OAPERM1 收紧启用前权限冻结

client/src/pages/EmployeeProfilePage.tsx

@@ -183,6 +183,7 @@ export function EmployeeProfilePage() {
     queryFn: () => fetchEmployeeProfile(employeeId),
   });
   const canManageEmployeeProfile = hasPermission(permissions, "system.users");
+  const canManageSensitiveHr = hasPermission(permissions, "system.settings");
   const canEditSelfProfile = me?.id === employeeId;
   const canEditBaseFields = canManageEmployeeProfile || canEditSelfProfile;
   const canEditExtendedFields = canManageEmployeeProfile;
@@ -266,11 +267,19 @@ export function EmployeeProfilePage() {
   }, [employeeId, requestedTab]);
 
   useEffect(() => {
-    if (canManageEmployeeProfile || canEditSelfProfile || activeTab === "profile" || activeTab === "performance") {
+    if (activeTab === "salary" && !canManageSensitiveHr && !canEditSelfProfile) {
+      updateActiveTab("profile");
+      return;
+    }
+    if (activeTab === "performance" && !canManageSensitiveHr && !canEditSelfProfile) {
+      updateActiveTab("profile");
+      return;
+    }
+    if (canManageEmployeeProfile || canEditSelfProfile || activeTab === "profile") {
       return;
     }
     updateActiveTab("profile");
-  }, [activeTab, canEditSelfProfile, canManageEmployeeProfile]);
+  }, [activeTab, canEditSelfProfile, canManageEmployeeProfile, canManageSensitiveHr]);
 
   useEffect(() => {
     setAvatarFile(null);
@@ -528,8 +537,8 @@ export function EmployeeProfilePage() {
     profileQuery.isError && isApiError(profileQuery.error) && profileQuery.error.status === 403;
   const performanceOnlyMode = activeTab === "performance" && profilePermissionDenied && Boolean(performanceQuery.data);
   const showPerformanceTab =
-    canManageEmployeeProfile || canEditSelfProfile || performanceOnlyMode || performanceQuery.data?.viewerRole === "manager";
-  const showSalaryTab = canManageEmployeeProfile || canEditSelfProfile;
+    canManageSensitiveHr || canEditSelfProfile || performanceOnlyMode || performanceQuery.data?.viewerRole === "manager";
+  const showSalaryTab = canManageSensitiveHr || canEditSelfProfile;
 
   const performanceContent =
     performanceQuery.isLoading ? (
@@ -546,7 +555,7 @@ export function EmployeeProfilePage() {
         ]}
       />
     );
-  const salaryContent = <EmployeeSalaryPanel employeeId={employeeId} canManage={canManageEmployeeProfile} isSelf={canEditSelfProfile} />;
+  const salaryContent = <EmployeeSalaryPanel employeeId={employeeId} canManage={canManageSensitiveHr} isSelf={canEditSelfProfile} />;
 
   if (profileQuery.isLoading || (activeTab === "performance" && profilePermissionDenied && performanceQuery.isLoading)) {
     return <div className="card-std p-6 text-sm text-zinc-500">加载员工档案中...</div>;

client/src/pages/PeopleStatsPage.tsx

@@ -117,7 +117,7 @@ export function PeopleStatsPage() {
           <section className="card-std p-5">
             <div className="text-sm text-zinc-500">上月人均薪资</div>
             <div className="mt-2 text-3xl font-semibold text-zinc-900">{moneyText(salarySummary.previousMonth?.averageNetAmount)}</div>
-            <div className="mt-2 text-xs text-zinc-500">非 system.users 不展示任何薪资汇总</div>
+            <div className="mt-2 text-xs text-zinc-500">非 system.settings 不展示任何薪资汇总</div>
           </section>
         ) : null}
         <section className="card-std p-5">