- Gate 智能调度 module on BI-SCHEDULE-OPT role (or full-access roles)
via shared canAccessScheduling helper, replacing hardcoded userId allowlist
- Thread roles[] through JWT payload → middleware → frontend nav
- Add router guard that 403s non-authorized users on /api/scheduling/*
- Emit replace_qualified suggestion for every qualified vehicle so list
count matches the 已完成考核目标 card; recalc qualifiedCount /
hopelessCount post-permission-filter for card↔list consistency
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Disable BYPASS_AUTH (was true, now false) — backend enforces JWT auth
- Scheduling suggestions filtered by department/manager permissions:
- full: see all suggestions
- department: see only own department's vehicles
- personal: see only own managed vehicles
- Candidate vehicles (inventory) remain fully visible to all
- Summary recalculated after permission filtering
- Consistent with mileage module permission model
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
