feat(M02-C): 建立RBAC与门店数据范围

backend/src/routes/auth.ts

@@ -4,6 +4,7 @@ import { z } from 'zod';
 import type { AuthRepository } from '../auth/auth-repository.js';
 import { signAccessToken, verifyAccessToken } from '../auth/jwt.js';
 import { WechatApiError, type WechatCodeExchange } from '../auth/wechat-client.js';
+import type { AccessProfile } from '../auth/rbac-repository.js';
 
 const headersSchema = z.object({
   'x-wechat-appid': z.string().trim().min(6).max(64),
@@ -17,6 +18,9 @@ export interface AuthRouteOptions {
   jwtSecret: string;
   accessTokenTtlSeconds: number;
   sessionTtlSeconds: number;
+  accessControl?: {
+    getAccessProfile(tenantId: string, userId: string): Promise<AccessProfile>;
+  };
 }
 
 export async function registerAuthRoutes(app: FastifyInstance, options: AuthRouteOptions): Promise<void> {
@@ -98,7 +102,14 @@ export async function registerAuthRoutes(app: FastifyInstance, options: AuthRout
   app.get('/app-api/auth/me', async (request, reply) => {
     const auth = await authenticate(request.headers.authorization, options);
     if (!auth) return unauthorized(reply, request.traceId);
-    return { code: 0, data: { user: publicUser(auth.user) }, traceId: request.traceId };
+    const access = options.accessControl
+      ? await options.accessControl.getAccessProfile(auth.user.tenantId, auth.user.id)
+      : { roles: [], capabilities: [], storeIds: [] };
+    return {
+      code: 0,
+      data: { user: publicUser(auth.user), access },
+      traceId: request.traceId
+    };
   });
 
   app.post('/app-api/auth/logout', async (request, reply) => {