From 8bab5e094ffa5b7c3e1a4e8b66dd1a77894c7e52 Mon Sep 17 00:00:00 2001
From: shaohuzhang1 <shaohu.zhang@fit2cloud.com>
Date: Thu, 17 Sep 2026 17:05:43 +0800
Subject: [PATCH] fix: UI permissions

---
 .../auth/constants/permission_constants.py    |  4 +-
 ui/src/layout/sidebar/SystemSidebar.vue       | 95 +++++++++++--------
 ui/src/permission/core/common.ts              | 11 ++-
 3 files changed, 61 insertions(+), 49 deletions(-)

diff --git a/apps/common/auth/constants/permission_constants.py b/apps/common/auth/constants/permission_constants.py
index e9a38ea47fb..3b57a937592 100644
--- a/apps/common/auth/constants/permission_constants.py
+++ b/apps/common/auth/constants/permission_constants.py
@@ -92,12 +92,12 @@ class PermissionConstants(Enum):
 
     SYSTEM_HOMEPAGE_READ = (
         Permission(group=Group.HOMEPAGE, sub_group=Group.HOMEPAGE, operate=Operate.READ, bit_index=0),
-        PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM),
+        PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM, scope=[PermissionScopeConstants.SYSTEM]),
     )
 
     SYSTEM_HOMEPAGE_EXPORT = (
         Permission(group=Group.HOMEPAGE, sub_group=Group.HOMEPAGE, operate=Operate.EXPORT, bit_index=1),
-        PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM),
+        PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM, scope=[PermissionScopeConstants.SYSTEM]),
     )
 
     # ==================== 资源主分组（无子分组） ====================
diff --git a/ui/src/layout/sidebar/SystemSidebar.vue b/ui/src/layout/sidebar/SystemSidebar.vue
index ccaf448a991..1de9c200591 100644
--- a/ui/src/layout/sidebar/SystemSidebar.vue
+++ b/ui/src/layout/sidebar/SystemSidebar.vue
@@ -18,40 +18,36 @@ const getSystemMenuIcon = (systemMenuItem: LayoutMenuItem) => (isSystemMenuActiv
 <template>
   <div class="mk-system-sidebar flex h-full flex-col">
     <el-scrollbar class="min-h-0 flex-1">
-      <el-menu
-        class="mt-2!"
-        :class="props.collapsed ? 'px-3.5!' : 'px-4!'"
-        :collapse="props.collapsed"
-        :collapse-transition="false"
-        :default-active="route.path"
-        router
-        :persistent="false"
-      >
-        <template v-for="item in systemMenuItems" :key="item.name" >
-          <template v-if="item.permission? item.permission():true">
-          <!-- 有子菜单 -->
-          <el-sub-menu v-if="item.children?.length && item.route" :index="router.resolve(item.route).path" popper-class="mk-system-sidebar-menu-popper">
-            <template #title>
+      <el-menu class="mt-2!" :class="props.collapsed ? 'px-3.5!' : 'px-4!'" :collapse="props.collapsed"
+        :collapse-transition="false" :default-active="route.path" router :persistent="false">
+        <template v-for="item in systemMenuItems" :key="item.name">
+          <template v-if="item.permission ? item.permission() : true">
+            <!-- 有子菜单 -->
+            <el-sub-menu v-if="item.children?.length && item.route" :index="router.resolve(item.route).path"
+              popper-class="mk-system-sidebar-menu-popper">
+              <template #title>
+                <MkIcon v-if="item.icon" :name="getSystemMenuIcon(item)" :size="18" />
+                <span>{{ item.label }}</span>
+              </template>
+              <el-menu-item-group>
+                <template #title v-if="props.collapsed"><span>{{ item.label }}</span></template>
+                <template v-for="child in item.children" :key="child.name">
+                  <template v-if="child.permission ? child.permission() : true">
+                    <el-menu-item :index="child.route ? router.resolve(child.route).path : child.name">
+                      {{ child.label }}
+                    </el-menu-item>
+                  </template>
+                </template>
+              </el-menu-item-group>
+            </el-sub-menu>
+            <!-- 无子菜单 -->
+            <el-menu-item v-else :index="item.route ? router.resolve(item.route).path : item.name">
               <MkIcon v-if="item.icon" :name="getSystemMenuIcon(item)" :size="18" />
-              <span>{{ item.label }}</span>
-            </template>
-            <el-menu-item-group>
-              <template #title v-if="props.collapsed"
-                ><span>{{ item.label }}</span></template
-              >
-              <el-menu-item v-for="child in item.children" :key="child.name" :index="child.route ? router.resolve(child.route).path : child.name">
-                {{ child.label }}
-              </el-menu-item>
-            </el-menu-item-group>
-          </el-sub-menu>
-          <!-- 无子菜单 -->
-          <el-menu-item v-else :index="item.route ? router.resolve(item.route).path : item.name">
-            <MkIcon v-if="item.icon" :name="getSystemMenuIcon(item)" :size="18" />
-            <template #title>{{ item.label }}</template>
-          </el-menu-item>
+              <template #title>{{ item.label }}</template>
+            </el-menu-item>
 
           </template>
-         
+
         </template>
       </el-menu>
     </el-scrollbar>
@@ -61,14 +57,12 @@ const getSystemMenuIcon = (systemMenuItem: LayoutMenuItem) => (isSystemMenuActiv
     </div>
     <!-- 收起导航按钮 -->
     <div :class="props.collapsed ? 'px-3.5' : 'px-4'" class="py-2">
-      <button
-        type="button"
-        :class="props.collapsed ? 'p-2.75' : 'px-2 p-2.75'"
+      <button type="button" :class="props.collapsed ? 'p-2.75' : 'px-2 p-2.75'"
         class="mk-system-sidebar-toggle flex w-full cursor-pointer items-center gap-2 rounded-md"
-        @click="emit('toggle')"
-      >
+        @click="emit('toggle')">
         <MkIcon name="icon_side-fold_outlined" :size="18" :class="props.collapsed && 'rotate-180'" />
-        <span class="whitespace-nowrap transition-opacity duration-100" :class="props.collapsed ? 'opacity-0' : 'delay-200 opacity-100'"> 收起导航 </span>
+        <span class="whitespace-nowrap transition-opacity duration-100"
+          :class="props.collapsed ? 'opacity-0' : 'delay-200 opacity-100'"> 收起导航 </span>
       </button>
     </div>
   </div>
@@ -76,6 +70,7 @@ const getSystemMenuIcon = (systemMenuItem: LayoutMenuItem) => (isSystemMenuActiv
 <style lang="scss">
 .mk-system-sidebar,
 .mk-system-sidebar-menu-popper {
+
   /* menu */
   .el-menu {
     background: none !important;
@@ -87,24 +82,29 @@ const getSystemMenuIcon = (systemMenuItem: LayoutMenuItem) => (isSystemMenuActiv
       gap: calc(var(--spacing) * 1);
     }
   }
+
   .el-menu-item {
     border-radius: var(--el-border-radius-base);
     color: var(--el-text-color-primary);
     height: auto;
     line-height: 18px;
     padding: 11px calc(var(--spacing) * 2) !important;
+
     [class^='el-icon'] {
       margin-right: calc(var(--spacing) * 2);
     }
+
     &:hover {
       background-color: var(--mk-N900-transparent-10);
     }
+
     &.is-active {
       background-color: white;
       color: var(--mk-primary);
       font-weight: 500;
     }
   }
+
   // 子菜单
   .el-sub-menu {
     display: flex;
@@ -117,53 +117,62 @@ const getSystemMenuIcon = (systemMenuItem: LayoutMenuItem) => (isSystemMenuActiv
       height: auto;
       line-height: 18px;
       padding: 11px calc(var(--spacing) * 2) !important;
+
       &:hover {
         background-color: var(--mk-N900-transparent-10);
       }
     }
+
     .el-icon {
       margin-right: calc(var(--spacing) * 2);
       width: auto;
     }
+
     .el-menu-item {
       height: auto;
       line-height: 18px;
       padding: 11px calc(var(--spacing) * 2) !important;
       padding-left: 34px !important;
     }
+
     .el-sub-menu__icon-arrow {
       font-size: 16px;
       margin-top: calc(var(--spacing) * -2);
       right: 0;
     }
   }
+
   .el-menu-item-group {
-    > ul {
+    >ul {
       display: flex;
       flex-direction: column;
       gap: calc(var(--spacing) * 1);
     }
+
     &__title {
       padding: 9px calc(var(--spacing) * 4) !important;
       font-size: var(--mk-font-size-base);
       color: var(--el-text-color-regular);
     }
   }
+
   // 菜单收起
   .el-menu--collapse {
-    > .el-menu-item {
+    >.el-menu-item {
       min-height: calc(var(--spacing) * 10);
+
       .el-menu-tooltip__trigger {
         padding: 11px !important;
       }
     }
 
-    > .el-sub-menu {
-      > .el-sub-menu__title {
+    >.el-sub-menu {
+      >.el-sub-menu__title {
         min-height: calc(var(--spacing) * 10);
         padding: 11px !important;
       }
-      &.is-active > .el-sub-menu__title {
+
+      &.is-active>.el-sub-menu__title {
         background-color: white;
       }
     }
@@ -180,10 +189,12 @@ const getSystemMenuIcon = (systemMenuItem: LayoutMenuItem) => (isSystemMenuActiv
   background-color: var(--mk-N200);
   background-image: rgb(var(--mk-primary-rgb) / 5%);
   border-radius: var(--el-border-radius-base);
+
   .el-menu {
     padding: calc(var(--spacing) * 2);
     border-radius: var(--el-border-radius-base);
   }
+
   .el-menu-item {
     padding: 9px calc(var(--spacing) * 4) !important;
   }
diff --git a/ui/src/permission/core/common.ts b/ui/src/permission/core/common.ts
index 3723aa68bb1..75406db0e09 100644
--- a/ui/src/permission/core/common.ts
+++ b/ui/src/permission/core/common.ts
@@ -236,10 +236,11 @@ export class Permission {
 
   /** 非资源权限 key，对应后端 `Permission.__str__`。 */
   toString(): string {
-    const sub = this.subGroup !== this.group ? `_${this.subGroup}` : ''
-    const flag = this.flag ? `_${this.flag}` : ''
-    return `${this.group}${sub}_${this.operate}${flag}`
-  }
+  const sub = this.subGroup !== this.group ? `_${this.subGroup}` : ''
+  const flag = this.flag ? `_${this.flag}` : ''
+  const operate = this.operate ? `:${this.operate}` : ''
+  return `${this.group}${sub}${operate}${flag}`
+}
 
   /** 资源级权限 key，对应后端 `Permission.get_resource_permission_key`。 */
   getResourcePermissionKey(): string {
@@ -250,7 +251,7 @@ export class Permission {
 
   /** 判定时使用的最终 key，对应后端 `AggregatePermission._match_permission`。 */
   toPermissionKey(): string {
-    return this.resourceId ? this.getResourcePermissionKey() : this.toString()
+    return this.resourceId ? this.getResourcePermissionKey() : this.group
   }
 
   /** 基于上下文派生出带 workspace / resource 的权限副本。 */