From f8a35ec224ef42cf84060bbe3eaed563e739b6bc Mon Sep 17 00:00:00 2001
From: yml <yml@ymldeiMac-Pro.local>
Date: Sat, 14 Nov 2026 14:55:42 +0800
Subject: [PATCH] =?UTF-8?q?feat(permissions):=20=E8=BF=90=E8=90=A5?=
 =?UTF-8?q?=E9=BB=98=E8=AE=A4=E6=8B=A5=E6=9C=89=E5=BE=AE=E5=8D=9A=E5=BC=BA?=
 =?UTF-8?q?=E5=88=B6=E6=9B=B4=E6=96=B0=E6=9D=83=E9=99=90?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tests/test_weibo_accounts.py         | 33 +++++++++++-----------------
 web/backend/permissions.py           |  1 +
 web/frontend/src/pages/UsersPage.tsx |  2 +-
 3 files changed, 15 insertions(+), 21 deletions(-)

diff --git a/tests/test_weibo_accounts.py b/tests/test_weibo_accounts.py
index 30f1b64..169f6c3 100644
--- a/tests/test_weibo_accounts.py
+++ b/tests/test_weibo_accounts.py
@@ -309,7 +309,7 @@ def test_occupied_workbench_account_cannot_be_updated_by_another_user(db, curren
     assert imported.cookie == original_cookie
 
 
-def test_super_admin_force_updates_occupied_ck_without_changing_owner(db, current_user):
+def test_operator_force_updates_occupied_ck_without_changing_owner(db, current_user):
     imported_out = import_cookies(
         WeiboCookieImport(text="SCF=a; SUB=owner"),
         db=db,
@@ -324,6 +324,14 @@ def test_super_admin_force_updates_occupied_ck_without_changing_owner(db, curren
     )
     db.add(owner)
     db.commit()
+    operator = User(
+        username="weibo-force-update-operator",
+        password_hash="hash",
+        role="operation",
+        is_active=True,
+    )
+    db.add(operator)
+    db.commit()
     imported.assigned_to = owner.id
     db.add(
         WeiboWorkbenchAccount(
@@ -341,7 +349,7 @@ def test_super_admin_force_updates_occupied_ck_without_changing_owner(db, curren
             force_update=True,
         ),
         db=db,
-        current=current_user,
+        current=operator,
     )
 
     assert result.count == 1
@@ -1153,7 +1161,7 @@ def test_weibo_batch_assign_cleans_previous_workbench(db):
     assert "SCF=a" not in audit.detail
 
 
-def test_weibo_force_assign_requires_dedicated_permission(db):
+def test_weibo_force_assign_permissions_for_operator_and_support(db):
     old_support = User(
         username="weibo-force-old-support",
         password_hash="hash",
@@ -1183,17 +1191,7 @@ def test_weibo_force_assign_requires_dedicated_permission(db):
     db.add(account)
     db.commit()
 
-    assert "weibo:assign:force" not in ROLE_PERMISSIONS["operation"]
-    with pytest.raises(HTTPException) as exc_info:
-        batch_assign_accounts(
-            WeiboBatchAssignRequest(
-                account_ids=[account.id],
-                assigned_to=support.id,
-            ),
-            db=db,
-            current=operator,
-        )
-    assert exc_info.value.status_code == 403
+    assert "weibo:assign:force" in ROLE_PERMISSIONS["operation"]
 
     with pytest.raises(HTTPException) as exc_info:
         force_assign_accounts(
@@ -1203,15 +1201,10 @@ def test_weibo_force_assign_requires_dedicated_permission(db):
                 expected_count=1,
             ),
             db=db,
-            current=operator,
+            current=support,
         )
     assert exc_info.value.status_code == 403
 
-    operator.custom_permissions = [
-        *ROLE_PERMISSIONS["operation"],
-        "weibo:assign:force",
-    ]
-    db.commit()
     result = force_assign_accounts(
         WeiboForceAssignRequest(
             account_ids=[account.id],
diff --git a/web/backend/permissions.py b/web/backend/permissions.py
index c9effb9..88ede00 100644
--- a/web/backend/permissions.py
+++ b/web/backend/permissions.py
@@ -120,6 +120,7 @@ ROLE_PERMISSIONS = {
         "weibo:view",
         "weibo:workbench",
         "weibo:assign",
+        "weibo:assign:force",
         "weibo:import",
         "weibo:manage",
         "weibo:account:ck_export",
diff --git a/web/frontend/src/pages/UsersPage.tsx b/web/frontend/src/pages/UsersPage.tsx
index d333753..19e3807 100644
--- a/web/frontend/src/pages/UsersPage.tsx
+++ b/web/frontend/src/pages/UsersPage.tsx
@@ -477,7 +477,7 @@ export default function UsersPage() {
                 <div>
                   <Text type="secondary">
                     打开后可查看“全部账号”页签，并把勾选账号或指定标签的账号强制转给客服。
-                    该权限仅超级管理员默认拥有，运营默认关闭。
+                    超级管理员和运营默认拥有，客服默认关闭。
                   </Text>
                 </div>
               </div>