fix: 权限固定为全局

src/Application/TakeoutSaaS.Application/Identity/Handlers/CreatePermissionCommandHandler.cs

@@ -3,6 +3,8 @@ using TakeoutSaaS.Application.Identity.Commands;
 using TakeoutSaaS.Application.Identity.Contracts;
 using TakeoutSaaS.Domain.Identity.Entities;
 using TakeoutSaaS.Domain.Identity.Repositories;
+using TakeoutSaaS.Shared.Abstractions.Constants;
+using TakeoutSaaS.Shared.Abstractions.Exceptions;
 using TakeoutSaaS.Shared.Abstractions.Tenancy;
 
 namespace TakeoutSaaS.Application.Identity.Handlers;
@@ -23,10 +25,16 @@ public sealed class CreatePermissionCommandHandler(
     /// <returns>创建后的权限 DTO。</returns>
     public async Task<PermissionDto> Handle(CreatePermissionCommand request, CancellationToken cancellationToken)
     {
-        // 1. 获取租户上下文
+        // 1. 权限固定时禁止新增
+        if (!PermissionPolicy.CanMaintainPermissions)
+        {
+            throw new BusinessException(ErrorCodes.Forbidden, "权限已固定，禁止新增");
+        }
+
+        // 2. 获取租户上下文
         var tenantId = tenantProvider.GetCurrentTenantId();
 
-        // 2. 构建权限实体
+        // 3. 构建权限实体
         var normalizedType = string.IsNullOrWhiteSpace(request.Type)
             ? "leaf"
             : request.Type.Trim().ToLowerInvariant();
@@ -44,11 +52,11 @@ public sealed class CreatePermissionCommandHandler(
             Description = request.Description
         };
 
-        // 3. 持久化
+        // 4. 持久化
         await permissionRepository.AddAsync(permission, cancellationToken);
         await permissionRepository.SaveChangesAsync(cancellationToken);
 
-        // 4. 返回 DTO
+        // 5. 返回 DTO
         return new PermissionDto
         {
             Id = permission.Id,