feat(server): 统一课表解析并完善权限范围与年度升级

packages/server/src/lib/permission-scope.ts

@@ -0,0 +1,32 @@
+import { prisma } from './db.js';
+import type { TokenPayload } from './jwt.js';
+import type { Prisma } from '../generated/prisma/client.js';
+import type { PermissionKey } from '@classhelper/shared';
+
+/** 范围与功能键正交；显式分组覆盖角色默认，不在范围内一律不放行。 */
+export async function teacherScopeWhere(
+  user: TokenPayload,
+  permission?: PermissionKey,
+): Promise<Prisma.ClassWhereInput> {
+  const assignments = await prisma.userPermissionGroup.findMany({
+    where: { userId: user.sub },
+    include: { group: { include: { items: true } } },
+  });
+  const own = { OR: [{ teacherId: user.sub }, { courses: { some: { teacherId: user.sub } } }] };
+  if (!assignments.length) return own;
+  const alternatives: Prisma.ClassWhereInput[] = [];
+  for (const { group } of assignments) {
+    if (permission && !group.items.some((item) => item.key === permission)) continue;
+    if (group.scope === 'ALL') return {};
+    if (group.scope === 'SELF_CLASS')
+      alternatives.push(group.scopeValue === 'HEAD' ? { teacherId: user.sub } : own);
+    if (group.scope === 'GRADE' || group.scope === 'DIVISION') {
+      const grades = group.scopeValue
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+      if (grades.length) alternatives.push({ grade: { in: grades } });
+    }
+  }
+  return { OR: alternatives };
+}