优化，排查项目问题

internal/repository/permission_repository.go

@@ -3,6 +3,7 @@ package repository
 import (
 	"context"
 	"errors"
+	"time"
 
 	"gorm.io/gorm"
 
@@ -44,10 +45,43 @@ func (r *PermissionRepository) Update(ctx context.Context, userID string, update
 }
 
 // Upsert creates or updates a permission record.
+// 显式 map 更新：Assign(struct) 会被 GORM 跳过零值字段，导致权限
+// "撤销"（false）保存后静默失效且无法重置。
 func (r *PermissionRepository) Upsert(ctx context.Context, p *model.UserPermission) error {
 	return withSQLiteBusyRetry(ctx, func() error {
-		return r.db.WithContext(ctx).Where("user_id = ?", p.UserID).
-			Assign(*p).FirstOrCreate(p).Error
+		return r.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+			var existing model.UserPermission
+			err := tx.Where("user_id = ?", p.UserID).First(&existing).Error
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return tx.Create(p).Error
+			}
+			if err != nil {
+				return err
+			}
+			p.ID = existing.ID
+			p.CreatedAt = existing.CreatedAt
+			return tx.Model(&existing).Updates(map[string]any{
+				"can_view_dashboard":       p.CanViewDashboard,
+				"can_play_media":           p.CanPlayMedia,
+				"can_cast":                 p.CanCast,
+				"can_external_player":      p.CanExternalPlayer,
+				"can_favorite":             p.CanFavorite,
+				"can_view_history":         p.CanViewHistory,
+				"can_edit_media":           p.CanEditMedia,
+				"can_rescrape":             p.CanRescrape,
+				"can_use_ai":               p.CanUseAI,
+				"can_capture_frames":       p.CanCaptureFrames,
+				"can_manage_downloads":     p.CanManageDownloads,
+				"can_manage_subscriptions": p.CanManageSubscriptions,
+				"can_manage_sites":         p.CanManageSites,
+				"can_use_ai_assistant":     p.CanUseAIAssistant,
+				"can_manage_users":         p.CanManageUsers,
+				"can_manage_files":         p.CanManageFiles,
+				"can_manage_strm":          p.CanManageStrm,
+				"can_access_settings":      p.CanAccessSettings,
+				"updated_at":               time.Now(),
+			}).Error
+		})
 	})
 }