PA6 补齐权限与审计回归

client/src/pages/MobileMePage.tsx

@@ -6,7 +6,7 @@ import { fetchEmployeeProfile } from "../api/employees";
 import { mapApiErrorMessage } from "../api/errorMessages";
 import { isApiError } from "../api/types";
 import { useAuth } from "../auth/AuthContext";
-import { hasAnyPermission } from "../auth/permissions";
+import { hasAnyPermission, hasBusinessApproverRole } from "../auth/permissions";
 import { EmployeeAvatar } from "../components/common/EmployeeAvatar";
 import { PageHeader } from "../components/common/PageHeader";
 import { MobileIcon } from "../components/mobile/MobileIcon";
@@ -52,8 +52,15 @@ function MobileActionLink({
 
 export function MobileMePage() {
   const { me, permissions, refreshMe, logout } = useAuth();
-  const canAccessApprovals = hasAnyPermission(permissions, ["expense.approve", "leave.approve", "procurement.approve", "travel.approve"]);
-  const canAccessAdmin = hasAnyPermission(permissions, ["*", "system.settings", "system.users", "report.dashboard.view"]);
+  const canAccessApprovals = hasBusinessApproverRole(me?.roleCodes, permissions);
+  const canAccessAdmin = hasAnyPermission(permissions, [
+    "*",
+    "system.settings",
+    "system.users",
+    "masterdata.manage",
+    "notification.channel.manage",
+    "integration.manage",
+  ]);
   const canAccessAssets = hasAnyPermission(permissions, ["asset.view_own", "asset.view_all", "asset.manage", "asset.transfer", "asset.inventory"]);
   const canAccessProjects = hasAnyPermission(permissions, ["project.view_own", "project.view_all", "project.manage"]);
 

client/src/pages/MobilePortalPage.tsx

@@ -12,13 +12,12 @@ import { fetchNotifications } from "../api/notifications";
 import { isApiError } from "../api/types";
 import { fetchWorkflowTasks } from "../api/workflow";
 import { useAuth } from "../auth/AuthContext";
-import { hasAnyPermission } from "../auth/permissions";
+import { hasAnyPermission, hasBusinessApproverRole } from "../auth/permissions";
 import { PageHeader } from "../components/common/PageHeader";
 import { PageScaffold } from "../components/patterns/PageScaffold";
 import { MobileIcon } from "../components/mobile/MobileIcon";
 import { Button } from "../components/ui/button";
 import {
-  MOBILE_APPROVAL_PERMISSIONS,
   MOBILE_CAPTURE_PERMISSIONS,
   MOBILE_LEAVE_PERMISSIONS,
   MOBILE_REIMBURSEMENT_PERMISSIONS,
@@ -155,8 +154,8 @@ function ActionTile({ action }: { action: MobileAction }) {
 
 export function MobilePortalPage() {
   const queryClient = useQueryClient();
-  const { permissions } = useAuth();
-  const canAccessApprovals = hasAnyPermission(permissions, [...MOBILE_APPROVAL_PERMISSIONS]);
+  const { me, permissions } = useAuth();
+  const canAccessApprovals = hasBusinessApproverRole(me?.roleCodes, permissions);
   const canAccessCapture = hasAnyPermission(permissions, [...MOBILE_CAPTURE_PERMISSIONS]);
   const canAccessLeave = hasAnyPermission(permissions, [...MOBILE_LEAVE_PERMISSIONS]);
   const canAccessReimbursements = hasAnyPermission(permissions, [...MOBILE_REIMBURSEMENT_PERMISSIONS]);
@@ -217,14 +216,16 @@ export function MobilePortalPage() {
   const unreadNotificationCount = notifications.filter((item) => !item.readAt).length;
 
   const actions: MobileAction[] = [
-    {
-      key: "approvals",
-      label: "审批",
-      meta: pendingApprovalCount > 0 ? `${pendingApprovalCount} 条待处理` : "暂无待办",
-      icon: "fact_check",
-      to: "/mobile/approvals",
-      tone: pendingApprovalCount > 0 ? "warning" : "primary",
-    },
+    canAccessApprovals
+      ? {
+          key: "approvals",
+          label: "审批",
+          meta: pendingApprovalCount > 0 ? `${pendingApprovalCount} 条待处理` : "暂无待办",
+          icon: "fact_check",
+          to: "/mobile/approvals",
+          tone: pendingApprovalCount > 0 ? "warning" : "primary",
+        }
+      : null,
     canAccessCapture
       ? {
           key: "capture",