feat: consolidate ticket domain baseline

backend/apps/accounts/permissions.py

@@ -15,17 +15,30 @@ PERMISSIONS: tuple[PermissionSpec, ...] = (
     PermissionSpec("ticket.edit", "编辑工单", "工单"),
     PermissionSpec("ticket.export", "导出工单", "工单"),
     PermissionSpec("ticket.assign", "分派工单", "工单"),
+    PermissionSpec("ticket.resolve", "解决工单", "工单"),
+    PermissionSpec("ticket.reply", "确认客户回复", "工单"),
     PermissionSpec("ticket.close", "关闭工单", "工单"),
+    PermissionSpec("ticket.archive", "归档工单", "工单"),
     PermissionSpec("solution.view", "查看解决方案", "解决方案"),
     PermissionSpec("solution.manage", "管理解决方案", "解决方案"),
+    PermissionSpec("solution.submit", "提交解决方案审核", "解决方案"),
+    PermissionSpec("solution.review", "审核与发布解决方案", "解决方案"),
     PermissionSpec("knowledge.view", "查看知识库", "知识库"),
     PermissionSpec("knowledge.manage", "管理知识库", "知识库"),
+    PermissionSpec("knowledge.submit", "提交知识审核", "知识库"),
+    PermissionSpec("knowledge.review", "审核与发布知识", "知识库"),
     PermissionSpec("agent.use", "使用 Agent", "AI 平台"),
     PermissionSpec("agent.manage", "管理 Agent", "AI 平台"),
     PermissionSpec("agent.run.view", "查看 Agent 运行", "AI 平台"),
     PermissionSpec("model.manage", "管理模型配置", "AI 平台"),
     PermissionSpec("skill.manage", "管理 Skill", "AI 平台"),
+    PermissionSpec("tool.view", "查看工具目录", "AI 平台"),
+    PermissionSpec("tool.invoke", "调用已授权工具", "AI 平台"),
+    PermissionSpec("tool.confirm", "确认高风险工具调用", "AI 平台"),
     PermissionSpec("tool.manage", "管理 MCP 工具", "AI 平台"),
+    PermissionSpec("channel.view", "查看渠道消息", "渠道"),
+    PermissionSpec("channel.send", "发送渠道消息", "渠道"),
+    PermissionSpec("channel.manage", "管理渠道适配器", "渠道"),
     PermissionSpec("system.user.view", "查看用户", "系统治理"),
     PermissionSpec("system.user.manage", "管理用户", "系统治理"),
     PermissionSpec("system.user_group.view", "查看用户组", "系统治理"),
@@ -44,9 +57,15 @@ DEFAULT_GROUPS: dict[str, tuple[str, ...]] = {
         "ticket.view",
         "knowledge.view",
         "knowledge.manage",
+        "knowledge.submit",
+        "knowledge.review",
         "solution.view",
         "solution.manage",
+        "solution.submit",
+        "solution.review",
         "agent.use",
+        "tool.view",
+        "channel.view",
     ),
     "技术支持": (
         "ticket.view",
@@ -54,17 +73,45 @@ DEFAULT_GROUPS: dict[str, tuple[str, ...]] = {
         "ticket.ai_draft",
         "ticket.edit",
         "ticket.assign",
+        "ticket.resolve",
+        "ticket.reply",
         "ticket.close",
         "knowledge.view",
+        "knowledge.manage",
+        "knowledge.submit",
         "solution.view",
+        "solution.manage",
+        "solution.submit",
         "agent.use",
+        "tool.view",
+        "tool.invoke",
+        "channel.view",
+        "channel.send",
     ),
-    "普通建单人": (
+    "技术支持负责人": (
         "ticket.view",
         "ticket.create",
         "ticket.ai_draft",
+        "ticket.edit",
+        "ticket.export",
+        "ticket.assign",
+        "ticket.resolve",
+        "ticket.reply",
+        "ticket.close",
+        "ticket.archive",
         "knowledge.view",
+        "knowledge.manage",
+        "knowledge.submit",
         "solution.view",
+        "solution.manage",
+        "solution.submit",
+        "agent.use",
+        "agent.run.view",
+        "tool.view",
+        "tool.invoke",
+        "tool.confirm",
+        "channel.view",
+        "channel.send",
     ),
     "只读审计员": (
         "ticket.view",

backend/apps/accounts/tests/test_permission_enforcement.py

@@ -19,9 +19,9 @@ def test_anonymous_ticket_list_is_denied(client, db):
     assert response.status_code == 401
 
 
-def test_user_with_ticket_view_can_list_tickets(client, db):
+def test_support_user_with_ticket_view_can_list_tickets(client, db):
     Ticket.objects.create(ticket_no="TK202607010001", title="A", description="A")
-    client.force_login(user_with_role("普通建单人"))
+    client.force_login(user_with_role("技术支持"))
 
     response = client.get("/api/tickets")
 
@@ -42,7 +42,7 @@ def test_user_without_ticket_create_cannot_create_ticket(client, db):
 
 
 def test_user_with_solution_view_can_list_solutions(client, db):
-    client.force_login(user_with_role("普通建单人"))
+    client.force_login(user_with_role("技术支持"))
 
     response = client.get("/api/solutions")
 
@@ -57,7 +57,7 @@ def test_audit_log_requires_audit_permission(client, db):
         target_id="health",
         result="success",
     )
-    client.force_login(user_with_role("普通建单人"))
+    client.force_login(user_with_role("技术支持"))
 
     denied = client.get("/api/audit/operation-logs")
     assert denied.status_code == 403