feat: 管理端 RBAC 权限体系与员工管理

新增多角色权限控制（赛事/财务/客服管理员），支持员工 CRUD、路由菜单按权限显隐、审计日志范围过滤；登录返回角色与权限列表。玩家端赛事列表增加静默刷新避免图片闪烁。Seed 补充演示员工账号与充值相关权限。附带 RBAC/审计范围单元测试及 UAT 文档更新。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/admin/src/views/AgentManager.vue

@@ -7,8 +7,33 @@ import { resolveFormError, resolveApiError } from '../i18n/form-validation';
 import api from '../api';
 import { clearStaffSession } from '../stores/auth';
 
+import { usePermissions } from '../composables/usePermissions';
+import { AdminPerm } from '../constants/permissions';
+
 const { t, localeTag } = useAdminLocale();
 const router = useRouter();
+const { hasPermission, role: staffRole } = usePermissions();
+
+const canViewAgents = computed(() => hasPermission(AdminPerm.agentsView));
+const canViewUsers = computed(() => hasPermission(AdminPerm.usersView));
+const canCreateUsers = computed(() => hasPermission(AdminPerm.usersCreate));
+const canCreateAgents = computed(() => hasPermission(AdminPerm.agentsCreate));
+const canResetPassword = computed(() => hasPermission(AdminPerm.usersResetPassword));
+const canDeposit = computed(() => hasPermission(AdminPerm.walletDeposit));
+const canWithdraw = computed(() => hasPermission(AdminPerm.walletWithdraw));
+const canAdjustCredit = computed(() => hasPermission(AdminPerm.agentsCredit));
+const canManageSettings = computed(() => hasPermission(AdminPerm.settings));
+const canEditPlayerProfile = computed(() => canCreateUsers.value);
+const playerActionsReadOnly = computed(
+  () => canViewUsers.value && !canCreateUsers.value && !canDeposit.value && !canWithdraw.value,
+);
+const playerActionFlags = computed(() => ({
+  showEdit: canViewUsers.value && (canEditPlayerProfile.value || canResetPassword.value),
+  showDeposit: canDeposit.value,
+  showWithdraw: canWithdraw.value,
+  showFreeze: canEditPlayerProfile.value,
+  showDelete: canEditPlayerProfile.value,
+}));
 
 import {
   emptyPlayerCreateForm,
@@ -387,9 +412,15 @@ function resolveCreateParentLabel(agentId: string) {
 
 /* ─── Init ─── */
 onMounted(() => {
-  void loadUsersPageInit();
-  loadAllPlayers();
-  loadTier1Agents();
+  if (canManageSettings.value) {
+    void loadUsersPageInit();
+  }
+  if (canViewUsers.value) {
+    loadAllPlayers();
+  }
+  if (canViewAgents.value) {
+    loadTier1Agents();
+  }
 });
 
 async function loadUsersPageInit() {
@@ -980,6 +1011,37 @@ async function submitEditPlayer() {
     ElMessage.warning(t('err.password_min'));
     return;
   }
+  const newPwd = editPlayerForm.value.newPassword.trim();
+  const passwordOnly =
+    newPwd &&
+    !canEditPlayerProfile.value &&
+    canResetPassword.value &&
+    !editPlayerForm.value.useCustomCashback;
+
+  if (passwordOnly) {
+    editPlayerLoading.value = true;
+    try {
+      const { data } = await api.post(`/admin/users/${editingId.value}/reset-password`, {
+        password: newPwd,
+      });
+      const plain = data.data?.password ?? newPwd;
+      editPlayerForm.value.managedPassword = plain;
+      editPlayerForm.value.newPassword = '';
+      ElMessage.success(t('user.msg.password_saved', { password: plain }));
+    } catch (e: unknown) {
+      const err = e as { response?: { data?: { error?: string } } };
+      ElMessage.error(err.response?.data?.error ?? t('msg.save_failed'));
+    } finally {
+      editPlayerLoading.value = false;
+    }
+    return;
+  }
+
+  if (!canEditPlayerProfile.value) {
+    ElMessage.warning(t('msg.save_failed'));
+    return;
+  }
+
   try {
     assertPlayerUsername(editPlayerForm.value.username);
   } catch (e) {
@@ -988,7 +1050,6 @@ async function submitEditPlayer() {
   }
   editPlayerLoading.value = true;
   try {
-    const newPwd = editPlayerForm.value.newPassword.trim();
     const payload: Record<string, unknown> = {
       username: editPlayerForm.value.username.trim(),
       phone: editPlayerForm.value.phone.trim() || undefined,
@@ -1346,7 +1407,7 @@ function creditTypeLabel(type: string) {
 <template>
   <div class="admin-list-page agent-mgr-page">
     <!-- ─── Global settings collapse ─── -->
-    <el-collapse v-model="settingsCollapseOpen" class="list-settings">
+    <el-collapse v-if="canManageSettings" v-model="settingsCollapseOpen" class="list-settings">
       <el-collapse-item :title="t('user.page_settings')" name="settings">
         <div class="list-settings-block">
           <p class="list-settings-title">{{ t('user.global_settings') }}</p>
@@ -1438,12 +1499,12 @@ function creditTypeLabel(type: string) {
     <InviteManageDialog v-model="inviteDialogOpen" />
 
     <div class="mgr-tabs-shell">
-      <el-button type="primary" class="invite-prominent-btn" @click="inviteDialogOpen = true">
+      <el-button v-if="canManageSettings" type="primary" class="invite-prominent-btn" @click="inviteDialogOpen = true">
         {{ t('invite.menu_btn') }}
       </el-button>
-      <el-tabs v-model="activeViewTab" class="mgr-top-tabs mgr-top-tabs--with-invite">
+      <el-tabs v-model="activeViewTab" class="mgr-top-tabs" :class="{ 'mgr-top-tabs--with-invite': canManageSettings }">
       <!-- ─── Tab: 全部玩家（默认） ─── -->
-      <el-tab-pane :label="`${t('user.type.player')} (${playerTotal})`" name="players">
+      <el-tab-pane v-if="canViewUsers" :label="`${t('user.type.player')} (${playerTotal})`" name="players">
         <section class="list-panel player-list-panel">
           <div class="list-panel-toolbar">
             <el-form inline class="list-chrome__grow">
@@ -1456,7 +1517,7 @@ function creditTypeLabel(type: string) {
                   @keyup.enter="searchPlayers"
                 />
               </el-form-item>
-              <el-form-item :label="t('user.filter.agent')">
+              <el-form-item v-if="canViewAgents" :label="t('user.filter.agent')">
                 <el-select
                   v-model="playerFilterAgent"
                   :placeholder="t('user.filter.agent_ph')"
@@ -1487,7 +1548,7 @@ function creditTypeLabel(type: string) {
                 <el-button type="primary" @click="searchPlayers">{{ t('common.search') }}</el-button>
               </el-form-item>
             </el-form>
-            <div class="list-chrome__actions">
+            <div v-if="canCreateUsers" class="list-chrome__actions">
               <el-button type="primary" @click="openCreateAccount">{{ t('user.create_btn') }}</el-button>
             </div>
           </div>
@@ -1530,6 +1591,7 @@ function creditTypeLabel(type: string) {
               <el-table-column :label="t('common.actions')" min-width="340" align="center">
                 <template #default="{ row }">
                   <AdminPlayerRowActions
+                    v-bind="playerActionFlags"
                     :row="row"
                     @detail="openDetailPlayer(row.id)"
                     @ledger="openPlayerWalletLedger(row.id, row.username)"
@@ -1559,7 +1621,7 @@ function creditTypeLabel(type: string) {
       </el-tab-pane>
 
       <!-- ─── Tab: 一级代理 ─── -->
-      <el-tab-pane :label="`${agentTierName(1)} (${tier1Total})`" name="tier1Agents">
+      <el-tab-pane v-if="canViewAgents" :label="`${agentTierName(1)} (${tier1Total})`" name="tier1Agents">
     <section class="list-panel agent-list-panel">
       <div class="list-panel-toolbar">
         <el-form inline class="list-chrome__grow">
@@ -1576,7 +1638,7 @@ function creditTypeLabel(type: string) {
             <el-button type="primary" @click="searchTier1Agents">{{ t('common.search') }}</el-button>
           </el-form-item>
         </el-form>
-        <div class="list-chrome__actions">
+        <div v-if="canCreateAgents" class="list-chrome__actions">
           <el-button type="primary" @click="openCreateTier1Agent">{{ t('agent.create_btn') }}</el-button>
         </div>
       </div>
@@ -1638,6 +1700,7 @@ function creditTypeLabel(type: string) {
                         <el-table-column :label="t('common.actions')" min-width="320" align="center">
                           <template #default="{ row: player }">
                             <AdminPlayerRowActions
+                              v-bind="playerActionFlags"
                               :row="player"
                               @detail="openDetailPlayer(player.id)"
                               @ledger="openPlayerWalletLedger(player.id, player.username)"
@@ -1709,6 +1772,7 @@ function creditTypeLabel(type: string) {
       </el-tab-pane>
 
       <!-- ─── Tab: L2+ 各级代理 ─── -->
+      <template v-if="canViewAgents">
       <el-tab-pane
         v-for="agentLevel in visibleSubAgentTabLevels"
         :key="agentLevel"
@@ -1794,6 +1858,7 @@ function creditTypeLabel(type: string) {
                         <el-table-column :label="t('common.actions')" min-width="280" align="center">
                           <template #default="{ row: player }">
                             <AdminPlayerRowActions
+                              v-bind="playerActionFlags"
                               :row="player"
                               @detail="openDetailPlayer(player.id)"
                               @ledger="openPlayerWalletLedger(player.id, player.username)"
@@ -1858,6 +1923,7 @@ function creditTypeLabel(type: string) {
           </div>
         </section>
       </el-tab-pane>
+      </template>
     </el-tabs>
     </div>
 
@@ -2068,7 +2134,13 @@ function creditTypeLabel(type: string) {
     </el-dialog>
 
     <!-- ── Edit Player ── -->
-    <el-dialog v-model="editPlayerVisible" :title="t('user.dialog.edit')" width="560px" destroy-on-close class="user-edit-dialog">
+    <el-dialog
+      v-model="editPlayerVisible"
+      :title="canEditPlayerProfile ? t('user.dialog.edit') : t('user.field.reset_password')"
+      width="560px"
+      destroy-on-close
+      class="user-edit-dialog"
+    >
       <el-form label-width="84px" size="small" class="compact-edit-form">
         <div class="edit-meta">
           <span>ID {{ editPlayerForm.id }}</span>
@@ -2078,11 +2150,20 @@ function creditTypeLabel(type: string) {
         <div class="edit-form-section">
           <div class="section-title">{{ t('user.section.basic_info') }}</div>
           <el-form-item :label="t('user.col.username')">
-            <el-input v-model="editPlayerForm.username" :placeholder="t('user.ph.username_player')" />
+            <el-input
+              v-model="editPlayerForm.username"
+              :readonly="!canEditPlayerProfile"
+              :placeholder="t('user.ph.username_player')"
+            />
             <div class="field-hint">{{ t('user.hint.username_player') }}</div>
           </el-form-item>
         </div>
 
+        <div v-if="!canEditPlayerProfile" class="edit-form-section">
+          <div class="section-title">{{ t('user.section.affiliation') }}</div>
+          <el-tag size="small" type="info" class="affiliation-tag">{{ affiliationLabel(editPlayerForm) }}</el-tag>
+        </div>
+
         <div class="edit-form-section">
           <div class="password-mgmt-block">
             <div class="block-title">{{ t('user.section.password_mgmt') }}</div>
@@ -2099,7 +2180,7 @@ function creditTypeLabel(type: string) {
           </div>
         </div>
 
-        <div class="edit-form-section">
+        <div v-if="canEditPlayerProfile" class="edit-form-section">
           <div class="section-title">{{ t('user.section.affiliation') }}</div>
           <el-form-item :label="t('user.col.agent')">
             <el-tag size="small" type="info" class="affiliation-tag">{{ affiliationLabel(editPlayerForm) }}</el-tag>
@@ -2121,7 +2202,7 @@ function creditTypeLabel(type: string) {
           </el-form-item>
         </div>
 
-        <div class="edit-form-section">
+        <div v-if="canEditPlayerProfile" class="edit-form-section">
           <div class="section-title">{{ t('user.section.contact') }}</div>
           <el-row :gutter="12" class="contact-row">
             <el-col :span="12">
@@ -2155,7 +2236,9 @@ function creditTypeLabel(type: string) {
       </el-form>
       <template #footer>
         <el-button size="small" @click="editPlayerVisible = false">{{ t('common.cancel') }}</el-button>
-        <el-button size="small" type="primary" :loading="editPlayerLoading" @click="submitEditPlayer">{{ t('user.btn.save_profile') }}</el-button>
+        <el-button size="small" type="primary" :loading="editPlayerLoading" @click="submitEditPlayer">
+          {{ canEditPlayerProfile ? t('user.btn.save_profile') : t('user.field.reset_password') }}
+        </el-button>
       </template>
     </el-dialog>