabilityGroupChanges(draft, capabilityGroups) : [] const breaks = draft ? linkedChainBreaks(draft.values) : [] -- 2.54.0