fix(auth): bind admins to enterprise tenant context

web/src/utils/accessControl.js

@@ -63,6 +63,10 @@ function normalizedGrade(user) {
   return String(user?.grade || user?.employeeGrade || '').trim().toUpperCase()
 }
 
+function normalizedTenantId(user) {
+  return String(user?.tenantId || user?.tenant_id || '').trim()
+}
+
 function departmentIntersects(request, user) {
   const requestDepartments = collectIdentityNames(
     request?.dept,
@@ -234,6 +238,10 @@ export function canAccessAppView(user, viewId) {
     return false
   }
 
+  if (viewId === 'employees' && normalizedTenantId(user) === 'platform') {
+    return false
+  }
+
   if (viewId === 'budget') {
     if (isPlatformAdminUser(user)) {
       return true

web/tests/accessControl.test.mjs

@@ -98,6 +98,34 @@ test('platform admin users do not enter the personal workbench', () => {
   )
 })
 
+test('platform workspace hides the enterprise employee directory', () => {
+  const platformAdmin = {
+    username: 'admin',
+    isAdmin: true,
+    tenantId: 'platform',
+    roleCodes: ['manager']
+  }
+  const enterpriseAdmin = {
+    username: 'admin',
+    isAdmin: true,
+    tenantId: 'default',
+    roleCodes: ['manager']
+  }
+
+  assert.equal(canAccessAppView(platformAdmin, 'employees'), false)
+  assert.equal(canAccessAppView(enterpriseAdmin, 'employees'), true)
+  assert.deepEqual(
+    filterNavItemsByAccess(
+      [
+        { id: 'employees', label: '员工管理' },
+        { id: 'settings', label: '系统设置' }
+      ],
+      platformAdmin
+    ).map((item) => item.id),
+    ['settings']
+  )
+})
+
 test('budget center is visible to platform admin, budget monitor, and executive roles only', () => {
   assert.equal(canAccessAppView({ isAdmin: true, roleCodes: ['manager'] }, 'budget'), true)
   assert.equal(canAccessAppView({ username: 'admin', roleCodes: ['manager'] }, 'budget'), true)