weichen/Agent-System-Backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden delegated role authority boundaries

Browse Source 
Why: Independent review found delegated account actions, stale resource policy, and role migration cutover gaps in the initial U4 implementation.

Evidence: Backend full SQLite suite passed; isolated PostgreSQL role and migration suite passed; independent final review found no remaining findings.

Impact: Enforces transactional system grants, current role snapshots, staged role import with v36 migration, and fail-closed activation.

Refs: feature/iam-u4-role-authority
This commit is contained in:
weichen
2026-10-15 02:27:50 +00:00
parent b2a1cd0a60
commit 06ef17a70a
20 changed files with 748 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/storage-migrate/main.go
+1 -1
View File
@@ -281,7 +281,7 @@ func cmdBackup(args []string) error {
// copyOrder：按外键依赖排序的业务表全集（projects 最先，引用方在后）。
// admission_leases 是运行态执行许可（迁移无意义），明确排除。
var copyOrder = []string{
"projects", "users", "roles", "role_permissions", "user_role_bindings", "system_grants", "authority_state", "policy_receipts",
"projects", "users", "roles", "role_permissions", "user_role_bindings", "system_grants", "authority_state", "policy_receipts", "role_authority_import_state",
"account_directory_revision", "profiles", "settings", "plugins",
"conversations", "runs", "messages", "events", "artifacts",
"hitl_cards", "plans", "todos", "knowledge", "knowledge_vectors",