diff --git a/GROUP_IDENTITY.md b/GROUP_IDENTITY.md
index bf8577d3a..64e6a72e1 100644
--- a/GROUP_IDENTITY.md
+++ b/GROUP_IDENTITY.md
@@ -4,6 +4,20 @@
 
 已有有效 zyt 后台账号可从集团工作台一键进入客服。首次创建固定“集团基础用户”角色，没有业务权限；客服管理员使用原本地账号在“系统管理 → 用户管理”分配角色，在“角色权限”勾选具体能力。再次集团登录保留管理员分配的角色和本地停用状态，不按同名账号合并，不继承医院 root。密码仍由 zyt 验证，绑定账号不能使用或设置客服本地密码。
 
+网页登录使用同一个账号密码表单：输入zyt账号密码或客服本地账号密码，点击“登录”直接进入客服，不跳转集团后台。本地凭据验证成功时沿用本地账号和角色；否则通过服务器配置的ZYT API实时验密。无医院菜单权限的有效zyt账号也可使用。
+
+直接登录仅需客服API配置`ZYT_GROUP_API_URL`。中央端点`POST /adminapi/group/kefu/login`调用原项目无会话验密`POST /adminapi/identity.session/verify`，不创建或注销zyt网页会话，不依赖集团前端运行。密码仅用于本次验证，不在客服保存为本地密码、放入URL或返回给浏览器；密码仍由zyt管理。
+
+同名账号不会合并：有效本地凭据优先；只有zyt凭据匹配时，按提供方和稳定GID创建/查找独立绑定账号，首次为无业务权限的“集团基础用户”。原客服管理员在用户管理分配本地业务角色，再次直接登录保持该角色与本地停用状态。不能在客服重置绑定账号的zyt密码。
+
+管理端标准API前缀为`/api/v2`，构建产物应设置`VITE_GLOB_API_URL=/api/v2`，可以由8766服务直接托管；开发代理及本机5666预览同时兼容旧`/api`与标准前缀。如果通过其他地址访问，集团登录会先进入已配置的客服回调地址，再发起登录，避免不同域或端口丢失登录事务。回调仍严格固定，不接受任意跳转。
+
+本地管理员在用户列表“来源/原账号”找到集团用户，选择业务角色即可；“集团基础用户”固定无权限，只读不可扩权。后端每请求使用新权限，已登录前端在页面可见时每3秒同步菜单和按钮，切回窗口立即同步。仅有角色读取权限的角色管理员也能进入角色页；分配用户角色仍需用户管理权限，不因登录成功自动授予管理能力。
+
+集团管理员可查看这里分配的角色和有效权限、同步动态新增的权限目录，并直接编辑已绑定用户的客服授权。客服API配置`ZYT_GROUP_METADATA_KEY_FILE`，集团配置`IAM_KEFU_METADATA_API_URL`及`IAM_KEFU_METADATA_KEY_FILE`，两个文件内容为同一份32字节随机密钥的64位hex表示。文件须放在非公开目录、限制服务用户读取，勿写入浏览器、URL或仓库。Docker需要额外挂载该文件，配置值是容器内只读路径；只有api服务需要它。该密钥同时用于专用授权管理协议，必须仅提供给受信任的集团服务。
+
+元数据接口`POST /api/v2/group/access-snapshot`只接受专用HMAC请求并签名响应，不接受普通客服用户token代替机器认证，也不能登录或改授权。按稳定GID关联，查询不会创建账号或认领同名本地账号。集团用户页“客服授权”展示当前角色、启停和有效权限，打开期间每30秒刷新；集团菜单管理的客服公司目录自动拉取，也可点击“同步客服权限”。自定义权限增改删会反映到集团管理目录，删除采用软停用并保留既有引用，恢复沿用原节点。不会把客服权限并入集团/医院授权，也不会自动给集团角色加权限。
+
 客服 API 配置以下公开地址，缺少任一项时关闭集团登录：
 
 ```dotenv
@@ -12,8 +26,12 @@ ZYT_GROUP_API_URL=https://<集团API域名>/adminapi
 KEFU_PUBLIC_BASE_URL=https://<客服前端域名>
 ```
 
-同时在集团配置 `IAM_KEFU_BASE_URL=<客服前端地址>`、`IAM_KEFU_COMPANY_CODE=<实际客服公司编码>`。回调严格为客服前端根路径 `/auth/group-login`，使用 history 路由。生产 HTTPS；只有回环本地开发可用 HTTP。Docker compose 已透传三项配置，不能把密钥或密码放进这些地址。
+同时在集团配置 `IAM_KEFU_BASE_URL=<已登记客服地址>`、`IAM_KEFU_COMPANY_CODE=<实际客服公司编码>`以启用该客户端。上面的前端/回调配置仅为保留集团工作台旧单点入口所需；客服主登录框直接验密只依赖API地址。旧回调仍严格为`/auth/group-login`。生产HTTPS；只有回环本地开发可用HTTP。Docker compose已透传配置，不能把密钥或密码放进这些地址。
 
 集团菜单目录仅控制集团入口显示，客服业务菜单和按钮由客服本地角色决定。集团基础角色固定为空，需给用户分配其他业务角色，而不是给基础角色扩权。客服 SSO 会话最长 8 小时；本地停用和权限调整每请求生效。当前无跨系统全局注销，集团改密/退出会阻止新的 SSO，但不会声称立即撤销所有已签发客服会话。
 
+集团管理员也可在集团“用户管理 → 客服授权 → 编辑客服授权”中直接分配客服角色，或勾选仅该用户的权限。独立权限通过专属客服角色保存，不修改共享角色或其他用户；实际授权仍存于客服。保存提交后，既有客服会话下一次请求即按新权限执行。2026-11-04起前台页面每3秒同步菜单、按钮和路由，切回窗口或恢复可见立即同步；当前页面失权后返回账号页，不注销登录，仍有权页面及其草稿保留。前端升级首次加载新版本需要刷新一次，后续授权变化无需整页刷新。未绑定用户须先用ZYT账号登录客服，不能按同名本地账号认领。
+
+此管理使用独立的`/api/v2/group/access-options`、`/api/v2/group/access-update`端点，沿用服务密钥但绑定实际端点签名，持久化防重放并校验旧版本。普通客服token不能调用。集团仅允许显式集团管理员，并在每次操作核对来源用户/GID/应用归属；两端审计。原`access-snapshot`仍只读。联调协议见集团`integration/kefu-group-authorization-contract.md`。
+
 新增回归：`wechat_rpa/test_group_sso.py` 与 `admin-web/apps/web-antd/tests/group-sso.test.mjs`。后端测试需要在合成配置及隔离临时目录运行，勿初始化或重置真实账号库。集团侧跨项目联合测试见 `C:/zyt/identity-admin/tests/kefu-joint-flow.test.mjs`。
diff --git a/admin-web/apps/web-antd/src/api/core/auth.ts b/admin-web/apps/web-antd/src/api/core/auth.ts
index b13538c35..e2f259d8c 100644
--- a/admin-web/apps/web-antd/src/api/core/auth.ts
+++ b/admin-web/apps/web-antd/src/api/core/auth.ts
@@ -36,6 +36,7 @@ export namespace AuthApi {
   }
 }
 
+/** ZYT 与客服本地账号共用密码登录；凭证只放 POST body，由服务端选择验证来源。 */
 export async function loginApi(data: AuthApi.LoginParams) {
   const resp = await requestClient.post<AuthApi.BackendLoginResult>(
     '/auth/login',
diff --git a/admin-web/apps/web-antd/src/api/request.ts b/admin-web/apps/web-antd/src/api/request.ts
index 245ad9de4..b47b8db21 100644
--- a/admin-web/apps/web-antd/src/api/request.ts
+++ b/admin-web/apps/web-antd/src/api/request.ts
@@ -17,6 +17,7 @@ import { message } from 'ant-design-vue';
 
 import { t } from '#/locales/t';
 import { useAuthStore } from '#/store';
+import { requestBelongsToSession } from '#/utils/authorization-sync';
 
 import { refreshTokenApi } from './core';
 import { responseErrorMessage } from './error-message';
@@ -109,15 +110,23 @@ function createRequestClient(baseURL: string, options?: RequestClientOptions) {
   );
 
   // token过期的处理
-  client.addResponseInterceptor(
-    authenticateResponseInterceptor({
-      client,
-      doReAuthenticate,
-      doRefreshToken,
-      enableRefreshToken: preferences.app.enableRefreshToken,
-      formatToken,
-    }),
-  );
+  const authentication = authenticateResponseInterceptor({
+    client,
+    doReAuthenticate,
+    doRefreshToken,
+    enableRefreshToken: preferences.app.enableRefreshToken,
+    formatToken,
+  });
+  client.addResponseInterceptor({
+    ...authentication,
+    rejected: (error) => {
+      // A delayed 401 from a previous account must not log out the new account.
+      if (!requestBelongsToSession(error?.config?.headers?.Authorization, useAccessStore().accessToken)) {
+        return Promise.reject(error);
+      }
+      return authentication.rejected?.(error);
+    },
+  });
 
   // 通用的错误处理,如果没有进入上面的错误处理逻辑，就会进入这里
   client.addResponseInterceptor(
diff --git a/admin-web/apps/web-antd/src/bootstrap.ts b/admin-web/apps/web-antd/src/bootstrap.ts
index 811e1a260..0d48f04ac 100644
--- a/admin-web/apps/web-antd/src/bootstrap.ts
+++ b/admin-web/apps/web-antd/src/bootstrap.ts
@@ -17,6 +17,7 @@ import { initComponentAdapter } from './adapter/component';
 import { initSetupVbenForm } from './adapter/form';
 import App from './app.vue';
 import { router } from './router';
+import { installAuthorizationSync } from './router/authorization-sync';
 
 async function bootstrap(namespace: string) {
   // 初始化组件适配器
@@ -57,6 +58,7 @@ async function bootstrap(namespace: string) {
 
   // 配置路由及路由守卫
   app.use(router);
+  app.onUnmount(installAuthorizationSync(router));
 
   // 配置Motion插件
   const { MotionPlugin } = await import('@vben/plugins/motion');
diff --git a/admin-web/apps/web-antd/src/locales/en/permissions.ts b/admin-web/apps/web-antd/src/locales/en/permissions.ts
index cf98bd0c5..817b58f7c 100644
--- a/admin-web/apps/web-antd/src/locales/en/permissions.ts
+++ b/admin-web/apps/web-antd/src/locales/en/permissions.ts
@@ -6,6 +6,9 @@
  * 管理员自己加的条目（custom）没有译文，原样显示。
  */
 export default {
+  '已保存，后端权限立即生效；在线用户的菜单和按钮将在数秒内自动更新。': 'Saved. Server permissions take effect immediately; menus and buttons update automatically within a few seconds for online users.',
+  '后端权限修改后立即生效，无需重启或重新登录；在线用户的菜单和按钮将在数秒内自动更新，切回窗口时立即同步。管理员和集团基础用户角色只读，内置角色和仍有人在用的角色不可删除。要新增权限点或左侧菜单链接，去「系统管理 → 权限菜单」。': 'Server permission changes take effect immediately without restarting or signing in again. Menus and buttons update within a few seconds for online users and sync immediately when the window regains focus. Administrator and group basic roles are read-only. Built-in roles and roles assigned to users cannot be deleted. Add permissions or navigation links under System → Permission menus.',
+  '集团基础用户固定无业务权限，不能修改。请到「系统管理 → 用户管理」为账号分配其他业务角色。': 'The group basic role has no business permissions and cannot be changed. Assign another business role to the account under System → Users.',
   // ── 权限菜单页 permissions.vue ──────────────────────────────────────────────
   '已新增 {code}。管理员自动拥有它；其他角色去「角色权限」里勾选':
     'Added {code}. Administrators get it automatically; grant it to other roles under "Roles"',
diff --git a/admin-web/apps/web-antd/src/locales/en/users.ts b/admin-web/apps/web-antd/src/locales/en/users.ts
index 8dbc1e9db..25af61781 100644
--- a/admin-web/apps/web-antd/src/locales/en/users.ts
+++ b/admin-web/apps/web-antd/src/locales/en/users.ts
@@ -1,5 +1,9 @@
 /** views/console/users.vue */
 export default {
+  'ZYT 账号或客服本地账号': 'ZYT account or local service account',
+  '请输入账号': 'Enter your account',
+  'ZYT 密码或客服本地密码': 'ZYT password or local service password',
+  'ZYT 首次登录为基础用户，业务权限由客服管理员分配。': 'First-time ZYT users start with basic access. Service administrators assign business permissions.',
   '登录响应无效，请重新登录': 'Invalid login response. Please sign in again',
   '集团登录地址配置无效': 'Invalid group sign-in URL configuration',
   '集团登录尚未启用': 'Group sign-in is not enabled',
diff --git a/admin-web/apps/web-antd/src/router/authorization-sync.ts b/admin-web/apps/web-antd/src/router/authorization-sync.ts
new file mode 100644
index 000000000..9d2ac1189
--- /dev/null
+++ b/admin-web/apps/web-antd/src/router/authorization-sync.ts
@@ -0,0 +1,133 @@
+import type { UserInfo } from '@vben/types';
+import type { RouteRecordRaw, Router } from 'vue-router';
+
+import { watch } from 'vue';
+import { createMemoryHistory, createRouter } from 'vue-router';
+
+import { getTabKey, useAccessStore, useTabbarStore, useUserStore } from '@vben/stores';
+
+import { getUserInfoApi } from '#/api/core/user';
+import { createAuthorizationSync } from '#/utils/authorization-sync';
+
+import { generateAccess } from './access';
+import { accessRoutes, routes } from './routes';
+
+function copyRoutes(input: RouteRecordRaw[]): RouteRecordRaw[] {
+  return input.map((route) => ({ ...route, meta: { ...route.meta },
+    children: route.children ? copyRoutes(route.children) : undefined } as RouteRecordRaw));
+}
+
+// Vben adds dynamic children into the normalized Root. Keep a clean template,
+// including component functions, rather than cloning that mutated tree later.
+const staticRoutes = copyRoutes(routes).map((route) => route.path === '/' ? { ...route, children: [] } : route);
+const installations = new WeakMap<Router, () => void>();
+
+function routeNames(input: RouteRecordRaw[]): Set<string | symbol> {
+  return new Set(input.flatMap((route) => [
+    ...(route.name ? [route.name] : []), ...routeNames(route.children ?? []),
+  ]));
+}
+
+export function isAuthorizedPath(router: Router, path: string, codes: string[]) {
+  const target = router.resolve(path);
+  return target.matched.length > 0 && target.name !== 'FallbackNotFound' && target.matched.every((record) => {
+    const authority = record.meta.authority;
+    return !Array.isArray(authority) || authority.length === 0 || authority.some((code) => codes.includes(code));
+  });
+}
+
+/** Reconcile by name/path, retaining authorized matcher/component instances. */
+export function reconcileAccessRoutes(router: Router, nextRoutes: RouteRecordRaw[]) {
+  const staticNames = routeNames(staticRoutes);
+  const desired = routeNames(nextRoutes);
+  const root = router.getRoutes().find((route) => route.path === '/');
+  if (!root?.name) throw new Error('Missing application root route');
+
+  for (const record of router.getRoutes()) {
+    if (record.name && !staticNames.has(record.name) && !desired.has(record.name)) router.removeRoute(record.name);
+  }
+
+  function install(input: RouteRecordRaw[], parent: string | symbol) {
+    for (const route of input) {
+      const parentPath = router.getRoutes().find((record) => record.name === parent)?.path ?? '/';
+      const expectedPath = route.path.startsWith('/') ? route.path : `${parentPath.replace(/\/$/, '')}/${route.path}`;
+      let existing = route.name ? router.getRoutes().find((record) => record.name === route.name) : undefined;
+      if (existing && existing.path !== expectedPath) {
+        router.removeRoute(existing.name!);
+        existing = undefined;
+      }
+      if (existing) {
+        // Existing authorized pages keep their resolved components and drafts.
+        // Recurse so a grant adds missing siblings without replacing their parent.
+        Object.assign(existing.meta, route.meta);
+        install(route.children ?? [], existing.name!);
+      } else if (route.meta?.noBasicLayout) {
+        router.addRoute(route);
+      } else {
+        router.addRoute(parent, route);
+      }
+    }
+  }
+  install(nextRoutes, root.name);
+  // Keep Vben's source tree exact as well as Vue Router's matcher table.
+  root.children.splice(0, root.children.length, ...nextRoutes.filter((route) => !route.meta?.noBasicLayout));
+}
+
+export function pruneAuthorizationTabs(router: Router, codes: string[], tabbar: ReturnType<typeof useTabbarStore>) {
+  tabbar.tabs = tabbar.tabs.filter((tab) => isAuthorizedPath(router, tab.fullPath || tab.path, codes));
+  tabbar.visitHistory.retain(tabbar.tabs.map((tab) => tab.key || getTabKey(tab)));
+  for (const [key, cached] of tabbar.cachedRoutes) {
+    if (!isAuthorizedPath(router, cached.route.fullPath || cached.route.path, codes)) tabbar.removeCachedRoute(key);
+  }
+  for (const name of tabbar.excludeCachedTabs) {
+    if (!router.hasRoute(name)) tabbar.excludeCachedTabs.delete(name);
+  }
+  void tabbar.updateCacheTabs();
+}
+
+/** Install once for this app, after Pinia and Router are available. */
+export function installAuthorizationSync(router: Router) {
+  installations.get(router)?.();
+  const access = useAccessStore();
+  const user = useUserStore();
+  const tabbar = useTabbarStore();
+  const sync = createAuthorizationSync({
+    window, document,
+    fetch: getUserInfoApi,
+    getCodes: () => access.accessCodes,
+    getSession: () => access.accessToken && access.isAccessChecked && user.userInfo?.userId
+      ? { token: access.accessToken, userId: String(user.userInfo.userId) } : undefined,
+    async prepare(info: UserInfo) {
+      const preparedRouter = createRouter({ history: createMemoryHistory(), routes: copyRoutes(staticRoutes) });
+      return generateAccess({ roles: info.roles ?? [], router: preparedRouter, routes: accessRoutes });
+    },
+    apply(info, snapshot) {
+      const codes = info.roles ?? [];
+      user.setUserInfo(info);
+      access.setAccessCodes(codes);
+      if (!snapshot) return;
+      reconcileAccessRoutes(router, snapshot.accessibleRoutes);
+      access.setAccessMenus(snapshot.accessibleMenus);
+      access.setAccessRoutes(snapshot.accessibleRoutes);
+      pruneAuthorizationTabs(router, codes, tabbar);
+      // Keep an authorized current component mounted; replacing its route would
+      // discard unsaved forms merely because a different permission changed.
+      if (!isAuthorizedPath(router, router.currentRoute.value.fullPath, codes)) {
+        return router.replace('/group/welcome').then(() => {});
+      }
+    },
+  });
+  const unwatch = watch(() => JSON.stringify([
+    access.accessToken, user.userInfo?.userId, access.isAccessChecked,
+  ]), () => {
+    sync.stop();
+    if (access.accessToken && user.userInfo?.userId && access.isAccessChecked) sync.start();
+  }, { immediate: true, flush: 'sync' });
+  const dispose = () => {
+    unwatch();
+    sync.stop();
+    if (installations.get(router) === dispose) installations.delete(router);
+  };
+  installations.set(router, dispose);
+  return dispose;
+}
diff --git a/admin-web/apps/web-antd/src/router/routes/modules/console.ts b/admin-web/apps/web-antd/src/router/routes/modules/console.ts
index e17d20954..e10b66175 100644
--- a/admin-web/apps/web-antd/src/router/routes/modules/console.ts
+++ b/admin-web/apps/web-antd/src/router/routes/modules/console.ts
@@ -40,7 +40,6 @@ const routes: RouteRecordRaw[] = [
       icon: 'lucide:bot',
       order: 0,
       title: 'AI 模型',
-      authority: ['model:read', 'agent:read', 'stats:read'],
     },
     name: 'ModelCenter',
     path: '/model',
@@ -94,7 +93,6 @@ const routes: RouteRecordRaw[] = [
       icon: 'lucide:monitor-smartphone',
       order: 1,
       title: '桌面端',
-      authority: ['desktop-account:read', 'config:read'],
     },
     name: 'DesktopCenter',
     path: '/desktop',
@@ -138,7 +136,6 @@ const routes: RouteRecordRaw[] = [
       icon: 'lucide:messages-square',
       order: 2,
       title: '聊天归档',
-      authority: ['im:read', 'im:content:read', 'im:export', 'im:identity:write', 'im:storage:write'],
     },
     name: 'ArchiveCenter',
     path: '/archive',
@@ -200,7 +197,6 @@ const routes: RouteRecordRaw[] = [
       icon: 'lucide:shield',
       order: 3,
       title: '系统管理',
-      authority: ['user:read', 'audit:read'],
     },
     name: 'SystemCenter',
     path: '/system',
@@ -212,7 +208,7 @@ const routes: RouteRecordRaw[] = [
         meta: {
           icon: 'lucide:key-round',
           title: '角色权限',
-          authority: ['role:read', 'role:write'],
+          authority: ['role:read', 'user:read'],
         },
       },
       {
@@ -262,4 +258,12 @@ const routes: RouteRecordRaw[] = [
   },
 ];
 
+// A business directory is visible when at least one of its pages is granted.
+// Derive its codes so newly split page permissions cannot be hidden by stale parents.
+for (const route of routes) {
+  if (route.meta && route.children?.length && route.children.every(child => child.meta?.authority?.length)) {
+    route.meta.authority = [...new Set(route.children.flatMap(child => child.meta?.authority || []))];
+  }
+}
+
 export default routes;
diff --git a/admin-web/apps/web-antd/src/utils/authorization-sync.ts b/admin-web/apps/web-antd/src/utils/authorization-sync.ts
new file mode 100644
index 000000000..7cce84390
--- /dev/null
+++ b/admin-web/apps/web-antd/src/utils/authorization-sync.ts
@@ -0,0 +1,91 @@
+interface AuthorizationInfo {
+  roles?: string[];
+  userId: string;
+}
+
+interface Session {
+  token: string;
+  userId: string;
+}
+
+interface SyncOptions<Info extends AuthorizationInfo, Snapshot> {
+  apply: (info: Info, snapshot?: Snapshot) => Promise<void> | void;
+  document: Pick<Document, 'addEventListener' | 'removeEventListener' | 'visibilityState'>;
+  fetch: () => Promise<Info>;
+  getCodes: () => string[];
+  getSession: () => Session | undefined;
+  interval?: number;
+  prepare: (info: Info) => Promise<Snapshot>;
+  window: Pick<Window, 'addEventListener' | 'clearInterval' | 'removeEventListener' | 'setInterval'>;
+}
+
+function permissionKey(codes: string[]) {
+  return JSON.stringify([...new Set(codes)].sort());
+}
+
+/** Ignore failures from a request made by a different, already-ended session. */
+export function requestBelongsToSession(authorization: unknown, token: null | string) {
+  return (authorization || null) === (token ? `Bearer ${token}` : null);
+}
+
+/** One foreground poller. Preparation never mutates the displayed router/stores. */
+export function createAuthorizationSync<Info extends AuthorizationInfo, Snapshot>(options: SyncOptions<Info, Snapshot>) {
+  let active = false;
+  let epoch = 0;
+  let timer: number | undefined;
+  let pending: Promise<void> | undefined;
+  let appliedPermissions = permissionKey(options.getCodes());
+
+  function refresh(): Promise<void> {
+    if (!active || options.document.visibilityState !== 'visible') return Promise.resolve();
+    if (pending) return pending;
+    const session = options.getSession();
+    if (!session) return Promise.resolve();
+    const generation = epoch;
+    const current = () => {
+      const now = options.getSession();
+      return active && epoch === generation && now?.token === session.token && now.userId === session.userId;
+    };
+    const task = (async () => {
+      try {
+        const info = await options.fetch();
+        if (!current() || String(info.userId) !== session.userId) return;
+        const changed = permissionKey(info.roles ?? []) !== appliedPermissions;
+        const snapshot = changed ? await options.prepare(info) : undefined;
+        if (!current()) return;
+        await options.apply(info, snapshot);
+        if (current()) appliedPermissions = permissionKey(info.roles ?? []);
+      } catch {
+        // requestClient owns HTTP/401 handling. A later foreground poll can recover;
+        // failed background reads must never clear grants or replay a write.
+      }
+    })();
+    pending = task;
+    void task.finally(() => { if (pending === task) pending = undefined; });
+    return task;
+  }
+
+  const trigger = () => { void refresh(); };
+  function stop() {
+    active = false;
+    epoch += 1;
+    pending = undefined;
+    if (timer !== undefined) options.window.clearInterval(timer);
+    timer = undefined;
+    options.window.removeEventListener('focus', trigger);
+    options.document.removeEventListener('visibilitychange', trigger);
+  }
+
+  function start() {
+    if (active) return;
+    active = true;
+    epoch += 1;
+    appliedPermissions = permissionKey(options.getCodes());
+    options.window.addEventListener('focus', trigger);
+    options.document.addEventListener('visibilitychange', trigger);
+    timer = options.window.setInterval(trigger, options.interval ?? 3000);
+    trigger();
+  }
+
+  return { refresh, start, stop };
+}
diff --git a/admin-web/apps/web-antd/src/utils/group-sso.ts b/admin-web/apps/web-antd/src/utils/group-sso.ts
index 005927957..154e1f925 100644
--- a/admin-web/apps/web-antd/src/utils/group-sso.ts
+++ b/admin-web/apps/web-antd/src/utils/group-sso.ts
@@ -42,6 +42,15 @@ export function validateGroupConfig(config: GroupConfig, origin: string): GroupC
   return config as GroupConfig & Required<Omit<GroupConfig, 'enabled'>>;
 }
 
+/** Reach the configured callback origin before storing its tab-bound PKCE proof. */
+export function groupLoginEntry(config: GroupConfig, origin: string): string {
+  const callback = safeUrl(config?.redirect_uri);
+  validateGroupConfig(config, callback.origin);
+  const current = safeUrl(origin);
+  if (current.href !== `${current.origin}/`) throw new Error(t('集团登录地址配置无效'));
+  return callback.origin === current.origin ? '/auth/group-login' : callback.href;
+}
+
 function base64url(value: Uint8Array): string {
   return btoa(String.fromCharCode(...value)).replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '');
 }
diff --git a/admin-web/apps/web-antd/src/views/_core/authentication/group-login.vue b/admin-web/apps/web-antd/src/views/_core/authentication/group-login.vue
index 185e53dab..5f61eec16 100644
--- a/admin-web/apps/web-antd/src/views/_core/authentication/group-login.vue
+++ b/admin-web/apps/web-antd/src/views/_core/authentication/group-login.vue
@@ -6,7 +6,7 @@ import { Alert, Button, Spin } from 'ant-design-vue';
 
 import { getGroupConfigApi } from '#/api';
 import { useAuthStore } from '#/store';
-import { beginGroupLogin, consumeGroupCallback, GROUP_TRANSACTION_KEY } from '#/utils/group-sso';
+import { beginGroupLogin, consumeGroupCallback, groupLoginEntry, GROUP_TRANSACTION_KEY } from '#/utils/group-sso';
 
 const error = ref('');
 const router = useRouter();
@@ -24,7 +24,13 @@ onMounted(async () => {
       await auth.authGroupLogin(transaction);
     } else {
       sessionStorage.removeItem(GROUP_TRANSACTION_KEY);
-      const target = await beginGroupLogin(await getGroupConfigApi());
+      const config = await getGroupConfigApi();
+      const entry = groupLoginEntry(config, window.location.origin);
+      if (entry !== '/auth/group-login') {
+        window.location.replace(entry);
+        return;
+      }
+      const target = await beginGroupLogin(config);
       window.location.assign(target);
     }
   } catch {
diff --git a/admin-web/apps/web-antd/src/views/_core/authentication/login.vue b/admin-web/apps/web-antd/src/views/_core/authentication/login.vue
index 0a4f406b8..525ef1273 100644
--- a/admin-web/apps/web-antd/src/views/_core/authentication/login.vue
+++ b/admin-web/apps/web-antd/src/views/_core/authentication/login.vue
@@ -1,14 +1,9 @@
 <script lang="ts" setup>
 import type { VbenFormSchema } from '@vben/common-ui';
 
-import { computed, onMounted, ref } from 'vue';
-import { useRouter } from 'vue-router';
+import { computed } from 'vue';
 
 import { AuthenticationLogin, z } from '@vben/common-ui';
-import { Button } from 'ant-design-vue';
-
-import { getGroupConfigApi } from '#/api';
-import { validateGroupConfig } from '#/utils/group-sso';
 
 import { t } from '#/locales/t';
 import { useAuthStore } from '#/store';
@@ -16,14 +11,6 @@ import { useAuthStore } from '#/store';
 defineOptions({ name: 'Login' });
 
 const authStore = useAuthStore();
-const router = useRouter();
-const groupEnabled = ref(false);
-onMounted(async () => {
-  try {
-    validateGroupConfig(await getGroupConfigApi(), window.location.origin);
-    groupEnabled.value = true;
-  } catch { groupEnabled.value = false; }
-});
 
 // 模板自带的演示账号下拉、滑块验证码、手机号/扫码/第三方登录、注册和找回密码
 // 都删掉了——后端没有对应的接口，留着只会让人点进死路。滑块验证码尤其要注意：
@@ -31,14 +18,14 @@ onMounted(async () => {
 const formSchema = computed((): VbenFormSchema[] => [
   {
     component: 'VbenInput',
-    componentProps: { placeholder: t('用户名') },
+    componentProps: { placeholder: t('ZYT 账号或客服本地账号') },
     fieldName: 'username',
-    label: t('用户名'),
-    rules: z.string().min(1, { message: t('请输入用户名') }),
+    label: t('账号'),
+    rules: z.string().min(1, { message: t('请输入账号') }),
   },
   {
     component: 'VbenInputPassword',
-    componentProps: { placeholder: t('密码') },
+    componentProps: { placeholder: t('ZYT 密码或客服本地密码') },
     fieldName: 'password',
     label: t('密码'),
     rules: z.string().min(1, { message: t('请输入密码') }),
@@ -54,15 +41,10 @@ const formSchema = computed((): VbenFormSchema[] => [
     :show-forget-password="false"
     :show-qrcode-login="false"
     :show-register="false"
+    :show-remember-me="false"
     :show-third-party-login="false"
-    :sub-title="t('请使用管理员分配的账号登录')"
+    :sub-title="t('ZYT 首次登录为基础用户，业务权限由客服管理员分配。')"
     :title="t('真羊 AI 客服 · 管理后台')"
     @submit="authStore.authLogin"
-  >
-    <template #third-party-login>
-      <Button v-if="groupEnabled" block class="mt-4" @click="router.push('/auth/group-login')">
-        {{ t('使用集团账号登录') }}
-      </Button>
-    </template>
-  </AuthenticationLogin>
+  />
 </template>
diff --git a/admin-web/apps/web-antd/src/views/console/roles.vue b/admin-web/apps/web-antd/src/views/console/roles.vue
index 4f9cd4bc8..a4e2ce2b9 100644
--- a/admin-web/apps/web-antd/src/views/console/roles.vue
+++ b/admin-web/apps/web-antd/src/views/console/roles.vue
@@ -27,8 +27,9 @@ const open = ref(false);
 const isNew = ref(false);
 
 const form = reactive({ code: '', name: '', permissions: [] as string[] });
+const protectedRole = (code: string) => code === 'admin' || code === 'zyt_basic';
 // 新增和修改是两个按钮：只能新增的人打开已有角色只能看
-const readonly = computed(() => !(isNew.value ? canCreate.value : canWrite.value) || form.code === 'admin');
+const readonly = computed(() => !(isNew.value ? canCreate.value : canWrite.value) || protectedRole(form.code));
 
 /** 一级菜单 → 页面 → 权限码，和左侧菜单一一对应。 */
 const grouped = computed(() => groupPermissions(permissions.value));
@@ -49,6 +50,7 @@ function expandAll() {
 }
 
 function onCheck(keys: unknown) {
+  if (readonly.value) return;
   // 不是严格模式时 antd 给的是数组；兜底处理 { checked } 形状
   const list = Array.isArray(keys) ? keys : ((keys as { checked?: (number | string)[] }).checked ?? []);
   form.permissions = applyTreeCheck(form.permissions, list, visibleCodes.value, permissions.value);
@@ -98,10 +100,11 @@ async function submit() {
   const known = new Set(permissions.value.map((item) => item.code));
   roles.value = (await saveRole({ ...form, permissions: form.permissions.filter((code) => known.has(code)) })).roles;
   open.value = false;
-  message.success(t('已保存，权限立即生效（无需重启，也无需重新登录）'));
+  message.success(t('已保存，后端权限立即生效；在线用户的菜单和按钮将在数秒内自动更新。'));
 }
 
 async function remove(row: RoleItem) {
+  if (!canDelete.value || protectedRole(row.code) || row.builtin || row.user_count > 0) return;
   roles.value = (await deleteRole(row.code)).roles;
   message.success(t('已删除'));
 }
@@ -125,7 +128,7 @@ onMounted(load);
       type="info"
       show-icon
       :message="t('权限按左侧菜单组织：菜单 → 页面 → 页面里的每个按钮')"
-      :description="t('改完立刻生效——不用重启服务，用户也不用重新登录。管理员角色不可削权（削了就没人能加回来），内置角色和仍有人在用的角色不可删除。要新增权限点或左侧菜单链接，去「系统管理 → 权限菜单」。')"
+      :description="t('后端权限修改后立即生效，无需重启或重新登录；在线用户的菜单和按钮将在数秒内自动更新，切回窗口时立即同步。管理员和集团基础用户角色只读，内置角色和仍有人在用的角色不可删除。要新增权限点或左侧菜单链接，去「系统管理 → 权限菜单」。')"
     />
     <Card :title="t('角色与权限')">
       <template #extra>
@@ -158,12 +161,12 @@ onMounted(load);
           </template>
           <template v-else-if="column.key === 'action'">
             <Button type="link" size="small" @click="openEdit(record as RoleItem)">
-              {{ canWrite && record.code !== 'admin' ? t('编辑') : t('查看') }}
+              {{ canWrite && !protectedRole(record.code) ? t('编辑') : t('查看') }}
             </Button>
             <Popconfirm :title="t('确定删除这个角色？')" @confirm="remove(record as RoleItem)">
               <Button
                 type="link" size="small" danger
-                :disabled="!canDelete || record.builtin || record.user_count > 0"
+                :disabled="!canDelete || protectedRole(record.code) || record.builtin || record.user_count > 0"
               >
                 {{ t('删除') }}
               </Button>
@@ -190,6 +193,9 @@ onMounted(load);
           <p v-if="form.code === 'admin'" class="mb-2 text-xs text-gray-500">
             {{ t('管理员始终拥有全部权限（包括以后新增的），不能修改。') }}
           </p>
+          <p v-else-if="form.code === 'zyt_basic'" class="mb-2 text-xs text-gray-500">
+            {{ t('集团基础用户固定无业务权限，不能修改。请到「系统管理 → 用户管理」为账号分配其他业务角色。') }}
+          </p>
           <div class="mb-2 flex flex-wrap items-center gap-2">
             <Input v-model:value="keyword" allow-clear size="small" class="w-60" :placeholder="t('搜索按钮名称或权限码')"
               @change="expandAll" />
diff --git a/admin-web/apps/web-antd/tests/api-proxy.test.mjs b/admin-web/apps/web-antd/tests/api-proxy.test.mjs
new file mode 100644
index 000000000..ea714c60b
--- /dev/null
+++ b/admin-web/apps/web-antd/tests/api-proxy.test.mjs
@@ -0,0 +1,21 @@
+import assert from 'node:assert/strict';
+import {readFileSync} from 'node:fs';
+import {createRequire} from 'node:module';
+import vm from 'node:vm';
+import test from 'node:test';
+const require=createRequire(import.meta.url);
+const ts=require(process.env.KEFU_SSO_TYPESCRIPT||'typescript');
+test('实际Vite代理同时接受旧前缀与标准API前缀，保留独立后端配置',async()=>{
+  const source=readFileSync(new URL('../vite.config.ts',import.meta.url),'utf8');
+  const code=ts.transpileModule(source,{compilerOptions:{module:ts.ModuleKind.CommonJS}}).outputText;
+  for(const target of [undefined,'http://127.0.0.1:18766']) {
+    const module={exports:{}};
+    vm.runInNewContext(code,{module,exports:module.exports,process:{env:{VITE_API_TARGET:target}},
+      require(name){assert.equal(name,'@vben/vite-config');return {defineConfig:factory=>factory};}});
+    const proxy=(await module.exports.default()).vite.server.proxy['/api'];
+    assert.equal(proxy.rewrite('/api/auth/login'),'/api/v2/auth/login');
+    assert.equal(proxy.rewrite('/api/v2/auth/group/config'),'/api/v2/auth/group/config');
+    assert.equal(proxy.rewrite('/api/v2/users?active=true'),'/api/v2/users?active=true');
+    assert.equal(proxy.target,target||'http://127.0.0.1:8766');
+  }
+});
diff --git a/admin-web/apps/web-antd/tests/authorization-sync.test.mjs b/admin-web/apps/web-antd/tests/authorization-sync.test.mjs
new file mode 100644
index 000000000..cbe946ad8
--- /dev/null
+++ b/admin-web/apps/web-antd/tests/authorization-sync.test.mjs
@@ -0,0 +1,328 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { resolve } from 'node:path';
+import test from 'node:test';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import vm from 'node:vm';
+
+const require = createRequire(process.env.KEFU_SSO_TYPESCRIPT
+  ? pathToFileURL(resolve(process.env.KEFU_SSO_TYPESCRIPT, 'package.json'))
+  : new URL('../package.json', import.meta.url));
+const ts = require('typescript');
+const vue = require('vue');
+const pinia = require('pinia');
+const routing = require('vue-router');
+const workspace = process.env.KEFU_SSO_WORKSPACE || fileURLToPath(new URL('../../../', import.meta.url));
+const source = relative => readFile(resolve(workspace, relative), 'utf8');
+const staged = relative => readFile(new URL(`../src/${relative}`, import.meta.url), 'utf8');
+const normalized = value => JSON.parse(JSON.stringify(value));
+const clone = value => Array.isArray(value) ? value.map(clone)
+  : value && typeof value === 'object' ? Object.fromEntries(Object.entries(value).map(([key, item]) => [key, clone(item)])) : value;
+
+function load(code, dependencies = {}, globals = {}) {
+  const compiled = ts.transpileModule(code.replaceAll('import.meta.hot', 'undefined'), { compilerOptions: {
+    module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022,
+  }, reportDiagnostics: true });
+  assert.deepEqual(compiled.diagnostics, []);
+  const module = { exports: {} };
+  vm.runInNewContext(compiled.outputText, { module, exports: module.exports,
+    require(name) { assert.ok(name in dependencies, `Unexpected import ${name}`); return dependencies[name]; },
+    console, ...globals });
+  return module.exports;
+}
+
+const preferences = { app: { accessMode: 'frontend', loginExpiredMode: 'modal', enableRefreshToken: false },
+  tabbar: { visitHistory: true, maxCount: 0 } };
+const tree = load(await source('packages/@core/base/shared/src/utils/tree.ts'));
+const stack = load(await source('packages/@core/base/shared/src/utils/stack.ts'));
+const { useAccessStore } = load(await source('packages/stores/src/modules/access.ts'), { pinia });
+const { useUserStore } = load(await source('packages/stores/src/modules/user.ts'), { pinia });
+const { useTabbarStore, getTabKey } = load(await source('packages/stores/src/modules/tabbar.ts'), {
+  vue, pinia, '@vben-core/preferences': { preferences },
+  '@vben-core/shared/utils': { ...stack, startProgress() {}, stopProgress() {}, openWindow() {} },
+}, { sessionStorage: {} });
+const stores = { useAccessStore, useUserStore, useTabbarStore, getTabKey };
+const { useAccess } = load(await source('packages/effects/access/src/use-access.ts'), {
+  vue, '@vben/preferences': { preferences }, '@vben/stores': stores,
+});
+const { generateRoutesByFrontend } = load(await source('packages/utils/src/helpers/generate-routes-frontend.ts'), {
+  '@vben-core/shared/utils': tree,
+});
+const { generateMenus } = load(await source('packages/utils/src/helpers/generate-menus.ts'), {
+  '@vben-core/shared/utils': tree,
+});
+const { generateAccessible } = load(await source('packages/effects/access/src/accessible.ts'), {
+  vue, '@vben/utils': { ...tree, cloneDeep: clone, generateMenus, generateRoutesByFrontend,
+    generateRoutesByBackend() { throw new Error('Unexpected backend access mode'); },
+    isFunction: value => typeof value === 'function', isString: value => typeof value === 'string' },
+});
+const syncModule = load(await staged('utils/authorization-sync.ts'));
+const menuHelpers = load(await source('apps/web-antd/src/router/menu-access.ts'));
+const originalRoutes = load(await staged('router/routes/modules/console.ts')).default;
+function pageRoutes(input) {
+  return input.map(route => ({ ...route, meta: { ...route.meta },
+    ...(route.component ? { component: { name: `Test${route.name}`, render: () => null } } : {}),
+    children: route.children ? pageRoutes(route.children) : undefined }));
+}
+const accessRoutes = pageRoutes(originalRoutes);
+const routes = [
+  { name: 'Root', path: '/', component: { render: () => vue.h(routing.RouterView) }, children: [] },
+  { name: 'Login', path: '/auth/login', component: { render: () => null } },
+  { name: 'FallbackNotFound', path: '/:path(.*)*', component: { render: () => null } },
+];
+
+function environment() {
+  const window = new EventTarget();
+  const document = new EventTarget();
+  document.visibilityState = 'visible';
+  const timers = new Map();
+  let sequence = 0;
+  window.setInterval = (callback, delay) => { const id = ++sequence; timers.set(id, { callback, delay }); return id; };
+  window.clearInterval = id => timers.delete(id);
+  return { window, document, timers,
+    tick() { for (const timer of [...timers.values()]) timer.callback(); },
+    focus() { window.dispatchEvent(new Event('focus')); },
+    visible(value) { document.visibilityState = value ? 'visible' : 'hidden'; document.dispatchEvent(new Event('visibilitychange')); } };
+}
+const settle = () => new Promise(resolve => setImmediate(resolve));
+const info = (roles = [], userId = '7') => ({ userId, username: `user${userId}`, realName: 'Test', roles });
+const deferred = () => { let resolve, reject; const promise = new Promise((yes, no) => { resolve = yes; reject = no; }); return { promise, resolve, reject }; };
+
+async function harness(initial = []) {
+  pinia.setActivePinia(pinia.createPinia());
+  const access = useAccessStore();
+  const user = useUserStore();
+  const tabbar = useTabbarStore();
+  const env = environment();
+  const router = routing.createRouter({ history: routing.createMemoryHistory(), routes: clone(routes) });
+  const requests = [];
+  let answer = info(initial);
+  let preparations = 0;
+  const generateAccess = async options => {
+    preparations += 1;
+    const generated = await generateAccessible('frontend', options);
+    return { ...generated, accessibleMenus: menuHelpers.pruneEmptyMenus(generated.accessibleMenus, menuHelpers.parentPaths(options.routes)) };
+  };
+  const adapter = load(await staged('router/authorization-sync.ts'), {
+    vue, 'vue-router': routing, '@vben/stores': stores,
+    '#/api/core/user': { getUserInfoApi() { requests.push('GET /me'); return Promise.resolve(typeof answer === 'function' ? answer() : clone(answer)); } },
+    '#/utils/authorization-sync': syncModule, './access': { generateAccess },
+    './routes': { accessRoutes, routes: clone(routes) },
+  }, env);
+  access.setAccessToken('same-session');
+  access.setAccessCodes(initial);
+  user.setUserInfo(info(initial));
+  const first = await generateAccess({ roles: initial, routes: accessRoutes, router });
+  access.setAccessMenus(first.accessibleMenus);
+  access.setAccessRoutes(first.accessibleRoutes);
+  access.setIsAccessChecked(true);
+  await router.push('/group/welcome');
+  const dispose = adapter.installAuthorizationSync(router);
+  await settle();
+  return { access, user, tabbar, env, router, requests, adapter, dispose,
+    preparations: () => preparations,
+    answer(value) { answer = value; },
+    async poll(value) { answer = value; env.tick(); await settle(); },
+  };
+}
+
+test('same logged-in token gains/revokes real menus, matcher routes and reactive action rights', async () => {
+  const h = await harness();
+  try {
+    const { hasAccessByCodes } = useAccess();
+    const createButton = vue.computed(() => hasAccessByCodes(['role:create']));
+    assert.equal(h.router.hasRoute('RoleManage'), false);
+    assert.equal(createButton.value, false);
+    await h.poll(info(['role:read']));
+    assert.equal(h.router.hasRoute('RoleManage'), true);
+    assert.ok(h.access.accessMenus.some(menu => menu.children?.some(item => item.path === '/system/roles')));
+    await h.router.push('/system/roles');
+    const current = h.router.currentRoute.value;
+    const record = h.router.getRoutes().find(route => route.name === 'RoleManage');
+    const component = record.components.default;
+    const cachedDraft = { component: vue.markRaw({ draft: 'unsaved role form' }), key: '/system/roles', route: vue.markRaw(current) };
+    h.tabbar.cachedRoutes.set('/system/roles', cachedDraft);
+    await h.poll(info(['role:read', 'role:create']));
+    assert.equal(createButton.value, true);
+    assert.equal(h.router.currentRoute.value, current, 'authorized current route was navigated/replaced');
+    assert.equal(h.router.getRoutes().find(route => route.name === 'RoleManage').components.default, component);
+    assert.equal(h.tabbar.cachedRoutes.get('/system/roles').component.draft, 'unsaved role form');
+    await h.poll(info(['role:read']));
+    assert.equal(createButton.value, false);
+    assert.equal(h.router.currentRoute.value, current);
+    assert.equal(h.access.accessToken, 'same-session');
+    await h.poll(info([]));
+    assert.equal(h.router.hasRoute('RoleManage'), false);
+    assert.equal(h.router.hasRoute('SystemCenter'), false, 'fully revoked branch survived');
+    assert.equal(h.router.resolve('/system/roles').name, 'FallbackNotFound');
+    assert.ok(!h.access.accessMenus.some(menu => menu.path === '/system'));
+    assert.equal(h.router.currentRoute.value.path, '/group/welcome');
+    assert.equal(h.access.accessToken, 'same-session');
+    assert.equal(h.tabbar.cachedRoutes.has('/system/roles'), false);
+  } finally { h.dispose(); }
+});
+
+test('grant/revoke siblings preserves an authorized current matcher, component and pinned tab', async () => {
+  const h = await harness(['user:read']);
+  try {
+    await h.router.push('/system/users');
+    const current = h.router.currentRoute.value;
+    const components = h.router.getRoutes().find(route => route.name === 'UserManage').components;
+    h.tabbar.addTab({ ...current, key: '/system/users', meta: { ...current.meta, affixTab: true, keepAlive: true } });
+    await h.poll(info(['user:read', 'audit:read']));
+    assert.equal(h.router.hasRoute('AuditLog'), true);
+    assert.equal(h.router.currentRoute.value, current);
+    assert.equal(h.router.getRoutes().find(route => route.name === 'UserManage').components, components);
+    const audit = h.router.resolve('/system/audit');
+    h.tabbar.addTab({ ...audit, key: '/system/audit', meta: { ...audit.meta, affixTab: true, keepAlive: true } });
+    h.tabbar.cachedRoutes.set('/system/audit', { key: '/system/audit', route: vue.markRaw(audit), component: vue.markRaw({}) });
+    await h.poll(info(['user:read']));
+    assert.equal(h.router.hasRoute('AuditLog'), false);
+    assert.equal(h.router.currentRoute.value, current);
+    assert.deepEqual(normalized(h.tabbar.tabs.map(tab => tab.path)), ['/system/users']);
+    assert.equal(h.tabbar.cachedTabs.has('AuditLog'), false);
+    assert.equal(h.tabbar.cachedRoutes.has('/system/audit'), false);
+    assert.equal(h.tabbar.visitHistory.size, 1);
+  } finally { h.dispose(); }
+});
+
+test('equal/reordered permissions refresh profile without rebuilding menus; hidden polls pause and focus resumes', async () => {
+  const h = await harness(['role:read', 'role:create']);
+  try {
+    const before = h.preparations();
+    await h.poll({ ...info(['role:create', 'role:read', 'role:read']), realName: 'Changed display name' });
+    assert.equal(h.preparations(), before);
+    assert.equal(h.user.userInfo.realName, 'Changed display name');
+    assert.deepEqual([...h.env.timers.values()].map(timer => timer.delay), [3000]);
+    const requests = h.requests.length;
+    h.env.visible(false);
+    h.env.tick();
+    h.env.focus();
+    await settle();
+    assert.equal(h.requests.length, requests);
+    h.answer(info([]));
+    h.env.visible(true);
+    await settle();
+    assert.equal(h.router.hasRoute('RoleManage'), false);
+    assert.equal(h.requests.length, requests + 1);
+    h.answer(info(['role:read']));
+    h.env.focus();
+    await settle();
+    assert.equal(h.router.hasRoute('RoleManage'), true);
+    h.dispose();
+    const disposed = h.requests.length;
+    h.env.tick(); h.env.focus(); h.env.visible(true);
+    await settle();
+    assert.equal(h.env.timers.size, 0);
+    assert.equal(h.requests.length, disposed);
+  } finally { h.dispose(); }
+});
+
+test('concurrent events coalesce; logout disposes; old account response cannot overwrite a new session', async () => {
+  const h = await harness();
+  try {
+    const old = deferred();
+    h.answer(() => old.promise);
+    const before = h.requests.length;
+    h.env.tick(); h.env.focus(); h.env.visible(true); h.env.tick();
+    assert.equal(h.requests.length, before + 1);
+    h.access.setAccessToken(null);
+    assert.equal(h.env.timers.size, 0);
+    h.user.setUserInfo(info([], '8'));
+    h.access.setAccessCodes([]);
+    h.answer(info(['role:read'], '8'));
+    h.access.setAccessToken('new-session');
+    await settle();
+    assert.equal(h.router.hasRoute('RoleManage'), true);
+    old.resolve(info(['user:read', 'role:create'], '7'));
+    await settle();
+    assert.equal(h.access.accessToken, 'new-session');
+    assert.equal(h.user.userInfo.userId, '8');
+    assert.deepEqual(normalized(h.access.accessCodes), ['role:read']);
+    assert.equal(h.router.hasRoute('UserManage'), false);
+    assert.equal(h.env.timers.size, 1);
+  } finally { h.dispose(); }
+});
+
+test('wrong identity and late preparation are ignored; failed preparation can recover', async () => {
+  const env = environment();
+  let session = { token: 'A', userId: '7' };
+  let answer = info(['role:read'], '8');
+  const stagedSnapshot = deferred();
+  let prepares = 0, applied = 0;
+  let prepare = async () => { prepares += 1; return stagedSnapshot.promise; };
+  const sync = syncModule.createAuthorizationSync({ ...env, getSession: () => session, getCodes: () => [],
+    fetch: async () => answer, prepare: value => prepare(value), apply() { applied += 1; } });
+  sync.start();
+  await sync.refresh();
+  assert.equal(prepares, 0);
+  answer = info(['role:read']);
+  const pending = sync.refresh();
+  await Promise.resolve();
+  session = { token: 'B', userId: '9' };
+  stagedSnapshot.resolve({});
+  await pending;
+  assert.equal(applied, 0);
+  sync.stop();
+  session = { token: 'A', userId: '7' };
+  prepare = async () => { throw new Error('Temporary menu read failure'); };
+  sync.start();
+  await sync.refresh();
+  assert.equal(applied, 0);
+  prepare = async () => ({});
+  await sync.refresh();
+  assert.equal(applied, 1);
+  sync.stop();
+});
+
+test('reinstall is singleton and an old disposer cannot stop its replacement', async () => {
+  const h = await harness();
+  const replacement = h.adapter.installAuthorizationSync(h.router);
+  try {
+    h.dispose();
+    await settle();
+    assert.equal(h.env.timers.size, 1);
+    h.answer(info(['role:read']));
+    h.env.focus();
+    await settle();
+    assert.equal(h.router.hasRoute('RoleManage'), true);
+  } finally { replacement(); }
+  assert.equal(h.env.timers.size, 0);
+});
+
+test('actual request auth interceptor ignores an old 401; current 401 retains expiry handling; 403 never retries', async () => {
+  pinia.setActivePinia(pinia.createPinia());
+  const access = useAccessStore();
+  access.setAccessToken('new-session'); access.setIsAccessChecked(true);
+  const clients = [];
+  class RequestClient {
+    constructor() { this.responses = []; clients.push(this); }
+    addRequestInterceptor() {}
+    addResponseInterceptor(value) { this.responses.push(value); }
+  }
+  const preset = load(await source('packages/effects/request/src/request-client/preset-interceptors.ts'), {
+    '@vben/locales': { $t: key => key }, '@vben/utils': { isFunction: value => typeof value === 'function' },
+    axios: createRequire(require.resolve('@vben/request'))('axios'),
+  });
+  let logouts = 0;
+  load((await staged('api/request.ts')).replaceAll('import.meta.env.PROD', 'false').replaceAll('import.meta.env', '{}'), {
+    '@vben/hooks': { useAppConfig: () => ({ apiURL: '/api/v2' }) },
+    '@vben/preferences': { preferences }, '@vben/request': { ...preset, RequestClient }, '@vben/stores': stores,
+    'ant-design-vue': { message: { error() {} } }, '#/locales/t': { t: key => key },
+    '#/store': { useAuthStore: () => ({ logout: async () => { logouts += 1; } }) },
+    '#/utils/authorization-sync': syncModule, './core': { refreshTokenApi: async () => { throw new Error('No refresh token'); } },
+    './error-message': { responseErrorMessage: () => 'Error' },
+  });
+  const authentication = clients[0].responses[1];
+  const error = (status, token) => ({ config: { headers: { Authorization: `Bearer ${token}` } }, response: { status } });
+  await assert.rejects(authentication.rejected(error(401, 'old-session')));
+  assert.equal(access.accessToken, 'new-session');
+  assert.equal(access.loginExpired, false);
+  await assert.rejects(authentication.rejected(error(403, 'new-session')));
+  assert.equal(access.accessToken, 'new-session');
+  assert.equal(logouts, 0);
+  await assert.rejects(authentication.rejected(error(401, 'new-session')));
+  assert.equal(access.accessToken, null);
+  assert.equal(access.loginExpired, true);
+});
diff --git a/admin-web/apps/web-antd/tests/group-navigation.test.mjs b/admin-web/apps/web-antd/tests/group-navigation.test.mjs
index ca1178007..f8cd87794 100644
--- a/admin-web/apps/web-antd/tests/group-navigation.test.mjs
+++ b/admin-web/apps/web-antd/tests/group-navigation.test.mjs
@@ -12,6 +12,9 @@ const engine=await readFile(enginePath,'utf8');
 const tree=ts.createSourceFile('engine.ts',engine,ts.ScriptTarget.Latest,true);
 const functions=tree.statements.filter(node=>ts.isFunctionDeclaration(node)&&['hasAuthority','menuHasVisibleWithForbidden'].includes(node.name?.text)).map(node=>node.getText(tree)).join('\n');
 const {hasAuthority}=await import(moduleUrl(compile(functions+'\nexport {hasAuthority};')));
+const sharedPath=process.env.KEFU_SSO_WORKSPACE?pathToFileURL(resolve(process.env.KEFU_SSO_WORKSPACE,'packages/@core/base/shared/src/utils/tree.ts')):new URL('../../../packages/@core/base/shared/src/utils/tree.ts',import.meta.url);
+const shared=moduleUrl(compile(await readFile(sharedPath,'utf8')));
+const {generateRoutesByFrontend}=await import(moduleUrl(compile(engine).replace("from '@vben-core/shared/utils'",`from '${shared}'`)));
 test('基础角色只显示我的账号，业务目录使用实际Vben权限算法按子页面读权限开放',()=>{
   const visible=permissions=>routes.filter(route=>!route.meta?.hideInMenu&&hasAuthority(route,permissions)).map(route=>route.name);
   assert.deepEqual(visible([]),['GroupAccount']);
@@ -22,3 +25,31 @@ test('基础角色只显示我的账号，业务目录使用实际Vben权限算
   const all=[...new Set(routes.flatMap(route=>(route.children||[]).flatMap(child=>child.meta?.authority||[])))];
   assert.equal(visible(all).length,6);
 });
+
+test('角色读取权限经过实际Vben父子路由过滤后可进入角色页，兼容用户读取权限',async()=>{
+  for(const permissions of [['role:read'],['role:read','role:write'],['user:read']]){
+    const filtered=await generateRoutesByFrontend(structuredClone(routes.map(({component,...route})=>({...route,children:route.children?.map(({component,...child})=>child)}))),permissions);
+    const system=filtered.find(route=>route.name==='SystemCenter');
+    assert.ok(system,permissions.join(','));
+    assert.ok(system.children.some(route=>route.name==='RoleManage'),permissions.join(','));
+    if(!permissions.includes('user:read')) assert.ok(!system.children.some(route=>route.name==='UserManage'));
+  }
+  for(const permissions of [[],['role:write'],['role:create'],['role:delete']]){
+    const filtered=await generateRoutesByFrontend(structuredClone(routes.map(({component,...route})=>({...route,children:route.children?.map(({component,...child})=>child)}))),permissions);
+    assert.ok(!filtered.some(route=>route.name==='SystemCenter'),permissions.join(','));
+  }
+});
+
+test('每个已授予的页面都能通过实际父目录过滤，包括新增的细分读取权限',async()=>{
+  for(const parent of routes.filter(route=>!route.meta?.hideInMenu)){
+    for(const child of parent.children||[]){
+      for(const code of child.meta?.authority||[]){
+        const input=routes.map(({component,...route})=>({...route,children:route.children?.map(({component,...page})=>page)}));
+        const filtered=await generateRoutesByFrontend(structuredClone(input),[code]);
+        const directory=filtered.find(route=>route.name===parent.name);
+        assert.ok(directory,`${code}: ${parent.name}`);
+        assert.ok(directory.children.some(page=>page.name===child.name),`${code}: ${child.name}`);
+      }
+    }
+  }
+});
diff --git a/admin-web/apps/web-antd/tests/group-sso.test.mjs b/admin-web/apps/web-antd/tests/group-sso.test.mjs
index 0cc507440..83c578800 100644
--- a/admin-web/apps/web-antd/tests/group-sso.test.mjs
+++ b/admin-web/apps/web-antd/tests/group-sso.test.mjs
@@ -29,6 +29,19 @@ const origin = 'http://127.0.0.1:5666';
 const now = 1_000_000;
 const code = 'C'.repeat(43);
 
+test('不同访问地址先进入固定客服回调域，再在该域创建PKCE事务', async () => {
+  assert.equal(sso.groupLoginEntry(config, origin), '/auth/group-login');
+  assert.equal(sso.groupLoginEntry(config, 'http://127.0.0.1:8766'), config.redirect_uri);
+  assert.equal(sso.groupLoginEntry(config, 'http://localhost:5666'), config.redirect_uri);
+  const pending = storage();
+  await assert.rejects(sso.beginGroupLogin(config, 'http://127.0.0.1:8766', pending, webcrypto, now));
+  assert.equal(pending.values.size, 0);
+  assert.throws(() => sso.groupLoginEntry({...config, enabled: false}, origin));
+  assert.throws(() => sso.groupLoginEntry({...config, redirect_uri: 'https://evil.example/other'}, origin));
+  assert.throws(() => sso.groupLoginEntry({...config, authorize_url: 'https://evil.example/sso/authorize'}, origin));
+  assert.throws(() => sso.groupLoginEntry(config, `${origin}/auth/login`));
+});
+
 function storage() {
   const values = new Map();
   return { getItem: key => values.get(key) ?? null, setItem: (key, value) => values.set(key, value),
@@ -152,6 +165,90 @@ test('password login shares authoritative initialization and preserves forced pa
   assert.equal(h.events.at(-1), 'route:/profile/password');
 });
 
+test('local and ZYT credentials share password API and use only current /me permissions', async () => {
+  for (const account of [
+    { username: 'local_operator', permissions: ['stats:read', 'conversation:read'], home: '/model/stats' },
+    { username: 'zyt_new', permissions: [], home: '/group/welcome' },
+    { username: 'zyt_authorized', permissions: ['stats:read', 'user:read'], home: '/model/stats' },
+  ]) {
+    const h = authHarness();
+    const requests = [];
+    const requestClient = {
+      async post(path, body) {
+        requests.push({ method: 'POST', path, body });
+        // Even stale/overbroad permissions in the login response are ignored.
+        return { access_token: `token-${account.username}`, user: { permissions: ['user:write', 'role:write'] } };
+      },
+      async get(path) {
+        requests.push({ method: 'GET', path });
+        return { id: 12, username: account.username, permissions: account.permissions,
+          must_change_password: false, role: account.permissions.length ? 'operator' : 'zyt_basic' };
+      },
+    };
+    h.api.loginApi = loadTs('../src/api/core/auth.ts', {
+      '#/api/request': { requestClient, baseRequestClient: { get() { assert.fail('Password login requested group config'); } } },
+    }).loginApi;
+    h.api.getUserInfoApi = loadTs('../src/api/core/user.ts', { '#/api/request': { requestClient } }).getUserInfoApi;
+    h.api.groupExchangeApi = async () => { assert.fail('Password login used group exchange'); };
+    await h.store.authLogin({ username: account.username, password: 'Fixture@2026' });
+    assert.equal(h.access.accessToken, `token-${account.username}`);
+    assert.deepEqual(h.access.accessCodes, account.permissions);
+    assert.deepEqual(h.user.userInfo.roles, account.permissions);
+    assert.equal(h.user.userInfo.username, account.username);
+    assert.equal(h.access.accessMenus.length, 0);
+    assert.equal(h.access.accessRoutes.length, 0);
+    assert.equal(h.access.isAccessChecked, false);
+    assert.equal(h.persisted.tabs.length, 0);
+    assert.equal(h.persisted.cachedUser, null);
+    assert.equal(h.persisted.lock, false);
+    assert.equal(h.store.loginLoading.value, false);
+    assert.deepEqual(h.events, ['reset-routes', 'reset-stores', `token:token-${account.username}`, 'route:' + account.home]);
+    assert.deepEqual(JSON.parse(JSON.stringify(requests)), [
+      { method: 'POST', path: '/auth/login', body: { username: account.username, password: 'Fixture@2026', device_name: 'web' } },
+      { method: 'GET', path: '/me' },
+    ]);
+  }
+});
+
+test('ordinary password errors release loading and permit retry through the same authLogin', async () => {
+  const h = authHarness();
+  let attempts = 0;
+  h.api.loginApi = async () => {
+    if (++attempts === 1) throw new Error('账号或密码错误');
+    return { accessToken: 'retry-basic' };
+  };
+  const credentials = { username: 'zyt_new', password: 'Fixture@2026' };
+  await assert.rejects(h.store.authLogin(credentials), /账号或密码错误/);
+  assert.equal(h.store.loginLoading.value, false);
+  assert.deepEqual(h.events, []);
+  h.setUser({ userId: '8', username: 'zyt_new', roles: [], homePath: '/group/welcome' });
+  await h.store.authLogin(credentials);
+  assert.equal(attempts, 2);
+  assert.equal(h.store.loginLoading.value, false);
+  assert.equal(h.access.accessToken, 'retry-basic');
+  assert.deepEqual(h.access.accessCodes, []);
+  assert.equal(h.events.at(-1), 'route:/group/welcome');
+});
+
+test('ordinary password /me failure clears new identity and allows a clean retry', async () => {
+  const h = authHarness();
+  h.api.getUserInfoApi = async () => { throw new Error('revoked'); };
+  const credentials = { username: 'zyt_new', password: 'Fixture@2026' };
+  await assert.rejects(h.store.authLogin(credentials), /revoked/);
+  assert.equal(h.store.loginLoading.value, false);
+  assert.equal(h.access.accessToken, null);
+  assert.equal(h.access.accessCodes.length, 0);
+  assert.equal(h.access.accessMenus.length, 0);
+  assert.equal(h.access.accessRoutes.length, 0);
+  assert.equal(h.user.userInfo, null);
+  assert.equal(h.persisted.cachedUser, null);
+  h.api.getUserInfoApi = async () => ({ userId: '8', username: 'zyt_new', roles: [], homePath: '/group/welcome' });
+  await h.store.authLogin(credentials);
+  assert.equal(h.access.accessToken, 'local-user');
+  assert.equal(h.access.accessCodes.length, 0);
+  assert.equal(h.events.at(-1), 'route:/group/welcome');
+});
+
 test('failure to load current local identity clears the new token and authorization', async () => {
   const h = authHarness();
   h.api.getUserInfoApi = async () => { throw new Error('revoked'); };
diff --git a/admin-web/apps/web-antd/tests/local-role-page.test.mjs b/admin-web/apps/web-antd/tests/local-role-page.test.mjs
new file mode 100644
index 000000000..dd0ad265c
--- /dev/null
+++ b/admin-web/apps/web-antd/tests/local-role-page.test.mjs
@@ -0,0 +1,141 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { resolve } from 'node:path';
+import test from 'node:test';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import vm from 'node:vm';
+
+const require = createRequire(process.env.KEFU_SSO_TYPESCRIPT
+  ? pathToFileURL(resolve(process.env.KEFU_SSO_TYPESCRIPT, 'package.json'))
+  : new URL('../package.json', import.meta.url));
+const ts = require('typescript');
+const vue = require('vue');
+const vueRequire = createRequire(require.resolve('vue/package.json'));
+const { parse, compileScript, compileTemplate } = vueRequire('@vue/compiler-sfc');
+const { renderToString } = vueRequire('@vue/server-renderer');
+const workspace = process.env.KEFU_SSO_WORKSPACE || fileURLToPath(new URL('../../../', import.meta.url));
+const translate = { t: value => value };
+
+function load(source, dependencies) {
+  const compiled = ts.transpileModule(source, { compilerOptions: {
+    module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022,
+  }, reportDiagnostics: true });
+  assert.deepEqual(compiled.diagnostics, []);
+  const module = { exports: {} };
+  vm.runInNewContext(compiled.outputText, { module, exports: module.exports,
+    require(name) { assert.ok(name in dependencies, `Unexpected import ${name}`); return dependencies[name]; },
+    console });
+  return module.exports;
+}
+
+// Compile the actual SFC and its actual permission-tree helpers. Ant components
+// only render their props/slots; Vue setup, computed state and template run as-is.
+const filename = fileURLToPath(new URL('../src/views/console/roles.vue', import.meta.url));
+const { descriptor } = parse(await readFile(filename, 'utf8'), { filename });
+const script = compileScript(descriptor, { id: 'local-role-page-test' });
+const template = compileTemplate({ source: descriptor.template.content, filename,
+  id: 'local-role-page-test', compilerOptions: { bindingMetadata: script.bindings } });
+assert.deepEqual(template.errors, []);
+const helpers = load(await readFile(resolve(workspace, 'apps/web-antd/src/views/console/permission-menu.ts'), 'utf8'), {
+  '#/locales/t': translate,
+});
+
+const plain = tag => vue.defineComponent({ inheritAttrs: false,
+  setup(_props, { attrs, slots }) { return () => vue.h(tag, attrs, slots.default?.()); } });
+const ant = Object.fromEntries(['Alert', 'Card', 'Form', 'FormItem', 'Input', 'Popconfirm', 'Tag']
+  .map(name => [name, plain('div')]));
+ant.Button = plain('button');
+ant.Tree = vue.defineComponent({ props: ['disabled'], setup(props) {
+  return () => vue.h('div', { 'data-permission-tree': String(Boolean(props.disabled)) });
+} });
+ant.Modal = vue.defineComponent({ props: ['open', 'title', 'okText'], setup(props, { slots }) {
+  return () => props.open ? vue.h('section', { 'data-modal-title': props.title }, [
+    vue.h('button', { 'data-modal-action': '' }, props.okText), slots.default?.(),
+  ]) : null;
+} });
+ant.Table = vue.defineComponent({ props: ['dataSource', 'columns'], setup(props, { slots }) {
+  return () => vue.h('div', {}, props.dataSource.map(record => vue.h('div', { 'data-role': record.code },
+    props.columns.map(column => slots.bodyCell?.({ column, record })))));
+} });
+
+const catalog = [
+  { code: 'user:read', name: '查看用户', group_name: '系统管理', page_name: '用户管理', kind: 'page' },
+  { code: 'custom:report', name: '自定义报表', group_name: '报表', page_name: '报表', kind: 'link' },
+];
+const rows = [
+  { code: 'admin', name: '管理员', permissions: ['user:read'], builtin: false, user_count: 0 },
+  { code: 'zyt_basic', name: '集团基础用户', permissions: [], builtin: false, user_count: 0 },
+  { code: 'reviewer', name: '审核员', permissions: ['user:read', 'custom:report', 'removed:code'], builtin: false, user_count: 0 },
+];
+
+async function page(codes, configure = () => {}) {
+  const calls = { save: [], remove: [], success: [] };
+  let state;
+  const component = load(script.content, {
+    vue, 'vue-router': { useRouter: () => ({ push() {} }) },
+    '@vben/access': { useAccess: () => ({ hasAccessByCodes: values => values.some(value => codes.includes(value)) }) },
+    'ant-design-vue': { ...ant, message: { warning() {}, success(value) { calls.success.push(value); } } },
+    '#/locales/t': translate, './permission-menu': helpers,
+    '#/api/console': {
+      async fetchRoles() { return { roles: rows }; }, async fetchPermissions() { return { permissions: catalog }; },
+      async saveRole(data) { calls.save.push(data); return { roles: rows }; },
+      async deleteRole(code) { calls.remove.push(code); return { roles: rows }; },
+    },
+  }).default;
+  component.render = load(template.code, { vue }).render;
+  const original = component.setup;
+  component.setup = (props, context) => {
+    state = original(props, context);
+    state.roles.value = rows;
+    state.permissions.value = catalog;
+    configure(state);
+    return state;
+  };
+  const html = await renderToString(vue.createSSRApp(component));
+  return { state, calls, html };
+}
+
+test('管理员和集团基础角色实际组件均为只读：名称/权限禁用、查看与关闭、禁止写删', async () => {
+  for (const row of rows.slice(0, 2)) {
+    const { state, calls, html } = await page(['role:write', 'role:delete'], state => state.openEdit(row));
+    assert.equal(state.readonly.value, true);
+    assert.match(html, /data-modal-title="查看角色"/);
+    assert.match(html, /data-modal-action(?:="")?>关闭/);
+    assert.match(html, new RegExp(`value="${row.name}" disabled`));
+    assert.match(html, /data-permission-tree="true"/);
+    assert.match(html, new RegExp(`data-role="${row.code}"[\\s\\S]*?<button[^>]*>查看<\\/button>[\\s\\S]*?<button[^>]*disabled`));
+    if (row.code === 'zyt_basic') assert.match(html, /请到「系统管理 → 用户管理」为账号分配其他业务角色/);
+    const before = [...state.form.permissions];
+    state.onCheck(['user:read']);
+    assert.deepEqual([...state.form.permissions], before);
+    await state.submit();
+    await state.remove(row);
+    assert.deepEqual(calls.save, []);
+    assert.deepEqual(calls.remove, []);
+  }
+});
+
+test('普通业务角色仍可编辑并保留自定义权限，保存只过滤失效码并说明在线用户自动同步', async () => {
+  const { state, calls, html } = await page(['role:read', 'role:write', 'role:delete'], state => state.openEdit(rows[2]));
+  assert.equal(state.readonly.value, false);
+  assert.match(html, /data-modal-title="编辑角色"/);
+  assert.match(html, /data-permission-tree="false"/);
+  await state.submit();
+  assert.equal(calls.save.length, 1);
+  assert.deepEqual([...calls.save[0].permissions], ['user:read', 'custom:report']);
+  assert.equal(calls.save[0].code, 'reviewer');
+  assert.match(calls.success[0], /后端权限立即生效/);
+  assert.match(calls.success[0], /菜单和按钮将在数秒内自动更新/);
+  await state.remove(rows[2]);
+  assert.deepEqual(calls.remove, ['reviewer']);
+});
+
+test('角色只读用户不能通过组件方法保存或删除业务角色', async () => {
+  const { state, calls } = await page(['role:read'], state => state.openEdit(rows[2]));
+  assert.equal(state.readonly.value, true);
+  await state.submit();
+  await state.remove(rows[2]);
+  assert.deepEqual(calls.save, []);
+  assert.deepEqual(calls.remove, []);
+});
diff --git a/admin-web/apps/web-antd/tests/password-login-page.test.mjs b/admin-web/apps/web-antd/tests/password-login-page.test.mjs
new file mode 100644
index 000000000..fe0dbcd2c
--- /dev/null
+++ b/admin-web/apps/web-antd/tests/password-login-page.test.mjs
@@ -0,0 +1,127 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { resolve } from 'node:path';
+import test from 'node:test';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import vm from 'node:vm';
+
+const require = createRequire(process.env.KEFU_SSO_TYPESCRIPT
+  ? pathToFileURL(resolve(process.env.KEFU_SSO_TYPESCRIPT, 'package.json'))
+  : new URL('../package.json', import.meta.url));
+const ts = require('typescript');
+const vue = require('vue');
+const vueRequire = createRequire(require.resolve('vue/package.json'));
+const { parse, compileScript, compileTemplate } = vueRequire('@vue/compiler-sfc');
+const { renderToString } = vueRequire('@vue/server-renderer');
+
+function load(source, dependencies) {
+  const compiled = ts.transpileModule(source, { compilerOptions: {
+    module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022,
+  }, reportDiagnostics: true });
+  assert.deepEqual(compiled.diagnostics, []);
+  const module = { exports: {} };
+  vm.runInNewContext(compiled.outputText, { module, exports: module.exports,
+    require(name) { assert.ok(name in dependencies, `Unexpected import ${name}`); return dependencies[name]; },
+    // Normal password login must not read browser redirect/storage APIs.
+    get window() { assert.fail('Password login accessed window'); },
+    get localStorage() { assert.fail('Password login accessed localStorage'); },
+    console });
+  return module.exports;
+}
+
+const filename = fileURLToPath(new URL('../src/views/_core/authentication/login.vue', import.meta.url));
+const { descriptor } = parse(await readFile(filename, 'utf8'), { filename });
+const script = compileScript(descriptor, { id: 'password-login-page-test' });
+const template = compileTemplate({ source: descriptor.template.content, filename,
+  id: 'password-login-page-test', compilerOptions: { bindingMetadata: script.bindings } });
+assert.deepEqual(template.errors, []);
+
+async function page(authLogin) {
+  let submit;
+  let formProps;
+  const store = vue.reactive({ loginLoading: false, authLogin });
+  // Render the real page SFC. The shared form adapter displays its schema/slots
+  // and exposes the submit listener assigned by the compiled page template.
+  const AuthenticationLogin = vue.defineComponent({
+    props: ['formSchema', 'loading', 'title', 'subTitle', 'showCodeLogin', 'showForgetPassword',
+      'showQrcodeLogin', 'showRegister', 'showRememberMe', 'showThirdPartyLogin'],
+    emits: ['submit'],
+    setup(props, { slots }) {
+      formProps = props;
+      const instance = vue.getCurrentInstance();
+      submit = values => instance.vnode.props.onSubmit(values);
+      return () => vue.h('section', {}, [
+        vue.h('h1', {}, props.title), vue.h('p', {}, props.subTitle),
+        vue.h('form', {}, [
+          ...props.formSchema.map(field => vue.h('input', { name: field.fieldName,
+            type: field.component === 'VbenInputPassword' ? 'password' : 'text',
+            placeholder: field.componentProps.placeholder })),
+          vue.h('button', { type: 'submit', disabled: props.loading }, '登录'),
+        ]),
+        slots['third-party-login']?.(),
+      ]);
+    },
+  });
+  // No config API, group URL helper or router is provided: an accidental import
+  // or use fails this actual SFC test instead of silently becoming a mock call.
+  const component = load(script.content, { vue,
+    '@vben/common-ui': { AuthenticationLogin, z: { string: () => ({ min: () => ({}) }) } },
+    '#/locales/t': { t: value => value }, '#/store': { useAuthStore: () => store },
+  }).default;
+  component.render = load(template.code, { vue }).render;
+  const html = await renderToString(vue.createSSRApp(component));
+  return { html, submit, store, formProps };
+}
+
+test('实际登录页只有一份账号密码表单和登录按钮，ZYT/本地均走普通提交', async () => {
+  const calls = [];
+  const view = await page(async values => { calls.push(values); });
+  assert.equal((view.html.match(/<form(?:\s|>)/g) || []).length, 1);
+  assert.equal((view.html.match(/<input\b/g) || []).length, 2);
+  assert.equal((view.html.match(/<button\b/g) || []).length, 1);
+  assert.match(view.html, /name="username"[^>]*placeholder="ZYT 账号或客服本地账号"/);
+  assert.match(view.html, /name="password" type="password"[^>]*placeholder="ZYT 密码或客服本地密码"/);
+  assert.match(view.html, /ZYT 首次登录为基础用户，业务权限由客服管理员分配/);
+  assert.doesNotMatch(view.html, /集团账号登录|重试获取集团入口|href=|group-login/);
+  for (const name of ['showCodeLogin', 'showForgetPassword', 'showQrcodeLogin', 'showRegister',
+    'showRememberMe', 'showThirdPartyLogin']) assert.equal(view.formProps[name], false);
+  for (const username of ['local_operator', 'zyt_operator']) {
+    await view.submit({ username, password: 'Fixture@2026' });
+  }
+  assert.deepEqual(calls, [
+    { username: 'local_operator', password: 'Fixture@2026' },
+    { username: 'zyt_operator', password: 'Fixture@2026' },
+  ]);
+});
+
+test('实际登录页普通提交失败后仍可用同一份表单重试', async () => {
+  let attempts = 0;
+  const view = await page(async () => {
+    if (++attempts === 1) throw new Error('账号或密码错误');
+    return { userInfo: { username: 'zyt_operator' } };
+  });
+  const credentials = { username: 'zyt_operator', password: 'Fixture@2026' };
+  await assert.rejects(view.submit(credentials), /账号或密码错误/);
+  assert.equal((await view.submit(credentials)).userInfo.username, 'zyt_operator');
+  assert.equal(attempts, 2);
+});
+
+test('ZYT/本地密码只随统一POST body发送，不进入URL或localStorage', async () => {
+  const requests = [];
+  const api = load(await readFile(new URL('../src/api/core/auth.ts', import.meta.url), 'utf8'), {
+    '#/locales/t': { t: value => value },
+    '#/api/request': {
+      requestClient: { async post(...args) { requests.push(args); return { access_token: 'current-token' }; } },
+      baseRequestClient: { get() { assert.fail('Password login fetched group config'); } },
+    },
+  });
+  for (const username of ['local_operator', 'zyt_operator']) {
+    const result = await api.loginApi({ username, password: 'Fixture@2026', redirect: 'https://unused.example/' });
+    assert.equal(result.accessToken, 'current-token');
+  }
+  assert.deepEqual(JSON.parse(JSON.stringify(requests)), [
+    ['/auth/login', { username: 'local_operator', password: 'Fixture@2026', device_name: 'web' }],
+    ['/auth/login', { username: 'zyt_operator', password: 'Fixture@2026', device_name: 'web' }],
+  ]);
+});
diff --git a/admin-web/apps/web-antd/vite.config.ts b/admin-web/apps/web-antd/vite.config.ts
index 90d7bd795..c4ba8f7b5 100644
--- a/admin-web/apps/web-antd/vite.config.ts
+++ b/admin-web/apps/web-antd/vite.config.ts
@@ -6,12 +6,12 @@ export default defineConfig(async () => {
     vite: {
       server: {
         proxy: {
-          // 前端统一请求 /api/*，代理到 admin_api.py 的 /api/v2/*。
+          // 兼容 /api/* 和标准 /api/v2/*，避免重复添加版本前缀。
           // 走代理而不是直连，是为了开发态和生产态同源、没有 CORS 差异——
           // 生产环境前端是静态文件，由同一个 Nginx 反代到后端。
           '/api': {
             changeOrigin: true,
-            rewrite: (path) => path.replace(/^\/api/, '/api/v2'),
+            rewrite: (path) => path.startsWith('/api/v2/') ? path : path.replace(/^\/api/, '/api/v2'),
             // 端口可用环境变量覆盖：本机同时跑多套后端时（比如拿一次性的库
             // 验证前端，不碰生产库）不用改代码。
             target: process.env.VITE_API_TARGET || 'http://127.0.0.1:8766',
diff --git a/deploy/im-admin/compose.yaml b/deploy/im-admin/compose.yaml
index cd41773be..f406d3eea 100644
--- a/deploy/im-admin/compose.yaml
+++ b/deploy/im-admin/compose.yaml
@@ -6,7 +6,7 @@ x-common: &common
     context: ../..
     dockerfile: deploy/im-admin/Dockerfile
   restart: unless-stopped
-  environment:
+  environment: &common-environment
     PYTHONDONTWRITEBYTECODE: "1"
     PYTHONUNBUFFERED: "1"
     KNOWLEDGE_QDRANT_URL: "${KNOWLEDGE_QDRANT_URL:-}"
@@ -32,6 +32,10 @@ x-common: &common
 services:
   api:
     <<: *common
+    environment:
+      <<: *common-environment
+      # File must be mounted read-only outside public assets; never put the key in URLs.
+      ZYT_GROUP_METADATA_KEY_FILE: "${ZYT_GROUP_METADATA_KEY_FILE:-}"
     command:
       - python
       - admin_api.py
diff --git a/wechat_rpa/admin_api.py b/wechat_rpa/admin_api.py
index ad86a0cfe..f68964558 100644
--- a/wechat_rpa/admin_api.py
+++ b/wechat_rpa/admin_api.py
@@ -49,6 +49,8 @@ import knowledge_api
 import remote_api
 import zyt_auth
 import group_sso
+import group_access
+import group_authorization
 
 # 账号下拉框里「全部」的取值。用 -1 而不是 0：0 早就有含义了（旧版未归属数据），
 # 而"不传"在 FastAPI 里就是 None，同样已经被占用。
@@ -64,7 +66,7 @@ DEV_ORIGINS = [
 # ── 请求体 ───────────────────────────────────────────────────────────────────
 class LoginBody(BaseModel):
     username: str
-    password: str
+    password: str = Field(repr=False)
     device_name: str = "web"
 
 
@@ -370,10 +372,12 @@ def create_app(
     release_directory = database.path.parent / "releases"
     release_directory.mkdir(parents=True, exist_ok=True)
     app = FastAPI(title="企微客服助手管理 API", version="2.0")
+    group_access_snapshot = group_access.AccessSnapshot(database)
+    group_authorization_service = group_authorization.GroupAuthorization(database)
 
     @app.exception_handler(RequestValidationError)
     async def safe_group_validation(request: Request, exc: RequestValidationError):
-        if request.url.path == "/api/v2/auth/group/exchange":
+        if request.url.path in {"/api/v2/auth/group/exchange", "/api/v2/auth/login"}:
             # Pydantic's default error projection includes the submitted input.
             return JSONResponse(status_code=422, content={"detail": "集团登录请求无效，请重新登录"})
         return await request_validation_exception_handler(request, exc)
@@ -386,7 +390,7 @@ def create_app(
             # callback codes in the ASGI scope later used by access logging.
             request.scope["query_string"] = b""
         response = await call_next(request)
-        if path == "/auth/group-login" or path.startswith("/api/v2/auth/group/"):
+        if path in {"/auth/group-login", "/api/v2/auth/login"} or path.startswith("/api/v2/auth/group/"):
             response.headers["Cache-Control"] = "no-store"
             response.headers["Referrer-Policy"] = "no-referrer"
         return response
@@ -698,6 +702,22 @@ def create_app(
         )
         return {"ok": True}
 
+    @app.post("/api/v2/group/access-snapshot")
+    async def group_access_metadata(request: Request):
+        # Machine credentials only: no human login/enrollment or authorization
+        # mutation is reachable from this dedicated read-only projection.
+        return await group_access.handle_request(request, group_access_snapshot)
+
+    @app.post("/api/v2/group/access-options")
+    async def group_authorization_options(request: Request):
+        return await group_authorization.handle_request(
+            request, group_authorization_service, group_authorization.OPTIONS_PATH)
+
+    @app.post("/api/v2/group/access-update")
+    async def group_authorization_update(request: Request):
+        return await group_authorization.handle_request(
+            request, group_authorization_service, group_authorization.UPDATE_PATH)
+
     # ── 管理端认证 ───────────────────────────────────────────────────────
     @app.get("/api/v2/auth/group/config")
     async def group_config() -> dict:
@@ -733,22 +753,38 @@ def create_app(
         if not backend.LOGIN_LIMITER.allowed(key):
             raise HTTPException(status_code=429, detail="登录失败次数过多，请稍后再试")
         user = database.authenticate(body.username, body.password)
+        group_login = False
+        if user is None:
+            config = group_sso.GroupPasswordConfig.from_env()
+            if config is not None:
+                try:
+                    identity = await asyncio.to_thread(
+                        group_sso.password_login, config, body.username, body.password,
+                    )
+                    user = await asyncio.to_thread(database.group_sso_user, identity)
+                    group_login = True
+                except ValueError:
+                    # Includes remote failures and locally disabled bindings.
+                    # Do not reflect upstream responses, URLs, or credentials.
+                    user = None
         if not user:
             backend.LOGIN_LIMITER.failure(key)
             database.audit(None, "login.failed", f"username={body.username}", ip)
             raise HTTPException(status_code=401, detail="用户名或密码不正确")
         backend.LOGIN_LIMITER.success(key)
+        lifetime = 8 * 3600 if group_login else 30 * 86400
         token, _ = database.create_token(
-            int(user["id"]), "api", body.device_name, 30 * 86400
+            int(user["id"]), "api", body.device_name, lifetime
         )
-        database.audit(int(user["id"]), "login.api", body.device_name, ip)
+        database.audit(int(user["id"]), "login.group" if group_login else "login.api",
+                       "provider=zyt_group" if group_login else body.device_name, ip)
         principal = Principal(user, database.permissions_for_user(int(user["id"])))
         # 首次登录不拦 API：改密页面本身也要调接口。前端凭
         # must_change_password 把用户锁在改密页上，比后端一刀切 403 好用得多
         # ——老实现那样连改密接口都调不通，只能去网页后台改。
         return {
             "access_token": token,
-            "expires_in": 30 * 86400,
+            "expires_in": lifetime,
             "user": principal.payload(),
         }
 
diff --git a/wechat_rpa/group_access.py b/wechat_rpa/group_access.py
new file mode 100644
index 000000000..68ed90c8f
--- /dev/null
+++ b/wechat_rpa/group_access.py
@@ -0,0 +1,255 @@
+"""Authenticated, read-only group metadata snapshots; never enroll or grant."""
+from __future__ import annotations
+
+import hashlib
+import hmac
+import json
+import os
+import re
+import threading
+import time
+from pathlib import Path
+from typing import Any, Callable
+
+
+SIGNED_PATH = "/group/access-snapshot"
+MAX_REQUEST_BYTES = 16 * 1024
+MAX_RESPONSE_BYTES = 4 * 1024 * 1024
+MAX_GIDS = 100
+MAX_PERMISSIONS = 2000
+WINDOW_SECONDS = 90
+MAX_NONCES = 8192
+_HEX_32 = re.compile(r"[0-9a-f]{32}\Z")
+_HEX_64 = re.compile(r"[0-9a-f]{64}\Z")
+_GID = re.compile(r"gid_[0-9a-f]{32}\Z")
+_TIMESTAMP = re.compile(r"(?:0|[1-9][0-9]{0,11})\Z")
+
+
+class AccessError(ValueError):
+    def __init__(self, status: int, message: str):
+        super().__init__(message)
+        self.status = status
+
+
+def _unavailable() -> AccessError:
+    return AccessError(503, "集团授权元数据暂不可用")
+
+
+def load_key() -> bytes:
+    """Load only the explicitly configured, bounded, non-public key file."""
+    configured = os.environ.get("ZYT_GROUP_METADATA_KEY_FILE", "")
+    try:
+        path = Path(configured)
+        if not configured or not path.is_absolute() or path.is_symlink():
+            raise ValueError("Invalid key location")
+        resolved = path.resolve(strict=True)
+        project = Path(__file__).resolve().parent.parent
+        public_roots = (
+            project / "admin-web/apps/web-antd/dist",
+            project / "admin-web/apps/mobile-h5/dist",
+        )
+        if any(resolved.is_relative_to(root.resolve()) for root in public_roots):
+            raise ValueError("Public key location")
+        with resolved.open("rb") as source:
+            raw = source.read(65)
+        if not re.fullmatch(rb"[0-9a-fA-F]{64}", raw):
+            raise ValueError("Invalid key contents")
+        return bytes.fromhex(raw.decode("ascii"))
+    except (OSError, ValueError, RuntimeError):
+        raise _unavailable() from None
+
+
+def request_signature(key: bytes, body: bytes, timestamp: str, nonce: str) -> str:
+    signed = f"POST\n{SIGNED_PATH}\n{timestamp}\n{nonce}\n{hashlib.sha256(body).hexdigest()}"
+    return hmac.new(key, signed.encode("ascii"), hashlib.sha256).hexdigest()
+
+
+def response_signature(key: bytes, body: bytes, nonce: str) -> str:
+    signed = f"response\n{nonce}\n{hashlib.sha256(body).hexdigest()}"
+    return hmac.new(key, signed.encode("ascii"), hashlib.sha256).hexdigest()
+
+
+def _object(pairs):
+    result = {}
+    for key, value in pairs:
+        if key in result:
+            raise ValueError("Duplicate JSON key")
+        result[key] = value
+    return result
+
+
+def parse_request(body: bytes) -> dict[str, Any]:
+    try:
+        def invalid_constant(_value):
+            raise ValueError("Invalid JSON constant")
+
+        value = json.loads(body.decode("utf-8"), object_pairs_hook=_object,
+                           parse_constant=invalid_constant)
+        if not isinstance(value, dict) or set(value) != {"client_id", "gids", "include_catalog"}:
+            raise ValueError("Invalid fields")
+        gids = value["gids"]
+        if value["client_id"] != "kefu" or type(value["include_catalog"]) is not bool:
+            raise ValueError("Invalid client")
+        if not isinstance(gids, list) or len(gids) > MAX_GIDS:
+            raise ValueError("Invalid subjects")
+        if any(not isinstance(gid, str) or not _GID.fullmatch(gid) for gid in gids):
+            raise ValueError("Invalid identity")
+        if len(set(gids)) != len(gids):
+            raise ValueError("Duplicate identities")
+        return value
+    except (ValueError, UnicodeError, RecursionError):
+        raise AccessError(422, "集团授权元数据请求无效") from None
+
+
+def _positive(value: Any) -> int:
+    if type(value) is not int or value < 1:
+        raise _unavailable()
+    return value
+
+
+def _text(value: Any) -> str:
+    if not isinstance(value, str):
+        raise _unavailable()
+    return value
+
+
+def snapshot(database, request: dict[str, Any], generated_at: int) -> dict[str, Any]:
+    """Project existing bindings only. Authorization stays in its existing reader."""
+    gids = request["gids"]
+    rows = {}
+    if gids:
+        with database.connect() as db:
+            placeholders = ",".join("?" for _ in gids)
+            found = db.execute(f"""SELECT b.gid,b.source_admin_id,b.company_id,
+                b.source_account,b.source_name,u.id,u.username,u.active,
+                u.role AS role_code,COALESCE(r.name,u.role) AS role_name
+                FROM group_sso_bindings b JOIN users u ON u.id=b.user_id
+                LEFT JOIN roles r ON r.code=u.role
+                WHERE b.provider=? AND b.gid IN ({placeholders})""",
+                ["zyt_group", *gids]).fetchall()
+            rows = {row["gid"]: dict(row) for row in found}
+    subjects = []
+    for gid in gids:
+        row = rows.get(gid)
+        if row is None:
+            subjects.append({"gid": gid, "found": False})
+            continue
+        user_id = _positive(row["id"])
+        # Deliberately use the same effective-permission reader as ordinary API
+        # authentication. Inactive users are empty there; do not reinterpret
+        # catalog enabled flags as API authorization rules.
+        permissions = sorted(database.permissions_for_user(user_id))
+        if len(permissions) > MAX_PERMISSIONS or any(not isinstance(code, str) for code in permissions):
+            raise _unavailable()
+        # A concurrent deactivation must not pair an inactive metadata row with
+        # nonempty permissions. This does not claim a cross-request transaction.
+        if not row["active"]:
+            permissions = []
+        subjects.append({
+            "gid": gid, "found": True,
+            "source_admin_id": _positive(row["source_admin_id"]),
+            "company_id": _positive(row["company_id"]),
+            "user": {
+                "id": user_id, "username": _text(row["username"]),
+                "source_account": _text(row["source_account"]),
+                "source_name": _text(row["source_name"]), "active": bool(row["active"]),
+                "role": {"code": _text(row["role_code"]), "name": _text(row["role_name"])},
+                "permissions": permissions,
+            },
+        })
+    catalog = None
+    if request["include_catalog"]:
+        definitions = database.permission_catalog()
+        if len(definitions) > MAX_PERMISSIONS:
+            raise _unavailable()
+        permissions = []
+        seen = set()
+        for item in definitions:
+            code = _text(item["code"])
+            if not code or code in seen or item["kind"] not in {"page", "action", "link"}:
+                raise _unavailable()
+            seen.add(code)
+            # A custom link is a page in this protocol; never expose its URL.
+            permissions.append({
+                "code": code, "name": _text(item["name"]),
+                "group": _text(item["group_name"]), "page": _text(item["page_name"]),
+                "kind": "page" if item["kind"] == "link" else item["kind"],
+                "source": _text(item["source"]), "enabled": bool(item["enabled"]),
+                "sort": int(item["sort_order"]),
+            })
+        catalog = {"permissions": permissions}
+    return {"version": 1, "client_id": "kefu", "generated_at": generated_at,
+            "subjects": subjects, "catalog": catalog}
+
+
+class AccessSnapshot:
+    """One application instance's bounded, fail-closed read-protocol replay cache.
+
+    Memory replay protection is permitted by metadata v1. Multi-worker installs
+    should share a nonce store when replay rejection across workers is required.
+    """
+    def __init__(self, database, clock: Callable[[], float] | None = None,
+                 max_nonces: int = MAX_NONCES):
+        self.database = database
+        self.clock = clock or time.time
+        self.max_nonces = max_nonces
+        self._nonces: dict[str, int] = {}
+        self._lock = threading.Lock()
+
+    def respond(self, body: bytes, headers) -> tuple[bytes, dict[str, str]]:
+        key = load_key()
+        if len(body) > MAX_REQUEST_BYTES:
+            raise AccessError(413, "集团授权元数据请求过大")
+        timestamp = headers.get("x-group-timestamp", "")
+        nonce = headers.get("x-group-nonce", "")
+        signature = headers.get("x-group-signature", "")
+        now = int(self.clock())
+        if (not _TIMESTAMP.fullmatch(timestamp) or not _HEX_32.fullmatch(nonce)
+                or not _HEX_64.fullmatch(signature) or abs(int(timestamp) - now) > WINDOW_SECONDS):
+            raise AccessError(401, "集团服务认证无效")
+        if not hmac.compare_digest(request_signature(key, body, timestamp, nonce), signature):
+            raise AccessError(401, "集团服务认证无效")
+        with self._lock:
+            self._nonces = {value: expires for value, expires in self._nonces.items() if expires >= now}
+            if nonce in self._nonces:
+                raise AccessError(401, "集团服务认证无效")
+            if len(self._nonces) >= self.max_nonces:
+                raise _unavailable()
+            self._nonces[nonce] = int(timestamp) + WINDOW_SECONDS
+        request = parse_request(body)
+        try:
+            result = snapshot(self.database, request, now)
+            raw = json.dumps(result, ensure_ascii=False, separators=(",", ":"), allow_nan=False).encode("utf-8")
+            if len(raw) > MAX_RESPONSE_BYTES:
+                raise _unavailable()
+        except AccessError:
+            raise
+        except Exception:
+            # No upstream/database values or deployment paths may reach callers.
+            raise _unavailable() from None
+        return raw, {"Cache-Control": "no-store",
+                     "X-Group-Response-Signature": response_signature(key, raw, nonce)}
+
+
+async def handle_request(request, service: AccessSnapshot):
+    """Read bounded raw bytes; authenticate before any JSON interpretation."""
+    from fastapi.responses import JSONResponse, Response
+
+    try:
+        if request.url.query:
+            raise AccessError(422, "集团授权元数据请求无效")
+        for name in ("x-group-timestamp", "x-group-nonce", "x-group-signature"):
+            if len(request.headers.getlist(name)) != 1:
+                raise AccessError(401, "集团服务认证无效")
+        raw = bytearray()
+        async for chunk in request.stream():
+            if len(raw) + len(chunk) > MAX_REQUEST_BYTES:
+                raise AccessError(413, "集团授权元数据请求过大")
+            raw.extend(chunk)
+        # The DB work and key-file access run outside the application's loop.
+        import asyncio
+        body, headers = await asyncio.to_thread(service.respond, bytes(raw), request.headers)
+        return Response(content=body, media_type="application/json", headers=headers)
+    except AccessError as exc:
+        return JSONResponse(status_code=exc.status, content={"detail": str(exc)},
+                            headers={"Cache-Control": "no-store"})
diff --git a/wechat_rpa/group_authorization.py b/wechat_rpa/group_authorization.py
new file mode 100644
index 000000000..03fe6c419
--- /dev/null
+++ b/wechat_rpa/group_authorization.py
@@ -0,0 +1,360 @@
+"""Machine-only edits of existing Group bindings in KF's native role model.
+
+The caller authenticates the Group owner; the signed actor ID is its assertion,
+not a KF user ID. SQLite serializes revisions, private roles, assignment and audit.
+Neither this module nor its HTTP routes enroll users or accept human sessions.
+"""
+from __future__ import annotations
+
+import hashlib
+import hmac
+import json
+import secrets
+import time
+from typing import Any, Callable
+
+import group_access
+import rbac
+
+
+OPTIONS_PATH = "/group/access-options"
+UPDATE_PATH = "/group/access-update"
+MAX_REQUEST_BYTES = 256 * 1024
+MAX_RESPONSE_BYTES = group_access.MAX_RESPONSE_BYTES
+MAX_PERMISSIONS = group_access.MAX_PERMISSIONS
+MAX_NONCES = group_access.MAX_NONCES
+WINDOW_SECONDS = group_access.WINDOW_SECONDS
+_POSITIVE_MAX = 9_223_372_036_854_775_807
+_BASE_FIELDS = {"client_id", "gid", "source_admin_id", "company_id"}
+_WRITE_FIELDS = {"actor_source_admin_id", "request_id", "expected_revision", "role_code", "permissions"}
+_SCHEMA = (
+    """CREATE TABLE IF NOT EXISTS group_authorization_nonces (
+        nonce TEXT PRIMARY KEY, expires_at INTEGER NOT NULL)""",
+    """CREATE INDEX IF NOT EXISTS idx_group_authorization_nonce_expiry
+        ON group_authorization_nonces(expires_at)""",
+    """CREATE TABLE IF NOT EXISTS group_authorization_requests (
+        request_id TEXT PRIMARY KEY, body_digest TEXT NOT NULL,
+        result_json BLOB NOT NULL, created_at INTEGER NOT NULL)""",
+    """CREATE TABLE IF NOT EXISTS group_authorization_private_roles (
+        role_code TEXT PRIMARY KEY REFERENCES roles(code) ON DELETE CASCADE,
+        user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        permissions_digest TEXT NOT NULL, created_at INTEGER NOT NULL)""",
+    """CREATE INDEX IF NOT EXISTS idx_group_authorization_private_owner
+        ON group_authorization_private_roles(user_id,permissions_digest)""",
+    """CREATE TABLE IF NOT EXISTS group_authorization_audit (
+        request_id TEXT PRIMARY KEY, actor_source_admin_id INTEGER NOT NULL,
+        target_user_id INTEGER NOT NULL, detail_json TEXT NOT NULL,
+        created_at INTEGER NOT NULL)""",
+)
+
+
+class AuthorizationError(group_access.AccessError):
+    pass
+
+
+def _unavailable() -> AuthorizationError:
+    return AuthorizationError(503, "客服授权服务暂不可用")
+
+
+def request_signature(key: bytes, body: bytes, timestamp: str, nonce: str, path: str) -> str:
+    if path not in {OPTIONS_PATH, UPDATE_PATH}:
+        raise ValueError("Unsupported authorization path")
+    canonical = f"POST\n{path}\n{timestamp}\n{nonce}\n{hashlib.sha256(body).hexdigest()}"
+    return hmac.new(key, canonical.encode("ascii"), hashlib.sha256).hexdigest()
+
+
+def _identifier(value: Any) -> bool:
+    return type(value) is int and 0 < value <= _POSITIVE_MAX
+
+
+def _code(value: Any) -> bool:
+    return (isinstance(value, str) and 0 < len(value) <= 256
+            and all(ord(char) >= 32 and ord(char) != 127
+                    and not 0xD800 <= ord(char) <= 0xDFFF for char in value))
+
+
+def parse_request(body: bytes, path: str) -> dict[str, Any]:
+    """Validate exact types/fields without normalizing identity or permission codes."""
+    try:
+        def invalid_constant(_value):
+            raise ValueError("Invalid JSON constant")
+
+        value = json.loads(body.decode("utf-8"), object_pairs_hook=group_access._object,
+                           parse_constant=invalid_constant)
+        fields = _BASE_FIELDS | (_WRITE_FIELDS if path == UPDATE_PATH else set())
+        if not isinstance(value, dict) or set(value) != fields:
+            raise ValueError("Invalid fields")
+        if (value["client_id"] != "kefu" or not isinstance(value["gid"], str)
+                or not group_access._GID.fullmatch(value["gid"])
+                or not _identifier(value["source_admin_id"]) or not _identifier(value["company_id"])):
+            raise ValueError("Invalid subject")
+        if path == UPDATE_PATH:
+            if (not _identifier(value["actor_source_admin_id"])
+                    or not isinstance(value["request_id"], str)
+                    or not group_access._HEX_32.fullmatch(value["request_id"])
+                    or not isinstance(value["expected_revision"], str)
+                    or not group_access._HEX_64.fullmatch(value["expected_revision"])
+                    or not _code(value["role_code"])):
+                raise ValueError("Invalid mutation")
+            permissions = value["permissions"]
+            if permissions is not None and (not isinstance(permissions, list)
+                    or len(permissions) > MAX_PERMISSIONS
+                    or any(not _code(code) for code in permissions)
+                    or len(set(permissions)) != len(permissions)):
+                raise ValueError("Invalid permissions")
+        return value
+    except (ValueError, UnicodeError, RecursionError):
+        raise AuthorizationError(422, "客服授权请求无效") from None
+
+
+def _encode(value: Any) -> bytes:
+    raw = json.dumps(value, ensure_ascii=False, separators=(",", ":"), allow_nan=False).encode("utf-8")
+    if len(raw) > MAX_RESPONSE_BYTES:
+        raise _unavailable()
+    return raw
+
+
+def _binding(db, request: dict[str, Any]):
+    row = db.execute("""SELECT b.provider,b.gid,b.source_admin_id,b.company_id,
+        b.source_account,b.source_name,u.id,u.username,u.active,u.role AS role_code,
+        r.name AS role_name FROM group_sso_bindings b JOIN users u ON u.id=b.user_id
+        JOIN roles r ON r.code=u.role WHERE b.provider='zyt_group' AND b.gid=?""",
+        (request["gid"],)).fetchone()
+    if row is None:
+        raise AuthorizationError(404, "客服绑定用户不存在")
+    if (row["source_admin_id"] != request["source_admin_id"]
+            or row["company_id"] != request["company_id"]):
+        raise AuthorizationError(409, "客服绑定身份已变化，请重新加载")
+    return row
+
+
+def _assigned(db, role: str) -> list[str]:
+    # Exact native authorization semantics: enabled is navigation metadata only.
+    result = sorted(rbac.permissions_of(db, role))
+    if len(result) > MAX_PERMISSIONS or any(not _code(code) for code in result):
+        raise _unavailable()
+    return result
+
+
+def _revision(db, row) -> str:
+    identity = {name: row[name] for name in ("provider", "gid", "source_admin_id", "company_id",
+                                           "id", "username", "source_account", "source_name", "role_code")}
+    identity["active"] = bool(row["active"])
+    identity["permissions"] = _assigned(db, row["role_code"])
+    return hashlib.sha256(_encode(identity)).hexdigest()
+
+
+def _result(db, row, now: int) -> dict[str, Any]:
+    definitions = rbac.catalog(db)
+    if len(definitions) > MAX_PERMISSIONS:
+        raise _unavailable()
+    catalog = []
+    known = set()
+    for item in definitions:
+        if (not _code(item["code"]) or item["code"] in known
+                or item["kind"] not in {"page", "action", "link"}
+                or any(not isinstance(item[name], str) for name in ("name", "group_name", "page_name", "source"))):
+            raise _unavailable()
+        known.add(item["code"])
+        catalog.append({"code": item["code"], "name": item["name"], "group": item["group_name"],
+                        "page": item["page_name"], "kind": "page" if item["kind"] == "link" else item["kind"],
+                        "source": item["source"], "enabled": bool(item["enabled"]), "sort": int(item["sort_order"])})
+    roles = []
+    for role in db.execute("""SELECT r.code,r.name FROM roles r
+            LEFT JOIN group_authorization_private_roles p ON p.role_code=r.code
+            WHERE p.role_code IS NULL OR p.user_id=? OR r.code=?
+            ORDER BY r.builtin DESC,r.code""", (row["id"], row["role_code"])):
+        assigned = _assigned(db, role["code"])
+        if not set(assigned) <= known or not _code(role["code"]) or not isinstance(role["name"], str):
+            raise _unavailable()
+        roles.append({"code": role["code"], "name": role["name"], "permissions": assigned})
+    assigned = _assigned(db, row["role_code"])
+    if not any(role["code"] == row["role_code"] for role in roles):
+        raise _unavailable()
+    subject = {"gid": row["gid"], "found": True, "source_admin_id": row["source_admin_id"],
+               "company_id": row["company_id"], "user": {
+                   "id": row["id"], "username": row["username"], "source_account": row["source_account"],
+                   "source_name": row["source_name"], "active": bool(row["active"]),
+                   "role": {"code": row["role_code"], "name": row["role_name"]},
+                   "permissions": assigned if row["active"] else []}}
+    return {"version": 1, "client_id": "kefu", "generated_at": now, "subject": subject,
+            "revision": _revision(db, row), "roles": roles, "catalog": {"permissions": catalog}}
+
+
+class GroupAuthorization:
+    def __init__(self, database, clock: Callable[[], float] | None = None,
+                 max_nonces: int = MAX_NONCES):
+        self.database = database
+        self.clock = clock or time.time
+        self.max_nonces = max_nonces
+        with database.connect() as db:
+            db.execute("BEGIN IMMEDIATE")
+            for statement in _SCHEMA:
+                db.execute(statement)
+            db.commit()
+
+    def _authenticate(self, body: bytes, headers, path: str, now: int) -> tuple[bytes, str]:
+        key = group_access.load_key()
+        timestamp = headers.get("x-group-timestamp", "")
+        nonce = headers.get("x-group-nonce", "")
+        signature = headers.get("x-group-signature", "")
+        if (not group_access._TIMESTAMP.fullmatch(timestamp)
+                or not group_access._HEX_32.fullmatch(nonce)
+                or not group_access._HEX_64.fullmatch(signature)
+                or abs(int(timestamp) - now) > WINDOW_SECONDS
+                or not hmac.compare_digest(request_signature(key, body, timestamp, nonce, path), signature)):
+            raise AuthorizationError(401, "集团服务认证无效")
+        return key, nonce
+
+    def _reserve_nonce(self, nonce: str, expires: int, now: int) -> None:
+        # A separate durable transaction consumes even requests whose domain
+        # transaction rolls back. Multiple instances/workers share this store.
+        with self.database.connect() as db:
+            db.execute("BEGIN IMMEDIATE")
+            db.execute("DELETE FROM group_authorization_nonces WHERE expires_at < ?", (now,))
+            if db.execute("SELECT 1 FROM group_authorization_nonces WHERE nonce=?", (nonce,)).fetchone():
+                raise AuthorizationError(401, "集团服务认证无效")
+            if db.execute("SELECT COUNT(*) FROM group_authorization_nonces").fetchone()[0] >= self.max_nonces:
+                raise _unavailable()
+            db.execute("INSERT INTO group_authorization_nonces(nonce,expires_at) VALUES (?,?)", (nonce, expires))
+            db.commit()
+
+    def _private_role(self, db, user_id: int, permissions: list[str], now: int) -> str:
+        granted = sorted(permissions)
+        digest = hashlib.sha256(_encode(granted)).hexdigest()
+        for row in db.execute("""SELECT p.role_code FROM group_authorization_private_roles p
+                JOIN roles r ON r.code=p.role_code WHERE p.user_id=? AND p.permissions_digest=?
+                AND NOT EXISTS(SELECT 1 FROM users u WHERE u.role=p.role_code AND u.id!=?)
+                ORDER BY p.role_code""", (user_id, digest, user_id)):
+            # Native KF admins can edit roles: never trust only the stored hash.
+            if _assigned(db, row["role_code"]) == granted:
+                return row["role_code"]
+        code = f"zyt_group_u{user_id}_{digest[:32]}"
+        while db.execute("SELECT 1 FROM roles WHERE code=?", (code,)).fetchone():
+            code = f"zyt_group_u{user_id}_{digest[:32]}_{secrets.token_hex(4)}"
+        import admin_backend
+        stamp = admin_backend.now_text()
+        db.execute("""INSERT INTO roles(code,name,builtin,created_at,updated_at)
+            VALUES (?,?,0,?,?)""", (code, f"集团个人授权（用户 {user_id}）", stamp, stamp))
+        # Use the native grant validator but only ever on a newly-created role.
+        rbac.grant(db, code, granted, stamp)
+        db.execute("""INSERT INTO group_authorization_private_roles
+            (role_code,user_id,permissions_digest,created_at) VALUES (?,?,?,?)""", (code, user_id, digest, now))
+        return code
+
+    def _process(self, body: bytes, request: dict[str, Any], path: str, now: int) -> bytes:
+        with self.database.connect() as db:
+            db.execute("BEGIN IMMEDIATE" if path == UPDATE_PATH else "BEGIN")
+            row = _binding(db, request)
+            if path == OPTIONS_PATH:
+                return _encode(_result(db, row, now))
+            body_digest = hashlib.sha256(body).hexdigest()
+            previous = db.execute("SELECT body_digest,result_json FROM group_authorization_requests WHERE request_id=?",
+                                  (request["request_id"],)).fetchone()
+            if previous is not None:
+                if not hmac.compare_digest(previous["body_digest"], body_digest):
+                    raise AuthorizationError(409, "客服授权请求编号已使用，请重新提交")
+                cached = bytes(previous["result_json"])
+                if len(cached) > MAX_RESPONSE_BYTES:
+                    raise _unavailable()
+                if json.loads(cached)["subject"]["user"]["id"] != row["id"]:
+                    raise AuthorizationError(409, "客服绑定身份已变化，请重新加载")
+                return cached
+            before_revision = _revision(db, row)
+            if not hmac.compare_digest(before_revision, request["expected_revision"]):
+                raise AuthorizationError(409, "客服授权已变化，请重新加载后保存")
+            selected = db.execute("SELECT code FROM roles WHERE code=?", (request["role_code"],)).fetchone()
+            private = db.execute("SELECT user_id FROM group_authorization_private_roles WHERE role_code=?",
+                                 (request["role_code"],)).fetchone()
+            if selected is None or (private is not None and private["user_id"] != row["id"]):
+                raise AuthorizationError(422, "客服角色无效，请重新加载")
+            permissions = request["permissions"]
+            if permissions is not None:
+                known = {item[0] for item in db.execute("SELECT code FROM permissions")}
+                if len(known) > MAX_PERMISSIONS:
+                    raise _unavailable()
+                if not set(permissions) <= known:
+                    raise AuthorizationError(422, "客服权限无效，请重新加载")
+            # Preserve the existing KF invariant: one active native admin role.
+            # Customizing admin creates an independent role and is a demotion.
+            demotes_admin = permissions is not None or request["role_code"] != "admin"
+            if row["active"] and row["role_code"] == "admin" and demotes_admin:
+                count = db.execute("SELECT COUNT(*) FROM users WHERE role='admin' AND active=1").fetchone()[0]
+                if count <= 1:
+                    raise AuthorizationError(409, "系统至少需要保留一个启用的管理员")
+            role_code = (request["role_code"] if permissions is None else
+                         self._private_role(db, row["id"], permissions, now))
+            import admin_backend
+            db.execute("UPDATE users SET role=?,updated_at=? WHERE id=?",
+                       (role_code, admin_backend.now_text(), row["id"]))
+            updated = _binding(db, request)
+            result = _result(db, updated, now)
+            raw = _encode(result)  # Bound the full DTO before anything commits.
+            detail = {"provider": "zyt_group", "gid": request["gid"],
+                      "source_admin_id": request["source_admin_id"], "company_id": request["company_id"],
+                      "actor_source_admin_id": request["actor_source_admin_id"], "target_user_id": row["id"],
+                      "request_id": request["request_id"], "before_role": row["role_code"], "after_role": role_code,
+                      "before_permissions": _assigned(db, row["role_code"]),
+                      "after_permissions": _assigned(db, role_code),
+                      "before_revision": before_revision, "after_revision": result["revision"]}
+            db.execute("""INSERT INTO group_authorization_audit
+                (request_id,actor_source_admin_id,target_user_id,detail_json,created_at) VALUES (?,?,?,?,?)""",
+                (request["request_id"], request["actor_source_admin_id"], row["id"],
+                 _encode(detail).decode("utf-8"), now))
+            # Group actor IDs belong to another identity domain; do not forge a
+            # local actor FK. The full transactional audit above is authoritative.
+            self.database._audit(db, None, "group.authorization.update", json.dumps({
+                "request_id": request["request_id"], "actor_source_admin_id": request["actor_source_admin_id"],
+                "gid": request["gid"], "source_admin_id": request["source_admin_id"],
+                "company_id": request["company_id"], "target_user_id": row["id"]}, separators=(",", ":")), "")
+            db.execute("""INSERT INTO group_authorization_requests
+                (request_id,body_digest,result_json,created_at) VALUES (?,?,?,?)""",
+                (request["request_id"], body_digest, raw, now))
+            db.commit()
+            return raw
+
+    def respond(self, body: bytes, headers, path: str, *, query: bool = False) -> tuple[int, bytes, dict[str, str]]:
+        if path not in {OPTIONS_PATH, UPDATE_PATH}:
+            raise AuthorizationError(401, "集团服务认证无效")
+        if len(body) > MAX_REQUEST_BYTES:
+            raise AuthorizationError(413, "客服授权请求过大")
+        now = int(self.clock())
+        key, nonce = self._authenticate(body, headers, path, now)
+        try:
+            self._reserve_nonce(nonce, int(headers["x-group-timestamp"]) + WINDOW_SECONDS, now)
+            if query:
+                raise AuthorizationError(422, "客服授权请求无效")
+            request = parse_request(body, path)
+            raw = self._process(body, request, path, now)
+            status = 200
+        except group_access.AccessError as exc:
+            if exc.status == 401:
+                raise
+            status = exc.status
+            raw = _encode({"version": 1, "client_id": "kefu", "generated_at": now,
+                           "error": {"code": status, "message": str(exc)}})
+        except Exception:
+            status = 503
+            raw = _encode({"version": 1, "client_id": "kefu", "generated_at": now,
+                           "error": {"code": status, "message": "客服授权服务暂不可用"}})
+        return status, raw, {"Cache-Control": "no-store",
+                             "X-Group-Response-Signature": group_access.response_signature(key, raw, nonce)}
+
+
+async def handle_request(request, service: GroupAuthorization, path: str):
+    from fastapi.responses import JSONResponse, Response
+    try:
+        for name in ("x-group-timestamp", "x-group-nonce", "x-group-signature"):
+            if len(request.headers.getlist(name)) != 1:
+                raise AuthorizationError(401, "集团服务认证无效")
+        raw = bytearray()
+        async for chunk in request.stream():
+            if len(raw) + len(chunk) > MAX_REQUEST_BYTES:
+                raise AuthorizationError(413, "客服授权请求过大")
+            raw.extend(chunk)
+        import asyncio
+        status, body, headers = await asyncio.to_thread(service.respond, bytes(raw), request.headers,
+                                                       path, query=bool(request.url.query))
+        return Response(content=body, status_code=status, media_type="application/json", headers=headers)
+    except group_access.AccessError as exc:
+        return JSONResponse(status_code=exc.status, content={"detail": str(exc)}, headers={"Cache-Control": "no-store"})
diff --git a/wechat_rpa/group_sso.py b/wechat_rpa/group_sso.py
index 96a114a92..8b2086a44 100644
--- a/wechat_rpa/group_sso.py
+++ b/wechat_rpa/group_sso.py
@@ -77,6 +77,19 @@ class GroupSSOConfig:
                 "redirect_uri": self.redirect_uri}
 
 
+@dataclass(frozen=True)
+class GroupPasswordConfig:
+    """Server-only direct login; no browser entry or callback is required."""
+    group_api_url: str
+
+    @classmethod
+    def from_env(cls) -> GroupPasswordConfig | None:
+        try:
+            return cls(_base_url(os.environ.get("ZYT_GROUP_API_URL", "")))
+        except ValueError:
+            return None
+
+
 class _NoRedirect(urllib.request.HTTPRedirectHandler):
     def redirect_request(self, req, fp, code, msg, headers, newurl):
         return None
@@ -103,12 +116,31 @@ def validate_identity(value: Any) -> dict[str, Any]:
 def exchange(config: GroupSSOConfig, code: str, code_verifier: str) -> dict[str, Any]:
     if not CODE_PATTERN.fullmatch(code) or not VERIFIER_PATTERN.fullmatch(code_verifier):
         raise GroupSSOError("集团登录凭据无效，请重新登录")
-    payload = json.dumps({"client_id": CLIENT_ID, "redirect_uri": config.redirect_uri,
-                          "code": code, "code_verifier": code_verifier}).encode("utf-8")
-    request = urllib.request.Request(config.group_api_url + "/group/sso/exchange",
-                                     data=payload, method="POST",
-                                     headers={"Content-Type": "application/json", "Accept": "application/json"})
+    return _post_identity(config.group_api_url, "/group/sso/exchange", {
+        "client_id": CLIENT_ID, "redirect_uri": config.redirect_uri,
+        "code": code, "code_verifier": code_verifier,
+    })
+
+
+def password_login(config: GroupPasswordConfig, account: str, password: str) -> dict[str, Any]:
+    if (not isinstance(account, str) or not account.strip() or len(account) > 200
+            or any(ord(c) < 32 or ord(c) == 127 for c in account)
+            or not isinstance(password, str) or not password or len(password) > 4096):
+        raise GroupSSOError("用户名或密码不正确，或集团登录暂不可用")
+    # Credentials exist only in this request. Neither source tokens nor roles are
+    # accepted, persisted, or returned by the strict identity projection.
+    return _post_identity(config.group_api_url, "/group/kefu/login", {
+        "client_id": CLIENT_ID, "account": account, "password": password,
+    })
+
+
+def _post_identity(api_url: str, path: str, payload: dict[str, str]) -> dict[str, Any]:
     try:
+        # Revalidate even an explicitly constructed config. The path is supplied
+        # only by the two fixed call sites, never from the login request.
+        request = urllib.request.Request(_base_url(api_url) + path,
+            data=json.dumps(payload).encode("utf-8"), method="POST",
+            headers={"Content-Type": "application/json", "Accept": "application/json"})
         # Neither proxy environment nor a remote redirect may change the recipient.
         opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), _NoRedirect())
         with opener.open(request, timeout=10) as response:
@@ -122,4 +154,4 @@ def exchange(config: GroupSSOConfig, code: str, code_verifier: str) -> dict[str,
             raise ValueError("Invalid envelope")
         return validate_identity(result.get("data"))
     except Exception:
-        raise GroupSSOError("集团登录失败或已过期，请重新登录") from None
+        raise GroupSSOError("用户名或密码不正确，或集团登录暂不可用") from None
diff --git a/wechat_rpa/test_group_access.py b/wechat_rpa/test_group_access.py
new file mode 100644
index 000000000..a91f683e0
--- /dev/null
+++ b/wechat_rpa/test_group_access.py
@@ -0,0 +1,341 @@
+"""Real FastAPI metadata checks using copied public modules and temporary SQLite.
+
+Run this file with C:/kefu/wechat_rpa/.venv/Scripts/python.exe. No deployed
+configuration, database, existing key or server is read or started.
+"""
+from __future__ import annotations
+
+import atexit
+import faulthandler
+import hashlib
+import hmac
+import json
+import os
+import secrets
+import shutil
+import sys
+import tempfile
+import unittest
+from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
+from unittest import mock
+
+
+MIRROR = Path(__file__).resolve().parent
+PROJECT = MIRROR.parents[2]
+SOURCE = Path(os.environ.get("IAM_KEFU_SOURCE_ROOT", "C:/kefu")) / "wechat_rpa"
+TEST_RUNTIME = PROJECT / ".test-runtime"
+TEST_RUNTIME.mkdir(parents=True, exist_ok=True)
+RUNTIME = tempfile.TemporaryDirectory(prefix="iam-kefu-metadata-", dir=TEST_RUNTIME)
+ISOLATED = Path(RUNTIME.name)
+
+
+def cleanup_runtime():
+    os.chdir(TEST_RUNTIME)
+    RUNTIME.cleanup()
+
+
+atexit.register(cleanup_runtime)
+# Only .py public sources: never .env, JSON settings, DB or an existing key.
+for source in SOURCE.glob("*.py"):
+    shutil.copyfile(source, ISOLATED / source.name)
+for name in ("admin_api.py", "admin_backend.py", "rbac.py", "group_sso.py", "group_access.py", "group_authorization.py"):
+    shutil.copyfile(MIRROR / name, ISOLATED / name)
+os.chdir(ISOLATED)
+RUNTIME_ENV = {key: value for key, value in os.environ.items()
+               if key.upper() in {"SYSTEMROOT", "WINDIR", "TEMP", "TMP"}}
+os.environ.clear()
+os.environ.update(RUNTIME_ENV)
+sys.path.insert(0, str(ISOLATED))
+
+from fastapi.testclient import TestClient
+import admin_api
+import admin_backend as backend
+import group_access
+import rbac
+
+
+KEY = bytes.fromhex("12" * 32)
+NOW = 1_800_000_000
+URL = "/api/v2/group/access-snapshot"
+GID = "gid_" + "a" * 32
+OTHER_GID = "gid_" + "b" * 32
+PASSWORD = "Fixture-Metadata-Password-2026"
+
+
+class GroupAccessTests(unittest.TestCase):
+    def setUp(self):
+        self.directory = tempfile.TemporaryDirectory(dir=ISOLATED)
+        self.addCleanup(self.directory.cleanup)
+        self.root = Path(self.directory.name)
+        self.key_file = self.root / "metadata.key"
+        self.key_file.write_text(KEY.hex(), encoding="ascii")
+        self.env = mock.patch.dict(os.environ, {"ZYT_GROUP_METADATA_KEY_FILE": str(self.key_file)}, clear=True)
+        self.env.start()
+        self.addCleanup(self.env.stop)
+        self.db = backend.Database(self.root / "fixture.sqlite")
+        self.clock = mock.Mock(return_value=NOW)
+        actual_service = group_access.AccessSnapshot
+        self.service = actual_service(self.db, clock=self.clock)
+        with mock.patch.object(backend, "load_initial_config", return_value=backend.CONFIG_DEFAULTS.copy()):
+            self.db.initialize(PASSWORD)
+            with mock.patch.object(group_access, "AccessSnapshot", return_value=self.service):
+                self.client = TestClient(admin_api.create_app(self.db.path))
+        self.addCleanup(self.client.close)
+
+    def body(self, gids=None, catalog=False):
+        return {"client_id": "kefu", "gids": [GID] if gids is None else gids,
+                "include_catalog": catalog}
+
+    def raw(self, value):
+        return json.dumps(value, ensure_ascii=False, separators=(",", ":")).encode("utf-8")
+
+    def headers(self, raw, *, nonce=None, timestamp=None, key=KEY, path="/group/access-snapshot"):
+        nonce = nonce or secrets.token_hex(16)
+        timestamp = str(NOW if timestamp is None else timestamp)
+        message = f"POST\n{path}\n{timestamp}\n{nonce}\n{hashlib.sha256(raw).hexdigest()}"
+        return {"Content-Type": "application/json", "X-Group-Timestamp": timestamp,
+                "X-Group-Nonce": nonce,
+                "X-Group-Signature": hmac.new(key, message.encode("ascii"), hashlib.sha256).hexdigest()}
+
+    def fetch(self, body=None, *, raw=None, **signing):
+        raw = self.raw(self.body() if body is None else body) if raw is None else raw
+        headers = self.headers(raw, **signing)
+        response = self.client.post(URL, content=raw, headers=headers)
+        if response.status_code == 200:
+            signed = f"response\n{headers['X-Group-Nonce']}\n{hashlib.sha256(response.content).hexdigest()}"
+            expected = hmac.new(KEY, signed.encode("ascii"), hashlib.sha256).hexdigest()
+            self.assertEqual(response.headers["X-Group-Response-Signature"], expected)
+        self.assertEqual(response.headers.get("Cache-Control"), "no-store")
+        return response
+
+    def enroll(self, gid=GID, source_id=7, account="same-account", name="合成集团用户"):
+        return self.db.group_sso_user({"client_id": "kefu", "gid": gid,
+            "source_admin_id": source_id, "account": account, "name": name, "company_id": 2})
+
+    def fingerprint(self):
+        tables = ("users", "roles", "role_permissions", "auth_tokens", "permissions", "group_sso_bindings")
+        with self.db.connect() as db:
+            return {table: [tuple(row) for row in db.execute(f"SELECT * FROM {table} ORDER BY rowid")]
+                    for table in tables}
+
+    def test_missing_subject_is_not_created_and_names_never_match(self):
+        self.db.create_user("same-account", PASSWORD, "admin", 1, "fixture")
+        before = self.fingerprint()
+        with mock.patch.object(backend.Database, "group_sso_user", side_effect=AssertionError("No enrollment")), \
+             mock.patch.object(backend.Database, "sync_code_permissions", side_effect=AssertionError("No sync")), \
+             mock.patch.object(rbac, "seed", side_effect=AssertionError("No seed")), \
+             mock.patch.object(rbac, "grant", side_effect=AssertionError("No grant")):
+            response = self.fetch(self.body(catalog=True))
+        self.assertEqual(response.status_code, 200, response.text)
+        self.assertEqual(response.json()["subjects"], [{"gid": GID, "found": False}])
+        self.assertEqual(before, self.fingerprint())
+
+    def test_exact_projection_and_signed_raw_utf8_response(self):
+        self.enroll()
+        result = self.fetch(self.body(catalog=True))
+        self.assertEqual(result.status_code, 200, result.text)
+        data = result.json()
+        self.assertEqual(set(data), {"version", "client_id", "generated_at", "subjects", "catalog"})
+        self.assertEqual((data["version"], data["client_id"], data["generated_at"]), (1, "kefu", NOW))
+        subject = data["subjects"][0]
+        self.assertEqual(set(subject), {"gid", "found", "source_admin_id", "company_id", "user"})
+        self.assertEqual(subject["source_admin_id"], 7)
+        user = subject["user"]
+        self.assertEqual(set(user), {"id", "username", "source_account", "source_name", "active", "role", "permissions"})
+        self.assertEqual(set(user["role"]), {"code", "name"})
+        self.assertEqual(user["role"]["code"], "zyt_basic")
+        self.assertEqual(user["permissions"], [])
+        self.assertEqual(user["source_name"], "合成集团用户")
+        for item in data["catalog"]["permissions"]:
+            self.assertEqual(set(item), {"code", "name", "group", "page", "kind", "source", "enabled", "sort"})
+            self.assertIn(item["kind"], {"page", "action"})
+            self.assertIs(type(item["enabled"]), bool)
+        for secret in ("password_salt", "password_digest", "auth_tokens", "link_url", "user_count", str(self.key_file), KEY.hex()):
+            self.assertNotIn(secret, result.text)
+
+    def test_binding_identity_and_requested_order_are_exact(self):
+        first = self.enroll()
+        second = self.enroll(OTHER_GID, 8, name="同名")
+        self.db.update_user(int(first["id"]), "operator", True, "", 1, "fixture")
+        self.db.update_user(int(second["id"]), "viewer", True, "", 1, "fixture")
+        third = "gid_" + "c" * 32
+        response = self.fetch(self.body([OTHER_GID, third, GID]))
+        self.assertEqual(response.status_code, 200)
+        subjects = response.json()["subjects"]
+        self.assertEqual([row["gid"] for row in subjects], [OTHER_GID, third, GID])
+        self.assertEqual(subjects[1], {"gid": third, "found": False})
+        self.assertEqual(subjects[0]["user"]["role"]["code"], "viewer")
+        self.assertEqual(subjects[2]["user"]["role"]["code"], "operator")
+        with self.db.connect() as db:
+            db.execute("UPDATE group_sso_bindings SET provider='other_provider' WHERE gid=?", (GID,))
+            db.commit()
+        self.assertEqual(self.fetch().json()["subjects"], [{"gid": GID, "found": False}])
+
+    def test_role_and_active_changes_are_live_and_effective_reader_is_used(self):
+        user = self.enroll()
+        user_id = int(user["id"])
+        self.assertEqual(self.fetch().json()["subjects"][0]["user"]["permissions"], [])
+        self.db.update_user(user_id, "operator", True, "", 1, "fixture")
+        expected = sorted(self.db.permissions_for_user(user_id))
+        self.assertTrue(expected)
+        with mock.patch.object(backend.Database, "permissions_for_user", wraps=self.db.permissions_for_user) as effective:
+            actual = self.fetch().json()["subjects"][0]["user"]
+            effective.assert_called_once_with(user_id)
+        self.assertEqual(actual["permissions"], expected)
+        self.assertEqual(actual["role"]["code"], "operator")
+        self.db.update_user(user_id, "operator", False, "", 1, "fixture")
+        actual = self.fetch().json()["subjects"][0]["user"]
+        self.assertFalse(actual["active"])
+        self.assertEqual(actual["permissions"], [])
+        self.assertEqual(actual["role"]["code"], "operator")
+
+    def test_dynamic_catalog_add_update_delete_and_link_projection(self):
+        payload = {"code": "fixture:dynamic", "name": "动态测试", "group_name": "合成菜单",
+            "page_name": "合成页面", "kind": "action", "enabled": True, "sort_order": 14}
+        self.db.create_permission(payload, 1, "fixture")
+        catalog = lambda: {row["code"]: row for row in self.fetch(self.body([], True)).json()["catalog"]["permissions"]}
+        self.assertEqual(catalog()[payload["code"]]["name"], "动态测试")
+        self.db.update_permission(payload["code"], {**payload, "name": "已更新", "enabled": False}, 1, "fixture")
+        changed = catalog()[payload["code"]]
+        self.assertEqual(changed["name"], "已更新")
+        self.assertFalse(changed["enabled"])
+        self.db.create_permission({**payload, "code": "link:fixture", "kind": "link",
+            "link_url": "https://example.invalid/private?secret=fixture", "link_mode": "tab"}, 1, "fixture")
+        link = catalog()["link:fixture"]
+        self.assertEqual(link["kind"], "page")
+        self.assertNotIn("link_url", link)
+        self.db.delete_permission(payload["code"], 1, "fixture")
+        self.assertNotIn(payload["code"], catalog())
+
+    def test_reading_does_not_change_users_roles_grants_tokens_or_catalog(self):
+        self.enroll()
+        self.db.create_token(1, "api", "fixture", 3600)
+        before = self.fingerprint()
+        self.assertEqual(self.fetch(self.body(catalog=True)).status_code, 200)
+        self.assertEqual(self.fetch(self.body([], True)).status_code, 200)
+        self.assertEqual(self.fetch(self.body([OTHER_GID], False)).status_code, 200)
+        self.assertEqual(before, self.fingerprint())
+
+    def test_no_catalog_requested_does_not_read_it(self):
+        with mock.patch.object(backend.Database, "permission_catalog", side_effect=AssertionError("No catalog")):
+            response = self.fetch(self.body([], False))
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json()["subjects"], [])
+        self.assertIsNone(response.json()["catalog"])
+
+    def test_user_bearer_never_substitutes_for_machine_authentication(self):
+        token, _ = self.db.create_token(1, "api", "fixture", 3600)
+        response = self.client.post(URL, json=self.body(), headers={"Authorization": "Bearer " + token})
+        self.assertEqual(response.status_code, 401)
+        self.assertEqual(response.headers["Cache-Control"], "no-store")
+
+    def test_bad_signature_and_body_or_path_tampering_are_rejected_before_parsing(self):
+        raw = self.raw(self.body())
+        for key, path, changed in ((b"x" * 32, "/group/access-snapshot", raw),
+                                   (KEY, "/api/v2/group/access-snapshot", raw),
+                                   (KEY, "/group/access-snapshot", b"not-json")):
+            with self.subTest(path=path, body=changed):
+                headers = self.headers(raw, key=key, path=path)
+                with mock.patch.object(group_access, "parse_request", side_effect=AssertionError("Not authenticated")):
+                    response = self.client.post(URL, content=changed, headers=headers)
+                self.assertEqual(response.status_code, 401)
+
+    def test_clock_window_and_replay(self):
+        for offset in (-91, 91):
+            self.assertEqual(self.fetch(timestamp=NOW + offset).status_code, 401)
+        for offset in (-90, 90):
+            self.assertEqual(self.fetch(timestamp=NOW + offset).status_code, 200)
+        nonce = "d" * 32
+        self.assertEqual(self.fetch(nonce=nonce).status_code, 200)
+        self.assertEqual(self.fetch(nonce=nonce).status_code, 401)
+        self.clock.return_value = NOW + 91
+        self.assertEqual(self.fetch(nonce=nonce, timestamp=NOW + 91).status_code, 200)
+
+    def test_replay_cache_full_fails_closed_and_does_not_evict_live_nonces(self):
+        self.service.max_nonces = 1
+        self.assertEqual(self.fetch(nonce="1" * 32).status_code, 200)
+        self.assertEqual(self.fetch(nonce="2" * 32).status_code, 503)
+        self.assertEqual(self.fetch(nonce="1" * 32).status_code, 401)
+
+    def test_concurrent_replay_consumes_nonce_once(self):
+        raw = self.raw(self.body([], False))
+        headers = self.headers(raw, nonce="e" * 32)
+        with ThreadPoolExecutor(max_workers=4) as pool:
+            statuses = list(pool.map(lambda _: self.client.post(URL, content=raw, headers=headers).status_code,
+                                     range(8)))
+        self.assertEqual(statuses.count(200), 1)
+        self.assertEqual(statuses.count(401), 7)
+
+    def test_invalid_and_missing_key_configuration_fail_closed(self):
+        for value in ("", str(self.root / "missing.key"), "relative.key"):
+            with self.subTest(value=value), mock.patch.dict(os.environ, {"ZYT_GROUP_METADATA_KEY_FILE": value}):
+                self.assertEqual(self.fetch().status_code, 503)
+        for raw in (b"x" * 64, b"1" * 63, b"1" * 65, b"1" * 64 + b"\n"):
+            self.key_file.write_bytes(raw)
+            response = self.fetch()
+            self.assertEqual(response.status_code, 503)
+            self.assertNotIn(str(self.key_file), response.text)
+
+    def test_public_static_key_location_is_rejected(self):
+        directory = self.root / "admin-web/apps/web-antd/dist"
+        directory.mkdir(parents=True, exist_ok=True)
+        key = directory / ("fixture-" + secrets.token_hex(8) + ".key")
+        key.write_text(KEY.hex(), encoding="ascii")
+        with mock.patch.object(group_access, "__file__", str(self.root / "wechat_rpa/group_access.py")), \
+             mock.patch.dict(os.environ, {"ZYT_GROUP_METADATA_KEY_FILE": str(key)}):
+            self.assertEqual(self.fetch().status_code, 503)
+
+    def test_strict_body_shapes_and_no_duplicate_json_keys(self):
+        bad = [[], {}, {**self.body(), "role": "admin"}, {**self.body(), "client_id": "hospital"},
+               {**self.body(), "include_catalog": 1}, {**self.body(), "gids": "bad"},
+               self.body([GID, GID]), self.body(["gid_" + "A" * 32]), self.body([True]),
+               self.body(["gid_" + f"{number:032x}" for number in range(101)])]
+        for value in bad:
+            with self.subTest(body=value):
+                self.assertEqual(self.fetch(value).status_code, 422)
+        for raw in (b'{"client_id":"kefu","client_id":"kefu","gids":[],"include_catalog":false}',
+                    b'{"client_id":"kefu","gids":[],"include_catalog":NaN}', b"\xff", b"not-json"):
+            self.assertEqual(self.fetch(raw=raw).status_code, 422)
+
+    def test_request_and_response_bounds(self):
+        self.assertEqual(self.fetch(raw=b" " * (16 * 1024 + 1)).status_code, 413)
+        gids = ["gid_" + f"{number:032x}" for number in range(100)]
+        self.assertEqual(len(self.fetch(self.body(gids)).json()["subjects"]), 100)
+        definition = {"code": "test:one", "name": "one", "group_name": "g", "page_name": "p",
+                      "kind": "action", "source": "custom", "enabled": True, "sort_order": 0}
+        with mock.patch.object(backend.Database, "permission_catalog", return_value=[definition] * 2001):
+            self.assertEqual(self.fetch(self.body([], True)).status_code, 503)
+        self.enroll()
+        with mock.patch.object(backend.Database, "permissions_for_user", return_value={f"test:{i}" for i in range(2001)}):
+            self.assertEqual(self.fetch().status_code, 503)
+        with mock.patch.object(backend.Database, "permission_catalog", return_value=[{**definition, "name": "a" * (4 * 1024 * 1024)}]):
+            self.assertEqual(self.fetch(self.body([], True)).status_code, 503)
+
+    def test_duplicate_security_headers_and_query_are_rejected(self):
+        raw = self.raw(self.body())
+        headers = list(self.headers(raw).items())
+        headers.append(("X-Group-Nonce", "f" * 32))
+        self.assertEqual(self.client.post(URL, content=raw, headers=headers).status_code, 401)
+        response = self.client.post(URL + "?gid=extra", content=raw, headers=self.headers(raw))
+        self.assertEqual(response.status_code, 422)
+
+    def test_response_signature_changes_with_payload_and_nonce(self):
+        self.enroll()
+        first = self.fetch(nonce="1" * 32)
+        second = self.fetch(nonce="2" * 32)
+        self.assertEqual(first.content, second.content)
+        self.assertNotEqual(first.headers["X-Group-Response-Signature"], second.headers["X-Group-Response-Signature"])
+        self.db.update_user(int(first.json()["subjects"][0]["user"]["id"]), "operator", True, "", 1, "fixture")
+        third = self.fetch(nonce="3" * 32)
+        self.assertNotEqual(first.content, third.content)
+
+
+if __name__ == "__main__":
+    # A restricted Windows socketpair can hang Python's test event loop before
+    # the endpoint runs. Bound the process instead of leaving a test stranded.
+    faulthandler.dump_traceback_later(60, exit=True)
+    try:
+        unittest.main(verbosity=2)
+    finally:
+        faulthandler.cancel_dump_traceback_later()
diff --git a/wechat_rpa/test_group_authorization.py b/wechat_rpa/test_group_authorization.py
new file mode 100644
index 000000000..ab2d661b2
--- /dev/null
+++ b/wechat_rpa/test_group_authorization.py
@@ -0,0 +1,484 @@
+"""Real FastAPI + isolated public Python copies + synthetic SQLite/key only."""
+from __future__ import annotations
+
+import atexit
+import faulthandler
+import hashlib
+import hmac
+import json
+import os
+import secrets
+import shutil
+import sys
+import tempfile
+import unittest
+from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
+from unittest import mock
+
+
+MIRROR = Path(__file__).resolve().parent
+SOURCE = Path(os.environ.get("IAM_KEFU_SOURCE_ROOT", "C:/kefu")) / "wechat_rpa"
+TEST_RUNTIME = MIRROR.parents[2] / ".test-runtime"
+TEST_RUNTIME.mkdir(parents=True, exist_ok=True)
+RUNTIME = tempfile.TemporaryDirectory(prefix="iam-kefu-authorization-", dir=TEST_RUNTIME)
+ISOLATED = Path(RUNTIME.name)
+
+
+def cleanup_runtime():
+    os.chdir(TEST_RUNTIME)
+    RUNTIME.cleanup()
+
+
+atexit.register(cleanup_runtime)
+# Copy no settings, .env, database, production key, or assets from the real app.
+for source in SOURCE.glob("*.py"):
+    shutil.copyfile(source, ISOLATED / source.name)
+for name in ("admin_api.py", "admin_backend.py", "rbac.py", "group_sso.py", "group_access.py", "group_authorization.py"):
+    shutil.copyfile(MIRROR / name, ISOLATED / name)
+os.chdir(ISOLATED)
+RUNTIME_ENV = {key: value for key, value in os.environ.items()
+               if key.upper() in {"SYSTEMROOT", "WINDIR", "TEMP", "TMP"}}
+os.environ.clear()
+os.environ.update(RUNTIME_ENV)
+sys.path.insert(0, str(ISOLATED))
+
+from fastapi.testclient import TestClient
+import admin_api
+import admin_backend as backend
+import group_access
+import group_authorization as authorization
+import rbac
+
+
+KEY = bytes.fromhex("34" * 32)
+NOW = 1_800_000_000
+GID = "gid_" + "a" * 32
+OTHER_GID = "gid_" + "b" * 32
+PASSWORD = "Fixture-Authorization-Password-2026"
+
+
+class GroupAuthorizationTests(unittest.TestCase):
+    def setUp(self):
+        self.directory = tempfile.TemporaryDirectory(dir=ISOLATED)
+        self.addCleanup(self.directory.cleanup)
+        self.root = Path(self.directory.name)
+        self.key_file = self.root / "synthetic.key"
+        self.key_file.write_text(KEY.hex(), encoding="ascii")
+        self.env = mock.patch.dict(os.environ, {"ZYT_GROUP_METADATA_KEY_FILE": str(self.key_file)}, clear=True)
+        self.env.start()
+        self.addCleanup(self.env.stop)
+        self.db = backend.Database(self.root / "synthetic.sqlite")
+        self.clock = mock.Mock(return_value=NOW)
+        with mock.patch.object(backend, "load_initial_config", return_value=backend.CONFIG_DEFAULTS.copy()):
+            self.db.initialize(PASSWORD)
+            self.service = authorization.GroupAuthorization(self.db, clock=self.clock)
+            with mock.patch.object(authorization, "GroupAuthorization", return_value=self.service):
+                self.client = TestClient(admin_api.create_app(self.db.path))
+        self.addCleanup(self.client.close)
+
+    def identity(self, gid=GID, source_id=7):
+        return {"client_id": "kefu", "gid": gid, "source_admin_id": source_id, "company_id": 2}
+
+    def enroll(self, gid=GID, source_id=7):
+        return self.db.group_sso_user({**self.identity(gid, source_id),
+            "account": "same-account", "name": "合成集团用户"})
+
+    def raw(self, value):
+        return json.dumps(value, ensure_ascii=False, separators=(",", ":")).encode("utf-8")
+
+    def headers(self, raw, path, *, nonce=None, timestamp=None, key=KEY):
+        nonce = nonce or secrets.token_hex(16)
+        timestamp = str(NOW if timestamp is None else timestamp)
+        message = f"POST\n{path}\n{timestamp}\n{nonce}\n{hashlib.sha256(raw).hexdigest()}"
+        return {"Content-Type": "application/json", "X-Group-Timestamp": timestamp,
+                "X-Group-Nonce": nonce,
+                "X-Group-Signature": hmac.new(key, message.encode("ascii"), hashlib.sha256).hexdigest()}
+
+    def fetch(self, body, path=authorization.OPTIONS_PATH, *, raw=None, query="", **signing):
+        raw = self.raw(body) if raw is None else raw
+        headers = self.headers(raw, path, **signing)
+        response = self.client.post("/api/v2" + path + query, content=raw, headers=headers)
+        self.assertEqual(response.headers.get("Cache-Control"), "no-store")
+        if response.status_code not in {401, 413} and "X-Group-Response-Signature" in response.headers:
+            self.assertEqual(response.headers["X-Group-Response-Signature"],
+                             group_access.response_signature(KEY, response.content, headers["X-Group-Nonce"]))
+        if response.status_code != 200 and response.status_code not in {401, 413}:
+            self.assertEqual(response.json(), {"version": 1, "client_id": "kefu", "generated_at": int(self.clock()),
+                "error": {"code": response.status_code, "message": response.json()["error"]["message"]}})
+            self.assertIn("X-Group-Response-Signature", response.headers)
+        return response
+
+    def options(self, identity=None):
+        result = self.fetch(identity or self.identity())
+        self.assertEqual(result.status_code, 200, result.text)
+        return result.json()
+
+    def mutation(self, revision=None, role="operator", permissions=None, identity=None, **changes):
+        return {**(identity or self.identity()), "actor_source_admin_id": 9,
+                "request_id": secrets.token_hex(16), "expected_revision": revision or self.options(identity)["revision"],
+                "role_code": role, "permissions": permissions, **changes}
+
+    def update(self, body=None, **changes):
+        return self.fetch(body or self.mutation(**changes), authorization.UPDATE_PATH)
+
+    def fingerprint(self):
+        tables = ("users", "roles", "role_permissions", "auth_tokens", "permissions", "group_sso_bindings",
+                  "audit_log", "group_authorization_audit", "group_authorization_private_roles", "group_authorization_requests")
+        with self.db.connect() as db:
+            return {table: [tuple(row) for row in db.execute(f"SELECT * FROM {table} ORDER BY rowid")]
+                    for table in tables}
+
+    def token_headers(self, user_id):
+        token, _ = self.db.create_token(user_id, "api", "existing-synthetic-session", 3600)
+        return {"Authorization": "Bearer " + token}
+
+    def test_options_exact_native_projection_is_readonly(self):
+        user = self.enroll()
+        self.db.update_user(user["id"], "operator", True, "", 1, "fixture")
+        with self.db.connect() as db:
+            db.execute("UPDATE permissions SET enabled=0 WHERE code='config:read'")
+            db.commit()
+        before = self.fingerprint()
+        data = self.options()
+        self.assertEqual(set(data), {"version", "client_id", "generated_at", "subject", "revision", "roles", "catalog"})
+        self.assertRegex(data["revision"], r"^[0-9a-f]{64}$")
+        subject = data["subject"]
+        self.assertEqual(set(subject), {"gid", "found", "source_admin_id", "company_id", "user"})
+        self.assertEqual(subject["gid"], GID)
+        self.assertEqual(subject["user"]["permissions"], sorted(self.db.permissions_for_user(user["id"])))
+        self.assertIn("config:read", subject["user"]["permissions"])
+        for role in data["roles"]:
+            self.assertEqual(set(role), {"code", "name", "permissions"})
+        for item in data["catalog"]["permissions"]:
+            self.assertEqual(set(item), {"code", "name", "group", "page", "kind", "source", "enabled", "sort"})
+        text = self.raw(data).decode("utf-8")
+        for forbidden in ("password_salt", "password_digest", "link_url", "user_count", str(self.key_file), KEY.hex()):
+            self.assertNotIn(forbidden, text)
+        self.assertEqual(before, self.fingerprint())
+
+    def test_role_assignment_existing_token_gains_and_loses_without_login(self):
+        user = self.enroll()
+        other = self.enroll(OTHER_GID, 8)
+        self.db.update_user(other["id"], "viewer", True, "", 1, "fixture")
+        headers = self.token_headers(user["id"])
+        other_headers = self.token_headers(other["id"])
+        initial = self.fingerprint()
+        other_before = self.client.get("/api/v2/me", headers=other_headers).json()
+        self.assertEqual(self.client.get("/api/v2/stats/model-calls", headers=headers).status_code, 403)
+        self.assertEqual(self.client.get("/api/v2/config", headers=headers).status_code, 403)
+        first = self.update()
+        self.assertEqual(first.status_code, 200, first.text)
+        self.assertEqual(first.json()["subject"]["user"]["role"]["code"], "operator")
+        self.assertEqual(self.client.get("/api/v2/stats/model-calls", headers=headers).status_code, 200)
+        self.assertEqual(self.client.get("/api/v2/config", headers=headers).status_code, 200)
+        self.assertEqual(self.client.get("/api/v2/me", headers=headers).json()["role"], "operator")
+        second = self.update(role="zyt_basic", revision=first.json()["revision"])
+        self.assertEqual(second.status_code, 200, second.text)
+        self.assertEqual(self.client.get("/api/v2/stats/model-calls", headers=headers).status_code, 403)
+        self.assertEqual(self.client.get("/api/v2/config", headers=headers).status_code, 403)
+        self.assertEqual(self.client.get("/api/v2/me", headers=headers).json()["permissions"], [])
+        self.assertEqual(self.client.get("/api/v2/me", headers=other_headers).json(), other_before)
+        final = self.fingerprint()
+        for table in ("roles", "role_permissions", "permissions", "group_sso_bindings"):
+            self.assertEqual(initial[table], final[table])
+        # session() updates last_used_at; identity, token/CSRF digests, expiry,
+        # credentials, status, password policy and all session rows are retained.
+        self.assertEqual([row[:-1] for row in initial["auth_tokens"]], [row[:-1] for row in final["auth_tokens"]])
+        for before, after in zip(initial["users"], final["users"]):
+            self.assertEqual(before[:-1], after[:-1])  # updated_at only may move
+
+    def test_explicit_permissions_are_private_empty_is_valid_and_other_users_unchanged(self):
+        user = self.enroll()
+        other = self.enroll(OTHER_GID, 8)
+        shared = self.fingerprint()["role_permissions"]
+        granted = ["config:read", "stats:read"]
+        result = self.update(permissions=granted)
+        self.assertEqual(result.status_code, 200, result.text)
+        first_role = result.json()["subject"]["user"]["role"]["code"]
+        self.assertNotEqual(first_role, "operator")
+        self.assertEqual(self.db.permissions_for_user(user["id"]), set(granted))
+        self.assertEqual(self.db.permissions_for_user(other["id"]), set())
+        with self.db.connect() as db:
+            unchanged = [tuple(row) for row in db.execute("SELECT * FROM role_permissions WHERE role_code!=? ORDER BY rowid", (first_role,))]
+        self.assertEqual(shared, unchanged)
+        second = self.update(role="operator", permissions=granted, identity=self.identity(OTHER_GID, 8))
+        self.assertEqual(second.status_code, 200, second.text)
+        self.assertNotEqual(first_role, second.json()["subject"]["user"]["role"]["code"])
+        self.assertNotIn(first_role, {role["code"] for role in second.json()["roles"]})
+        attempt = self.update(role=first_role, identity=self.identity(OTHER_GID, 8))
+        self.assertEqual(attempt.status_code, 422)
+        empty = self.update(permissions=[])
+        self.assertEqual(empty.status_code, 200, empty.text)
+        self.assertEqual(empty.json()["subject"]["user"]["permissions"], [])
+        self.assertEqual(self.db.permissions_for_user(other["id"]), set(granted))
+
+    def test_reuses_matching_private_role_but_forks_when_natively_shared_or_edited(self):
+        user = self.enroll()
+        other = self.enroll(OTHER_GID, 8)
+        first = self.update(permissions=["config:read"]).json()
+        role = first["subject"]["user"]["role"]["code"]
+        again = self.update(permissions=["config:read"]).json()
+        self.assertEqual(again["subject"]["user"]["role"]["code"], role)
+        self.db.update_user(other["id"], role, True, "", 1, "fixture")
+        shared_before = self.db.permissions_for_user(other["id"])
+        shared_fork = self.update(permissions=["config:read"]).json()["subject"]["user"]["role"]["code"]
+        self.assertNotEqual(shared_fork, role)
+        self.assertEqual(self.db.permissions_for_user(other["id"]), shared_before)
+        self.db.save_role(shared_fork, "KF 原生改名", ["stats:read"], 1, "fixture")
+        edited_fork = self.update(permissions=["config:read"]).json()["subject"]["user"]["role"]["code"]
+        self.assertNotIn(edited_fork, {role, shared_fork})
+        with self.db.connect() as db:
+            self.assertEqual(rbac.permissions_of(db, shared_fork), {"stats:read"})
+
+    def test_inactive_user_stays_inactive_and_revision_binds_assigned_permissions(self):
+        user = self.enroll()
+        self.db.update_user(user["id"], "viewer", False, "", 1, "fixture")
+        before = self.options()
+        result = self.update(revision=before["revision"], permissions=["config:read"])
+        self.assertEqual(result.status_code, 200, result.text)
+        self.assertFalse(result.json()["subject"]["user"]["active"])
+        self.assertEqual(result.json()["subject"]["user"]["permissions"], [])
+        role = result.json()["subject"]["user"]["role"]["code"]
+        self.assertEqual(next(item["permissions"] for item in result.json()["roles"] if item["code"] == role), ["config:read"])
+        self.assertNotEqual(before["revision"], result.json()["revision"])
+
+    def test_last_active_native_admin_is_preserved(self):
+        user = self.enroll()
+        self.db.update_user(user["id"], "admin", True, "", 1, "fixture")
+        with self.db.connect() as db:
+            db.execute("UPDATE users SET active=0 WHERE id=1")
+            db.commit()
+        before = self.fingerprint()
+        for permissions, role in ((None, "viewer"), ([], "admin"), (list(self.db.permissions_for_user(user["id"])), "admin")):
+            self.assertEqual(self.update(role=role, permissions=permissions).status_code, 409)
+            self.assertEqual(before, self.fingerprint())
+        self.assertEqual(self.update(role="admin").status_code, 200)
+
+    def test_missing_native_same_name_or_mismatched_binding_never_enrolls(self):
+        self.db.create_user("same-account", PASSWORD, "admin", 1, "fixture")
+        before = self.fingerprint()
+        with mock.patch.object(backend.Database, "group_sso_user", side_effect=AssertionError("No enrollment")):
+            self.assertEqual(self.fetch(self.identity()).status_code, 404)
+            self.assertEqual(self.update(self.mutation(revision="0" * 64)).status_code, 404)
+        self.assertEqual(before, self.fingerprint())
+        self.enroll()
+        before = self.fingerprint()
+        for changed in ({"company_id": 3}, {"source_admin_id": 8}):
+            identity = {**self.identity(), **changed}
+            self.assertEqual(self.fetch(identity).status_code, 409)
+            self.assertEqual(self.update(self.mutation(revision="0" * 64, identity=identity)).status_code, 409)
+            self.assertEqual(before, self.fingerprint())
+        with self.db.connect() as db:
+            db.execute("UPDATE group_sso_bindings SET provider='unrelated' WHERE gid=?", (GID,))
+            db.commit()
+        self.assertEqual(self.fetch(self.identity()).status_code, 404)
+
+    def test_unknown_role_permission_and_stale_revision_rollback(self):
+        self.enroll()
+        for changes, expected in (({"role": "missing-role"}, 422), ({"permissions": ["missing:permission"]}, 422),
+                                  ({"revision": "0" * 64}, 409)):
+            body = self.mutation(**changes)
+            before = self.fingerprint()
+            self.assertEqual(self.update(body).status_code, expected)
+            self.assertEqual(before, self.fingerprint())
+
+    def test_revision_detects_native_role_permission_active_and_identity_changes(self):
+        user = self.enroll()
+        self.db.update_user(user["id"], "viewer", True, "", 1, "fixture")
+        sql_changes = [("UPDATE role_permissions SET permission_code='config:write' WHERE role_code='viewer' AND permission_code='config:read'", ()),
+                       ("UPDATE users SET active=0 WHERE id=?", (user["id"],)),
+                       ("UPDATE users SET role='operator' WHERE id=?", (user["id"],)),
+                       ("UPDATE group_sso_bindings SET source_name='更新姓名' WHERE gid=?", (GID,))]
+        for sql, parameters in sql_changes:
+            body = self.mutation()
+            with self.db.connect() as db:
+                db.execute(sql, parameters)
+                db.commit()
+            before = self.fingerprint()
+            self.assertEqual(self.update(body).status_code, 409)
+            self.assertEqual(before, self.fingerprint())
+
+    def test_idempotency_is_durable_exact_body_and_revalidates_binding(self):
+        self.enroll()
+        body = self.mutation(permissions=["stats:read"])
+        first = self.update(body)
+        self.assertEqual(first.status_code, 200, first.text)
+        fingerprint = self.fingerprint()
+        # Simulate another worker/restart using the same SQLite file.
+        restarted = authorization.GroupAuthorization(self.db, clock=self.clock)
+        self.service._reserve_nonce = restarted._reserve_nonce
+        second = self.update(body)
+        self.assertEqual(second.status_code, 200, second.text)
+        self.assertEqual(first.content, second.content)
+        self.assertNotEqual(first.headers["X-Group-Response-Signature"], second.headers["X-Group-Response-Signature"])
+        self.assertEqual(fingerprint, self.fingerprint())
+        for changed in ({"role_code": "viewer"}, {"actor_source_admin_id": 10}, {"permissions": []}):
+            self.assertEqual(self.update({**body, **changed}).status_code, 409)
+            self.assertEqual(fingerprint, self.fingerprint())
+        with self.db.connect() as db:
+            db.execute("UPDATE group_sso_bindings SET company_id=3 WHERE gid=?", (GID,))
+            db.commit()
+        self.assertEqual(self.update(body).status_code, 409)
+
+    def test_idempotent_success_never_crosses_a_reassigned_binding(self):
+        self.enroll()
+        replacement = self.enroll(OTHER_GID, 8)
+        body = self.mutation(permissions=["stats:read"])
+        self.assertEqual(self.update(body).status_code, 200)
+        with self.db.connect() as db:
+            db.execute("DELETE FROM group_sso_bindings WHERE gid=?", (GID,))
+            db.execute("UPDATE group_sso_bindings SET gid=?,source_admin_id=7 WHERE gid=?", (GID, OTHER_GID))
+            db.commit()
+        before = self.fingerprint()
+        self.assertEqual(self.update(body).status_code, 409)
+        self.assertEqual(self.db.permissions_for_user(replacement["id"]), set())
+        self.assertEqual(before, self.fingerprint())
+
+    def test_atomic_compare_and_swap_allows_only_one_concurrent_writer(self):
+        self.enroll()
+        revision = self.options()["revision"]
+        bodies = [self.mutation(revision=revision, role="operator"), self.mutation(revision=revision, role="viewer")]
+        with ThreadPoolExecutor(max_workers=2) as pool:
+            results = list(pool.map(self.update, bodies))
+        self.assertEqual(sorted(result.status_code for result in results), [200, 409])
+        with self.db.connect() as db:
+            self.assertEqual(db.execute("SELECT COUNT(*) FROM group_authorization_requests").fetchone()[0], 1)
+            self.assertEqual(db.execute("SELECT COUNT(*) FROM group_authorization_audit").fetchone()[0], 1)
+
+    def test_both_audits_are_transactional_and_preserve_asserted_actor(self):
+        user = self.enroll()
+        body = self.mutation(permissions=["stats:read"])
+        result = self.update(body)
+        self.assertEqual(result.status_code, 200, result.text)
+        with self.db.connect() as db:
+            audit = db.execute("SELECT * FROM group_authorization_audit").fetchone()
+            detail = json.loads(audit["detail_json"])
+            native = db.execute("SELECT user_id,detail FROM audit_log WHERE action='group.authorization.update'").fetchone()
+        self.assertEqual(audit["actor_source_admin_id"], 9)
+        self.assertEqual(audit["target_user_id"], user["id"])
+        self.assertEqual(detail["request_id"], body["request_id"])
+        self.assertEqual(detail["before_permissions"], [])
+        self.assertEqual(detail["after_permissions"], ["stats:read"])
+        self.assertEqual(detail["after_revision"], result.json()["revision"])
+        self.assertIsNone(native["user_id"])
+        self.assertEqual(json.loads(native["detail"])["actor_source_admin_id"], 9)
+
+    def test_audit_failure_rolls_back_role_grants_assignment_and_idempotency(self):
+        self.enroll()
+        for table in ("audit_log", "group_authorization_audit", "group_authorization_requests"):
+            body = self.mutation(permissions=["stats:read"])
+            with self.db.connect() as db:
+                db.execute(f"CREATE TRIGGER synthetic_audit_failure BEFORE INSERT ON {table} BEGIN SELECT RAISE(ABORT,'synthetic-secret-error'); END")
+                db.commit()
+            before = self.fingerprint()
+            response = self.update(body)
+            self.assertEqual(response.status_code, 503)
+            self.assertNotIn("synthetic-secret-error", response.text)
+            self.assertEqual(before, self.fingerprint())
+            with self.db.connect() as db:
+                db.execute("DROP TRIGGER synthetic_audit_failure")
+                db.commit()
+
+    def test_response_bound_failure_rolls_back_mutation(self):
+        self.enroll()
+        body = self.mutation(permissions=["stats:read"])
+        before = self.fingerprint()
+        with mock.patch.object(authorization, "MAX_RESPONSE_BYTES", 1024):
+            response = self.update(body)
+        self.assertEqual(response.status_code, 503)
+        self.assertEqual(before, self.fingerprint())
+
+    def test_bearer_is_never_machine_auth_and_wrong_path_or_signature_fail_before_parse(self):
+        self.enroll()
+        token, _ = self.db.create_token(1, "api", "fixture", 3600)
+        for path in (authorization.OPTIONS_PATH, authorization.UPDATE_PATH):
+            response = self.client.post("/api/v2" + path, json=self.identity(), headers={"Authorization": "Bearer " + token})
+            self.assertEqual(response.status_code, 401)
+            raw = self.raw(self.identity())
+            for key, signed_path, changed in ((b"x" * 32, path, raw), (KEY, "/api/v2" + path, raw),
+                    (KEY, authorization.UPDATE_PATH if path == authorization.OPTIONS_PATH else authorization.OPTIONS_PATH, raw),
+                    (KEY, path, b"invalid-json")):
+                headers = self.headers(raw, signed_path, key=key)
+                with mock.patch.object(authorization, "parse_request", side_effect=AssertionError("Before auth")):
+                    response = self.client.post("/api/v2" + path, content=changed, headers=headers)
+                self.assertEqual(response.status_code, 401)
+
+    def test_nonce_replay_persists_across_instances_failures_and_concurrent_workers(self):
+        self.enroll()
+        nonce = "d" * 32
+        self.assertEqual(self.fetch(self.identity(), nonce=nonce).status_code, 200)
+        restarted = authorization.GroupAuthorization(self.db, clock=self.clock)
+        self.service._reserve_nonce = restarted._reserve_nonce
+        self.assertEqual(self.fetch(self.identity(), nonce=nonce).status_code, 401)
+        invalid = {**self.identity(), "extra": 1}
+        self.assertEqual(self.fetch(invalid, nonce="e" * 32).status_code, 422)
+        self.assertEqual(self.fetch(invalid, nonce="e" * 32).status_code, 401)
+        raw = self.raw(self.identity())
+        headers = self.headers(raw, authorization.OPTIONS_PATH, nonce="f" * 32)
+        with ThreadPoolExecutor(max_workers=4) as pool:
+            statuses = list(pool.map(lambda _: self.client.post("/api/v2" + authorization.OPTIONS_PATH,
+                content=raw, headers=headers).status_code, range(8)))
+        self.assertEqual(statuses.count(200), 1)
+        self.assertEqual(statuses.count(401), 7)
+
+    def test_clock_bounds_and_bounded_nonce_store(self):
+        self.enroll()
+        for offset in (-91, 91):
+            self.assertEqual(self.fetch(self.identity(), timestamp=NOW + offset).status_code, 401)
+        for offset in (-90, 90):
+            self.assertEqual(self.fetch(self.identity(), timestamp=NOW + offset).status_code, 200)
+        with self.db.connect() as db:
+            count = db.execute("SELECT COUNT(*) FROM group_authorization_nonces").fetchone()[0]
+        self.service.max_nonces = count
+        self.assertEqual(self.fetch(self.identity()).status_code, 503)
+        self.clock.return_value = NOW + 181
+        self.assertEqual(self.fetch(self.identity(), timestamp=NOW + 181).status_code, 200)
+
+    def test_strict_json_fields_and_types_signed_safe_errors(self):
+        self.enroll()
+        mutation = self.mutation()
+        invalid_options = [[], {}, {**self.identity(), "role_code": "admin"},
+            {**self.identity(), "client_id": "hospital"}, {**self.identity(), "source_admin_id": True},
+            {**self.identity(), "company_id": 0}, {**self.identity(), "gid": "gid_" + "A" * 32}]
+        for body in invalid_options:
+            self.assertEqual(self.fetch(body).status_code, 422)
+        invalid_updates = [{**mutation, "actor_source_admin_id": True}, {**mutation, "request_id": "A" * 32},
+            {**mutation, "expected_revision": "A" * 64}, {**mutation, "role_code": ""},
+            {**mutation, "permissions": "stats:read"}, {**mutation, "permissions": [True]},
+            {**mutation, "permissions": ["stats:read", "stats:read"]},
+            {**mutation, "permissions": [f"fixture:{i}" for i in range(2001)]},
+            {**mutation, "actor_id": 1}]
+        for body in invalid_updates:
+            self.assertEqual(self.update(body).status_code, 422)
+        for raw in (b' {"client_id":"kefu","client_id":"kefu","gid":"x","source_admin_id":7,"company_id":2}',
+                    b'{"client_id":NaN}', b"\xff", b"not-json"):
+            self.assertEqual(self.fetch(None, raw=raw).status_code, 422)
+
+    def test_duplicate_security_headers_query_and_oversize_requests(self):
+        self.enroll()
+        raw = self.raw(self.identity())
+        for name in ("X-Group-Nonce", "X-Group-Timestamp", "X-Group-Signature"):
+            headers = list(self.headers(raw, authorization.OPTIONS_PATH).items())
+            headers.append((name, "f" * 32))
+            self.assertEqual(self.client.post("/api/v2" + authorization.OPTIONS_PATH, content=raw, headers=headers).status_code, 401)
+        self.assertEqual(self.fetch(self.identity(), query="?identity=extra").status_code, 422)
+        self.assertEqual(self.fetch(None, raw=b" " * (authorization.MAX_REQUEST_BYTES + 1)).status_code, 413)
+
+    def test_invalid_key_fails_closed_without_paths_or_key_material(self):
+        for configured in ("", "relative.key", str(self.root / "missing.key")):
+            with mock.patch.dict(os.environ, {"ZYT_GROUP_METADATA_KEY_FILE": configured}):
+                raw = self.raw(self.identity())
+                response = self.client.post("/api/v2" + authorization.OPTIONS_PATH,
+                    content=raw, headers=self.headers(raw, authorization.OPTIONS_PATH))
+            self.assertEqual(response.status_code, 503)
+            self.assertNotIn(str(self.root), response.text)
+            self.assertNotIn(KEY.hex(), response.text)
+
+
+if __name__ == "__main__":
+    faulthandler.dump_traceback_later(90, exit=True)
+    try:
+        unittest.main(verbosity=2)
+    finally:
+        faulthandler.cancel_dump_traceback_later()