Commit Graph
3 Commits
Author SHA1 Message Date
weichenandCursor a56d033d3c feat(web): fail-closed capabilities and admin roles from server API
Stop persisting roles to localStorage as authority; AdminSettingsModal reads
and writes role matrices via /api/v1/admin/roles; hasPermission denies when
capabilities are not loaded from /auth/me.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-13 02:50:22 +00:00
WeiCHENandCursor 636eb0ccf1 fix(web): align workbench user ids with auth seed
Unify MOCK_USERS with backend auth (admin id=1), merge session identity on login, and migrate demo seeds/tests to id 2/3/4 for 张工/李/王.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-13 02:50:22 +00:00
WeiCHENandCursor e1c1d03a85 feat(web): wire rbac permission enforcement into left rail and rights modal
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-13 02:50:20 +00:00