feat(rbac): 成绩录入/导入放开到本班班主任（需求 6 与需求 7 口径统一）

依据: 需求 6 明确要求'成绩与表格导入……老师端与学生端班级账号均可用且不越权'，需求 7 的权限清单并未把成绩收归管理员专属（只限制班级增删改、人员分配与科任权限）。变更: - shared/permissions: canManageGrades(classRole) = ADMIN | HEAD；canImport 按 kind 分发（成绩=ADMIN|HEAD、名单=仅管理员、课表时间=ADMIN|HEAD）；PERMISSION_MATRIX 同步 - lib/access: assertCanManageGrades(user, classId) 异步按班级角色判定，科任/跨班给出针对性提示 - grades 服务与路由、imports 的模板/预览/提交路由放宽为 ADMIN|TEACHER，服务层按 kind + 班级二次校验（名单仍仅管理员，科任仍 403） - Web 管理端: 成绩录入菜单对教师可见；写入/导入按钮仅对'管理员或所选班级班主任'显示验证: - verify:e2e 133/133（新增: 班主任录入本班成绩 201 + 跨班 403、班主任模板/预览/导入本班成绩可用、科任导入 403、班主任名单模板与导入 403、append 重复导入跳过） - verify:web 19/19（新增: 班主任可见成绩导入入口并打开弹窗，越权入口仍隐藏、菜单 5 项） - verify:desktop 47/47（未受影响）文档: README 权限矩阵与'需求 6/7 口径统一'对照表、各项计数更新
2026-09-12 16:21:39 +08:00
1 parent 21485ea294
commit 97a89de944
@@ -1,4 +1,4 @@
-import { Router } from 'express';
+import { Router } from 'express';
 import { sendCreated, sendOk } from '../../lib/http.js';
 import { idParamSchema } from '../../lib/schemas.js';
 import { authenticate, getAuthUser, requireRole } from '../../middleware/auth.js';
@@ -52,7 +52,7 @@ router.get(
 );

 /** POST /api/grades - 录入单条成绩（广播 grade:updated） */
-router.post('/', requireRole('ADMIN'), validate({ body: createGradeSchema }), async (req, res) => {
+router.post('/', requireRole('ADMIN', 'TEACHER'), validate({ body: createGradeSchema }), async (req, res) => {
  const user = getAuthUser(req);
  sendCreated(
    res,
@@ -62,16 +62,21 @@ router.post('/', requireRole('ADMIN'), validate({ body: createGradeSchema }), as
 });

 /** POST /api/grades/bulk - 批量录入 / 导入成绩 */
-router.post('/bulk', requireRole('ADMIN'), validate({ body: bulkCreateGradeSchema }), async (req, res) => {
-  const user = getAuthUser(req);
-  const grades = await gradeService.bulkCreateGrades(user, req.body as BulkCreateGradeInput);
-  sendCreated(res, { count: grades.length, items: grades }, `已录入 ${grades.length} 条成绩`);
-});
+router.post(
+  '/bulk',
+  requireRole('ADMIN', 'TEACHER'),
+  validate({ body: bulkCreateGradeSchema }),
+  async (req, res) => {
+    const user = getAuthUser(req);
+    const grades = await gradeService.bulkCreateGrades(user, req.body as BulkCreateGradeInput);
+    sendCreated(res, { count: grades.length, items: grades }, `已录入 ${grades.length} 条成绩`);
+  },
+);

 /** PATCH /api/grades/:id - 修改成绩 */
 router.patch(
  '/:id',
-  requireRole('ADMIN'),
+  requireRole('ADMIN', 'TEACHER'),
  validate({ params: idParamSchema, body: updateGradeSchema }),
  async (req, res) => {
    const user = getAuthUser(req);
@@ -81,12 +86,17 @@ router.patch(
 );

 /** DELETE /api/grades/:id - 删除成绩 */
-router.delete('/:id', requireRole('ADMIN'), validate({ params: idParamSchema }), async (req, res) => {
-  const user = getAuthUser(req);
-  const { id } = validatedParams<{ id: string }>(req);
-  await gradeService.deleteGrade(user, id);
-  sendOk(res, { id }, '成绩已删除');
-});
+router.delete(
+  '/:id',
+  requireRole('ADMIN', 'TEACHER'),
+  validate({ params: idParamSchema }),
+  async (req, res) => {
+    const user = getAuthUser(req);
+    const { id } = validatedParams<{ id: string }>(req);
+    await gradeService.deleteGrade(user, id);
+    sendOk(res, { id }, '成绩已删除');
+  },
+);

 export const gradesModule = defineModule({
  name: 'grades',
@@ -106,7 +106,7 @@ export async function getGradeStats(user: TokenPayload, options: ListGradeOption
 }

 export async function createGrade(user: TokenPayload, input: CreateGradeInput): Promise<GradeDto> {
-  assertCanManageGrades(user);
+  await assertCanManageGrades(user, input.classId);
  await assertStudentInClass(input.userId, input.classId);
  if (input.courseId) await assertCourseInClass(input.courseId, input.classId);

@@ -127,7 +127,7 @@ export async function createGrade(user: TokenPayload, input: CreateGradeInput):

 /** 批量录入：同一个考试一次提交整班成绩 */
 export async function bulkCreateGrades(user: TokenPayload, input: BulkCreateGradeInput): Promise<GradeDto[]> {
-  assertCanManageGrades(user);
+  await assertCanManageGrades(user, input.classId);
  if (input.courseId) await assertCourseInClass(input.courseId, input.classId);

  const publishedAt = parseOptionalDate(input.publishedAt) ?? new Date();
@@ -163,7 +163,7 @@ export async function updateGrade(
 ): Promise<GradeDto> {
  const current = await prisma.grade.findUnique({ where: { id: gradeId } });
  if (!current) throw ApiError.notFound('成绩记录不存在');
-  assertCanManageGrades(user);
+  await assertCanManageGrades(user, current.classId);
  if (input.courseId) await assertCourseInClass(input.courseId, current.classId);

  const updated = await prisma.grade.update({
@@ -189,7 +189,7 @@ export async function updateGrade(
 export async function deleteGrade(user: TokenPayload, gradeId: string): Promise<void> {
  const current = await prisma.grade.findUnique({ where: { id: gradeId } });
  if (!current) throw ApiError.notFound('成绩记录不存在');
-  assertCanManageGrades(user);
+  await assertCanManageGrades(user, current.classId);
  await prisma.grade.delete({ where: { id: gradeId } });
  emitToClass(current.classId, SOCKET_EVENTS.gradeUpdated, {
    ...toGradeDto({ ...current, course: null, student: null, class: null }),
@@ -1,5 +1,5 @@
 import { Router } from 'express';
-import { sendOk } from '../../lib/http.js';
+import { ApiError, sendOk } from '../../lib/http.js';
 import { authenticate, getAuthUser, requireRole } from '../../middleware/auth.js';
 import { validate, validatedBody, validatedQuery } from '../../middleware/validate.js';
 import { defineModule } from '../module.types.js';
@@ -25,9 +25,12 @@ router.use(authenticate());

 /**
 * GET /api/imports/template?kind=grades|students&format=csv|xlsx - 下载导入模板
- * 成绩模板=管理员；名单模板=管理员（与写入权限一致，不额外开入口）
+ * 成绩模板：管理员或班主任（空白模板，不含任何业务数据）；名单模板：仅管理员
 */
-router.get('/template', requireRole('ADMIN'), (req, res) => {
+router.get('/template', requireRole('ADMIN', 'TEACHER'), (req, res) => {
+  if (req.query.kind === 'students' && getAuthUser(req).role !== 'ADMIN') {
+    throw ApiError.forbidden('只有管理员可以导入学生名单');
+  }
  const kind = req.query.kind === 'students' ? 'students' : 'grades';
  const format = req.query.format === 'xlsx' ? 'xlsx' : 'csv';
  if (format === 'xlsx') {
@@ -46,16 +49,30 @@ router.get('/template', requireRole('ADMIN'), (req, res) => {

 /**
 * POST /api/imports/table/preview - 上传表格并预览（解析 + 必填列校验 + 建议字段映射）
- * 仅管理员：与"成绩录入 / 名单管理"权限一致
+ * 成绩：管理员或班主任；学生名单：仅管理员（与写入权限保持一致）
 */
-router.post('/table/preview', requireRole('ADMIN'), validate({ body: tableFileSchema }), (req, res) => {
-  sendOk(res, previewTable(validatedBody<TableFileInput>(req)), '表格解析成功');
-});
+router.post(
+  '/table/preview',
+  requireRole('ADMIN', 'TEACHER'),
+  validate({ body: tableFileSchema }),
+  (req, res) => {
+    const input = validatedBody<TableFileInput>(req);
+    if (input.kind === 'students' && getAuthUser(req).role !== 'ADMIN') {
+      throw ApiError.forbidden('只有管理员可以导入学生名单');
+    }
+    sendOk(res, previewTable(input), '表格解析成功');
+  },
+);

-/** POST /api/imports/table/commit - 执行导入（字段映射 + 写入模式 + 结果统计） */
+/**
+ * POST /api/imports/table/commit - 执行导入（字段映射 + 写入模式 + 结果统计）
+ *
+ * 路由放行 ADMIN|TEACHER，真正的权限在 service 内按 kind + 班级二次校验：
+ * 成绩 → 管理员或本班班主任；学生名单 → 仅管理员；科任老师一律 403（需求 7）。
+ */
 router.post(
  '/table/commit',
-  requireRole('ADMIN'),
+  requireRole('ADMIN', 'TEACHER'),
  validate({ body: tableCommitSchema }),
  async (req, res) => {
    const result = await commitTable(getAuthUser(req), validatedBody<TableCommitInput>(req));
@@ -221,7 +221,8 @@ function cellValue(row: string[], columns: string[], mapping: Record<string, str

 /** 导入成绩：学生按用户名/姓名匹配；重复（同班级+学生+考试+课程）按 mode 处理 */
 export async function commitGrades(user: TokenPayload, input: TableCommitInput): Promise<ImportResult> {
-  assertCanManageGrades(user);
+  // 成绩导入：管理员或本班班主任（需求 6）；科任 403
+  await assertCanManageGrades(user, input.classId);
  const buffer = decodeBase64(input.contentBase64);
  const parsed = parseTable(buffer, input.fileName);