From c213b2d9e97a17526bf9d998c1a25d3942c51ec5 Mon Sep 17 00:00:00 2001
From: zhenhui <1276357500@qq.com>
Date: Wed, 15 Apr 2026 17:46:00 +0800
Subject: [PATCH] =?UTF-8?q?[=E6=B8=A0=E9=81=93=E7=AE=A1=E7=90=86]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/common/controller/Backend.php | 33 +++++++++++++++++++++++++++++--
 1 file changed, 31 insertions(+), 2 deletions(-)

diff --git a/app/common/controller/Backend.php b/app/common/controller/Backend.php
index 6fad10d..e0f8249 100644
--- a/app/common/controller/Backend.php
+++ b/app/common/controller/Backend.php
@@ -153,8 +153,15 @@ class Backend extends Api
             }
             if ($needPermission) {
                 $controllerPath = $this->getControllerPath($request);
-                $routePath = $controllerPath . '/' . $action;
-                if (!$this->auth->check($routePath)) {
+                $routePaths = $this->buildPermissionRoutePaths($controllerPath, $action);
+                $pass = false;
+                foreach ($routePaths as $routePath) {
+                    if ($this->auth->check($routePath)) {
+                        $pass = true;
+                        break;
+                    }
+                }
+                if (!$pass) {
                     return $this->error(__('You have no permission'), [], 401);
                 }
             }
@@ -467,4 +474,26 @@ class Backend extends Api
     {
         return get_controller_path($request);
     }
+
+    /**
+     * 构造权限节点候选：兼容 snake_case 与 camelCase 节点名
+     *
+     * @return string[]
+     */
+    protected function buildPermissionRoutePaths(string $controllerPath, string $action): array
+    {
+        $paths = [];
+        $paths[] = $controllerPath . '/' . $action;
+
+        $parts = explode('/', $controllerPath);
+        foreach ($parts as &$part) {
+            if (str_contains($part, '_')) {
+                $part = lcfirst(str_replace(' ', '', ucwords(str_replace('_', ' ', $part))));
+            }
+        }
+        $camelControllerPath = implode('/', $parts);
+        $paths[] = $camelControllerPath . '/' . $action;
+
+        return array_values(array_unique($paths));
+    }
 }