From 458220ecbc2f9d486cd4740c532d2c043ea504d3 Mon Sep 17 00:00:00 2001
From: bot_dev1 <bot_dev1@xayunmei.com>
Date: Wed, 5 Aug 2026 10:34:59 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20=E5=AE=8C=E6=88=90=20issue=20#151=20?=
 =?UTF-8?q?=E7=94=A8=E6=88=B7/=E8=A7=92=E8=89=B2=E7=AE=A1=E7=90=86?=
 =?UTF-8?q?=E9=A1=B5=E8=A1=A5=E5=85=85=E8=A7=92=E8=89=B2=E6=9D=83=E9=99=90?=
 =?UTF-8?q?=E7=9F=A9=E9=98=B5=E8=A7=86=E5=9B=BE=EF=BC=88PRD=205.7=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 web/auth/users.html |  9 +++++++++
 web/auth/users.js   | 26 ++++++++++++++++++++++++++
 2 files changed, 35 insertions(+)

diff --git a/web/auth/users.html b/web/auth/users.html
index ac075c3..ab7390e 100644
--- a/web/auth/users.html
+++ b/web/auth/users.html
@@ -78,6 +78,15 @@
       <div class="hint">配置后登录页出现「企业 SSO 登录」入口（标准 OIDC 授权码流程）；
         未配置走本地账号。令牌换会话的后端端点待 IAM 就绪后对接（见 README）。</div>
     </div>
+    <div class="panel" style="margin-top:12px">
+      <h2>角色权限矩阵（PRD 5.7，对齐 rbac.py Resource×Action）</h2>
+      <table id="perm-matrix">
+        <thead><tr><th>角色</th><th>查看 view</th><th>配置 edit</th><th>发布/回滚 publish</th><th>用户管理 manage</th></tr></thead>
+        <tbody></tbody>
+      </table>
+      <div class="hint">矩阵即前端门控依据：配置台写按钮按会话角色置灰（Viewer 只读 /
+        Editor 可配置 / Publisher 可发布回滚），本页仅 admin 可见。</div>
+    </div>
     <div class="panel" style="margin-top:12px">
       <h2>审计日志（写操作落日志，最近 500 条）</h2>
       <div id="audit-list"></div>
diff --git a/web/auth/users.js b/web/auth/users.js
index 89f3bb3..f77c096 100644
--- a/web/auth/users.js
+++ b/web/auth/users.js
@@ -117,5 +117,31 @@
     };
 
     renderUsers();
+    renderPermMatrix();
   });
+
+  /* 角色权限矩阵展示（issue #151 验收：矩阵生效可见；与 studio 门控同源） */
+  var PERM_MATRIX = {
+    readonly: { view: true,  edit: false, publish: false, manage: false },
+    engineer: { view: true,  edit: true,  publish: false, manage: false },
+    admin:    { view: true,  edit: true,  publish: true,  manage: true }
+  };
+  function renderPermMatrix() {
+    var tbody = document.querySelector("#perm-matrix tbody");
+    tbody.innerHTML = "";
+    UserStore.ROLES.forEach(function (r) {
+      var tr = document.createElement("tr");
+      var td = document.createElement("td");
+      td.textContent = UserStore.ROLE_LABELS[r];
+      td.className = "role-" + r;
+      tr.appendChild(td);
+      ["view", "edit", "publish", "manage"].forEach(function (a) {
+        var c = document.createElement("td");
+        c.textContent = PERM_MATRIX[r][a] ? "✓" : "✗";
+        c.style.color = PERM_MATRIX[r][a] ? "#2ecc71" : "#64748b";
+        tr.appendChild(c);
+      });
+      tbody.appendChild(tr);
+    });
+  }
 })();