From 92228a3fdbd8021f7556f12ec9fd5c42a5899cc0 Mon Sep 17 00:00:00 2001
From: aiyimickey <39365912+aiyimickey@users.noreply.github.com>
Date: Wed, 1 Jul 2026 23:51:09 +0800
Subject: [PATCH] =?UTF-8?q?docs:=20=E6=9B=B4=E6=96=B0=20todolist=20+=20LES?=
 =?UTF-8?q?SONS-LEARNED=20#34-38?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/app/api/admin/roles/route.ts | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/app/api/admin/roles/route.ts b/src/app/api/admin/roles/route.ts
index f1afee1..c74ed51 100644
--- a/src/app/api/admin/roles/route.ts
+++ b/src/app/api/admin/roles/route.ts
@@ -17,15 +17,17 @@ export async function GET(request: NextRequest) {
   // 返回所有权限定义 + 各角色的权限映射
   const rolePermissions = dbQuery<{ role: string; permission_key: string }>('SELECT role, permission_key FROM role_permissions')
   const roles = ['admin', 'editor', 'viewer']
+  const permKeys = PERMISSIONS.map(p => p.key)
+
   const result = roles.map(role => ({
     role,
     permissions: PERMISSIONS.map(p => ({
-      key: p,
-      enabled: role === 'admin' || rolePermissions.some(rp => rp.role === role && rp.permission_key === p),
+      key: p.key,
+      enabled: role === 'admin' || rolePermissions.some(rp => rp.role === role && rp.permission_key === p.key),
     })),
   }))
 
-  return NextResponse.json({ roles: result, allPermissions: PERMISSIONS })
+  return NextResponse.json({ roles: result, allPermissions: permKeys })
 }
 
 export async function PUT(request: NextRequest) {