Restore rendered control center baseline

backend-fastapi/core/role/service.py

@@ -14,6 +14,18 @@ from core.role.model import Role
 from core.role.schema import RoleCreate, RoleUpdate
 
 
+def _filter_ai_agent_admin_role_menus(menus: List[Any]) -> List[Any]:
+    from core.menu.service import (
+        AI_AGENT_ADMIN_MENU_NAMES,
+        _normalize_ai_agent_admin_menu,
+    )
+
+    filtered = [menu for menu in menus if menu.name in AI_AGENT_ADMIN_MENU_NAMES]
+    for menu in filtered:
+        _normalize_ai_agent_admin_menu(menu)
+    return filtered
+
+
 class RoleService(BaseService[Role, RoleCreate, RoleUpdate]):
     """
     角色服务层
@@ -430,26 +442,30 @@ class RoleService(BaseService[Role, RoleCreate, RoleUpdate]):
         # 菜单始终全量替换
         from core.menu.model import Menu
         result = await db.execute(select(Menu).where(Menu.id.in_(menu_ids)))
-        menus = list(result.scalars().all())
+        menus = _filter_ai_agent_admin_role_menus(list(result.scalars().all()))
+        allowed_menu_ids = {menu.id for menu in menus}
         role.menus = menus
         
         from core.permission.model import Permission
         
         if loaded_menu_ids:
             # 增量更新：只替换已加载菜单下的权限
-            loaded_menu_set = set(loaded_menu_ids)
+            loaded_menu_set = set(loaded_menu_ids) & allowed_menu_ids
             
             # 保留未加载菜单下的原有权限
             kept_permissions = [
                 p for p in (role.permissions or [])
-                if p.menu_id not in loaded_menu_set
+                if p.menu_id in allowed_menu_ids and p.menu_id not in loaded_menu_set
             ]
             
             # 获取前端提交的权限（已加载菜单下用户选择的权限）
             new_permissions = []
             if permission_ids:
                 result = await db.execute(
-                    select(Permission).where(Permission.id.in_(permission_ids))
+                    select(Permission).where(
+                        Permission.id.in_(permission_ids),
+                        Permission.menu_id.in_(allowed_menu_ids),
+                    )
                 )
                 new_permissions = list(result.scalars().all())
             
@@ -459,7 +475,10 @@ class RoleService(BaseService[Role, RoleCreate, RoleUpdate]):
             # 兼容旧逻辑：全量替换
             if permission_ids:
                 result = await db.execute(
-                    select(Permission).where(Permission.id.in_(permission_ids))
+                    select(Permission).where(
+                        Permission.id.in_(permission_ids),
+                        Permission.menu_id.in_(allowed_menu_ids),
+                    )
                 )
                 permissions = list(result.scalars().all())
             else:
@@ -543,17 +562,20 @@ class RoleService(BaseService[Role, RoleCreate, RoleUpdate]):
         
         # 获取所有菜单
         result = await db.execute(select(Menu).where(Menu.is_deleted == False))  # noqa: E712
-        all_menus = list(result.scalars().all())
+        all_menus = _filter_ai_agent_admin_role_menus(list(result.scalars().all()))
+        allowed_menu_ids = {menu.id for menu in all_menus}
         
         # 获取该角色已分配的权限ID和菜单ID
         role_permission_ids = set(p.id for p in role.permissions) if role.permissions else set()
-        role_menu_ids = set(m.id for m in role.menus) if role.menus else set()
+        role_menu_ids = {m.id for m in (role.menus or []) if m.id in allowed_menu_ids}
         
         # 获取所有启用的权限
         result = await db.execute(
             select(Permission).where(Permission.is_active == True, Permission.is_deleted == False)  # noqa: E712
         )
-        all_permissions = list(result.scalars().all())
+        all_permissions = [
+            perm for perm in list(result.scalars().all()) if perm.menu_id in allowed_menu_ids
+        ]
         
         # 权限类型映射
         PERMISSION_TYPE_MAP = {
@@ -637,7 +659,9 @@ class RoleService(BaseService[Role, RoleCreate, RoleUpdate]):
         if application_id:
             query = query.where(Menu.application_id == application_id)
         result = await db.execute(query)
-        all_menus = list(result.scalars().all())
+        all_menus = _filter_ai_agent_admin_role_menus(list(result.scalars().all()))
+        allowed_menu_ids = {menu.id for menu in all_menus}
+        role_menu_ids = {menu_id for menu_id in role_menu_ids if menu_id in allowed_menu_ids}
         
         # 统计每个菜单的权限数量
         permission_counts = {}
@@ -685,10 +709,20 @@ class RoleService(BaseService[Role, RoleCreate, RoleUpdate]):
     @classmethod
     async def get_menu_permissions(cls, db: AsyncSession, role: Role, menu_id: str) -> Dict[str, Any]:
         """获取指定菜单的权限列表"""
+        from core.menu.model import Menu
         from core.permission.model import Permission
         
         # 获取该角色已选中的权限ID
         role_permission_ids = set(p.id for p in role.permissions) if role.permissions else set()
+        menu_result = await db.execute(
+            select(Menu).where(Menu.id == menu_id, Menu.is_deleted == False)  # noqa: E712
+        )
+        menu = menu_result.scalar_one_or_none()
+        if not menu or not _filter_ai_agent_admin_role_menus([menu]):
+            return {
+                'menu_id': menu_id,
+                'permissions': [],
+            }
         
         # 权限类型映射
         PERMISSION_TYPE_MAP = {