feat: 重构管理员权限管理，移除 AdminPermission 模型，整合权限与角色管理逻辑，优化 API 接口以支持角色与权限的同步，增强数据库填充器以对齐权限配置

tests/Feature/AdminPhase15OperationsTest.php

@@ -1,14 +1,15 @@
 <?php
 
 use App\Lottery\ErrorCode;
-use App\Models\AdminPermission;
 use App\Models\AdminRole;
 use App\Models\AdminUser;
 use App\Models\AuditLog;
 use App\Models\ReconcileJob;
 use App\Models\ReportJob;
 use App\Services\AuditLogger;
+use App\Support\AdminPermissionBridge;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
 
 uses(RefreshDatabase::class);
@@ -90,8 +91,16 @@ test('reconcile job create with items and nested items index', function (): void
 
 test('admin without report permission receives 403 on report-jobs', function (): void {
     $role = AdminRole::query()->create(['slug' => 'auditor_test', 'name' => 'Auditor Test']);
-    $perm = AdminPermission::query()->create(['slug' => 'prd.audit.finance', 'name' => '§8 审计日志·资金相关']);
-    $role->permissions()->sync([(int) $perm->getKey()]);
+    $ids = DB::table('admin_menu_actions')
+        ->whereIn('permission_code', AdminPermissionBridge::menuActionCodesForLegacy('prd.audit.finance'))
+        ->where('status', 1)
+        ->pluck('id');
+    foreach ($ids as $mid) {
+        DB::table('admin_role_menu_actions')->insert([
+            'role_id' => $role->id,
+            'menu_action_id' => (int) $mid,
+        ]);
+    }
 
     $user = AdminUser::query()->create([
         'username' => 'auditor_only',
@@ -100,7 +109,13 @@ test('admin without report permission receives 403 on report-jobs', function ():
         'password' => Hash::make('pw-audit'),
         'status' => 0,
     ]);
-    $user->roles()->sync([(int) $role->getKey()]);
+    $siteId = AdminUser::defaultAdminSiteId();
+    $user->roles()->sync([
+        (int) $role->id => [
+            'site_id' => $siteId,
+            'granted_at' => now(),
+        ],
+    ]);
 
     $token = $user->createToken('test', ['*'], now()->addDay())->plainTextToken;
 

tests/Feature/AdminUserPermissionApiTest.php

@@ -1,10 +1,11 @@
 <?php
 
 use App\Lottery\ErrorCode;
-use App\Models\AdminPermission;
 use App\Models\AdminRole;
 use App\Models\AdminUser;
+use App\Support\AdminPermissionBridge;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
 
 uses(RefreshDatabase::class);
@@ -24,22 +25,36 @@ function makeAdminWithPermissions(string $username, array $permissionSlugs): str
         'name' => 'Role '.$username,
     ]);
 
+    $codes = [];
     foreach ($permissionSlugs as $slug) {
-        $permission = AdminPermission::query()->firstOrCreate(
-            ['slug' => $slug],
-            ['name' => $slug],
-        );
-        $role->permissions()->syncWithoutDetaching([(int) $permission->id]);
+        $codes = array_merge($codes, AdminPermissionBridge::menuActionCodesForLegacy($slug));
+    }
+    $codes = array_values(array_unique($codes));
+    $ids = DB::table('admin_menu_actions')
+        ->whereIn('permission_code', $codes)
+        ->where('status', 1)
+        ->pluck('id')
+        ->all();
+
+    foreach ($ids as $mid) {
+        DB::table('admin_role_menu_actions')->insert([
+            'role_id' => $role->id,
+            'menu_action_id' => (int) $mid,
+        ]);
     }
 
-    $admin->roles()->syncWithoutDetaching([(int) $role->id]);
+    $siteId = AdminUser::defaultAdminSiteId();
+    $admin->roles()->sync([
+        (int) $role->id => [
+            'site_id' => $siteId,
+            'granted_at' => now(),
+        ],
+    ]);
 
     return $admin->createToken('test', ['*'], now()->addDay())->plainTextToken;
 }
 
 test('admin user permission apis require rbac permission', function (): void {
-    AdminPermission::query()->create(['slug' => 'prd.admin_user.manage', 'name' => 'admin manage']);
-
     $token = makeAdminWithPermissions('rbac_viewer', ['prd.report.player']);
 
     $this->withHeader('Authorization', 'Bearer '.$token)
@@ -49,10 +64,6 @@ test('admin user permission apis require rbac permission', function (): void {
 });
 
 test('admin can list users and sync direct permissions', function (): void {
-    $manage = AdminPermission::query()->create(['slug' => 'prd.admin_user.manage', 'name' => 'admin manage']);
-    $report = AdminPermission::query()->create(['slug' => 'prd.report.player', 'name' => 'report player']);
-    $draw = AdminPermission::query()->create(['slug' => 'prd.draw_result.view', 'name' => 'draw view']);
-
     $token = makeAdminWithPermissions('rbac_manager', ['prd.admin_user.manage']);
 
     $target = AdminUser::query()->create([
@@ -63,14 +74,33 @@ test('admin can list users and sync direct permissions', function (): void {
         'status' => 0,
     ]);
     $targetRole = AdminRole::query()->create(['slug' => 'target_role', 'name' => 'Target Role']);
-    $targetRole->permissions()->sync([(int) $draw->id]);
-    $target->roles()->sync([(int) $targetRole->id]);
+
+    $drawCodes = AdminPermissionBridge::menuActionCodesForLegacy('prd.draw_result.view');
+    $drawIds = DB::table('admin_menu_actions')
+        ->whereIn('permission_code', $drawCodes)
+        ->where('status', 1)
+        ->pluck('id')
+        ->all();
+    foreach ($drawIds as $mid) {
+        DB::table('admin_role_menu_actions')->insert([
+            'role_id' => $targetRole->id,
+            'menu_action_id' => (int) $mid,
+        ]);
+    }
+
+    $siteId = AdminUser::defaultAdminSiteId();
+    $target->roles()->sync([
+        (int) $targetRole->id => [
+            'site_id' => $siteId,
+            'granted_at' => now(),
+        ],
+    ]);
 
     $this->withHeader('Authorization', 'Bearer '.$token)
         ->getJson('/api/v1/admin/admin-user-permission-catalog')
         ->assertOk()
         ->assertJsonPath('code', ErrorCode::Success->value)
-        ->assertJsonPath('data.permissions.0.slug', 'prd.admin_user.manage');
+        ->assertJsonFragment(['slug' => 'prd.admin_user.manage']);
 
     $this->withHeader('Authorization', 'Bearer '.$token)
         ->getJson('/api/v1/admin/admin-users?keyword=target')
@@ -81,22 +111,45 @@ test('admin can list users and sync direct permissions', function (): void {
 
     $this->withHeader('Authorization', 'Bearer '.$token)
         ->putJson('/api/v1/admin/admin-users/'.$target->id.'/permissions', [
-            'permission_slugs' => [$report->slug],
+            'permission_slugs' => ['prd.report.player'],
         ])
         ->assertOk()
         ->assertJsonPath('code', ErrorCode::Success->value)
-        ->assertJsonPath('data.direct_permissions.0', 'prd.report.player');
+        ->assertJsonFragment(['prd.report.player']);
 
-    expect(
-        $target->fresh()->permissions()->pluck('slug')->sort()->values()->all()
-    )->toBe([$report->slug]);
+    expect($target->fresh()->directLegacyPermissionSlugs())->toContain('prd.report.player');
 
     $list = $this->withHeader('Authorization', 'Bearer '.$token)
         ->getJson('/api/v1/admin/admin-users?keyword=target')
         ->assertOk()
         ->json('data.items.0.effective_permissions');
 
-    expect($list)->toContain($draw->slug);
-    expect($list)->toContain($report->slug);
-    expect($manage->slug)->toBe('prd.admin_user.manage');
+    expect($list)->toContain('prd.draw_result.view');
+    expect($list)->toContain('prd.report.player');
+});
+
+test('admin can sync user roles for default site', function (): void {
+    $token = makeAdminWithPermissions('rbac_role_editor', ['prd.admin_user.manage']);
+
+    $r1 = AdminRole::query()->create(['slug' => 'role_sync_a', 'name' => 'Role A']);
+    $r2 = AdminRole::query()->create(['slug' => 'role_sync_b', 'name' => 'Role B']);
+
+    $target = AdminUser::query()->create([
+        'username' => 'role_target',
+        'name' => 'Role Target',
+        'email' => null,
+        'password' => Hash::make('secret-strong'),
+        'status' => 0,
+    ]);
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->putJson('/api/v1/admin/admin-users/'.$target->id.'/roles', [
+            'role_slugs' => ['role_sync_b', 'role_sync_a'],
+        ])
+        ->assertOk()
+        ->assertJsonPath('code', ErrorCode::Success->value);
+
+    $slugs = $target->fresh()->adminRoleSlugs();
+    sort($slugs);
+    expect($slugs)->toBe(['role_sync_a', 'role_sync_b']);
 });

tests/Pest.php

@@ -52,13 +52,22 @@ function grantSuperAdminRole(AdminUser $admin): void
     $now = now();
     DB::table('admin_roles')->updateOrInsert(
         ['slug' => AdminUser::ROLE_SUPER_ADMIN],
-        ['name' => 'Super Admin', 'created_at' => $now, 'updated_at' => $now],
+        [
+            'name' => 'Super Admin',
+            'code' => AdminUser::ROLE_SUPER_ADMIN,
+            'created_at' => $now,
+            'updated_at' => $now,
+        ],
     );
     $rid = (int) DB::table('admin_roles')->where('slug', AdminUser::ROLE_SUPER_ADMIN)->value('id');
-    if (! DB::table('admin_user_roles')->where('admin_user_id', $admin->id)->where('role_id', $rid)->exists()) {
-        DB::table('admin_user_roles')->insert([
+    $siteId = (int) DB::table('admin_sites')->where('is_default', true)->value('id');
+
+    DB::table('admin_user_site_roles')->updateOrInsert(
+        [
             'admin_user_id' => $admin->id,
+            'site_id' => $siteId,
             'role_id' => $rid,
-        ]);
-    }
+        ],
+        ['granted_at' => $now],
+    );
 }