fix: 取消CEO默认AP台账权限（09-07-manager-ap-access-scope）

client/src/auth/permissions.ts

@@ -68,7 +68,6 @@ const ROLE_PERMISSIONS: Record<string, readonly string[]> = {
     "payment.batch.review",
   ],
   ceo: [
-    "finance.ledger.view",
     ...EMPLOYEE_BASE_PERMISSIONS,
     ...PROCUREMENT_SELF_SERVICE_PERMISSIONS,
     ...MASTERDATA_VIEW_PERMISSIONS,

client/tests/e2e/payment-reviewer-permissions.spec.ts

@@ -346,25 +346,28 @@ async function login(page: Page, actor: SyntheticActor) {
   await expect(page).toHaveURL(/\/(?:portal|mobile)$/);
 }
 
-test("只有付款复核职责的经理不能直连应付账款且不请求台账", async ({ page }) => {
-  test.skip(process.env.E2E_MODE === "live", "只使用本地合成角色，不访问公网");
-  const pageErrors = capturePageErrors(page);
-  await mockSyntheticApis(page, REVIEWER_ACTOR);
-  await login(page, REVIEWER_ACTOR);
+for (const role of ["manager", "ceo"]) {
+  test(`只有付款复核职责的 ${role} 不能直连应付账款且不请求台账`, async ({ page }) => {
+    test.skip(process.env.E2E_MODE === "live", "只使用本地合成角色，不访问公网");
+    const pageErrors = capturePageErrors(page);
+    await mockSyntheticApis(page, { ...REVIEWER_ACTOR, roleCodes: [role] });
+    await login(page, REVIEWER_ACTOR);
 
-  let apRequests = 0;
-  page.on("request", (request) => {
-    if (new URL(request.url()).pathname.startsWith("/api/ap-operations")) apRequests += 1;
+    let apRequests = 0;
+    page.on("request", (request) => {
+      if (new URL(request.url()).pathname.startsWith("/api/ap-operations")) apRequests += 1;
+    });
+    await page.goto("/ap-operations");
+    await expect(page).toHaveURL(/\/403$/);
+    await expect(page.getByRole("link", { name: "应付账款", exact: true })).toHaveCount(0);
+    expect(apRequests).toBe(0);
+    await expect(page.getByTestId("ap-export")).toHaveCount(0);
+    expectNoPageErrors(pageErrors);
   });
-  await page.goto("/ap-operations");
-  await expect(page).toHaveURL(/\/403$/);
-  await expect(page.getByRole("link", { name: "应付账款", exact: true })).toHaveCount(0);
-  expect(apRequests).toBe(0);
-  await expect(page.getByTestId("ap-export")).toHaveCount(0);
-  expectNoPageErrors(pageErrors);
-});
 
-for (const roleCodes of [["ceo"], ["finance"], ["finance_mgr"], ["manager", "finance"]]) {
+}
+
+for (const roleCodes of [["finance"], ["finance_mgr"], ["manager", "finance"], ["ceo", "finance"]]) {
   test(`AP 专用读取权限允许 ${roleCodes.join("+")} 进入台账且不提升导出权限`, async ({ page }) => {
     test.skip(process.env.E2E_MODE === "live", "只使用本地合成角色，不访问公网");
     const actor = { ...FINANCE_ACTOR, roleCodes };
@@ -375,8 +378,7 @@ for (const roleCodes of [["ceo"], ["finance"], ["finance_mgr"], ["manager", "fin
     await expect(page.getByRole("heading", { level: 1, name: "应付账款", exact: true })).toBeVisible();
     await page.getByRole("tab", { name: /^财务台账/ }).click();
     await expect(page.getByTestId("finance-ledger-table")).toBeVisible();
-    if (roleCodes.includes("ceo")) await expect(page.getByTestId("ap-export")).toHaveCount(0);
-    else await expect(page.getByTestId("ap-export")).toBeVisible();
+    await expect(page.getByTestId("ap-export")).toBeVisible();
   });
 }