From 266a0e011fb457bd6d39208ad8c5226ffc4564a3 Mon Sep 17 00:00:00 2001 From: yueli Date: Fri, 17 Jul 2026 15:42:31 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E9=98=B2=E8=87=AA=E9=94=81=20=E2=80=94?= =?UTF-8?q?=20=E6=93=8D=E4=BD=9C=E8=80=85=E4=BF=AE=E6=94=B9=E8=87=AA?= =?UTF-8?q?=E5=B7=B1=E8=A7=92=E8=89=B2=E6=97=B6=E5=BC=BA=E5=88=B6=E4=BF=9D?= =?UTF-8?q?=E7=95=99=20system=5Fpermission=20+=20system=5Fpermission:opera?= =?UTF-8?q?tion?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- inventory-backend/app/api/v1/permission.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/inventory-backend/app/api/v1/permission.py b/inventory-backend/app/api/v1/permission.py index 5c8e410..e258d35 100644 --- a/inventory-backend/app/api/v1/permission.py +++ b/inventory-backend/app/api/v1/permission.py @@ -79,6 +79,14 @@ def assign_perms(): role_code = data.get('role_code') permissions = data.get('permissions', []) + # ★ 防自锁：操作者修改自己角色时，强制保留权限管理的关键权限 + claims = get_jwt() + operator_role = claims.get('role', '') + if operator_role and operator_role.upper() == role_code.upper(): + for required in ('system_permission', 'system_permission:operation'): + if required not in permissions: + permissions.append(required) + company_name = _get_operator_company() PermissionService.assign_permissions(role_code, permissions, company_name=company_name) return jsonify({'code': 200, 'msg': '保存成功'}), 200