feat(rbac): define rbac data contracts and extend deliverable and user types

Co-authored-by: Cursor <cursoragent@cursor.com>

web/src/types/docgov.ts

@@ -1,3 +1,5 @@
+import { PermissionKey } from './rbac';
+
 export type DocLifecycleState =
   | 'template'
   | 'drafting'
@@ -25,6 +27,8 @@ export interface UserProfile {
   department: string;
   position: string; // 固定职位，不随项目改变
   avatar?: string;
+  roleId?: string; // 关联的全局唯一角色ID (如 'role-admin', 'role-director', 'role-engineer')
+  customPermissions?: PermissionKey[]; // 用户个人级特例微调权限
   role?: UserRole; // 兼容旧接口
   title?: string; // 兼容旧接口
   projectPermissions?: Record<string, DocPermissionRole>; // docId -> role

web/src/types/rbac.ts

@@ -0,0 +1,34 @@
+export type PermissionKey =
+  | 'project:create'             // 创建新项目/立项
+  | 'project:assign_lead'        // 设置/变更文档责任人(编制/审核/批准)
+  | 'perm:manage'                // 系统权限与角色管理配置 (进入管理中心增删改角色)
+  | 'workflow:config_visibility' // 配置工作流默认可见性
+  | 'doc:override_visibility'    // 配置单文档可见性覆盖
+  | 'doc:export'                 // 导出受控交付物(DOCX/XLSX)
+  | 'workflow:view_all';         // 默认查阅常规工作流文档
+
+export interface RoleDefinition {
+  id: string;                    // 唯一标识：如 'role-admin', 'role-director', 'role-engineer'
+  name: string;                  // 显示名称：如 "系统管理员", "研发总监", "方案工程师"
+  code: string;                  // 唯一代码：如 "ADMIN", "DIRECTOR", "ENGINEER"
+  description: string;           // 职责描述
+  isSystem?: boolean;            // 系统内置防死锁标记 (内置角色不可被删除)
+  permissions: PermissionKey[];  // 默认拥有的全局权限集
+  createdAt: string;
+  updatedAt: string;
+}
+
+export type VisibilityMode =
+  | 'inherit'           // 默认：继承工作流/阶段默认可见性
+  | 'role_whitelist'    // 覆盖：仅指定全局角色可见 (如仅总监、质保QA)
+  | 'designated_only'   // 覆盖：严格收紧，仅该文档当前的三权责任人可见
+  | 'public';           // 覆盖：放宽，所有成员均可查阅
+
+export interface DocVisibilityRule {
+  mode: VisibilityMode;
+  allowedRoleIds?: string[];     // 当 mode === 'role_whitelist' 时生效
+  allowedUserIds?: number[];     // 特例用户白名单 (例如特聘临床专家)
+  overrideReason?: string;       // 覆盖原因说明 (合规留痕审计)
+  configuredBy?: string;         // 设置人姓名
+  configuredAt?: string;         // 设置时间
+}

web/src/types/workbench.ts

@@ -1,4 +1,5 @@
 import { DocLifecycleState, UserRole } from './docgov';
+import { DocVisibilityRule } from './rbac';
 
 export type StageKey = 'V0.1' | 'V0.5' | 'V1.0';
 
@@ -113,6 +114,7 @@ export interface DeliverableItem {
   updatedAt: string;
   summary?: string;
   sourceMessageSnippet?: string;
+  visibilityRule?: DocVisibilityRule;
 }
 
 export interface WorkbenchState {