多角色账号按 All > College > Class > Self 自动取最高权限。

学院管理员限制在所属学院。
辅导员通过稳定账号 ID 绑定行政班，避免重名串班。
教师只能访问本人档案、授课课程和所授课学生。
学生只能访问本人档案及所在班级课程。
教师/学生角色会自动校验并绑定工号或学号档案。
超级管理员可在用户页面调整角色、学院、工号/学号，并预览生效后的数据范围。

scripts/smoke-test.ps1

@@ -66,6 +66,15 @@ try {
     $headers = @{ Authorization = "Bearer $($login.token)" }
     $dashboard = Invoke-RestMethod -Uri 'http://localhost:5255/api/dashboard' -Headers $headers
     $campuses = Invoke-RestMethod -Uri 'http://localhost:5255/api/base-data/campuses' -Headers $headers
+    $classes = Invoke-RestMethod -Uri 'http://localhost:5255/api/base-data/classes' -Headers $headers
+    $counselors = Invoke-RestMethod -Uri 'http://localhost:5255/api/base-data/counselors' -Headers $headers
+    $assignedClassCount = @($classes | Where-Object {
+        $null -ne $_.counselorUserId -and
+        @($counselors).id -contains $_.counselorUserId
+    }).Count
+    if ($assignedClassCount -lt 1) {
+        throw 'No administrative class is linked to a counselor account.'
+    }
     $teachers = Invoke-RestMethod -Uri 'http://localhost:5255/api/personnel/teachers?page=1&pageSize=10' -Headers $headers
     $students = Invoke-RestMethod -Uri 'http://localhost:5255/api/personnel/students?page=1&pageSize=10' -Headers $headers
     $courses = Invoke-RestMethod -Uri 'http://localhost:5255/api/courses?page=1&pageSize=10' -Headers $headers
@@ -82,6 +91,77 @@ try {
             -Uri "http://localhost:5255/api/schedules/plans/$($schedulePlans[0].id)" `
             -Headers $headers
     }
+    $managedUsers = Invoke-RestMethod -Uri 'http://localhost:5255/api/users' -Headers $headers
+    $teacherAccount = @($managedUsers) |
+        Where-Object { $_.userName -eq 'teacher' } |
+        Select-Object -First 1
+    if ($null -eq $teacherAccount) {
+        throw 'Development teacher account was not seeded.'
+    }
+    $teacherAccessBody = @{
+        staffNumber = $teacherAccount.staffNumber
+        collegeId = $teacherAccount.collegeId
+        roles = @('Teacher')
+    } | ConvertTo-Json
+    Invoke-RestMethod `
+        -Method Put `
+        -Uri "http://localhost:5255/api/users/$($teacherAccount.id)/roles" `
+        -Headers $headers `
+        -ContentType 'application/json' `
+        -Body $teacherAccessBody
+
+    $scopeScenarios = @(
+        @{
+            UserName = 'college'; Password = 'College@123456'; Scope = 'College'
+            Teachers = 2; Students = 3; Courses = 3
+        },
+        @{
+            UserName = 'counselor'; Password = 'Counselor@123456'; Scope = 'Class'
+            Teachers = 1; Students = 3; Courses = 1
+        },
+        @{
+            UserName = 'teacher'; Password = 'Teacher@123456'; Scope = 'Self'
+            Teachers = 1; Students = 3; Courses = 1
+        },
+        @{
+            UserName = 'student'; Password = 'Student@123456'; Scope = 'Self'
+            Teachers = 0; Students = 1; Courses = 1
+        }
+    )
+    $scopeChecks = foreach ($scenario in $scopeScenarios) {
+        $scenarioLoginBody = @{
+            userName = $scenario.UserName
+            password = $scenario.Password
+        } | ConvertTo-Json
+        $scenarioLogin = Invoke-RestMethod `
+            -Method Post `
+            -Uri 'http://localhost:5255/api/auth/login' `
+            -ContentType 'application/json' `
+            -Body $scenarioLoginBody
+        $scenarioHeaders = @{ Authorization = "Bearer $($scenarioLogin.token)" }
+        $scenarioTeachers = Invoke-RestMethod `
+            -Uri 'http://localhost:5255/api/personnel/teachers?page=1&pageSize=10' `
+            -Headers $scenarioHeaders
+        $scenarioStudents = Invoke-RestMethod `
+            -Uri 'http://localhost:5255/api/personnel/students?page=1&pageSize=10' `
+            -Headers $scenarioHeaders
+        $scenarioCourses = Invoke-RestMethod `
+            -Uri 'http://localhost:5255/api/courses?page=1&pageSize=10' `
+            -Headers $scenarioHeaders
+        if ($scenarioLogin.user.effectiveDataScope -ne $scenario.Scope -or
+            $scenarioTeachers.total -ne $scenario.Teachers -or
+            $scenarioStudents.total -ne $scenario.Students -or
+            $scenarioCourses.total -ne $scenario.Courses) {
+            throw ("Data-scope check failed for {0}: scope={1}, teachers={2}, students={3}, courses={4}." -f
+                $scenario.UserName,
+                $scenarioLogin.user.effectiveDataScope,
+                $scenarioTeachers.total,
+                $scenarioStudents.total,
+                $scenarioCourses.total)
+        }
+        "$($scenario.UserName):$($scenario.Scope)"
+    }
+
     $frontend = Invoke-WebRequest -Uri 'http://localhost:5255/' -TimeoutSec 5
     $spaFallback = Invoke-WebRequest -Uri 'http://localhost:5255/base-data' -TimeoutSec 5
     $unknownApiParameters = @{
@@ -97,6 +177,7 @@ try {
         User         = $login.user.displayName
         Term         = $dashboard.currentTerm.name
         Campuses     = @($campuses).Count
+        CounselorAssignments = $assignedClassCount
         Teachers     = $teachers.total
         Students     = $students.total
         Courses      = $courses.total
@@ -105,6 +186,8 @@ try {
         TeachingTasks = $teachingTasks.total
         Schedules     = @($schedulePlans).Count
         ScheduleEntries = if ($null -ne $scheduleDetail) { @($scheduleDetail.entries).Count } else { 0 }
+        AccessUpdate  = $true
+        ScopeChecks   = $scopeChecks -join ', '
         StaticIndex  = $frontend.Content.Contains('明序教务管理系统')
         SpaFallback  = $spaFallback.StatusCode
         ApiNotFound  = $unknownApi.StatusCode