feat: enforce per-user module access in Makelore

tests/unit/auth-store.test.ts

@@ -21,6 +21,12 @@ function resetAuthStore() {
     canRefresh: false,
     legacyRefreshToken: null,
     user: null,
+    moduleAccess: {
+      programming: true,
+      design: true,
+      learning: true,
+      robot: true,
+    },
   });
 }
 
@@ -60,6 +66,15 @@ describe('auth store', () => {
           lastActiveAt: Date.now(),
           canRefresh: true,
         },
+      })
+      .mockResolvedValueOnce({
+        success: true,
+        moduleAccess: {
+          programming: true,
+          design: false,
+          learning: true,
+          robot: false,
+        },
       });
 
     await useAuthStore.getState().loginWithBrowser();
@@ -81,11 +96,60 @@ describe('auth store', () => {
       deptId: 9,
       authorities: ['ROLE_USER'],
     });
+    expect(state.moduleAccess).toEqual({
+      programming: true,
+      design: false,
+      learning: true,
+      robot: false,
+    });
     expect(window.localStorage.getItem('niancode-auth')).not.toContain(
       'must-not-return-to-renderer-storage',
     );
   });
 
+  it('refreshes module access while restoring the session and defaults missing keys to enabled', async () => {
+    hostApiFetchMock
+      .mockResolvedValueOnce({
+        success: true,
+        session: {
+          accessToken: 'persisted-access-token',
+          tokenType: 'Bearer',
+          expiresAt: Date.now() + 60_000,
+          lastActiveAt: Date.now(),
+          canRefresh: true,
+        },
+      })
+      .mockResolvedValueOnce({
+        success: true,
+        moduleAccess: { design: false },
+      });
+    useAuthStore.setState({
+      authBase: 'https://biz.nianxx.cn/auth/',
+      accessToken: 'persisted-access-token',
+      tokenType: 'Bearer',
+      expiresAt: Date.now() + 60_000,
+      lastActiveAt: Date.now(),
+      canRefresh: true,
+      user: {
+        username: 'zhangsan',
+        userId: '1',
+        tenantId: null,
+        deptId: null,
+        authorities: [],
+      },
+    });
+
+    await useAuthStore.getState().init();
+
+    expect(hostApiFetchMock).toHaveBeenNthCalledWith(2, '/api/auth/me');
+    expect(useAuthStore.getState().moduleAccess).toEqual({
+      programming: true,
+      design: false,
+      learning: true,
+      robot: true,
+    });
+  });
+
   it('surfaces browser authorization failures and does not keep a partial session', async () => {
     hostApiFetchMock.mockResolvedValueOnce({
       success: false,