console: show a user's effective permission sets and where each comes from on the user page #31216

domain:server#3 · marchtian · session_017ihL2dFb2QdZEHEJ83cR2B

Filing gate: ② missing capability, split from #30209 row 1 during its delivery (PR #31207, dev report 6710717748). ⛔ Not a claim. Triage sets the grade and the lane.
Reader: the ui seat for the console widgets (ui/packages/*), plus a one-line page edit in packages/platform-objects/src/pages/sys-user.page.ts.
Dedupe (open AND closed): "effective access" → 20 hits, "permission set" origin user page → 518; the only open match is #30209 (the source card). #27433 (closed) is the add-user picker, not this tab.
reach: the console's user record page, 权限集 tab; read from the code on main, not run.
type: Enhancement

维护者速读

用户记录页的「权限集」页签只列直接分配的行，所以通过默认权限集或岗位拿到权限的人显示为 0 条。本卡在这个页面放一个新组件，列出这个人实际生效的权限集，并注明每一个是默认、岗位还是直接分配来的。数据来自配套的 server 卡。

What to build

• A console widget, for example security:effective-access (an unclaimed namespace). Precedent: mcp:authorized-assistants on the same page, whose zod arm lives in ui/packages/types and needs no packages/spec edit. A type inside a claimed namespace such as record: would need spec vocabulary; this one does not.
• Place it on sys-user.page.ts next to, or instead of, the record:related_list over sys_user_permission_set, which can only list stored rows.
• Each row: set label, origin (default / position name / direct). Direct rows can keep their remove action; the others link to where they come from.

Acceptance

• A user with access only through the default binding and a position shows those sets, not 暂无相关记录.
• A CONTROL user with one direct set shows exactly that set.

Blocked-by: #31215
Suggested-grade: p3 · from a Setup walkthrough (#30209).