;rgb:0000/0000/0000

gengx

server/app/mcp/service/Catalog.php

@@ -47,7 +47,7 @@ class Catalog
             $entry = array_merge(['kind' => 'report', 'http' => 'GET', 'writes' => [], 'external' => [], 'params' => [], 'no_login' => false],
                 $generated[$key] ?? [], $reviewed[$key] ?? []);
             $entry['key'] = $key;
-            $entry['perm'] = $entry['perm'] ?? $key;
+            $entry['perm'] = self::effectivePerm((string) ($entry['perm'] ?? $key), (array) ($entry['perm_fallback'] ?? []), $menus);
             $entry['reviewed'] = isset($reviewed[$key]);
             $menu = $menus[PermissionService::normalize($entry['perm'])] ?? null;
             $entry['registered'] = $menu !== null;
@@ -134,6 +134,25 @@ class Catalog
         self::$all = null;
     }
 
+    /**
+     * 实际用来判断的权限点。有些子接口在部分环境没有单独登记权限点：后台对未登记接口不做校验，
+     * 页面靠 Tab/页面权限控制能不能看到。审核文件用 perm_fallback 按顺序给出替代项：
+     * 自身已登记就用自身（与后台完全一致），否则用第一个已登记的替代项（与后台页面可见性一致），
+     * 从不比后台页面更宽。
+     */
+    private static function effectivePerm(string $perm, array $fallback, array $menus): string
+    {
+        if ($fallback === [] || isset($menus[PermissionService::normalize($perm)])) {
+            return $perm;
+        }
+        foreach ($fallback as $candidate) {
+            if (isset($menus[PermissionService::normalize((string) $candidate)])) {
+                return (string) $candidate;
+            }
+        }
+        return $perm;
+    }
+
     private static function decide(array $r): array
     {
         if (isset($r['status'])) {