fix(platform): protect system role menus

backend/api/internal/logic/platform/role.go

@@ -11,6 +11,8 @@ import (
 	"gorm.io/gorm"
 )
 
+var errSystemPlatformRole = errors.New("system platform roles cannot be modified")
+
 // ListPlatformRole 查询平台角色分页列表。
 func ListPlatformRole(ctx *gin.Context) { listPage[models.PlatformRole](ctx) }
 
@@ -108,6 +110,9 @@ func ReplacePlatformRoleMenus(ctx *gin.Context) {
 		if err := transaction.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
 			return err
 		}
+		if role.IsSystem {
+			return errSystemPlatformRole
+		}
 		var menus []models.PlatformMenu
 		if len(request.MenuIdentities) > 0 {
 			if err := transaction.Where("identity IN ?", request.MenuIdentities).Find(&menus).Error; err != nil {
@@ -132,6 +137,10 @@ func ReplacePlatformRoleMenus(ctx *gin.Context) {
 			infra.Response.Error(ctx, errcode.ErrRecordNotFound)
 			return
 		}
+		if errors.Is(err, errSystemPlatformRole) {
+			infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+			return
+		}
 		infra.Response.Error(ctx, err)
 		return
 	}