chore: commit pending admin-panel, api auth and parity doc changes

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>

apps/admin-panel/src/views/user/Permission.vue

@@ -74,6 +74,7 @@
 import { computed, onMounted, reactive, ref } from 'vue';
 import { message } from 'ant-design-vue';
 import { treeData, type PermissionNode } from './permissionConst';
+import { SUPER_ADMIN_RIDS } from '../../utils/superAdmin';
 import { useUsersStore } from '../../stores/users';
 import { useAuthStore } from '../../stores/auth';
 import api from '../../api/client';
@@ -108,12 +109,39 @@ const visibleUserTypes = computed(() => {
   return list;
 });
 
-/** legacy drops the whole "custom" branch for anyone outside level 104 */
-const visibleTree = computed<PermissionNode[]>(() =>
-  auth.user?.ut === RESERVED_TYPE_ID
-    ? treeData
-    : treeData.filter((x) => x.key !== 'custom'),
-);
+/** Drops every super-admin-only node, with its whole subtree. */
+function withoutSuperAdminNodes(nodes: PermissionNode[]): PermissionNode[] {
+  return nodes
+    .filter((x) => !SUPER_ADMIN_RIDS.has(x.key))
+    .map((x) => (x.children ? { ...x, children: withoutSuperAdminNodes(x.children) } : x));
+}
+
+/**
+ * legacy drops the whole "custom" branch for anyone outside level 104; the
+ * super-admin-only rids are shown to the super admin alone.
+ */
+const visibleTree = computed<PermissionNode[]>(() => {
+  const tree =
+    auth.user?.ut === RESERVED_TYPE_ID ? treeData : treeData.filter((x) => x.key !== 'custom');
+  return users.isSuperAdmin ? tree : withoutSuperAdminNodes(tree);
+});
+
+/**
+ * Super-admin-only rids the selected level already holds. Not on the tree for
+ * anyone else, so they are sent back untouched on save instead of being
+ * revoked by an admin who cannot see them.
+ */
+const heldHiddenRids = ref<string[]>([]);
+
+function setLoadedRids(loaded: string[]) {
+  if (users.isSuperAdmin) {
+    rid.value = loaded;
+    heldHiddenRids.value = [];
+    return;
+  }
+  rid.value = loaded.filter((x) => !SUPER_ADMIN_RIDS.has(x));
+  heldHiddenRids.value = loaded.filter((x) => SUPER_ADMIN_RIDS.has(x));
+}
 
 async function getData() {
   try {
@@ -127,17 +155,17 @@ async function getData() {
 /** legacy selectChange(): id 84 means "creating a new level", so start empty */
 async function selectChange(id: string | undefined) {
   if (!id) {
-    rid.value = [];
+    setLoadedRids([]);
     return;
   }
   if (id === NEW_TYPE_ID) {
-    rid.value = [];
+    setLoadedRids([]);
     return;
   }
   try {
     const { data } = await api.get(`roles/${id}`);
     // The server returns a flat array of rid strings.
-    rid.value = data;
+    setLoadedRids(data);
   } catch (e) {
     message.error('خطا در دریافت اطلاعات');
   }
@@ -166,7 +194,10 @@ async function handleSubmit() {
       targetUt = String(data.id);
     }
 
-    await api.post('roles/create', { ut: targetUt, roles: rid.value });
+    await api.post('roles/create', {
+      ut: targetUt,
+      roles: [...new Set([...rid.value, ...heldHiddenRids.value])],
+    });
 
     await getData();
     if (newUT.value) {