fix(permissions): 收回客服的 CK 检测重登和自动巡检入口

客服默认不再有 cookie:operate；自动巡检菜单改按 automation:view 显示。

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/test_automation_ck_health.py

@@ -471,6 +471,7 @@ class TestAutomationPermissions(_Base):
 
         assert "automation:view" in ROLE_PERMISSIONS["operation"]
         assert "automation:view" not in ROLE_PERMISSIONS["support"]
+        assert "cookie:operate" not in ROLE_PERMISSIONS["support"]
         assert "automation:manage" in ROLE_PERMISSIONS["super_admin"]
         assert "automation:manage" not in ROLE_PERMISSIONS["operation"]
 

tests/test_cookie_operations.py

@@ -34,7 +34,14 @@ class TestCookieOperation:
         self.engine = get_test_engine()
         self.session = make_test_session(self.engine)
 
-        self.support = User(username="support", password_hash="hash", role="support")
+        # 客服角色默认已经没有 CK 检测/重登。这里单独授权，只为保住
+        # 「有这个权限时也只能动分配给自己的号、看不到 Cookie 原文」。
+        self.support = User(
+            username="support",
+            password_hash="hash",
+            role="support",
+            custom_permissions=["cookie:operate"],
+        )
         self.other_support = User(
             username="other", password_hash="hash", role="support"
         )
@@ -91,6 +98,20 @@ class TestCookieOperation:
         assert "owned-secret" not in str(result)
         assert "owned-password" not in str(result)
 
+    def test_default_support_role_cannot_open_cookie_operations(self):
+        plain = User(username="plain-kf", password_hash="hash", role="support")
+        self.session.add(plain)
+        self.session.commit()
+        with pytest.raises(Exception, match="cookie:operate"):
+            list_cookie_operations(
+                search="",
+                tag="",
+                page=1,
+                page_size=20,
+                db=self.session,
+                current=plain,
+            )
+
     def test_support_cannot_use_cookie_management_endpoints(self):
         with pytest.raises(Exception, match="cookie:view"):
             list_cookies(db=self.session, current=self.support)

web/backend/permissions.py

@@ -103,7 +103,6 @@ ROLE_PERMISSIONS = {
         "account:view_assigned",
         "account:tag",
         "account:remark",
-        "cookie:operate",
         "douyu:task",
         "yyb:session",
         "yyb:history",

web/frontend/src/layouts/MainLayout.tsx

@@ -75,6 +75,8 @@ export default function MainLayout({ onLogout }: { onLogout?: () => void }) {
   }
   if (can('cookie:operate')) {
     douyuItems.push({ key: '/cookie-operations', label: 'CK 检测与重登', icon: <SafetyCertificateOutlined /> });
+  }
+  if (can('automation:view')) {
     douyuItems.push({ key: '/automation', label: '自动巡检', icon: <RobotOutlined /> });
   }
   if (can('douyu:task')) {