feat(auth,plugin): Q3 行级数据权限 — user_departments 表 + JWT 注入 department_ids + data_scope 接线

- 新增 user_departments 关联表（migration + entity）
- JWT 中间件查询用户部门并注入 TenantContext.department_ids
- role_permission entity 添加 data_scope 字段
- data_handler 接线行级数据权限过滤（list/count/aggregate）
- DataScopeParams + build_scope_sql + merge_scope_condition 实现全链路

crates/erp-server/migration/src/lib.rs

@@ -36,6 +36,7 @@ mod m20260417_000033_create_plugins;
 mod m20260417_000034_seed_plugin_permissions;
 mod m20260418_000035_pg_trgm_and_entity_columns;
 mod m20260418_000036_add_data_scope_to_role_permissions;
+mod m20260419_000037_create_user_departments;
 
 pub struct Migrator;
 
@@ -79,6 +80,7 @@ impl MigratorTrait for Migrator {
             Box::new(m20260417_000034_seed_plugin_permissions::Migration),
             Box::new(m20260418_000035_pg_trgm_and_entity_columns::Migration),
             Box::new(m20260418_000036_add_data_scope_to_role_permissions::Migration),
+            Box::new(m20260419_000037_create_user_departments::Migration),
         ]
     }
 }

crates/erp-server/migration/src/m20260419_000037_create_user_departments.rs

@@ -0,0 +1,98 @@
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .create_table(
+                Table::create()
+                    .table(Alias::new("user_departments"))
+                    .if_not_exists()
+                    .col(
+                        ColumnDef::new(Alias::new("user_id"))
+                            .uuid()
+                            .not_null(),
+                    )
+                    .col(
+                        ColumnDef::new(Alias::new("department_id"))
+                            .uuid()
+                            .not_null(),
+                    )
+                    .col(
+                        ColumnDef::new(Alias::new("tenant_id"))
+                            .uuid()
+                            .not_null(),
+                    )
+                    .col(
+                        ColumnDef::new(Alias::new("is_primary"))
+                            .boolean()
+                            .not_null()
+                            .default(false),
+                    )
+                    .col(
+                        ColumnDef::new(Alias::new("created_at"))
+                            .timestamp_with_time_zone()
+                            .not_null()
+                            .default(Expr::current_timestamp()),
+                    )
+                    .col(
+                        ColumnDef::new(Alias::new("updated_at"))
+                            .timestamp_with_time_zone()
+                            .not_null()
+                            .default(Expr::current_timestamp()),
+                    )
+                    .col(ColumnDef::new(Alias::new("created_by")).uuid())
+                    .col(ColumnDef::new(Alias::new("updated_by")).uuid())
+                    .col(ColumnDef::new(Alias::new("deleted_at")).timestamp_with_time_zone())
+                    .col(
+                        ColumnDef::new(Alias::new("version"))
+                            .integer()
+                            .not_null()
+                            .default(1),
+                    )
+                    .primary_key(
+                        Index::create()
+                            .col(Alias::new("user_id"))
+                            .col(Alias::new("department_id")),
+                    )
+                    .to_owned(),
+            )
+            .await?;
+
+        // 索引：按租户 + 用户查询部门
+        manager
+            .create_index(
+                Index::create()
+                    .if_not_exists()
+                    .name("idx_user_departments_tenant_user")
+                    .table(Alias::new("user_departments"))
+                    .col(Alias::new("tenant_id"))
+                    .col(Alias::new("user_id"))
+                    .to_owned(),
+            )
+            .await?;
+
+        // 索引：按部门查询成员
+        manager
+            .create_index(
+                Index::create()
+                    .if_not_exists()
+                    .name("idx_user_departments_dept")
+                    .table(Alias::new("user_departments"))
+                    .col(Alias::new("department_id"))
+                    .to_owned(),
+            )
+            .await?;
+
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_table(Table::drop().table(Alias::new("user_departments")).to_owned())
+            .await
+    }
+}

crates/erp-server/src/main.rs

@@ -426,10 +426,14 @@ async fn main() -> anyhow::Result<()> {
             state.clone(),
             middleware::rate_limit::rate_limit_by_user,
         ))
-        .layer(axum_middleware::from_fn(move |req, next| {
-            let secret = jwt_secret.clone();
-            async move { jwt_auth_middleware_fn(secret, req, next).await }
-        }))
+        .layer({
+            let db = state.db.clone();
+            axum_middleware::from_fn(move |req, next| {
+                let secret = jwt_secret.clone();
+                let db = db.clone();
+                async move { jwt_auth_middleware_fn(secret, Some(db), req, next).await }
+            })
+        })
         .with_state(state.clone());
 
     // Merge public + protected into the final application router