feat: restrict permission roles

middleware/auth.go

@@ -111,7 +111,7 @@ func AdminMiddleware() gin.HandlerFunc {
 	}
 }
 
-// TechnicianMiddleware 技术员权限中间件（放行 admin 和 technician）
+// TechnicianMiddleware 工单处理权限中间件（放行 admin 和可派单角色）
 func TechnicianMiddleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		user, exists := c.Get("user")
@@ -123,7 +123,7 @@ func TechnicianMiddleware() gin.HandlerFunc {
 		}
 
 		userModel := user.(models.User)
-		if userModel.Role != "admin" && userModel.Role != "technician" {
+		if !models.HasWorkOrderAccess(userModel.Role) {
 			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
 				"message": "无权限访问此资源",
 			})