fix(settings): hide can_edit=1 keys on superadmin settings page

Filter program settings UI by generated system-key allowlist so editable
tenant settings (e.g. montzar_product_id) never appear in superadmin.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/config/superAdminSettingKeys.ts

@@ -0,0 +1,199 @@
+/**
+ * کلیدهای تنظیمات سوپرادمین — هم‌تراز deploy_settings_const.sql
+ * تولید خودکار: controlpanel_server/scripts/sync-superadmin-setting-template.mjs
+ */
+export const SUPERADMIN_SYSTEM_SETTING_KEYS = new Set<string>([
+  "accounting_provider",
+  "admin_url",
+  "apk_download_link",
+  "app_url",
+  "bale_bot_token",
+  "chart_id",
+  "chart_use_local_data",
+  "chat_api",
+  "chat_api_key",
+  "chat_download_url",
+  "chat_upload_url",
+  "chat_webhook_base_url",
+  "chat_webhook_secret",
+  "customer_direct_sms",
+  "customer_special_pricing",
+  "down_price",
+  "enable_conditional_order",
+  "enable_customer_level_profit",
+  "enable_product_funds",
+  "external_order_api_enabled",
+  "external_payment_base_url",
+  "external_payment_client_id",
+  "external_payment_client_secret",
+  "external_payment_enabled",
+  "external_payment_gateway",
+  "external_payment_return_url",
+  "external_payment_webhook_url",
+  "fee_deduct_from_gold",
+  "group_sms",
+  "has_page_earn_money",
+  "has_page_gift_card",
+  "has_page_notification",
+  "has_page_price_trigger",
+  "is_store",
+  "jibit_enabled",
+  "logo_login",
+  "logo_register",
+  "main_metal",
+  "main_wallet_products",
+  "metal_type",
+  "montify_name",
+  "montzar_base_url",
+  "montzar_closed",
+  "montzar_diff",
+  "montzar_last_product_log",
+  "montzar_live_price",
+  "montzar_mazaneh",
+  "montzar_order_response",
+  "montzar_token",
+  "montzar_truly_buy_mazaneh",
+  "montzar_truly_sell_mazaneh",
+  "node_client_id",
+  "node_shared_secret",
+  "pargar_api_token",
+  "pargar_item_id_gold",
+  "pargar_item_id_rial",
+  "pargar_password",
+  "pargar_username",
+  "payping_fin_customer_id",
+  "payping_fin_sync_enabled",
+  "payping_fin_token",
+  "payping_fin_url",
+  "payping_gateway_items",
+  "payping_gateway_name",
+  "payping_round_toman",
+  "payping_start_url",
+  "payping_strict_failed_withdraw",
+  "payping_verify_url",
+  "permision__enabled",
+  "price_channel_access",
+  "price_channel_bale_to",
+  "price_channel_rubika_to",
+  "price_channel_telegram_to",
+  "price_extreme_date",
+  "referral_bonus_amount",
+  "rubika_bot_token",
+  "send_to_pargar",
+  "send_to_tahesab",
+  "show_to_users_chat",
+  "sms_panel",
+  "sse_path",
+  "tahesab_bank_account",
+  "tahesab_db",
+  "tahesab_host",
+  "tahesab_port",
+  "tahesab_token",
+  "telegram_bot_token",
+  "unit",
+  "up_price",
+  "wallet_payment_provider",
+  "wss_enabled",
+  "zarin_api",
+  "zarin_gorohe_kar",
+  "zarin_name_g",
+  "zarin_noe_kar",
+  "zarin_noe_kar_tedadi",
+  "zarin_token",
+  "zarin_uid_prefix",
+]);
+
+export const SUPERADMIN_EDITABLE_SETTING_KEYS = new Set<string>([
+  "auto_active_customer",
+  "balance_report_exclude_customer_id",
+  "banner_enabled",
+  "buy_fee",
+  "change_mesghal",
+  "charge_notif",
+  "close_price",
+  "deposit_account_holder",
+  "deposit_account_number",
+  "deposit_card_number",
+  "deposit_method_card_to_card",
+  "deposit_method_gateway",
+  "deposit_method_identified",
+  "deposit_method_shetab",
+  "deposit_sheba",
+  "deposit_sms_support_number",
+  "endDay",
+  "fee_conditional_order",
+  "fee_free",
+  "fee_service_charge_percentage",
+  "gift_for_referral",
+  "gift_for_referrer",
+  "has_chat",
+  "jibit_verification",
+  "main_product_price",
+  "min_deposit",
+  "min_first_buy",
+  "min_withdraw",
+  "minimum_sell",
+  "montzar_mobile",
+  "montzar_open_buy",
+  "montzar_open_sell",
+  "montzar_password",
+  "montzar_product_id",
+  "name_fa",
+  "open_register",
+  "price_channel_diff",
+  "price_channel_enabled",
+  "price_channel_footer_id",
+  "price_channel_footer_link",
+  "price_channel_footer_phone",
+  "price_channel_messengers",
+  "price_channel_min_seconds",
+  "products_site_link_enabled",
+  "products_site_link_text",
+  "products_site_link_url",
+  "referral_gift_buy_from_montzar",
+  "referral_gift_on_first_order",
+  "referral_id",
+  "referral_limit",
+  "referral_show",
+  "register_jibit_verify",
+  "register_referral_bonus_message",
+  "register_referral_sms_to_referrer",
+  "require_zero_main_gold_before_other_buy",
+  "sell_fee",
+  "show_gold_ounce_price",
+  "show_home_price_when_closed",
+  "show_last_price",
+  "show_product_card_meta",
+  "show_product_details",
+  "show_product_trade_status",
+  "sms_notif_bank_card_admin",
+  "sms_notif_bank_card_customer",
+  "sms_notif_fund_withdraw_admin",
+  "sms_notif_fund_withdraw_customer",
+  "sms_notif_gateway_charge_admin",
+  "sms_notif_jibit_admin",
+  "sms_notif_login_otp",
+  "sms_notif_order_admin",
+  "sms_notif_order_customer",
+  "sms_notif_price_trigger",
+  "sms_notif_register_admin",
+  "sms_notif_register_customer",
+  "sms_notif_support_admin",
+  "sms_notif_wallet_alert",
+  "sms_notif_withdraw_admin",
+  "sms_notif_withdraw_otp",
+  "startDay",
+  "support_messenger",
+  "support_messenger_id",
+  "support_messenger_text",
+  "tracking_systems",
+  "tracking_systems_enabled",
+]);
+
+export function isSuperAdminSystemSettingKey(key?: string | null): boolean {
+  const k = String(key || '').trim();
+  if (!k) return false;
+  if (SUPERADMIN_EDITABLE_SETTING_KEYS.has(k)) return false;
+  return SUPERADMIN_SYSTEM_SETTING_KEYS.has(k);
+}
+

src/pages/ProgramSettingsPage.vue

@@ -38,6 +38,7 @@ import {
   normalizeSettingRow,
   resolveSettingFieldType,
 } from '@/config/khanegiSettingCatalog'
+import { isSuperAdminSystemSettingKey } from '@/config/superAdminSettingKeys'
 import type { KhanegiSettingRow } from '@/config/khanegiSettingRow'
 import { useAuthStore } from '@/stores/auth'
 
@@ -133,6 +134,7 @@ const filteredRows = computed(() => {
   const q = search.value.trim().toLowerCase()
   return [...items.value]
     .filter((row) => {
+      if (!isSuperAdminSystemSettingKey(row.key)) return false
       if (!isSettingVisible(row.key)) return false
       if (filterType.value && resolveSettingFieldType(row) !== filterType.value) return false
       if (!q) return true