OAPERM1 收紧启用前权限冻结

server/src/routes/performance.js

@@ -25,6 +25,7 @@ const SCORE_SCHEMA = z
   .refine((value) => Number.isFinite(value) && Math.abs(value * 2 - Math.round(value * 2)) < 1e-9, {
     message: "invalid_score_step",
   });
+const PERFORMANCE_MANAGE_PERMISSION = "system.settings";
 
 const CYCLE_CREATE_SCHEMA = z
   .object({
@@ -212,15 +213,9 @@ function mapReview(review) {
 }
 
 function resolveViewerRole(fastify, request, employee) {
-  if (fastify.hasPermission(request.employee, "system.users")) {
+  if (fastify.hasPermission(request.employee, PERFORMANCE_MANAGE_PERMISSION)) {
     return "admin";
   }
-  if (request.employee.id === employee.id) {
-    return "self";
-  }
-  if (employee.direct_manager_id && employee.direct_manager_id === request.employee.id) {
-    return "manager";
-  }
   return null;
 }
 
@@ -386,8 +381,8 @@ async function buildEmployeeTimeline(prisma, employeeId, viewerRole) {
 async function performanceRoutes(fastify) {
   fastify.get("/performance/cycles", { preHandler: fastify.authenticate }, async (request, reply) => {
     await ensureFeatureEnabled(fastify, request);
-    if (!fastify.hasPermission(request.employee, "system.users")) {
-      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403, details: { permission: "system.users" } });
+    if (!fastify.hasPermission(request.employee, PERFORMANCE_MANAGE_PERMISSION)) {
+      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403, details: { permission: PERFORMANCE_MANAGE_PERMISSION } });
     }
 
     const cycles = await fastify.prisma.performanceReviewCycle.findMany();
@@ -398,8 +393,8 @@ async function performanceRoutes(fastify) {
 
   fastify.post("/performance/cycles", { preHandler: fastify.authenticate }, async (request, reply) => {
     await ensureFeatureEnabled(fastify, request);
-    if (!fastify.hasPermission(request.employee, "system.users")) {
-      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403, details: { permission: "system.users" } });
+    if (!fastify.hasPermission(request.employee, PERFORMANCE_MANAGE_PERMISSION)) {
+      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403, details: { permission: PERFORMANCE_MANAGE_PERMISSION } });
     }
 
     const body = parseBody(CYCLE_CREATE_SCHEMA, request.body);
@@ -431,8 +426,8 @@ async function performanceRoutes(fastify) {
 
   fastify.patch("/performance/cycles/:cycleId", { preHandler: fastify.authenticate }, async (request, reply) => {
     await ensureFeatureEnabled(fastify, request);
-    if (!fastify.hasPermission(request.employee, "system.users")) {
-      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403, details: { permission: "system.users" } });
+    if (!fastify.hasPermission(request.employee, PERFORMANCE_MANAGE_PERMISSION)) {
+      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403, details: { permission: PERFORMANCE_MANAGE_PERMISSION } });
     }
 
     const cycleId = parseId(request.params?.cycleId);
@@ -508,8 +503,8 @@ async function performanceRoutes(fastify) {
 
   fastify.get("/performance/cycles/:cycleId/reviews", { preHandler: fastify.authenticate }, async (request, reply) => {
     await ensureFeatureEnabled(fastify, request);
-    if (!fastify.hasPermission(request.employee, "system.users")) {
-      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403, details: { permission: "system.users" } });
+    if (!fastify.hasPermission(request.employee, PERFORMANCE_MANAGE_PERMISSION)) {
+      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403, details: { permission: PERFORMANCE_MANAGE_PERMISSION } });
     }
 
     const cycleId = parseId(request.params?.cycleId);