fix(auth): reject consumer-only admin sessions

src/routes/_authed.tsx

@@ -4,7 +4,7 @@ import { useEffect } from 'react'
 import { LogOut, Moon, Sun } from 'lucide-react'
 import { toast } from 'sonner'
 import { fetchMe } from '@/api/modules/auth'
-import { can, isAuthenticated, useAuthStore } from '@/auth/store'
+import { can, hasAdminAccess, isAuthenticated, useAuthStore } from '@/auth/store'
 import { NAV_GROUPS } from '@/components/layout/nav'
 import { Avatar, AvatarFallback, AvatarImage } from '@/components/ui/avatar'
 import { Button } from '@/components/ui/button'
@@ -44,7 +44,7 @@ function AuthedLayout() {
     if (me.data) {
       const roles = me.data.meta?.roles ?? []
       const permissions = me.data.meta?.permissions ?? []
-      if (roles.length === 0 && permissions.length === 0) {
+      if (!hasAdminAccess(roles, permissions)) {
         useAuthStore.getState().clear()
         toast.error('账号未分配管理后台权限，已退出登录')
         void navigate({ to: '/login' })

src/routes/_authed/roles.tsx

@@ -47,7 +47,9 @@ export const Route = createFileRoute('/_authed/roles')({
 
 function RolesPage() {
   const canCreate = useCan(PERM.ROLE_CREATE)
-  const canUpdate = useCan(PERM.ROLE_UPDATE)
+  const canUpdateRole = useCan(PERM.ROLE_UPDATE)
+  const canManagePermissions = useCan(PERM.PERMISSION_MANAGE)
+  const canUpdate = canUpdateRole && canManagePermissions
   const canDelete = useCan(PERM.ROLE_DELETE)
 
   const roles = useQuery({ queryKey: ['roles'], queryFn: fetchRoles })

src/routes/login.tsx

@@ -6,7 +6,7 @@ import { useState } from 'react'
 import { toast } from 'sonner'
 import { loginWithPassword, fetchMe } from '@/api/modules/auth'
 import { ApiError } from '@/api/client'
-import { useAuthStore, isAuthenticated } from '@/auth/store'
+import { hasAdminAccess, useAuthStore, isAuthenticated } from '@/auth/store'
 import { Button } from '@/components/ui/button'
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card'
 import { Input } from '@/components/ui/input'
@@ -46,7 +46,7 @@ function LoginPage() {
       const me = await fetchMe()
       const roles = me.meta?.roles ?? []
       const permissions = me.meta?.permissions ?? []
-      if (roles.length === 0 && permissions.length === 0) {
+      if (!hasAdminAccess(roles, permissions)) {
         useAuthStore.getState().clear()
         toast.error('该账号未分配管理后台权限，无法登录')
         return