修复root平台账户编辑角色误提交

frontend/platform_admin/scripts/check-resource-display-contracts.mjs

@@ -21,6 +21,7 @@ function assertIncludes(source, expected, message) {
 const resources = read('src/api/resources.ts');
 const display = read('src/api/resource-display.ts');
 const detailContract = read('src/api/resource-detail-contract.ts');
+const pageRules = read('src/api/resource-page-rules.ts');
 const detailPage = read('src/views/resource/ResourceDetailContent.vue');
 const listPage = read('src/views/shared/CrudListPage.vue');
 const listFieldDisplay = read('src/views/shared/resource-list-field-display.ts');
@@ -388,6 +389,17 @@ assertIncludes(
   "f('phone', { emptyText: '未填写' })",
   '平台账户联系电话为空时必须显示业务文案',
 );
+for (const rootAccountContract of [
+  "String(row.platform_role_code ?? '') === 'root'",
+  "visibleKeys.add('platform_role_code')",
+  "isProtectedPlatformRootAccount(definition, row)",
+]) {
+  assertIncludes(
+    pageRules,
+    rootAccountContract,
+    `root 平台账户缺少角色只读保护契约：${rootAccountContract}`,
+  );
+}
 assertIncludes(
   detailPage,
   '!hasResourceFieldLabel(props.definition, actualKey)',

frontend/platform_admin/src/api/resource-page-rules.ts

@@ -193,6 +193,17 @@ const ownerKeys: Record<string, string[]> = {
   gasorder_contract: ['user_account_identity', 'gas_basic_identity'],
 };
 
+/** 判断目标是否为受保护的 root 平台账户。 */
+function isProtectedPlatformRootAccount(
+  definition: ResourceUiDefinition,
+  row: ResourceRow,
+) {
+  return (
+    definition.name === 'platform_account' &&
+    String(row.platform_role_code ?? '') === 'root'
+  );
+}
+
 /** 返回当前模式需要展示的字段；编辑页会保留不可变字段但将其设为只读。 */
 export function pageFields(
   definition: ResourceUiDefinition,
@@ -210,7 +221,11 @@ export function pageFields(
   if (definition.name === 'product_repair' && row.result !== 'pending') {
     editableKeys = ['remark'];
   }
-  if (definition.name === 'platform_account' && context.role !== 'root') {
+  const protectedRootAccount = isProtectedPlatformRootAccount(definition, row);
+  if (
+    definition.name === 'platform_account' &&
+    (context.role !== 'root' || protectedRootAccount)
+  ) {
     editableKeys = editableKeys.filter((key) => key !== 'platform_role_code');
   }
   const visibleKeys = new Set([
@@ -229,6 +244,8 @@ export function pageFields(
       )
       .map((field) => field.key),
   ]);
+  // root 角色保持可见但只读，避免管理员误以为账户没有关联角色。
+  if (protectedRootAccount) visibleKeys.add('platform_role_code');
   return definition.fields.filter(
     (field) =>
       visibleKeys.has(field.key) &&
@@ -246,7 +263,11 @@ export function editableFields(
   let keys = rule?.editKeys ?? definition.fields.map((field) => field.key);
   if (definition.name === 'product_repair' && row.result !== 'pending')
     keys = ['remark'];
-  if (definition.name === 'platform_account' && context.role !== 'root') {
+  if (
+    definition.name === 'platform_account' &&
+    (context.role !== 'root' ||
+      isProtectedPlatformRootAccount(definition, row))
+  ) {
     keys = keys.filter((key) => key !== 'platform_role_code');
   }
   const allowed = new Set(keys);