优化

src/core/auth/auth.test.ts

@@ -43,8 +43,6 @@ function token(overrides: Record<string, unknown> = {}) {
     user_id: '1000001',
     username: 'platform_admin',
     app_code: 'PLATFORM',
-    roles: ['PLATFORM_ADMIN'],
-    permissions: ['platform:warehouse:list', 'platform:order:list'],
     exp: Math.floor(Date.now() / 1000) + 1800,
     ...overrides,
   }
@@ -75,7 +73,7 @@ describe('admin auth session', () => {
     mocks.refreshHandler = null
   })
 
-  it('intersects JWT permissions with the current authenticated permission snapshot', async () => {
+  it('loads permissions from the current authorization endpoint when the JWT only contains identity', async () => {
     mocks.post.mockResolvedValue(loginResponse())
     mocks.listCurrentPlatformPermissionCodes.mockResolvedValue(['platform:warehouse:list'])
     const auth = useAuthStore()
@@ -134,7 +132,7 @@ describe('admin auth session', () => {
     localStorage.setItem('cc-admin-refresh-token', 'refresh-old')
     localStorage.setItem('cc-admin-permission-codes', '["platform:warehouse:list"]')
     const refreshedToken = token({
-      permissions: ['platform:warehouse:list', 'platform:firstleg:inbound:list'],
+      token_version: 2,
     })
     mocks.post.mockResolvedValue(loginResponse(refreshedToken, 'refresh-rotated'))
     mocks.listCurrentPlatformPermissionCodes.mockResolvedValue([