From c9ad084f780ce3588e09997eb2e176e49d93117e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=8E=8B=E5=BE=B7=E5=AE=87?= <kvtodev@outlook.com>
Date: Sat, 3 Oct 2026 17:36:43 +0800
Subject: [PATCH] =?UTF-8?q?fix(=E5=90=8E=E5=8F=B0=E6=9D=83=E9=99=90):=20?=
 =?UTF-8?q?=E8=A1=A5=E4=B8=8A=20membership-plans=20Tab=20=E6=8E=88?=
 =?UTF-8?q?=E6=9D=83?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- ADMIN_TAB_PERMISSIONS 增加 membership-plans 并把数组长度改为 22，使非 owner 管理员可被授予会员档位页权限，修复该页接口对普通管理员恒 403。
- every_assignable_admin_tab_has_a_backend_route 增加断言：路由使用的每个 Tab 必须登记在 ADMIN_TAB_PERMISSIONS。
---
 server-rs/crates/api-server/src/admin.rs       | 9 +++++++--
 server-rs/crates/shared-contracts/src/admin.rs | 3 ++-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/server-rs/crates/api-server/src/admin.rs b/server-rs/crates/api-server/src/admin.rs
index 3ca5513e3..22dae19e1 100644
--- a/server-rs/crates/api-server/src/admin.rs
+++ b/server-rs/crates/api-server/src/admin.rs
@@ -5091,8 +5091,9 @@ mod tests {
     };
     use serde_json::{Value, json};
     use shared_contracts::admin::{
-        AdminConfirmEditorShowcaseCampaignImageUploadRequest, AdminDashboardQuery,
-        AdminDatabaseTableRowsQuery, AdminExternalApiKeyListQuery, AdminTrackingEventListQuery,
+        ADMIN_TAB_PERMISSIONS, AdminConfirmEditorShowcaseCampaignImageUploadRequest,
+        AdminDashboardQuery, AdminDatabaseTableRowsQuery, AdminExternalApiKeyListQuery,
+        AdminTrackingEventListQuery,
     };
     use shared_contracts::assets::{ConfirmAssetObjectAccessPolicy, GetReadUrlQuery};
     use spacetime_client::{
@@ -7474,6 +7475,10 @@ mod tests {
         ];
 
         for (permission, method, path) in cases {
+            assert!(
+                ADMIN_TAB_PERMISSIONS.contains(&permission),
+                "{permission} 未登记在 ADMIN_TAB_PERMISSIONS，非 owner 管理员无法被授予该 Tab"
+            );
             assert!(
                 enforce_admin_request_permission(
                     "member",
diff --git a/server-rs/crates/shared-contracts/src/admin.rs b/server-rs/crates/shared-contracts/src/admin.rs
index c74dd79e1..4db72aecc 100644
--- a/server-rs/crates/shared-contracts/src/admin.rs
+++ b/server-rs/crates/shared-contracts/src/admin.rs
@@ -10,7 +10,7 @@ use crate::creation_entry_config::{
 };
 
 /// 后台 member 可被授予的一级 Tab 权限；账号管理仅 owner 可见，不进入该集合。
-pub const ADMIN_TAB_PERMISSIONS: [&str; 21] = [
+pub const ADMIN_TAB_PERMISSIONS: [&str; 22] = [
     "dashboard",
     "overview",
     "tables",
@@ -23,6 +23,7 @@ pub const ADMIN_TAB_PERMISSIONS: [&str; 21] = [
     "profile-wallet",
     "tasks",
     "recharge-products",
+    "membership-plans",
     "recharge-orders",
     "editor-generation-pricing",
     "editor-showcase",