feat: 增加工作流和知识库三级权限

- 抽取统一资源访问骨架与部门可见范围判断

- 接入工作流和知识库的 READ/MANAGE 权限校验

- 增加可见范围配置与只读态前端交互

easyflow-modules/easyflow-module-system/src/test/java/tech/easyflow/system/service/impl/SysDeptServiceImplTest.java

@@ -0,0 +1,51 @@
+package tech.easyflow.system.service.impl;
+
+import org.junit.Assert;
+import org.junit.Test;
+import tech.easyflow.system.entity.SysDept;
+
+import java.io.Serializable;
+import java.math.BigInteger;
+import java.util.Set;
+
+public class SysDeptServiceImplTest {
+
+    @Test
+    public void shouldReturnSelfAndAncestors() {
+        SysDept dept = new SysDept();
+        dept.setId(BigInteger.valueOf(5));
+        dept.setAncestors("0,1,3");
+
+        SysDeptServiceImpl service = new SysDeptServiceImpl() {
+            @Override
+            public SysDept getById(Serializable id) {
+                return dept;
+            }
+        };
+
+        Set<BigInteger> deptIds = service.getSelfAndAncestorDeptIds(BigInteger.valueOf(5));
+        Assert.assertTrue(deptIds.contains(BigInteger.valueOf(1)));
+        Assert.assertTrue(deptIds.contains(BigInteger.valueOf(3)));
+        Assert.assertTrue(deptIds.contains(BigInteger.valueOf(5)));
+        Assert.assertFalse(deptIds.contains(BigInteger.ZERO));
+    }
+
+    @Test
+    public void shouldMatchDeptScopedResourceByAncestorChain() {
+        SysDept dept = new SysDept();
+        dept.setId(BigInteger.valueOf(9));
+        dept.setAncestors("1,5");
+
+        SysDeptServiceImpl service = new SysDeptServiceImpl() {
+            @Override
+            public SysDept getById(Serializable id) {
+                return dept;
+            }
+        };
+
+        Assert.assertTrue(service.canUserAccessDeptScopedResource(BigInteger.valueOf(9), BigInteger.valueOf(1)));
+        Assert.assertTrue(service.canUserAccessDeptScopedResource(BigInteger.valueOf(9), BigInteger.valueOf(5)));
+        Assert.assertTrue(service.canUserAccessDeptScopedResource(BigInteger.valueOf(9), BigInteger.valueOf(9)));
+        Assert.assertFalse(service.canUserAccessDeptScopedResource(BigInteger.valueOf(9), BigInteger.valueOf(7)));
+    }
+}