fix(admin): 收紧 isSuper、plan-prices RBAC 与封禁状态机

避免 roles.write 绕过全部 can()；定价读写挂 membership.plans 权限；去掉快捷封禁双路径并让 ban/unban 走 lifecycle。 Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-13 01:56:00 +08:00
parent 62cd8c45dd
commit 0d50c0ee73
10 changed files with 44 additions and 64 deletions
@@ -37,7 +37,7 @@ async function onLogout() {
        <RouterLink to="/cms">CMS</RouterLink>
        <RouterLink to="/catalogs">目录仓</RouterLink>
        <RouterLink to="/orders">订单</RouterLink>
-        <RouterLink v-if="auth.isSuper" to="/pricing">定价</RouterLink>
+        <RouterLink v-if="auth.can('admin.membership.plans.read')" to="/pricing">定价</RouterLink>
        <RouterLink to="/push">推送</RouterLink>
        <RouterLink v-if="auth.isSuper" to="/admins">管理员</RouterLink>
        <RouterLink to="/audit">审计</RouterLink>