fix(permissions):修复后端权限漏洞

web/admin/src/views/tenant/MembersPage.vue

@@ -8,6 +8,7 @@ import PageHeader from '@/components/PageHeader.vue'
 import TableStats from '@/components/TableStats.vue'
 import request from '@/utils/request'
 import { useExport } from '@/composables/useExport'
+import { hasPermission } from '@/utils/permission'
 import ResponsiveTable from '@/components/ResponsiveTable.vue'
 
 const loading = ref(false)
@@ -174,6 +175,11 @@ const columns: TableColumnData[] = [
     width: 180,
     fixed: 'right',
     render({ record }) {
+      // 禁用/启用/改密/解锁四个动作在后端要求 member:manage（只读的 member:view
+      // 只能看列表）。无权限时不渲染按钮，避免点了才拿到 403。
+      if (!hasPermission('member:manage')) {
+        return h('span', { style: 'color: var(--color-text-3)' }, '—')
+      }
       const isDisabled = record.status === 'disabled'
       const locked = !!record.locked_until && new Date(record.locked_until) > new Date()
       const actions = [

web/admin/src/views/tenant/detail/WalletTab.vue

@@ -262,9 +262,10 @@ watch(() => props.active, (v) => { if (v) refreshAll() })
       <ACard :bordered="false" title="钱包信息" class="mb-4">
         <template #extra>
           <ASpace :wrap="isMobile" :size="isMobile ? 'small' : 'medium'">
-            <AButton type="primary" @click="openRecharge">调整余额</AButton>
-            <AButton status="success" @click="openOfflineRecharge">线下入账</AButton>
-            <AButton @click="openThreshold">预警设置</AButton>
+            <!-- 三个动作在后端都要求 billing:refund（billing:view 只能看余额），按权限点渲染 -->
+            <AButton v-if="hasPermission('billing:refund')" type="primary" @click="openRecharge">调整余额</AButton>
+            <AButton v-if="hasPermission('billing:refund')" status="success" @click="openOfflineRecharge">线下入账</AButton>
+            <AButton v-if="hasPermission('billing:refund')" @click="openThreshold">预警设置</AButton>
           </ASpace>
         </template>
         <ADescriptions :column="isMobile ? 1 : 3" bordered size="medium">