OAPERM1 收紧启用前权限冻结

server/src/routes/search.js

@@ -65,6 +65,14 @@ async function isFlagEnabled(fastify, request, flagKey) {
   return gate.enabled;
 }
 
+function canSearchSensitiveRegistry(fastify, request, isAdmin) {
+  return isAdmin || fastify.hasPermission(request.employee, "system.settings");
+}
+
+function canSearchFrozenTravel(fastify, request, isAdmin) {
+  return isAdmin || fastify.hasPermission(request.employee, "system.settings");
+}
+
 async function searchRoutes(fastify) {
   fastify.get("/search", { preHandler: fastify.authenticate }, async (request, reply) => {
     await ensureFeatureEnabled(fastify, request);
@@ -307,7 +315,7 @@ async function searchRoutes(fastify) {
       );
     }
 
-    if (featureEnabled.projectLinking && (fastify.hasPermission(request.employee, "project.view_all") || fastify.hasPermission(request.employee, "project.manage") || fastify.hasPermission(request.employee, "system.settings") || isAdmin)) {
+    if (featureEnabled.projectLinking && canSearchSensitiveRegistry(fastify, request, isAdmin)) {
       tasks.push(
         fastify.prisma.contractRegistry.findMany({
           where: {
@@ -348,7 +356,7 @@ async function searchRoutes(fastify) {
       );
     }
 
-    if (featureEnabled.confidentialDocRefs && (fastify.hasPermission(request.employee, "project.view_all") || fastify.hasPermission(request.employee, "project.manage") || fastify.hasPermission(request.employee, "system.settings") || isAdmin)) {
+    if (featureEnabled.confidentialDocRefs && canSearchSensitiveRegistry(fastify, request, isAdmin)) {
       tasks.push(
         fastify.prisma.confidentialDocumentRef.findMany({
           where: {
@@ -449,7 +457,7 @@ async function searchRoutes(fastify) {
       );
     }
 
-    if (fastify.hasPermission(request.employee, "travel.view_own") || fastify.hasPermission(request.employee, "travel.view_all") || fastify.hasPermission(request.employee, "travel.manage")) {
+    if (canSearchFrozenTravel(fastify, request, isAdmin)) {
       tasks.push(
         fastify.prisma.travelRequest.findMany({
           where: {