feat: add full-stack API persistence and RBAC

modules/core/server/permissions.ts

@@ -0,0 +1,59 @@
+import type { Permission, RoleDefinition, RoleId } from "@/modules/core/types";
+import { ROLE_LABELS } from "@/modules/core/types";
+
+export const ROLE_DEFINITIONS: RoleDefinition[] = [
+  {
+    id: "admin",
+    label: ROLE_LABELS.admin,
+    description: "管理账号、权限、审计日志与全部业务数据。",
+    permissions: [
+      "account:read",
+      "account:manage",
+      "audit:read",
+      "elder:read",
+      "elder:create",
+      "elder:update",
+      "elder:delete",
+    ],
+  },
+  {
+    id: "manager",
+    label: ROLE_LABELS.manager,
+    description: "处理运营业务，可查看账号与审计日志，不管理账号角色。",
+    permissions: ["account:read", "audit:read", "elder:read", "elder:create", "elder:update", "elder:delete"],
+  },
+  {
+    id: "caregiver",
+    label: ROLE_LABELS.caregiver,
+    description: "查看老人档案并维护照护相关信息。",
+    permissions: ["elder:read", "elder:update"],
+  },
+  {
+    id: "viewer",
+    label: ROLE_LABELS.viewer,
+    description: "只读查看老人档案。",
+    permissions: ["elder:read"],
+  },
+];
+
+export function getRoleDefinition(role: RoleId): RoleDefinition {
+  const roleDefinition = ROLE_DEFINITIONS.find((item) => item.id === role);
+  if (roleDefinition) {
+    return roleDefinition;
+  }
+
+  return {
+    id: "viewer",
+    label: ROLE_LABELS.viewer,
+    description: "只读查看老人档案。",
+    permissions: ["elder:read"],
+  };
+}
+
+export function getPermissionsForRole(role: RoleId): Permission[] {
+  return [...getRoleDefinition(role).permissions];
+}
+
+export function hasPermission(role: RoleId, permission: Permission): boolean {
+  return getRoleDefinition(role).permissions.includes(permission);
+}