feat: 完善学生生命周期管理与权限范围并发布 1.4.2

packages/server/src/modules/calls/calls.module.ts

@@ -1,6 +1,6 @@
 import { Router } from 'express';
 import { sendCreated } from '../../lib/http.js';
-import { authenticate, getAuthUser, requirePermission } from '../../middleware/auth.js';
+import { authenticate, getAuthUser, requireStaffPermission } from '../../middleware/auth.js';
 import { validate } from '../../middleware/validate.js';
 import { defineModule } from '../module.types.js';
 import { createCallSchema, type CreateCallInput } from './calls.schemas.js';
@@ -13,10 +13,15 @@ router.use(authenticate());
  * POST /api/calls - 叫人（老师点名让学生过来）
  * ClassHelper 班级端会在灵动岛上立即弹出"请 XXX 同学找 XXX 老师"，无论是否在上课。
  */
-router.post('/', requirePermission('call:create'), validate({ body: createCallSchema }), async (req, res) => {
-  const user = getAuthUser(req);
-  sendCreated(res, await callService.createCall(user, req.body as CreateCallInput), '已通知该学生');
-});
+router.post(
+  '/',
+  requireStaffPermission('call:create'),
+  validate({ body: createCallSchema }),
+  async (req, res) => {
+    const user = getAuthUser(req);
+    sendCreated(res, await callService.createCall(user, req.body as CreateCallInput), '已通知该学生');
+  },
+);
 
 export const callsModule = defineModule({
   name: 'calls',