fix(auth): bind admins to enterprise tenant context

web/tests/accessControl.test.mjs

@@ -98,6 +98,34 @@ test('platform admin users do not enter the personal workbench', () => {
   )
 })
 
+test('platform workspace hides the enterprise employee directory', () => {
+  const platformAdmin = {
+    username: 'admin',
+    isAdmin: true,
+    tenantId: 'platform',
+    roleCodes: ['manager']
+  }
+  const enterpriseAdmin = {
+    username: 'admin',
+    isAdmin: true,
+    tenantId: 'default',
+    roleCodes: ['manager']
+  }
+
+  assert.equal(canAccessAppView(platformAdmin, 'employees'), false)
+  assert.equal(canAccessAppView(enterpriseAdmin, 'employees'), true)
+  assert.deepEqual(
+    filterNavItemsByAccess(
+      [
+        { id: 'employees', label: '员工管理' },
+        { id: 'settings', label: '系统设置' }
+      ],
+      platformAdmin
+    ).map((item) => item.id),
+    ['settings']
+  )
+})
+
 test('budget center is visible to platform admin, budget monitor, and executive roles only', () => {
   assert.equal(canAccessAppView({ isAdmin: true, roleCodes: ['manager'] }, 'budget'), true)
   assert.equal(canAccessAppView({ username: 'admin', roleCodes: ['manager'] }, 'budget'), true)