From 5571dcc511b87ec9564d4cb3f6813d8f0c2b1790 Mon Sep 17 00:00:00 2001
From: LanQin_ <lanqinnet@qq.com>
Date: Mon, 22 Jun 2026 15:02:25 +0800
Subject: [PATCH] =?UTF-8?q?fix(app):=20=E6=B8=85=E7=90=86=E6=97=A7?=
 =?UTF-8?q?=E7=89=88=E7=B3=BB=E7=BB=9F=E6=9D=83=E9=99=90=E7=BB=84?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 将旧版默认权限组 ID 纳入清理列表，确保初始化时自动删除遗留数据。
- 补充测试验证旧版权限组会在默认权限组修复流程中被移除。
---
 apps/api/internal/app/app_test.go    | 31 ++++++++++++++++++++++++++++
 apps/api/internal/app/permissions.go |  4 ++++
 2 files changed, 35 insertions(+)

diff --git a/apps/api/internal/app/app_test.go b/apps/api/internal/app/app_test.go
index afd3df5..ced3146 100644
--- a/apps/api/internal/app/app_test.go
+++ b/apps/api/internal/app/app_test.go
@@ -1174,6 +1174,37 @@ func TestFixedRolesProtectAdminRoutesAndDefaultAdmin(t *testing.T) {
 	}
 }
 
+func TestLegacySystemPermissionGroupsAreCleanedUp(t *testing.T) {
+	a := newTestApp(t)
+	ctx := context.Background()
+	now := time.Now().UTC().Format(time.RFC3339Nano)
+	legacyIDs := []string{
+		"pg_permission_manager",
+		"pg_user_manager",
+		"pg_system_operator",
+		"pg_mail_operator",
+	}
+
+	for _, groupID := range legacyIDs {
+		if _, err := a.db.ExecContext(ctx, `INSERT INTO permission_groups(id,name,description,permissions_json,system,created_at,updated_at)
+			VALUES(?,?,?,?,1,?,?)`, groupID, "Legacy "+groupID, "", "[]", now, now); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := a.ensureDefaultPermissionGroups(ctx); err != nil {
+		t.Fatal(err)
+	}
+	for _, groupID := range legacyIDs {
+		var count int
+		if err := a.db.QueryRowContext(ctx, `SELECT COUNT(*) FROM permission_groups WHERE id=?`, groupID).Scan(&count); err != nil {
+			t.Fatal(err)
+		}
+		if count != 0 {
+			t.Fatalf("legacy permission group %s was not removed", groupID)
+		}
+	}
+}
+
 func TestMaildirSyncImportsRFC822(t *testing.T) {
 	a := newTestApp(t)
 	ctx := context.Background()
diff --git a/apps/api/internal/app/permissions.go b/apps/api/internal/app/permissions.go
index 31aa178..f369b41 100644
--- a/apps/api/internal/app/permissions.go
+++ b/apps/api/internal/app/permissions.go
@@ -79,6 +79,10 @@ const (
 )
 
 var legacyDefaultPermissionGroupIDs = []string{
+	"pg_permission_manager",
+	"pg_user_manager",
+	"pg_system_operator",
+	"pg_mail_operator",
 	PermissionGroupUserAdmin,
 	PermissionGroupPermissionAdmin,
 	PermissionGroupDomainAdmin,