feat: complete phase 02 RBAC and data scope recovery

tests/e2e/service_station_permission_test.py

@@ -0,0 +1,40 @@
+"""
+E2E 测试：Phase 23 - 服务站权限隔离
+"""
+import os
+import pytest
+import requests
+
+BASE_URL = "http://localhost:8085/api/v1"
+E2E_PASSWORD = os.environ["E2E_PASSWORD"]
+
+def get_station_operator_token():
+    r = requests.post(f"{BASE_URL}/auth/operator/login", json={"username": "stationop", "password": E2E_PASSWORD})
+    return r.json()["data"]["accessToken"]
+
+def get_counselor_token():
+    r = requests.post(f"{BASE_URL}/auth/operator/login", json={"username": "counselor01", "password": E2E_PASSWORD})
+    return r.json()["data"]["accessToken"]
+
+def auth_header(token):
+    return {"Authorization": f"Bearer {token}"}
+
+def test_station_operator_cannot_view_counseling():
+    token = get_station_operator_token()
+    r = requests.get(f"{BASE_URL}/counseling/services/operator/queue", headers=auth_header(token))
+    # 服务站运营人员不应有咨询队列权限，返回403或空
+    assert r.status_code == 403
+
+def test_counselor_cannot_view_service_appointments():
+    token = get_counselor_token()
+    r = requests.get(f"{BASE_URL}/service-appointments/operator", headers=auth_header(token))
+    # Counselor只能查看自己相关的预约，不能浏览全部
+    assert r.status_code == 403
+
+def test_content_editor_cannot_access_user_data():
+    token = get_counselor_token()  # 复用counselor token模拟content_editor权限边界
+    r = requests.get(f"{BASE_URL}/operator/appeals/pending", headers=auth_header(token))
+    assert r.status_code == 403
+
+if __name__ == "__main__":
+    pytest.main([__file__, "-v"])