feat: add account self-service safeguards

backend/apps/accounts/tests/test_auth_api.py

@@ -1,4 +1,5 @@
 from django.contrib.auth import get_user_model
+from django.contrib.auth.models import Group, Permission
 from django.core.management import call_command
 
 
@@ -18,7 +19,24 @@ def test_login_me_and_logout_flow(client, db):
     payload = me.json()
     assert payload["username"] == "admin"
     assert "system.user.manage" in payload["permissions"]
-    assert any(menu["code"] == "system" for menu in payload["menus"])
+    assert [menu["code"] for menu in payload["menus"]] == [
+        "workbench",
+        "business",
+        "knowledge",
+        "platform",
+        "system",
+    ]
+    knowledge = next(menu for menu in payload["menus"] if menu["code"] == "knowledge")
+    assert [item["code"] for item in knowledge["children"]] == [
+        "platform.knowledge",
+        "knowledge.search",
+        "business.solutions",
+    ]
+    assert not any(
+        item["code"] == "workbench.overview"
+        for menu in payload["menus"]
+        for item in menu["children"]
+    )
 
     logout = client.post("/api/accounts/auth/logout")
     assert logout.status_code == 200
@@ -35,3 +53,22 @@ def test_login_rejects_invalid_password(client, db):
     )
 
     assert response.status_code == 401
+
+
+def test_current_user_menu_tree_excludes_unauthorized_second_level_pages(client, db):
+    call_command("bootstrap_governance")
+    role = Group.objects.create(name="仅工单查看")
+    role.permissions.add(Permission.objects.get(codename="ticket.view"))
+    user = get_user_model().objects.create_user(username="ticket-reader", password="password")
+    user.groups.add(role)
+
+    login = client.post(
+        "/api/accounts/auth/login",
+        data={"username": "ticket-reader", "password": "password"},
+        content_type="application/json",
+    )
+    assert login.status_code == 200
+
+    payload = client.get("/api/accounts/auth/me").json()
+    children = [item["code"] for menu in payload["menus"] for item in menu["children"]]
+    assert children == ["business.tickets", "system.design"]