fix(agent-assets): allow admin access to platform rules

server/tests/test_agent_asset_tenant_security.py

@@ -21,7 +21,7 @@ from app.models.agent_asset import AgentAsset, AgentAssetTestRun, AgentAssetVers
 from app.models.financial_record import ExpenseClaim
 from app.models.tenant import Tenant
 from app.schemas.agent_asset import AgentAssetRiskRuleScenarioTestRequest
-from app.services.agent_asset_access import stable_user_principal
+from app.services.agent_asset_access import AgentAssetAccessScope, stable_user_principal
 from app.services.agent_asset_onlyoffice_security import (
     AgentAssetOnlyOfficeSessionService,
 )
@@ -173,6 +173,43 @@ def test_asset_reads_are_authenticated_and_tenant_scoped() -> None:
     assert anonymous.status_code == 401
 
 
+def test_platform_tenant_scope_requires_real_admin_and_is_platform_only() -> None:
+    non_admin = CurrentUserContext(
+        username="platform-manager",
+        name="平台经理",
+        role_codes=["manager"],
+        is_admin=False,
+        tenant_id="platform",
+    )
+    with pytest.raises(PermissionError, match="有效租户"):
+        AgentAssetAccessScope.from_user(non_admin)
+
+    platform_admin = CurrentUserContext(
+        username="platform-admin",
+        name="平台管理员",
+        role_codes=["manager"],
+        is_admin=True,
+        tenant_id="platform",
+    )
+    access_scope = AgentAssetAccessScope.from_user(platform_admin)
+
+    factory = _factory()
+    with factory() as db:
+        assets = _seed(db)
+        visible_assets = list(
+            db.scalars(
+                select(AgentAsset).where(access_scope.visibility_clause(AgentAsset))
+            ).all()
+        )
+
+        assert [asset.id for asset in visible_assets] == [assets["platform"].id]
+        assert access_scope.can_write(assets["platform"]) is True
+        assert access_scope.can_write(assets["tenant-a"]) is False
+        access_scope.require_write(assets["platform"])
+        with pytest.raises(LookupError, match="Asset not found"):
+            access_scope.require_write(assets["tenant-a"])
+
+
 def test_version_write_uses_stable_principal_and_blocks_cross_tenant_or_platform() -> None:
     factory = _factory()
     with factory() as db: