From 080314aa441907b25eb3509d3950eb88feace335 Mon Sep 17 00:00:00 2001
From: Pine <wwork.wss@icloud.com>
Date: Mon, 24 Aug 2026 18:36:30 +0800
Subject: [PATCH] =?UTF-8?q?feat(rbac):=20=E5=B9=B3=E5=8F=B0=E7=AE=A1?=
 =?UTF-8?q?=E7=90=86=E6=96=B9(operator/op=5Fsuper=5Fadmin)=E6=81=92?=
 =?UTF-8?q?=E6=8E=88=E4=BA=88=E5=85=A8=E6=9D=83=E9=99=90=20=E2=80=94=20?=
 =?UTF-8?q?=E5=B9=B3=E5=8F=B0=E7=AB=AF=E6=8B=A5=E6=9C=89=E6=89=80=E6=9C=89?=
 =?UTF-8?q?=E6=93=8D=E4=BD=9C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

permission_granted 对平台管理方直接返回 True，使平台端能执行全部 /admin/* 操作
(用户/园区/算力/课程/活动/资讯/任务/服务商/配置/角色/审计)；与其它端口(投资人/政务/企业/OPC)不关联。
---
 app/domain/rules.py | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/app/domain/rules.py b/app/domain/rules.py
index b401c25..adc7154 100644
--- a/app/domain/rules.py
+++ b/app/domain/rules.py
@@ -10,6 +10,12 @@ from __future__ import annotations
 SCOPE_ORDER = ("province", "city", "district")
 
 
+def is_platform_admin(user: dict) -> bool:
+    """平台管理方（平台端运营者）：拥有全权限，可执行全部平台管理操作。
+    与其它端口（投资人/OPC/政务/企业/服务商/载体）不关联。"""
+    return user.get("role") == "operator" or user.get("sub_role") in ("op_super_admin", "superadmin")
+
+
 def role_allowed(user: dict, *roles: str) -> bool:
     """当前用户业务角色是否 ∈ 允许角色集合。"""
     return user.get("role") in set(roles)
@@ -21,7 +27,9 @@ def sub_role_allowed(user: dict, *sub_roles: str) -> bool:
 
 
 def permission_granted(user: dict, perm: str) -> bool:
-    """当前用户是否拥有权限码 perm。"""
+    """当前用户是否拥有权限码 perm。平台管理方(operator/op_super_admin)恒授予全权限。"""
+    if is_platform_admin(user):
+        return True
     return perm in user.get("permissions", [])