feat(frontend): enforce RBAC and refine burst analysis

src/app/RefineContext.tsx

@@ -1,32 +1,38 @@
 "use client";
 
-import { Refine, type AuthProvider } from "@refinedev/core";
-import { RefineKbar, RefineKbarProvider } from "@refinedev/kbar";
 import {
-  RefineSnackbarProvider,
+  Refine,
-} from "@refinedev/mui";
+  type AccessControlProvider,
+  type AuthProvider,
+} from "@refinedev/core";
+import { RefineKbar, RefineKbarProvider } from "@refinedev/kbar";
+import { RefineSnackbarProvider } from "@refinedev/mui";
 import { SessionProvider, signIn, signOut, useSession } from "next-auth/react";
 import { usePathname } from "next/navigation";
-import React, { useEffect, useState } from "react";
+import React, { useEffect } from "react";
 
 import routerProvider from "@refinedev/nextjs-router";
 
 import { ColorModeContextProvider } from "@contexts/color-mode";
 import { dataProvider } from "@providers/data-provider";
 import { ProjectProvider } from "@/contexts/ProjectContext";
+import { RoutePermissionGuard } from "@/components/auth/RoutePermissionGuard";
 import { useAuthStore } from "@/store/authStore";
+import { useAccessStore } from "@/store/accessStore";
+import { useProjectStore } from "@/store/projectStore";
 import { apiFetch } from "@/lib/apiFetch";
+import { permissionCodes, resourcePermissions } from "@/lib/permissions";
 import { config } from "@config/config";
 import { useAppNotificationProvider } from "@/providers/notification-provider/useAppNotificationProvider";
 
 import { LiaNetworkWiredSolid } from "react-icons/lia";
-import { TbDatabaseEdit, TbLocationPin, TbActivity } from "react-icons/tb";
+import { TbActivity, TbDatabaseEdit, TbLocationPin } from "react-icons/tb";
 import { LuReplace } from "react-icons/lu";
 import { AiOutlineSecurityScan } from "react-icons/ai";
-import { MdWater, MdOutlineWaterDrop, MdCleaningServices } from "react-icons/md";
+import { MdCleaningServices, MdOutlineWaterDrop } from "react-icons/md";
 import {
-  ManageAccounts as ManageAccountsIcon,
   FactCheck as FactCheckIcon,
+  ManageAccounts as ManageAccountsIcon,
   MyLocation as MyLocationIcon,
   Search as SearchIcon,
 } from "@mui/icons-material";
@@ -36,16 +42,12 @@ type RefineContextProps = {
 };
 
 export const RefineContext = (
-  props: React.PropsWithChildren<RefineContextProps>
+  props: React.PropsWithChildren<RefineContextProps>,
-) => {
+) => (
-  return (
   <SessionProvider>
-      <ProjectProvider>
     <App {...props} />
-      </ProjectProvider>
   </SessionProvider>
-  );
+);
-};
 
 type AppProps = {
   defaultMode?: string;
@@ -55,40 +57,71 @@ const App = (props: React.PropsWithChildren<AppProps>) => {
   const { data, status } = useSession();
   const to = usePathname();
   const setAccessToken = useAuthStore((state) => state.setAccessToken);
-  const [isMetadataAdmin, setIsMetadataAdmin] = useState(false);
+  const currentProjectId = useProjectStore((state) => state.currentProjectId);
+  const permissions = useAccessStore((state) => state.permissions);
+  const setAccessContext = useAccessStore((state) => state.setContext);
+  const setAccessLoading = useAccessStore((state) => state.setLoading);
+  const resetAccess = useAccessStore((state) => state.reset);
+  const can = (permission: string) => permissions.includes(permission);
 
   useEffect(() => {
-    setAccessToken(typeof data?.accessToken === "string" ? data.accessToken : null);
+    setAccessToken(
+      typeof data?.accessToken === "string" ? data.accessToken : null,
+    );
   }, [data?.accessToken, setAccessToken]);
 
   useEffect(() => {
     if (status !== "authenticated") {
-      setIsMetadataAdmin(false);
+      resetAccess();
       return;
     }
 
     let cancelled = false;
-    apiFetch(`${config.BACKEND_URL}/api/v1/admin/me`, {
+    setAccessLoading(true);
-      projectHeaderMode: "omit",
+    apiFetch(`${config.BACKEND_URL}/api/v1/access/context`, {
+      projectHeaderMode: currentProjectId ? "include" : "omit",
       skipAuthRedirect: true,
     })
       .then(async (response) => {
         if (cancelled) return;
         if (!response.ok) {
-          setIsMetadataAdmin(false);
+          resetAccess();
           return;
         }
-        const payload = await response.json();
+        setAccessContext(await response.json());
-        setIsMetadataAdmin(Boolean(payload?.is_superuser || payload?.role === "admin"));
       })
       .catch(() => {
-        if (!cancelled) setIsMetadataAdmin(false);
+        if (!cancelled) resetAccess();
       });
 
     return () => {
       cancelled = true;
     };
-  }, [status]);
+  }, [
+    currentProjectId,
+    resetAccess,
+    setAccessContext,
+    setAccessLoading,
+    status,
+  ]);
+
+  useEffect(() => {
+    if (status !== "authenticated" || !data?.user?.id) return;
+    const auditKey = `tjwater-login-audit:${data.user.id}`;
+    if (sessionStorage.getItem(auditKey)) return;
+
+    apiFetch(`${config.BACKEND_URL}/api/v1/audit/session-events`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ event: "login" }),
+      projectHeaderMode: "omit",
+      skipAuthRedirect: true,
+    })
+      .then((response) => {
+        if (response.ok) sessionStorage.setItem(auditKey, "1");
+      })
+      .catch(() => undefined);
+  }, [data?.user?.id, status]);
 
   if (status === "loading") {
     return <span>loading...</span>;
@@ -100,75 +133,65 @@ const App = (props: React.PropsWithChildren<AppProps>) => {
         callbackUrl: to ? to.toString() : "/",
         redirect: true,
       });
-
+      return { success: true };
-      return {
-        success: true,
-      };
     },
     logout: async () => {
-      signOut({
+      try {
-        redirect: true,
+        await apiFetch(`${config.BACKEND_URL}/api/v1/audit/session-events`, {
-        callbackUrl: "/login",
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ event: "logout" }),
+          projectHeaderMode: "omit",
+          skipAuthRedirect: true,
         });
-
+      } catch {
-      return {
+        // Logout must still complete when audit storage is unavailable.
-        success: true,
+      }
-      };
+      if (data?.user?.id) {
+        sessionStorage.removeItem(`tjwater-login-audit:${data.user.id}`);
+      }
+      signOut({ redirect: true, callbackUrl: "/login" });
+      return { success: true };
     },
     onError: async (error) => {
       if (error.response?.status === 401) {
-        return {
+        return { logout: true };
-          logout: true,
-        };
       }
-
+      return { error };
-      return {
-        error,
-      };
-    },
-    check: async () => {
-      if (status === "unauthenticated") {
-        return {
-          authenticated: false,
-          redirectTo: "/login",
-        };
-      }
-
-      return {
-        authenticated: true,
-      };
-    },
-    getPermissions: async () => {
-      return null;
     },
+    check: async () =>
+      status === "unauthenticated"
+        ? { authenticated: false, redirectTo: "/login" }
+        : { authenticated: true },
+    getPermissions: async () => permissions,
     getIdentity: async () => {
-      if (data?.user) {
+      if (!data?.user) return null;
-        const { user } = data;
       return {
-          id: user.id,
+        id: data.user.id,
-          username: user.username,
+        username: data.user.username,
-          name: user.name,
+        name: data.user.name,
-          avatar: user.image,
+        avatar: data.user.image,
       };
-      }
-
-      return null;
     },
   };
 
-  const defaultMode = props?.defaultMode;
+  const accessControlProvider: AccessControlProvider = {
+    can: async ({ resource }) => {
+      const requiredPermission = resource
+        ? resourcePermissions[resource]
+        : undefined;
+      return {
+        can: !requiredPermission || permissions.includes(requiredPermission),
+        reason: requiredPermission
+          ? `需要权限：${requiredPermission}`
+          : undefined,
+      };
+    },
+  };
 
-  return (
+  const resources = [
-    <>
+    ...(can(permissionCodes.simulationView)
-      <RefineKbarProvider>
+      ? [
-        <ColorModeContextProvider defaultMode={defaultMode}>
-          <RefineSnackbarProvider>
-            <Refine
-              routerProvider={routerProvider}
-              dataProvider={dataProvider}
-              notificationProvider={useAppNotificationProvider}
-              authProvider={authProvider}
-              resources={[
           {
             name: "管网在线模拟",
             list: "/network-simulation",
@@ -177,6 +200,10 @@ const App = (props: React.PropsWithChildren<AppProps>) => {
               label: "管网在线模拟",
             },
           },
+        ]
+      : []),
+    ...(can(permissionCodes.scadaClean)
+      ? [
           {
             name: "SCADA 数据清洗",
             list: "/scada-data-cleaning",
@@ -185,6 +212,10 @@ const App = (props: React.PropsWithChildren<AppProps>) => {
               label: "SCADA 数据清洗",
             },
           },
+        ]
+      : []),
+    ...(can(permissionCodes.optimizationRun)
+      ? [
           {
             name: "监测点优化布置",
             list: "/monitoring-place-optimization",
@@ -193,6 +224,10 @@ const App = (props: React.PropsWithChildren<AppProps>) => {
               label: "监测点优化布置",
             },
           },
+        ]
+      : []),
+    ...(can(permissionCodes.riskRun)
+      ? [
           {
             name: "健康风险分析",
             list: "/health-risk-analysis",
@@ -201,13 +236,18 @@ const App = (props: React.PropsWithChildren<AppProps>) => {
               label: "健康风险分析",
             },
           },
+        ]
+      : []),
+    ...(can(permissionCodes.simulationRun) || can(permissionCodes.burstRun)
+      ? [
           {
             name: "Hydraulic Simulation",
-                  meta: {
+            meta: { label: "事件模拟" },
-                    // icon: <MdWater className="w-6 h-6" />,
-                    label: "事件模拟",
-                  },
           },
+        ]
+      : []),
+    ...(can(permissionCodes.burstRun)
+      ? [
           {
             name: "爆管模拟",
             list: "/hydraulic-simulation/burst-simulation",
@@ -244,6 +284,10 @@ const App = (props: React.PropsWithChildren<AppProps>) => {
               label: "DMA 漏损识别",
             },
           },
+        ]
+      : []),
+    ...(can(permissionCodes.simulationRun)
+      ? [
           {
             name: "水质模拟",
             list: "/hydraulic-simulation/contaminant-simulation",
@@ -262,7 +306,9 @@ const App = (props: React.PropsWithChildren<AppProps>) => {
               label: "管道冲洗",
             },
           },
-                ...(isMetadataAdmin
+        ]
+      : []),
+    ...(can(permissionCodes.environmentManage)
       ? [
           {
             name: "系统管理",
@@ -272,6 +318,10 @@ const App = (props: React.PropsWithChildren<AppProps>) => {
               label: "系统管理",
             },
           },
+        ]
+      : []),
+    ...(can(permissionCodes.auditView)
+      ? [
           {
             name: "审计日志",
             list: "/audit-logs",
@@ -282,18 +332,31 @@ const App = (props: React.PropsWithChildren<AppProps>) => {
           },
         ]
       : []),
-              ]}
+  ];
+
+  return (
+    <ProjectProvider>
+      <RefineKbarProvider>
+        <ColorModeContextProvider defaultMode={props.defaultMode}>
+          <RefineSnackbarProvider>
+            <Refine
+              routerProvider={routerProvider}
+              dataProvider={dataProvider}
+              notificationProvider={useAppNotificationProvider}
+              authProvider={authProvider}
+              accessControlProvider={accessControlProvider}
+              resources={resources}
               options={{
                 syncWithLocation: true,
                 warnWhenUnsavedChanges: true,
               }}
             >
-              {props.children}
+              <RoutePermissionGuard>{props.children}</RoutePermissionGuard>
               <RefineKbar />
             </Refine>
           </RefineSnackbarProvider>
         </ColorModeContextProvider>
       </RefineKbarProvider>
-    </>
+    </ProjectProvider>
   );
 };

src/components/admin/SystemAdminPanel.tsx

@@ -106,24 +106,30 @@ type DatabaseHealth = {
 
 const businessRoleOptions = [
   { value: "admin", label: "系统管理员" },
-  { value: "operator", label: "运行人员" },
   { value: "user", label: "普通用户" },
-  { value: "viewer", label: "只读用户" },
 ];
 
 const projectRoleLabels: Record<string, string> = {
-  owner: "项目负责人",
-  admin: "项目管理员",
   member: "项目成员",
   viewer: "只读成员",
 };
 
 const projectRoleOptions = [
-  { value: "admin", label: projectRoleLabels.admin },
   { value: "member", label: projectRoleLabels.member },
   { value: "viewer", label: projectRoleLabels.viewer },
 ];
 
+const projectRolePermissionSummary = [
+  {
+    role: "项目成员",
+    permissions: "WebGIS 编辑、SCADA 清洗、水力模拟、爆管、风险和监测点优化分析",
+  },
+  {
+    role: "只读成员",
+    permissions: "默认工作台、WebGIS、SCADA 和既有模拟结果只读",
+  },
+];
+
 const projectStatusOptions = [
   { value: "active", label: "启用" },
   { value: "inactive", label: "停用" },
@@ -1340,7 +1346,7 @@ export const SystemAdminPanel = () => {
                   <Stack spacing={2}>
                     <SectionHeader
                       title="项目成员"
-                      description="维护当前项目内权限；此处只管理项目管理员、项目成员和只读成员，项目负责人另行维护。"
+                      description="项目访问角色保存在 Metadata DB 的 user_project_membership.project_role。模型上传由桌面端发起，仅系统管理员可执行。"
                       action={
                         <Button
                           variant="outlined"
@@ -1352,6 +1358,25 @@ export const SystemAdminPanel = () => {
                         </Button>
                       }
                     />
+                    <Paper variant="outlined" sx={{ p: 2, borderRadius: 2 }}>
+                      <Typography variant="subtitle2" fontWeight={800} sx={{ mb: 1 }}>
+                        固定项目权限
+                      </Typography>
+                      <Stack
+                        direction={{ xs: "column", md: "row" }}
+                        spacing={1}
+                        useFlexGap
+                        flexWrap="wrap"
+                      >
+                        {projectRolePermissionSummary.map((item) => (
+                          <Chip
+                            key={item.role}
+                            label={`${item.role}：${item.permissions}`}
+                            variant="outlined"
+                          />
+                        ))}
+                      </Stack>
+                    </Paper>
                     {!hasProjectId && (
                       <Alert severity="warning" sx={{ borderRadius: 2 }}>
                         当前未选择管理项目。
@@ -1467,7 +1492,6 @@ export const SystemAdminPanel = () => {
                           )}
                           {members.map((member) => {
                             const isSelf = member.user_id === currentAdmin?.id;
-                            const isOwner = member.project_role === "owner";
 
                             return (
                               <TableRow key={member.id} hover>
@@ -1486,15 +1510,6 @@ export const SystemAdminPanel = () => {
                                 </TableCell>
                                 <TableCell>{member.email}</TableCell>
                                 <TableCell>
-                                  {isOwner ? (
-                                    <Tooltip title="项目负责人不在系统管理页维护">
-                                      <Chip
-                                        size="small"
-                                        color="warning"
-                                        label={getProjectRoleLabel(member.project_role)}
-                                      />
-                                    </Tooltip>
-                                  ) : (
                                   <Tooltip title={isSelf ? "不能操作当前登录用户" : ""}>
                                     <span>
                                       <FormControl
@@ -1520,20 +1535,13 @@ export const SystemAdminPanel = () => {
                                       </FormControl>
                                     </span>
                                   </Tooltip>
-                                  )}
                                 </TableCell>
                                 <TableCell>
                                   <StatusChip active={member.is_active} />
                                 </TableCell>
                                 <TableCell align="right">
                                   <Tooltip
-                                    title={
+                                    title={isSelf ? "不能操作当前登录用户" : ""}
-                                      isSelf
-                                        ? "不能操作当前登录用户"
-                                        : isOwner
-                                          ? "项目负责人不在系统管理页维护"
-                                          : ""
-                                    }
                                   >
                                     <span>
                                       <Button
@@ -1542,7 +1550,7 @@ export const SystemAdminPanel = () => {
                                         variant="outlined"
                                         startIcon={<RemoveCircleOutlineIcon />}
                                         onClick={() => removeMember(member)}
-                                        disabled={isSelf || isOwner}
+                                        disabled={isSelf}
                                       >
                                         移除
                                       </Button>

src/components/audit/AuditLogPanel.tsx

@@ -49,6 +49,8 @@ import {
 } from "@mui/icons-material";
 import { config } from "@config/config";
 import { apiFetch } from "@/lib/apiFetch";
+import { permissionCodes } from "@/lib/permissions";
+import { useAccessStore } from "@/store/accessStore";
 
 type AuditLog = {
   id: string;
@@ -105,6 +107,8 @@ const defaultFilters: AuditFilters = {
   end_time: "",
 };
 
+const AUDIT_LOGS_PATH = "/api/v1/audit/logs";
+
 const statusFilterOptions: Array<{ value: AuditStatusFilter; label: string }> = [
   { value: "all", label: "全部状态" },
   { value: "success", label: "成功 2xx" },
@@ -338,8 +342,14 @@ const DetailSection = ({
 );
 
 export const AuditLogPanel = () => {
-  const [adminChecked, setAdminChecked] = useState(false);
+  const accessLoading = useAccessStore((state) => state.loading);
-  const [isAuthorized, setIsAuthorized] = useState(false);
+  const permissions = useAccessStore((state) => state.permissions);
+  const isSystemAdmin = useAccessStore(
+    (state) => state.context?.is_system_admin === true,
+  );
+  const canViewAudit = permissions.includes(permissionCodes.auditView);
+  const adminChecked = !accessLoading;
+  const isAuthorized = adminChecked && canViewAudit && isSystemAdmin;
   const [logs, setLogs] = useState<AuditLog[]>([]);
   const [users, setUsers] = useState<MetadataUser[]>([]);
   const [projects, setProjects] = useState<AdminProject[]>([]);
@@ -392,8 +402,8 @@ export const AuditLogPanel = () => {
         const params = buildServerParams(appliedFilters, page * rowsPerPage, rowsPerPage);
         const countParams = buildCountParams(appliedFilters);
         const [logsResponse, countResponse] = await Promise.all([
-          apiFetch(`${config.BACKEND_URL}/api/v1/audit/logs?${params.toString()}`),
+          apiFetch(`${config.BACKEND_URL}${AUDIT_LOGS_PATH}?${params.toString()}`),
-          apiFetch(`${config.BACKEND_URL}/api/v1/audit/logs/count?${countParams.toString()}`),
+          apiFetch(`${config.BACKEND_URL}${AUDIT_LOGS_PATH}/count?${countParams.toString()}`),
         ]);
         if (!logsResponse.ok) throw new Error(await readErrorText(logsResponse));
         if (!countResponse.ok) throw new Error(await readErrorText(countResponse));
@@ -402,7 +412,7 @@ export const AuditLogPanel = () => {
         setTotalCount(Number(countPayload.count ?? 0));
       } else {
         const params = buildServerParams(appliedFilters, 0, 1000);
-        const response = await apiFetch(`${config.BACKEND_URL}/api/v1/audit/logs?${params.toString()}`);
+        const response = await apiFetch(`${config.BACKEND_URL}${AUDIT_LOGS_PATH}?${params.toString()}`);
         if (!response.ok) throw new Error(await readErrorText(response));
         const payload = (await response.json()) as AuditLog[];
         setLogs(payload);
@@ -417,42 +427,9 @@ export const AuditLogPanel = () => {
   }, [appliedFilters, page, rowsPerPage]);
 
   useEffect(() => {
-    let cancelled = false;
+    if (!isAuthorized) return;
-
-    const checkAdmin = async () => {
-      try {
-        const response = await apiFetch(`${config.BACKEND_URL}/api/v1/admin/me`, {
-          projectHeaderMode: "omit",
-          skipAuthRedirect: true,
-        });
-        if (cancelled) return;
-        if (!response.ok) {
-          setIsAuthorized(false);
-          setAdminChecked(true);
-          return;
-        }
-        const payload = await response.json();
-        setIsAuthorized(Boolean(payload?.is_superuser || payload?.role === "admin"));
-        setAdminChecked(true);
-      } catch (err) {
-        if (!cancelled) {
-          setIsAuthorized(false);
-          setAdminChecked(true);
-          setError(String(err));
-        }
-      }
-    };
-
-    void checkAdmin();
-    return () => {
-      cancelled = true;
-    };
-  }, []);
-
-  useEffect(() => {
-    if (!adminChecked || !isAuthorized) return;
     void loadOptions();
-  }, [adminChecked, isAuthorized, loadOptions]);
+  }, [isAuthorized, loadOptions]);
 
   useEffect(() => {
     if (!adminChecked || !isAuthorized) return;
@@ -476,7 +453,7 @@ export const AuditLogPanel = () => {
     setError(null);
     try {
       const params = buildServerParams(appliedFilters, 0, 1000);
-      const response = await apiFetch(`${config.BACKEND_URL}/api/v1/audit/logs?${params.toString()}`);
+      const response = await apiFetch(`${config.BACKEND_URL}${AUDIT_LOGS_PATH}?${params.toString()}`);
       if (!response.ok) throw new Error(await readErrorText(response));
       const payload = ((await response.json()) as AuditLog[]).filter((log) =>
         matchesStatusFilter(log, appliedFilters.status),
@@ -544,7 +521,7 @@ export const AuditLogPanel = () => {
                   审计日志
                 </Typography>
                 <Typography variant="body2" color="text.secondary">
-                  管理员审计查询
+                  全局审计查询
                 </Typography>
               </Box>
             </Stack>
@@ -552,7 +529,7 @@ export const AuditLogPanel = () => {
               <Chip
                 color="success"
                 icon={<AdminPanelSettingsIcon />}
-                label="管理员权限已验证"
+                label="系统管理员权限已验证"
                 sx={{ alignSelf: { xs: "flex-start", md: "center" } }}
               />
             )}

src/components/auth/RoutePermissionGuard.tsx

@@ -0,0 +1,45 @@
+"use client";
+
+import LockOutlinedIcon from "@mui/icons-material/LockOutlined";
+import { Alert, Box, CircularProgress, Stack, Typography } from "@mui/material";
+import { usePathname } from "next/navigation";
+import type { ReactNode } from "react";
+
+import { permissionForPath } from "@/lib/permissions";
+import { useAccessStore } from "@/store/accessStore";
+
+export const RoutePermissionGuard = ({
+  children,
+}: {
+  children: ReactNode;
+}) => {
+  const pathname = usePathname();
+  const permissions = useAccessStore((state) => state.permissions);
+  const loading = useAccessStore((state) => state.loading);
+  const requiredPermission = permissionForPath(pathname);
+
+  if (requiredPermission && loading) {
+    return (
+      <Box sx={{ minHeight: 320, display: "grid", placeItems: "center" }}>
+        <CircularProgress size={28} />
+      </Box>
+    );
+  }
+
+  if (requiredPermission && !permissions.includes(requiredPermission)) {
+    return (
+      <Box sx={{ p: { xs: 2, md: 4 } }}>
+        <Alert severity="error" icon={<LockOutlinedIcon />}>
+          <Stack spacing={0.5}>
+            <Typography fontWeight={700}>无权访问此功能</Typography>
+            <Typography variant="body2">
+              当前项目角色缺少权限：{requiredPermission}
+            </Typography>
+          </Stack>
+        </Alert>
+      </Box>
+    );
+  }
+
+  return children;
+};

src/components/olmap/BurstSimulation/AnalysisReport.test.tsx

@@ -11,7 +11,10 @@ import AnalysisReport, {
   matchesValveAnalysis,
 } from "./AnalysisReport";
 import { SchemeRecord, ValveIsolationResult } from "./types";
-import { isAllowedAccidentPipe } from "./valveIsolationScope";
+import {
+  isAllowedAccidentPipe,
+  normalizeValveIsolationResult,
+} from "./valveIsolationScope";
 
 jest.mock("@/utils/mapQueryService", () => ({
   queryFeaturesByIds: jest.fn(),
@@ -139,12 +142,69 @@ describe("AnalysisReport", () => {
     );
   });
 
+  it("shows only the affected count for a non-isolatable result", async () => {
+    const legacyAffectedNodes = Array.from(
+      { length: 100 },
+      (_, index) => `legacy-node-${index}`,
+    );
+    const nonIsolatableResult = {
+      ...valveResult,
+      affected_nodes: legacyAffectedNodes,
+      affected_node_count: 85747,
+      must_close_valves: [],
+      isolatable: false,
+    };
+
+    render(
+      <AnalysisReport
+        scheme={scheme}
+        valveResult={nonIsolatableResult}
+        disabledValves={[]}
+        generatedAt={new Date("2026-07-30T10:00:00+08:00")}
+      />,
+    );
+
+    const preview = within(
+      screen.getByTestId("burst-analysis-report-preview"),
+    );
+    expect(preview.getByText("85747 个")).toBeInTheDocument();
+    expect(
+      preview.getByText("不可隔离，未生成受影响节点清单。"),
+    ).toBeInTheDocument();
+    expect(preview.queryByText("legacy-node-0")).not.toBeInTheDocument();
+    expect(preview.queryByText("legacy-node-99")).not.toBeInTheDocument();
+    await waitFor(() =>
+      expect(preview.getByText("315 mm")).toBeInTheDocument(),
+    );
+  });
+
   it("limits scheme-bound valve analysis to the scheme accident pipes", () => {
     expect(isAllowedAccidentPipe("P-1", ["P-1", "P-2"])).toBe(true);
     expect(isAllowedAccidentPipe("P-99", ["P-1", "P-2"])).toBe(false);
     expect(isAllowedAccidentPipe("P-99", undefined)).toBe(true);
   });
 
+  it("normalizes legacy valve results without changing isolatable lists", () => {
+    expect(
+      normalizeValveIsolationResult({
+        ...valveResult,
+        affected_nodes: ["J-1", "J-2", "J-3"],
+        must_close_valves: [],
+        isolatable: false,
+      }),
+    ).toMatchObject({
+      affected_nodes: [],
+      affected_node_count: 3,
+      isolatable: false,
+    });
+
+    expect(normalizeValveIsolationResult(valveResult)).toMatchObject({
+      affected_nodes: ["J-1", "J-2"],
+      affected_node_count: 2,
+      isolatable: true,
+    });
+  });
+
   it("prints only after assigning the report print state", async () => {
     const originalTitle = document.title;
     const print = jest

src/components/olmap/BurstSimulation/AnalysisReport.tsx

@@ -35,6 +35,7 @@ import {
   type PipeDiameterMap,
 } from "./schemePipeDiameters";
 import { SchemeRecord, ValveIsolationResult } from "./types";
+import { getAffectedNodeCount } from "./valveIsolationScope";
 import PanelEmptyState from "@components/olmap/common/PanelEmptyState";
 
 interface AnalysisReportProps {
@@ -212,6 +213,18 @@ const ReportDocument: React.FC<ReportDocumentProps> = ({
     ? valveResult
     : null;
   const duration = scheme.schemeDetail?.modify_total_duration;
+  const valveDetailRows: Array<[string, string[] | undefined]> =
+    matchedValveResult
+      ? [
+          ["已分析事故管段", matchedValveResult.accident_elements],
+          ["必关阀门", matchedValveResult.must_close_valves],
+          ["可选阀门", matchedValveResult.optional_valves],
+          ["不可用阀门", disabledValves],
+        ]
+      : [];
+  if (matchedValveResult?.isolatable) {
+    valveDetailRows.push(["受影响节点", matchedValveResult.affected_nodes]);
+  }
 
   return (
     <Box
@@ -348,7 +361,7 @@ const ReportDocument: React.FC<ReportDocumentProps> = ({
               {[
                 ["隔离结论", matchedValveResult.isolatable ? "可隔离" : "不可隔离"],
                 ["必关阀门", `${matchedValveResult.must_close_valves?.length ?? 0} 个`],
-                ["受影响节点", `${matchedValveResult.affected_nodes?.length ?? 0} 个`],
+                ["受影响节点", `${getAffectedNodeCount(matchedValveResult)} 个`],
               ].map(([label, value]) => (
                 <Paper
                   key={label}
@@ -364,20 +377,19 @@ const ReportDocument: React.FC<ReportDocumentProps> = ({
                 </Paper>
               ))}
             </Box>
-            {[
+            {valveDetailRows.map(([label, values]) => (
-              ["已分析事故管段", matchedValveResult.accident_elements],
+              <Box key={label} sx={{ breakInside: "avoid" }}>
-              ["必关阀门", matchedValveResult.must_close_valves],
-              ["可选阀门", matchedValveResult.optional_valves],
-              ["不可用阀门", disabledValves],
-              ["受影响节点", matchedValveResult.affected_nodes],
-            ].map(([label, values]) => (
-              <Box key={label as string} sx={{ breakInside: "avoid" }}>
                 <Typography sx={{ mb: 0.75, fontSize: 13, fontWeight: 700 }}>
-                  {label as string}
+                  {label}
                 </Typography>
-                <IdList values={values as string[]} />
+                <IdList values={values} />
               </Box>
             ))}
+            {!matchedValveResult.isolatable && (
+              <Alert severity="info" variant="outlined">
+                不可隔离，未生成受影响节点清单。
+              </Alert>
+            )}
           </Stack>
         ) : (
           <Alert severity="info" variant="outlined">

src/components/olmap/BurstSimulation/ValveIsolation.tsx

@@ -52,7 +52,11 @@ import {
 import { Point } from "ol/geom";
 import { toLonLat } from "ol/proj";
 import { useControllableObjectState } from "@components/olmap/core/useControllableState";
-import { isAllowedAccidentPipe } from "./valveIsolationScope";
+import {
+  getAffectedNodeCount,
+  isAllowedAccidentPipe,
+  normalizeValveIsolationResult,
+} from "./valveIsolationScope";
 
 interface ValveIsolationProps {
   initialPipeIds?: string[];
@@ -363,7 +367,7 @@ const ValveIsolation: React.FC<ValveIsolationProps> = ({
         if (disabled.length > 0) {
           params.disabled_valves = disabled;
         }
-        const response = await api.get(
+        const response = await api.get<ValveIsolationResult>(
           `${config.BACKEND_URL}/api/v1/valve-isolation-analysis`,
           {
             params,
@@ -372,7 +376,7 @@ const ValveIsolation: React.FC<ValveIsolationProps> = ({
             },
           },
         );
-        setResult(response.data);
+        setResult(normalizeValveIsolationResult(response.data));
         if (!isExpandSearch) {
           setActiveStep(1);
         } else {
@@ -711,7 +715,7 @@ const ValveIsolation: React.FC<ValveIsolationProps> = ({
             {[
               { label: "必关阀门", value: result.must_close_valves?.length || 0, color: "red", bgInfo: "from-red-50 to-red-100", textInfo: "text-red-700" },
               { label: "可选阀门", value: result.optional_valves?.length || 0, color: "orange", bgInfo: "from-orange-50 to-orange-100", textInfo: "text-orange-700" },
-              { label: "影响节点", value: result.affected_nodes?.length || 0, color: "blue", bgInfo: "from-blue-50 to-blue-100", textInfo: "text-blue-700" },
+              { label: "影响节点", value: getAffectedNodeCount(result), color: "blue", bgInfo: "from-blue-50 to-blue-100", textInfo: "text-blue-700" },
             ].map((item, index) => (
               <Box
                 key={index}
@@ -877,8 +881,14 @@ const ValveIsolation: React.FC<ValveIsolationProps> = ({
                 </Box>
               )}
 
+              {!result.isolatable && (
+                <Alert severity="info" variant="outlined">
+                  不可隔离，未生成受影响节点清单。
+                </Alert>
+              )}
+
               {/* 受影响节点 */}
-              {result.affected_nodes && result.affected_nodes.length > 0 && (
+              {result.isolatable && result.affected_nodes && result.affected_nodes.length > 0 && (
                 <Box>
                   <Box className="flex items-center justify-between mb-2">
                     <Typography variant="caption" className="text-gray-800 font-bold border-l-4 border-blue-500 pl-2">

src/components/olmap/BurstSimulation/types.ts

@@ -31,6 +31,7 @@ export interface SchemaItem {
 export interface ValveIsolationResult {
   accident_elements: string[];
   affected_nodes: string[];
+  affected_node_count?: number;
   must_close_valves: string[];
   optional_valves: string[];
   isolatable: boolean;

src/components/olmap/BurstSimulation/valveIsolationScope.ts

@@ -1,4 +1,17 @@
+import type { ValveIsolationResult } from "./types";
+
 export const isAllowedAccidentPipe = (
   pipeId: string,
   allowedPipeIds: string[] | undefined,
 ) => allowedPipeIds === undefined || allowedPipeIds.includes(pipeId);
+
+export const getAffectedNodeCount = (result: ValveIsolationResult) =>
+  result.affected_node_count ?? result.affected_nodes?.length ?? 0;
+
+export const normalizeValveIsolationResult = (
+  result: ValveIsolationResult,
+): ValveIsolationResult => ({
+  ...result,
+  affected_nodes: result.isolatable ? result.affected_nodes ?? [] : [],
+  affected_node_count: getAffectedNodeCount(result),
+});

src/components/olmap/core/Controls/Timeline.tsx

@@ -29,6 +29,8 @@ import { FiSkipBack, FiSkipForward } from "react-icons/fi";
 import { useData } from "../MapComponent";
 import { config, NETWORK_NAME } from "@/config/config";
 import { apiFetch } from "@/lib/apiFetch";
+import { permissionCodes } from "@/lib/permissions";
+import { useAccessStore } from "@/store/accessStore";
 import { useMap } from "../MapComponent";
 import {
   formatTimelineTime,
@@ -81,6 +83,9 @@ const Timeline: React.FC<TimelineProps> = ({
   schemeType = "burst_analysis",
 }) => {
   const data = useData();
+  const canRunSimulation = useAccessStore((state) =>
+    state.permissions.includes(permissionCodes.simulationRun),
+  );
   const fallbackSelectedDateRef = useRef(new Date());
   const hasTimelineState =
     data &&
@@ -926,8 +931,8 @@ const Timeline: React.FC<TimelineProps> = ({
                     </IconButton>
                   </Tooltip>
                 </Box>
+                {canRunSimulation && (
                   <Box sx={{ display: "flex", gap: 1 }} className="ml-4">
-                  {/* 强制计算时间段 */}
                     <FormControl size="small" sx={{ minWidth: 100 }}>
                       <InputLabel>计算时间段</InputLabel>
                       <Select
@@ -943,7 +948,6 @@ const Timeline: React.FC<TimelineProps> = ({
                       </Select>
                     </FormControl>
 
-                  {/* 功能按钮 */}
                     <Tooltip title="强制计算">
                       <Button
                         variant="outlined"
@@ -955,6 +959,7 @@ const Timeline: React.FC<TimelineProps> = ({
                       </Button>
                     </Tooltip>
                   </Box>
+                )}
 
                 {/* 当前时间显示 */}
                 <Typography

src/components/olmap/core/Controls/Toolbar.tsx

@@ -29,6 +29,8 @@ import { useStyleEditor } from "./useStyleEditor";
 import { config, NETWORK_NAME } from "@/config/config";
 import { useProject } from "@/contexts/ProjectContext";
 import { apiFetch } from "@/lib/apiFetch";
+import { permissionCodes } from "@/lib/permissions";
+import { useAccessStore } from "@/store/accessStore";
 
 // 添加接口定义隐藏按钮的props
 interface ToolbarProps {
@@ -94,6 +96,9 @@ const Toolbar: React.FC<ToolbarProps> = ({
   const map = useMap();
   const data = useData();
   const project = useProject();
+  const canEditNetwork = useAccessStore((state) =>
+    state.permissions.includes(permissionCodes.webgisEdit),
+  );
   const { open } = useNotification();
   const [activeTools, setActiveTools] = useState<string[]>([]);
   const [highlightFeatures, setHighlightFeatures] = useState<Feature[]>([]);
@@ -119,6 +124,15 @@ const Toolbar: React.FC<ToolbarProps> = ({
     }
   }, [enableCompare, isCompareMode, toggleCompareMode]);
 
+  useEffect(() => {
+    if (!canEditNetwork) {
+      setShowDrawPanel(false);
+      setActiveTools((previous) =>
+        previous.filter((tool) => tool !== "draw"),
+      );
+    }
+  }, [canEditNetwork]);
+
   // Chat tool action → direct featureInfos override (bypasses OL Feature lookup)
   const [chatPanelFeatureInfos, setChatPanelFeatureInfos] = useState<
     [string, string][] | null
@@ -697,7 +711,7 @@ const Toolbar: React.FC<ToolbarProps> = ({
       buildFeatureProperties(
         selectedFeature,
         computedProperties,
-        selectedValveId
+        canEditNetwork && selectedValveId
           ? {
               value: valveStatus,
               loading: isValveStatusLoading,
@@ -705,7 +719,7 @@ const Toolbar: React.FC<ToolbarProps> = ({
               onSave: handleValveStatusSave,
             }
           : undefined,
-        selectedValveId
+        canEditNetwork && selectedValveId
           ? {
               value: valveProperties.setting,
               vType: selectedValveType,
@@ -719,6 +733,7 @@ const Toolbar: React.FC<ToolbarProps> = ({
     [
       selectedFeature,
       computedProperties,
+      canEditNetwork,
       selectedValveId,
       valveStatus,
       valveProperties,
@@ -755,7 +770,7 @@ const Toolbar: React.FC<ToolbarProps> = ({
             onClick={() => handleToolClick("history")}
           />
         )}
-        {!hiddenButtons?.includes("draw") && (
+        {canEditNetwork && !hiddenButtons?.includes("draw") && (
           <ToolbarButton
             icon={<EditOutlinedIcon />}
             name="标记绘制"

src/contexts/ProjectContext.tsx

@@ -1,9 +1,26 @@
 "use client";
-import React, { createContext, useCallback, useContext, useEffect, useState } from "react";
+
 import { useSession } from "next-auth/react";
-import { config, NETWORK_NAME, setMapWorkspace, setNetworkName, setMapExtent } from "@/config/config";
+import { usePathname, useRouter } from "next/navigation";
+import React, {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useState,
+} from "react";
+
 import { ProjectSelector } from "@/components/project/ProjectSelector";
+import {
+  config,
+  NETWORK_NAME,
+  setMapExtent,
+  setMapWorkspace,
+  setNetworkName,
+} from "@/config/config";
 import { apiFetch } from "@/lib/apiFetch";
+import { permissionCodes } from "@/lib/permissions";
+import { useAccessStore } from "@/store/accessStore";
 import { useProjectStore } from "@/store/projectStore";
 
 interface ProjectContextType {
@@ -21,6 +38,11 @@ export const ProjectProvider: React.FC<{ children: React.ReactNode }> = ({
   children,
 }) => {
   const { status } = useSession();
+  const pathname = usePathname();
+  const router = useRouter();
+  const canManageEnvironment = useAccessStore((state) =>
+    state.permissions.includes(permissionCodes.environmentManage),
+  );
   const [isConfigured, setIsConfigured] = useState(false);
   const setCurrentProjectId = useProjectStore(
     (state) => state.setCurrentProjectId,
@@ -31,76 +53,69 @@ export const ProjectProvider: React.FC<{ children: React.ReactNode }> = ({
     extent: config.MAP_EXTENT,
   });
 
-  const applyConfig = useCallback(async (
+  const applyConfig = useCallback(
+    async (
       projectId: string,
-    ws: string,
+      workspace: string,
-    net: string,
+      networkName: string,
       extent: number[],
     ) => {
-    const resolvedProjectId = projectId || net || ws;
+      const resolvedProjectId = projectId || networkName || workspace;
-    setMapWorkspace(ws);
+      setMapWorkspace(workspace);
-    setNetworkName(net);
+      setNetworkName(networkName);
       setMapExtent(extent);
+      localStorage.setItem(MAP_WORKSPACE_STORAGE_KEY, workspace);
+      localStorage.setItem(NETWORK_NAME_STORAGE_KEY, networkName);
       localStorage.setItem(MAP_EXTENT_STORAGE_KEY, extent.join(","));
-    // Reset extent cache
+      localStorage.removeItem(`${workspace}_map_view`);
-    localStorage.removeItem(`${ws}_map_view`);
+      setCurrentProject({ workspace, networkName, extent });
-    setCurrentProject({ workspace: ws, networkName: net, extent: extent });
       setCurrentProjectId(resolvedProjectId);
-
-    // Save to localStorage
-    localStorage.setItem(MAP_WORKSPACE_STORAGE_KEY, ws);
-    localStorage.setItem(NETWORK_NAME_STORAGE_KEY, net);
-
       setIsConfigured(true);
 
       try {
-      // Open project backend (simulation model)
         const openResponse = await apiFetch(
-        `${config.BACKEND_URL}/api/v1/projects/open?network=${net}`,
+          `${config.BACKEND_URL}/api/v1/projects/open?network=${networkName}`,
-        {
+          { method: "POST" },
-          method: "POST",
-        },
         );
         if (!openResponse.ok) {
           throw new Error(`Failed to open project: HTTP ${openResponse.status}`);
         }
 
-      // Fetch project metadata
         const infoResponse = await apiFetch(
-        `${config.BACKEND_URL}/api/v1/project-info?network=${net}`,
+          `${config.BACKEND_URL}/api/v1/project-info?network=${networkName}`,
         );
         if (!infoResponse.ok) {
           console.warn(
             `Failed to fetch project info: HTTP ${infoResponse.status}`,
           );
-      } else {
+          return;
-        const data = await infoResponse.json();
+        }
 
-        // Update workspace if different
+        const data = await infoResponse.json();
-        if (data?.gs_workspace && data.gs_workspace !== ws) {
+        if (data?.gs_workspace && data.gs_workspace !== workspace) {
           setMapWorkspace(data.gs_workspace);
           localStorage.setItem(MAP_WORKSPACE_STORAGE_KEY, data.gs_workspace);
-          setCurrentProject((prev) => ({
+          setCurrentProject((previous) => ({
-            ...prev,
+            ...previous,
             workspace: data.gs_workspace,
           }));
         }
 
-        // Update extent if available
         const bbox = Array.isArray(data?.map_extent?.bbox)
           ? data.map_extent.bbox.map((value: number) => Number(value))
           : null;
-        if (bbox && bbox.length === 4) {
+        if (bbox?.length === 4) {
           setMapExtent(bbox);
           localStorage.setItem(MAP_EXTENT_STORAGE_KEY, bbox.join(","));
-          localStorage.removeItem(`${ws}_map_view`);
+          localStorage.removeItem(`${workspace}_map_view`);
-          setCurrentProject((prev) => ({ ...prev, extent: bbox }));
+          setCurrentProject((previous) => ({ ...previous, extent: bbox }));
-        }
         }
       } catch (error) {
         console.error("Failed to setup project:", error);
       }
-  }, [setCurrentProjectId]);
+    },
+    [setCurrentProjectId],
+  );
 
   useEffect(() => {
     // Check localStorage
@@ -120,11 +135,16 @@ export const ProjectProvider: React.FC<{ children: React.ReactNode }> = ({
     }
   }, [applyConfig]);
 
-  // Only show selector if authenticated and not configured
+  const isGlobalManagementRoute =
-  if (status === "authenticated" && !isConfigured) {
+    pathname.startsWith("/system-admin") || pathname.startsWith("/audit-logs");
+
+  if (status === "authenticated" && !isConfigured && !isGlobalManagementRoute) {
     return (
       <ProjectSelector
         open={true}
+        onClose={
+          canManageEnvironment ? () => router.push("/system-admin") : undefined
+        }
         onSelect={(projectId, ws, net, extent) =>
           applyConfig(projectId, ws, net, extent)
         }

src/lib/permissions.test.ts

@@ -0,0 +1,34 @@
+import {
+  permissionCodes,
+  permissionForPath,
+  resourcePermissions,
+} from "./permissions";
+
+describe("permission mappings", () => {
+  it("maps protected routes to backend permission codes", () => {
+    expect(permissionForPath("/system-admin")).toBe(
+      permissionCodes.environmentManage,
+    );
+    expect(permissionForPath("/scada-data-cleaning/devices")).toBe(
+      permissionCodes.scadaClean,
+    );
+    expect(permissionForPath("/monitoring-place-optimization")).toBe(
+      permissionCodes.optimizationRun,
+    );
+    expect(
+      permissionForPath("/hydraulic-simulation/burst-location"),
+    ).toBe(permissionCodes.burstRun);
+  });
+
+  it("leaves public or project-selection routes without a feature permission", () => {
+    expect(permissionForPath("/login")).toBeUndefined();
+    expect(permissionForPath("/")).toBeUndefined();
+  });
+
+  it("uses the same permission codes for resources and routes", () => {
+    expect(resourcePermissions["系统管理"]).toBe(
+      permissionCodes.environmentManage,
+    );
+    expect(resourcePermissions["审计日志"]).toBe(permissionCodes.auditView);
+  });
+});

src/lib/permissions.ts

@@ -0,0 +1,91 @@
+export const permissionCodes = {
+  webgisView: "webgis.view",
+  webgisEdit: "webgis.edit",
+  scadaView: "scada.view",
+  scadaClean: "scada.clean",
+  simulationView: "simulation.view",
+  simulationRun: "simulation.run",
+  burstView: "burst.view",
+  burstRun: "burst.run",
+  riskView: "risk.view",
+  riskRun: "risk.run",
+  optimizationView: "optimization.view",
+  optimizationRun: "optimization.run",
+  modelImport: "model.import",
+  auditView: "audit.view",
+  environmentManage: "environment.manage",
+  membershipManage: "membership.manage",
+} as const;
+
+export type PermissionCode =
+  (typeof permissionCodes)[keyof typeof permissionCodes];
+
+export type AccessContext = {
+  user_id: string;
+  username: string;
+  system_role: string;
+  is_system_admin: boolean;
+  project_id?: string | null;
+  project_role?: string | null;
+  permissions: string[];
+};
+
+export const resourcePermissions: Record<string, PermissionCode> = {
+  "管网在线模拟": permissionCodes.simulationView,
+  "SCADA 数据清洗": permissionCodes.scadaClean,
+  "监测点优化布置": permissionCodes.optimizationRun,
+  "健康风险分析": permissionCodes.riskRun,
+  "爆管模拟": permissionCodes.burstRun,
+  "爆管侦测": permissionCodes.burstRun,
+  "爆管定位": permissionCodes.burstRun,
+  "DMA 漏损识别": permissionCodes.burstRun,
+  "水质模拟": permissionCodes.simulationRun,
+  "管道冲洗": permissionCodes.simulationRun,
+  "系统管理": permissionCodes.environmentManage,
+  "审计日志": permissionCodes.auditView,
+};
+
+export const pathPermissions: Array<{
+  prefix: string;
+  permission: PermissionCode;
+}> = [
+  { prefix: "/system-admin", permission: permissionCodes.environmentManage },
+  { prefix: "/audit-logs", permission: permissionCodes.auditView },
+  { prefix: "/scada-data-cleaning", permission: permissionCodes.scadaClean },
+  {
+    prefix: "/monitoring-place-optimization",
+    permission: permissionCodes.optimizationRun,
+  },
+  { prefix: "/health-risk-analysis", permission: permissionCodes.riskRun },
+  {
+    prefix: "/hydraulic-simulation/burst-simulation",
+    permission: permissionCodes.burstRun,
+  },
+  {
+    prefix: "/hydraulic-simulation/burst-detection",
+    permission: permissionCodes.burstRun,
+  },
+  {
+    prefix: "/hydraulic-simulation/burst-location",
+    permission: permissionCodes.burstRun,
+  },
+  {
+    prefix: "/hydraulic-simulation/dma-leak-detection",
+    permission: permissionCodes.burstRun,
+  },
+  {
+    prefix: "/hydraulic-simulation/contaminant-simulation",
+    permission: permissionCodes.simulationRun,
+  },
+  {
+    prefix: "/hydraulic-simulation/flushing-analysis",
+    permission: permissionCodes.simulationRun,
+  },
+  {
+    prefix: "/network-simulation",
+    permission: permissionCodes.simulationView,
+  },
+];
+
+export const permissionForPath = (pathname: string) =>
+  pathPermissions.find(({ prefix }) => pathname.startsWith(prefix))?.permission;

src/store/accessStore.ts

@@ -0,0 +1,28 @@
+import { create } from "zustand";
+
+import type { AccessContext } from "@/lib/permissions";
+
+type AccessState = {
+  context: AccessContext | null;
+  permissions: string[];
+  loading: boolean;
+  setLoading: (loading: boolean) => void;
+  setContext: (context: AccessContext) => void;
+  reset: () => void;
+};
+
+export const useAccessStore = create<AccessState>((set) => ({
+  context: null,
+  permissions: [],
+  loading: true,
+  setLoading: (loading) => set({ loading }),
+  setContext: (context) =>
+    set({
+      context,
+      permissions: Array.isArray(context.permissions)
+        ? context.permissions
+        : [],
+      loading: false,
+    }),
+  reset: () => set({ context: null, permissions: [], loading: false }),
+}));