src/main/java/com/imyeyu/api/modules/user/service/implement/AuthorizationBoundaryServiceImplement.java

@@ -173,7 +173,6 @@ public class AuthorizationBoundaryServiceImplement implements AuthorizationBound
 		}
 		List<Permission> permissionList = permissionMapper.selectByIdList(permissionIdList.stream().toList());
 		checkPermissionIdListComplete(permissionIdList, permissionList);
-		Set<String> allPermissionIdSet = listRoleAllPermissionId(operatorUserId, roleId);
 		boolean hasParentRole = TimiJava.isNotEmpty(role.getParentRoleId());
 		Set<String> parentDelegationPermissionIdSet = listParentDelegationPermissionId(roleId);
 		if (!isCoreDelegationRoot(role)) {
@@ -182,7 +181,6 @@ public class AuthorizationBoundaryServiceImplement implements AuthorizationBound
 		Set<String> operatorGrantablePermissionIdSet = listGrantablePermissionId(operatorUserId, permissionList);
 		for (Permission permission : permissionList) {
 			TimiException.requiredTrue(role.getModuleCode() == permission.getModuleCode() || isCoreDelegationRoot(role) || isCoreAuthorizationPermission(permission), "不能配置其他模块转授权限");
-			TimiException.requiredTrue(isCoreDelegationRoot(role) || allPermissionIdSet.contains(permission.getId()), "转授权限必须先属于目标角色有效权限：%s".formatted(permission.getCode()));
 			if (hasParentRole) {
 				TimiException.requiredTrue(parentDelegationPermissionIdSet.contains(permission.getId()), "转授权限超过上级边界：%s".formatted(permission.getCode()));
 			}

src/main/java/com/imyeyu/api/modules/user/service/implement/RoleServiceImplement.java

@@ -151,7 +151,6 @@ public class RoleServiceImplement extends AbstractEntityService<Role, String> im
 
 			if (TimiJava.isNotEmpty(deleteIdList)) {
 				rolePermissionMapper.deleteByPermissionIdList(role.getId(), new ArrayList<>(deleteIdList));
-				rolePermissionDelegationMapper.deleteByPermissionIdList(role.getId(), new ArrayList<>(deleteIdList));
 			}
 			if (TimiJava.isNotEmpty(addIdList)) {
 				List<RolePermission> rolePermissionList = new ArrayList<>();
@@ -284,17 +283,18 @@ public class RoleServiceImplement extends AbstractEntityService<Role, String> im
 		String loginUserId = userLoginService.getRequireLoginUserId();
 		Role role = mapper.selectById(roleId);
 		TimiException.required(role, "not found role");
-		List<Permission> allPermissionList = isCoreDelegationRoot(role)
-			? Arrays.stream(ModuleCode.values()).flatMap(moduleCode -> permissionService.listByModuleCode(moduleCode).stream()).toList()
-			: listPermissionByRoleId(roleId);
-		Set<String> allPermissionIdSet = allPermissionList.stream().map(Permission::getId).collect(Collectors.toSet());
-		Set<String> operatorGrantableIdSet = listOperatorGrantablePermissionId(loginUserId, allPermissionList);
 		boolean hasParentRole = TimiJava.isNotEmpty(role.getParentRoleId());
-		Set<String> parentDelegationIdSet = listDelegationParentPermissionId(roleId);
 		boolean systemAdmin = authorizationScopeService.isSystemAdmin(loginUserId);
-		return allPermissionList.stream()
+		Set<String> candidateIdSet = isCoreDelegationRoot(role) && systemAdmin && !hasParentRole
-		                        .filter(permission -> allPermissionIdSet.contains(permission.getId()))
+			? Arrays.stream(ModuleCode.values())
-		                        .filter(permission -> parentDelegationIdSet.contains(permission.getId()) || isCoreDelegationRoot(role) && systemAdmin && !hasParentRole)
+			        .flatMap(moduleCode -> permissionService.listByModuleCode(moduleCode).stream())
+			        .map(Permission::getId)
+			        .collect(Collectors.toSet())
+			: listDelegationParentPermissionId(roleId);
+		List<Permission> candidateList = listPermissionById(candidateIdSet);
+		Set<String> operatorGrantableIdSet = listOperatorGrantablePermissionId(loginUserId, candidateList);
+		return candidateList.stream()
+		                    .filter(permission -> role.getModuleCode() == permission.getModuleCode() || isCoreDelegationRoot(role) || isCoreAuthorizationPermission(permission))
 		                    .filter(permission -> operatorGrantableIdSet.contains(permission.getId()) || systemAdmin)
 		                    .toList();
 	}
@@ -411,6 +411,10 @@ public class RoleServiceImplement extends AbstractEntityService<Role, String> im
 			&& (com.imyeyu.api.bean.CoreRoleCode.SYSTEM.name().equals(role.getCode()) || com.imyeyu.api.bean.CoreRoleCode.ADMIN.name().equals(role.getCode()));
 	}
 
+	private boolean isCoreAuthorizationPermission(Permission permission) {
+		return permission != null && ModuleCode.CORE == permission.getModuleCode();
+	}
+
 	private Set<String> listOperatorGrantablePermissionId(String loginUserId, List<Permission> permissionList) {
 		if (TimiJava.isEmpty(permissionList)) {
 			return Set.of();