PA6 补齐权限与审计回归

client/src/router/guards.tsx

@@ -1,7 +1,7 @@
 import type { PropsWithChildren } from "react";
 import { Navigate, useLocation } from "react-router-dom";
 import { useAuth } from "../auth/AuthContext";
-import { hasAnyPermission } from "../auth/permissions";
+import { hasAnyPermission, hasBusinessApproverRole } from "../auth/permissions";
 import { resolveDefaultWorkspacePath } from "../lib/runtimeContext";
 import { isOfflineSnapshotAllowedPath } from "../pwa";
 
@@ -78,3 +78,17 @@ export function RequirePermission({
 
   return <>{children}</>;
 }
+
+export function RequireBusinessApprover({ children }: PropsWithChildren) {
+  const { me, permissions, ready } = useAuth();
+
+  if (!ready) {
+    return <FullPageLoading />;
+  }
+
+  if (!hasBusinessApproverRole(me?.roleCodes, permissions)) {
+    return <Navigate to="/403" replace />;
+  }
+
+  return <>{children}</>;
+}

client/src/router/index.tsx

@@ -68,7 +68,7 @@ import {
   WorkflowTaskDetailPage,
   WorkflowTasksPage,
 } from "./lazy";
-import { GuestOnly, RequireAuth, RequirePermission } from "./guards";
+import { GuestOnly, RequireAuth, RequireBusinessApprover, RequirePermission } from "./guards";
 
 function withRouteFallback(node: ReactNode) {
   return <Suspense fallback={<RoutePageFallback />}>{node}</Suspense>;
@@ -277,18 +277,18 @@ export function AppRouter() {
         <Route
           path="workflow/tasks"
           element={
-            <RequirePermission anyOf={["expense.approve", "leave.approve", "procurement.approve", "travel.approve"]}>
+            <RequireBusinessApprover>
               {withRouteFallback(<WorkflowTasksPage />)}
-            </RequirePermission>
+            </RequireBusinessApprover>
           }
         />
 
         <Route
           path="workflow/tasks/:taskId"
           element={
-            <RequirePermission anyOf={["expense.approve", "leave.approve", "procurement.approve", "travel.approve"]}>
+            <RequireBusinessApprover>
               {withRouteFallback(<WorkflowTaskDetailPage />)}
-            </RequirePermission>
+            </RequireBusinessApprover>
           }
         />
 
@@ -358,7 +358,11 @@ export function AppRouter() {
 
         <Route
           path="mobile/approvals"
-          element={withRouteFallback(<MobileApprovalsPage />)}
+          element={
+            <RequireBusinessApprover>
+              {withRouteFallback(<MobileApprovalsPage />)}
+            </RequireBusinessApprover>
+          }
         />
 
         <Route path="notifications" element={withRouteFallback(<NotificationsPage />)} />
@@ -485,7 +489,7 @@ export function AppRouter() {
         <Route
           path="system/settings"
           element={
-            <RequirePermission anyOf={["system.settings", "system.users", "masterdata.view", "masterdata.manage", "notification.channel.manage", "integration.manage"]}>
+            <RequirePermission anyOf={["system.settings", "system.users", "masterdata.manage", "notification.channel.manage", "integration.manage"]}>
               {withRouteFallback(<SystemSettingsPage />)}
             </RequirePermission>
           }