From 377be6492ad5c9c4041b015f1d70f267a68199c5 Mon Sep 17 00:00:00 2001
From: Ed1s0nZ <zhaoyf1104@gmail.com>
Date: Tue, 8 Sep 2026 15:15:18 +0800
Subject: [PATCH] fix: refresh navigation permissions before login and on
 scoped renders

---
 web/static/js/auth.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/web/static/js/auth.js b/web/static/js/auth.js
index af874736..4245bfd5 100644
--- a/web/static/js/auth.js
+++ b/web/static/js/auth.js
@@ -47,6 +47,7 @@ function clearAuthStorage() {
     authRoles = [];
     authPermissions = new Set();
     authScope = '';
+    applyRBACToUI();
     try {
         localStorage.removeItem(AUTH_STORAGE_KEY);
     } catch (error) {
@@ -505,6 +506,12 @@ function installPermissionClickGuard() {
 function applyRBACToUI(root) {
     installPermissionClickGuard();
     document.querySelectorAll('[data-page]').forEach((el) => {
+        // Navigation permissions must also be refreshed during scoped renders.
+        // Explicit rules take precedence over the fallback page permission map.
+        if (el.hasAttribute('data-require-permission') || el.hasAttribute('data-require-permission-any')) {
+            applyPermissionElement(el);
+            return;
+        }
         const page = el.getAttribute('data-page');
         const permission = PAGE_PERMISSION_MAP[page];
         if (!permission) return;