From 2d1e5f5b16067fec331a1d06f0c41c31df7fd223 Mon Sep 17 00:00:00 2001 From: weichen Date: Wed, 21 Oct 2026 14:13:28 +0000 Subject: [PATCH 1/5] chore(task): start fix/iam-perm-ux-port --- .task/fix-iam-perm-ux-port.md | 66 +++++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) create mode 100644 .task/fix-iam-perm-ux-port.md diff --git a/.task/fix-iam-perm-ux-port.md b/.task/fix-iam-perm-ux-port.md new file mode 100644 index 0000000..332559e --- /dev/null +++ b/.task/fix-iam-perm-ux-port.md @@ -0,0 +1,66 @@ +# fix/iam-perm-ux-port 任务卡 + +任务主记录：。 +状态：进行中；owner：weichen + +## 基线与授权 + +- 权威仓：ssh://git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Backend.git；root_target：main；immediate_target：main +- branch_kind：standalone；initiative_id： +- R0（initial_main_sha）：01f4c47a2b5798c9b43fffb9e298aa87138a1537；工作区：/home/weichen/projects/Agent-System-Backend-wt-fix-iam-perm-ux-port（worktree）；分支：fix/iam-perm-ux-port +- 父任务信息（仅子任务填写）：无 +- accepting_requirements：false +- 需求分流：verdict=NEW；selected_initiative=无；候选=无；理由=no accepting initiative；triage 收据=/tmp/be-triage-iam-perm-ux-20261021.json；receipt_sha256=bb4a700446f22b5799e94f1c6efa488c4a30b65814a457b76ab41d30b0dc5038；requirement_sha256=9495f0dc1c3cbf04feb6c712bfa93c6bbb6803801285a518ae9f309c74ec836b +- 授权与交付终点：<本次允许的动作与终点；未授权事项写明> +- 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md；外部 Agent 一单元一新进程/会话/工作区） + +## 目标与非目标 + +<预期结果、受影响入口/模块/契约；明确不做什么。> + +## Agent 实施收据 + +按根目录 AGENT-EXECUTION.md 路由；外部 Agent 一单元一新进程/会话/隔离工作区。实施、修复与测试必须通过登记的候选执行；未配置或候选安全耗尽停在 unavailable/blocked，禁止 host 隐式代写。 + +| 单元 ID | 预期范围 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 | +|---|---|---|---|---|---|---|---|---|---| +| 待定义 | — | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | — | + +## 复用材料（task-start 自动检索结果摘录） + +- 相关近期提交： 命中；无则写无>。 +- 相关经验条目：<检索命中；无则写无>。 + +## 同步记录 + +| 节点 | sync_base_sha | tested_head_sha | checked_at | 结果 | +|---|---|---|---|---| +| 启动 | | | <日期时间> | <一致/已同步> | +| 验收前 | <填写> | <填写> | <填写> | <填写> | + +字段没有发生的写"无"，不省略。本卡与 PR 描述同源：开 PR 时将"目标与非目标、结果与验证、影响与剩余项"复制进 PR 描述，不另写第二份。 + +## 交付调度（有多个就绪任务时） + +- 调度记录 / entry_id / 当前 attempt_id：<平台或调度服务链接及标识；未入队写无>。 +- 入队源 HEAD / owner / 依赖：<完整 SHA、身份、依赖或无>。 +- 固定候选引用：<调度尝试中的 base/head、组件与配置；未固定写无>。 +- 窗口、最终 CI、Review 与真实合入结果：<引用调度记录及原始证据，不复制全队列>。 + +定义见 [合入调度与 CI 分配](../standards/merge-queue.md)。本段在候选固定前整理；固定后先使用源码之外的记录保存运行结果，再按项目闭合流程回填。 + +## 结果与验证（完成后填写） + +- 结果：<交付了什么；未发生写无>。 +- 验证：<结论性摘要：PASS/FAIL/SKIP/NOT_RUN 逐项；逐条证据见下表，来源标注与写入规则见 [按影响选择验证与证据](../standards/verification.md)>。 +- 影响与剩余项：<影响面、遗留风险、后续任务>。 + +| 时间(UTC) | 命令 | 被测 HEAD | exit | 来源 | 摘要/位置 | +|---|---|---|---|---|---| +| <时间> | <命令；由项目 evidence 工具写入，无工具时附命令+对象 SHA+输出 digest 并标 SELF> | | | GATE/REPLAY/SELF | <摘要/位置> | + +## 回收（task-finish） + +- 合入核对：<分支已包含于目标分支的核对输出>。 +- 未跟踪/ignored 文件处置：<归档/可再生/存疑 逐项；无则写无>。 +- 回收动作：。 From 76abebe790b7e7b3736041825d6c6b1566c0b146 Mon Sep 17 00:00:00 2001 From: agent-exec-transport Date: Wed, 21 Oct 2026 14:41:59 +0000 Subject: [PATCH 2/5] agent-exec transport 64b951970cf4308149cee90d2ab93fbb/078c7847c409 --- internal/authz/catalog/catalog_test.go | 16 + internal/server/account_search.go | 126 +++ internal/server/role_authorization_test.go | 190 ++++ internal/server/roles.go | 162 +++ internal/server/server.go | 6 + internal/store/role_policy.go | 1135 ++++++++++++++++++++ internal/store/role_policy_test.go | 483 +++++++++ 7 files changed, 2118 insertions(+) diff --git a/internal/authz/catalog/catalog_test.go b/internal/authz/catalog/catalog_test.go index 34f5ed3..b03a65a 100644 --- a/internal/authz/catalog/catalog_test.go +++ b/internal/authz/catalog/catalog_test.go @@ -54,3 +54,19 @@ func TestCatalogReturnsIndependentCopies(t *testing.T) { t.Fatal("Catalog exposed mutable registry storage") } } + +// TestCatalogLinkedActionsStayProjectScopedAndUnprotected pins the narrowing +// that the ported batch writers enforce: project.create remains the single +// role authority, and the linked own-project management actions stay +// project-scoped and never protected so the role cannot inherit them. +func TestCatalogLinkedActionsStayProjectScopedAndUnprotected(t *testing.T) { + for _, actionID := range ProjectCreateLinkedActions() { + descriptor, ok := DescriptorByID(actionID) + if !ok || descriptor.Scope != ScopeProject || descriptor.Protected { + t.Fatalf("linked %s descriptor=%+v ok=%v", actionID, descriptor, ok) + } + if IsProjectCreateLinkedAction(ProjectAccessAction) { + t.Fatal("project.create reported as a linked action of itself") + } + } +} diff --git a/internal/server/account_search.go b/internal/server/account_search.go index 2e2a0ee..9002449 100644 --- a/internal/server/account_search.go +++ b/internal/server/account_search.go @@ -194,6 +194,24 @@ func (s *Server) searchAdminUsers(w http.ResponseWriter, r *http.Request) { for _, account := range page { items = append(items, accountProfileJSON(account)) } + if s.systemActionAllowed(actor, "system.roles.view") { + userIDs := make([]string, 0, len(page)) + for _, account := range page { + userIDs = append(userIDs, account.ID) + } + roles, err := s.st.ActiveRolesForUsers(userIDs) + if err != nil { + writeStoreErr(w, err) + return + } + for i, account := range page { + var role *store.UserRoleSummary + if found, ok := roles[account.ID]; ok { + role = &found + } + items[i]["role"] = role + } + } next := "" if more { last := page[len(page)-1] @@ -202,3 +220,111 @@ func (s *Server) searchAdminUsers(w http.ResponseWriter, r *http.Request) { w.Header().Set("Cache-Control", "no-store") writeJSON(w, http.StatusOK, map[string]any{"accounts": items, "nextCursor": next, "directoryVersion": directoryVersion}) } + +// listRoleMembers filters a role's active members before paging them in owner +// order. The signed cursor is bound to the role, the filter, and the account +// directory revision so it cannot be replayed across roles or parameters. +func (s *Server) listRoleMembers(w http.ResponseWriter, r *http.Request) { + if s.accountSearchKeyErr != nil || s.accountSearchKey.Version < 1 { + http.Error(w, "account directory signing unavailable", http.StatusServiceUnavailable) + return + } + actor, ok := s.requireSystemAction(w, r, "system.users.view") + if !ok { + return + } + if _, ok := s.requireSystemAction(w, r, "system.roles.view"); !ok { + return + } + params := r.URL.Query() + query := strings.TrimSpace(params.Get("query")) + if !utf8.ValidString(query) || utf8.RuneCountInString(query) > 128 { + http.Error(w, "invalid account search query", http.StatusBadRequest) + return + } + for _, ch := range query { + if unicode.IsControl(ch) { + http.Error(w, "invalid account search query", http.StatusBadRequest) + return + } + } + mode := params.Get("mode") + if mode == "" { + mode = "fuzzy" + } + if mode != "exact" && mode != "fuzzy" { + http.Error(w, "unknown account search mode", http.StatusBadRequest) + return + } + status := params.Get("status") + if status == "" { + status = "all" + } + if status != "all" && status != "enabled" && status != "disabled" { + http.Error(w, "unknown account status filter", http.StatusBadRequest) + return + } + limit := 20 + if raw := params.Get("limit"); raw != "" { + parsed, err := strconv.Atoi(raw) + if err != nil || parsed < 1 || parsed > 100 { + http.Error(w, "invalid account search limit", http.StatusBadRequest) + return + } + limit = parsed + } + roleID := r.PathValue("roleId") + members, revision, err := s.st.ListRoleMembersForActor(actor, roleID) + if err != nil { + writeStoreErr(w, err) + return + } + visibleRevision := sha256.Sum256([]byte(revision.Private)) + fingerprint, _ := json.Marshal(struct { + Kind, Actor, RoleID, Query, Mode, Status, Revision string + }{"role-members", actor, roleID, query, mode, status, hex.EncodeToString(visibleRevision[:])}) + digest := sha256.Sum256(fingerprint) + version := hex.EncodeToString(digest[:]) + var after adminSearchCursor + if token := params.Get("cursor"); token != "" { + var valid bool + after, valid = s.parseAdminCursor(token, version) + if !valid { + http.Error(w, "role member cursor expired or invalid", http.StatusConflict) + return + } + } + page := make([]store.RoleMember, 0, limit+1) + matches := func(value string) bool { + if query == "" { + return true + } + if mode == "exact" { + return strings.EqualFold(value, query) + } + return strings.Contains(strings.ToLower(value), strings.ToLower(query)) + } + for _, member := range members { + if status == "enabled" && !member.Enabled || status == "disabled" && member.Enabled { + continue + } + if after.Owner != "" && (member.Owner < after.Owner || member.Owner == after.Owner && member.UserID <= after.UserID) { + continue + } + if query != "" && !matches(member.Owner) && !matches(member.Name) && !matches(member.UserID) { + continue + } + page = append(page, member) + if len(page) > limit { + break + } + } + next := "" + if len(page) > limit { + page = page[:limit] + last := page[len(page)-1] + next = s.signAdminCursor(adminSearchCursor{Version: version, Owner: last.Owner, UserID: last.UserID}) + } + w.Header().Set("Cache-Control", "no-store") + writeJSON(w, http.StatusOK, map[string]any{"members": page, "nextCursor": next}) +} diff --git a/internal/server/role_authorization_test.go b/internal/server/role_authorization_test.go index 2a12e8a..356f713 100644 --- a/internal/server/role_authorization_test.go +++ b/internal/server/role_authorization_test.go @@ -469,3 +469,193 @@ func TestLegacyRoleRowsDoNotAuthorizeSystemActionsOrAccess(t *testing.T) { t.Fatalf("legacy true,true row denied project access: %d %s", rec.Code, rec.Body.String()) } } + +// ===================================================================== +// HTTP-level coverage for the ported IAM batch endpoints (port from +// feature/iam-perm-ux-backend). The endpoints reuse the existing auth +// gates (system.permissions.* and system.roles.*) and main's narrowed role +// model (only project.create is role authority). +// ===================================================================== + +func TestRolePermissionPreviewRequiresPermissionViewOverHTTP(t *testing.T) { + srv, st := newAuthTestServer(t) + h := srv.Handler() + admin := bootAdmin(t, h, st) + roleRec := do(h, "POST", "/api/admin/roles", `{"name":"预览职位"}`, admin) + if roleRec.Code != http.StatusOK { + t.Fatalf("create role: %d %s", roleRec.Code, roleRec.Body.String()) + } + role := decodeRoleHTTP(t, roleRec) + body := `{"roles":[{"roleId":"` + role.RoleID + `","expectedRoleVersion":1,"changes":[{"actionId":"project.create","allowed":false,"capAllowed":true}]}]}` + if rec := do(h, "POST", "/api/admin/roles/permissions/preview", body, admin); rec.Code != http.StatusOK { + t.Fatalf("preview denied: %d %s", rec.Code, rec.Body.String()) + } else if !strings.Contains(rec.Body.String(), role.RoleID) { + t.Fatalf("preview body: %s", rec.Body.String()) + } + if rec := do(h, "POST", "/api/admin/roles/permissions/preview", + `{"roles":[{"roleId":"unknown","expectedRoleVersion":1,"changes":[]}]}`, admin); rec.Code != http.StatusBadRequest && + rec.Code != http.StatusInternalServerError { + t.Fatalf("empty-changes preview: %d %s", rec.Code, rec.Body.String()) + } +} + +func TestBatchRolePermissionPatchOverHTTP(t *testing.T) { + srv, st := newAuthTestServer(t) + h := srv.Handler() + admin := bootAdmin(t, h, st) + first := createRoleHTTP(t, h, st, admin, "批量职位一") + second := createRoleHTTP(t, h, st, admin, "批量职位二") + body := `{"idempotencyKey":"batch-1","roles":[` + + `{"roleId":"` + first.RoleID + `","expectedRoleVersion":1,"changes":[{"actionId":"project.create","allowed":true,"capAllowed":true}]},` + + `{"roleId":"` + second.RoleID + `","expectedRoleVersion":1,"changes":[{"actionId":"project.create","allowed":true,"capAllowed":true}]}` + + `]}` + if rec := do(h, "POST", "/api/admin/roles/permissions/batch", body, admin); rec.Code != http.StatusOK { + t.Fatalf("batch denied: %d %s", rec.Code, rec.Body.String()) + } else if !strings.Contains(rec.Body.String(), "receipts") { + t.Fatalf("batch body: %s", rec.Body.String()) + } + body = `{"idempotencyKey":"batch-bad","roles":[` + + `{"roleId":"` + first.RoleID + `","expectedRoleVersion":2,"changes":[{"actionId":"project.create","allowed":false,"capAllowed":true}]},` + + `{"roleId":"` + second.RoleID + `","expectedRoleVersion":1,"changes":[{"actionId":"system.users.view","allowed":true,"capAllowed":true}]}` + + `]}` + if rec := do(h, "POST", "/api/admin/roles/permissions/batch", body, admin); rec.Code != http.StatusInternalServerError && + rec.Code != http.StatusBadRequest { + t.Fatalf("bad batch response: %d %s", rec.Code, rec.Body.String()) + } +} + +func TestBatchRoleAssignmentPreviewAndCommitOverHTTP(t *testing.T) { + srv, st := newAuthTestServer(t) + h := srv.Handler() + admin := bootAdmin(t, h, st) + if err := st.CreateAccount("alice", "Alice", "hash", false); err != nil { + t.Fatal(err) + } + if err := st.CreateAccount("bob", "Bob", "hash", false); err != nil { + t.Fatal(err) + } + alice, _ := st.GetAccountByOwner("alice") + bob, _ := st.GetAccountByOwner("bob") + role := createRoleHTTP(t, h, st, admin, "职位预览") + preview := `{"assignments":[` + + `{"userId":"` + alice.ID + `","roleId":"` + role.RoleID + `","expectedStateVersion":` + strconv.FormatInt(alice.StateVersion, 10) + `},` + + `{"userId":"` + bob.ID + `","roleId":"` + role.RoleID + `","expectedStateVersion":` + strconv.FormatInt(bob.StateVersion, 10) + `}` + + `]}` + if rec := do(h, "POST", "/api/admin/users/role-assignments/preview", preview, admin); rec.Code != http.StatusOK { + t.Fatalf("preview denied: %d %s", rec.Code, rec.Body.String()) + } else if !strings.Contains(rec.Body.String(), alice.ID) { + t.Fatalf("preview missing alice: %s", rec.Body.String()) + } + commit := `{"idempotencyKey":"assign-batch","assignments":[` + + `{"userId":"` + alice.ID + `","roleId":"` + role.RoleID + `","expectedStateVersion":` + strconv.FormatInt(alice.StateVersion, 10) + `},` + + `{"userId":"` + bob.ID + `","roleId":"` + role.RoleID + `","expectedStateVersion":` + strconv.FormatInt(bob.StateVersion, 10) + `}` + + `]}` + if rec := do(h, "POST", "/api/admin/users/role-assignments", commit, admin); rec.Code != http.StatusOK { + t.Fatalf("commit denied: %d %s", rec.Code, rec.Body.String()) + } else if !strings.Contains(rec.Body.String(), "bindings") { + t.Fatalf("commit body: %s", rec.Body.String()) + } +} + +func TestCopyAssignRoleOverHTTP(t *testing.T) { + srv, st := newAuthTestServer(t) + h := srv.Handler() + admin := bootAdmin(t, h, st) + if err := st.CreateAccount("alice", "Alice", "hash", false); err != nil { + t.Fatal(err) + } + alice, _ := st.GetAccountByOwner("alice") + source := createRoleHTTP(t, h, st, admin, "源职位") + enable := do(h, "PUT", "/api/admin/roles/"+source.RoleID+"/permissions", + `{"expectedRoleVersion":1,"idempotencyKey":"copy-source","changes":[{"actionId":"project.create","allowed":true,"capAllowed":true}]}`, admin) + if enable.Code != http.StatusOK { + t.Fatalf("enable source: %d %s", enable.Code, enable.Body.String()) + } + body := `{"source":{"roleId":"` + source.RoleID + `","expectedRoleVersion":2},"name":"复制职位","description":"","idempotencyKey":"copy-1","assignments":[{"userId":"` + alice.ID + `","expectedStateVersion":` + strconv.FormatInt(alice.StateVersion, 10) + `}]}` + if rec := do(h, "POST", "/api/admin/roles/copy-assign", body, admin); rec.Code != http.StatusOK { + t.Fatalf("copy denied: %d %s", rec.Code, rec.Body.String()) + } else if !strings.Contains(rec.Body.String(), "复制职位") { + t.Fatalf("copy body: %s", rec.Body.String()) + } +} + +func TestRoleMembersFilterBeforePagingAndBindCursor(t *testing.T) { + srv, st := newAuthTestServer(t) + h := srv.Handler() + admin := bootAdmin(t, h, st) + if err := st.CreateAccount("alice", "Alice", "hash", false); err != nil { + t.Fatal(err) + } + if err := st.CreateAccount("bob", "Bob", "hash", false); err != nil { + t.Fatal(err) + } + alice, _ := st.GetAccountByOwner("alice") + bob, _ := st.GetAccountByOwner("bob") + role := createRoleHTTP(t, h, st, admin, "成员职位") + assign := func(userID string, version int64, key string) { + t.Helper() + rec := do(h, "PUT", "/api/admin/users/"+userID+"/role", + `{"roleId":"`+role.RoleID+`","expectedStateVersion":`+strconv.FormatInt(version, 10)+`,"idempotencyKey":"`+key+`"}`, admin) + if rec.Code != http.StatusOK { + t.Fatalf("assign %s: %d %s", userID, rec.Code, rec.Body.String()) + } + } + assign(alice.ID, alice.StateVersion, "assign-alice") + assign(bob.ID, bob.StateVersion, "assign-bob") + if rec := do(h, "GET", "/api/admin/roles/"+role.RoleID+"/members", "", admin); rec.Code != http.StatusOK { + t.Fatalf("list members: %d %s", rec.Code, rec.Body.String()) + } else if !strings.Contains(rec.Body.String(), alice.ID) || !strings.Contains(rec.Body.String(), bob.ID) { + t.Fatalf("members=%s", rec.Body.String()) + } + filtered := do(h, "GET", "/api/admin/roles/"+role.RoleID+"/members?query=alice&mode=exact", "", admin) + if filtered.Code != http.StatusOK || !strings.Contains(filtered.Body.String(), alice.ID) || strings.Contains(filtered.Body.String(), bob.ID) { + t.Fatalf("filter=%d %s", filtered.Code, filtered.Body.String()) + } +} + +func TestAccountSearchIncludesRoleProjection(t *testing.T) { + srv, st := newAuthTestServer(t) + h := srv.Handler() + admin := bootAdmin(t, h, st) + if err := st.CreateAccount("alice", "Alice", "hash", false); err != nil { + t.Fatal(err) + } + alice, _ := st.GetAccountByOwner("alice") + role := createRoleHTTP(t, h, st, admin, "账户目录职位") + if rec := do(h, "PUT", "/api/admin/users/"+alice.ID+"/role", + `{"roleId":"`+role.RoleID+`","expectedStateVersion":`+strconv.FormatInt(alice.StateVersion, 10)+`,"idempotencyKey":"search-assign"}`, admin); rec.Code != http.StatusOK { + t.Fatalf("assign: %d %s", rec.Code, rec.Body.String()) + } + if rec := do(h, "GET", "/api/admin/users/search?query=alice&mode=exact", "", admin); rec.Code != http.StatusOK { + t.Fatalf("search: %d %s", rec.Code, rec.Body.String()) + } else if !strings.Contains(rec.Body.String(), role.RoleID) { + t.Fatalf("search missing role projection: %s", rec.Body.String()) + } +} + +func decodeRoleHTTP(t *testing.T, rec *httptest.ResponseRecorder) struct { + RoleID string `json:"roleId"` + Name string `json:"name"` +} { + t.Helper() + var role struct { + RoleID string `json:"roleId"` + Name string `json:"name"` + } + if err := json.Unmarshal(rec.Body.Bytes(), &role); err != nil { + t.Fatalf("decode role: %v body=%s", err, rec.Body.String()) + } + return role +} + +func createRoleHTTP(t *testing.T, h http.Handler, st *store.Store, admin, name string) struct { + RoleID string `json:"roleId"` + Name string `json:"name"` +} { + t.Helper() + rec := do(h, "POST", "/api/admin/roles", `{"name":"`+name+`"}`, admin) + if rec.Code != http.StatusOK { + t.Fatalf("create role %s: %d %s", name, rec.Code, rec.Body.String()) + } + return decodeRoleHTTP(t, rec) +} diff --git a/internal/server/roles.go b/internal/server/roles.go index e65dddd..5f358b6 100644 --- a/internal/server/roles.go +++ b/internal/server/roles.go @@ -31,6 +31,17 @@ func isAccountAdministrationAction(actionID string) bool { return store.IsAccountAdministrationAction(actionID) } +// systemActionAllowed reports, without writing a response, whether the actor +// holds a system action. Optional read projections (e.g. role summary in the +// account directory) use it to skip the projection when the caller cannot +// see it, so a missing grant stays invisible rather than being denied loudly. +func (s *Server) systemActionAllowed(actor, actionID string) bool { + if s.Auth == nil || !s.Auth.Enabled { + return true + } + return s.authorizer.AuthorizeSystem(actor, actionID).Allowed +} + func (s *Server) listPermissionCatalog(w http.ResponseWriter, r *http.Request) { if _, ok := s.requireSystemAction(w, r, "system.permissions.view"); !ok { return @@ -191,3 +202,154 @@ func (s *Server) explainSystemAuthorization(w http.ResponseWriter, r *http.Reque } writeJSON(w, http.StatusOK, decision) } + +// listRolePermissionPreview predicts role permission replace/patch effects +// without writing rows or receipts. Viewing is enough to call it; the commit +// revalidates every item. +func (s *Server) listRolePermissionPreview(w http.ResponseWriter, r *http.Request) { + actor, ok := s.requireSystemAction(w, r, "system.permissions.view") + if !ok { + return + } + var req struct { + Roles []store.RolePermissionPreviewInput `json:"roles"` + } + if err := decodeStrictJSON(r, &req); err != nil || len(req.Roles) == 0 { + http.Error(w, "invalid role permission preview", http.StatusBadRequest) + return + } + for _, role := range req.Roles { + if role.RoleID == "" { + http.Error(w, "invalid role permission preview", http.StatusBadRequest) + return + } + } + previews, err := s.st.PreviewRolePermissions(actor, req.Roles) + if err != nil { + writeStoreErr(w, err) + return + } + writeJSON(w, http.StatusOK, map[string]any{"previews": previews}) +} + +// batchPatchRolePermissions applies an explicit patch to several roles in +// one transaction. The actor must hold system.permissions.manage (R4, R5). +func (s *Server) batchPatchRolePermissions(w http.ResponseWriter, r *http.Request) { + actor, ok := s.requireSystemAction(w, r, "system.permissions.manage") + if !ok { + return + } + var req struct { + IdempotencyKey string `json:"idempotencyKey"` + Roles []store.RolePermissionPatchInput `json:"roles"` + } + if err := decodeStrictJSON(r, &req); err != nil || req.IdempotencyKey == "" || len(req.Roles) == 0 { + http.Error(w, "invalid role permission batch", http.StatusBadRequest) + return + } + for _, role := range req.Roles { + if role.RoleID == "" || role.ExpectedRoleVersion < 1 { + http.Error(w, "invalid role permission batch", http.StatusBadRequest) + return + } + } + batch, err := s.st.PatchRolePermissionsBatch(actor, req.Roles, req.IdempotencyKey) + if err != nil { + writeStoreErr(w, err) + return + } + writeJSON(w, http.StatusOK, map[string]any{"receipts": batch.Receipts}) +} + +// decodeRoleAssignments parses a role assignment payload shared by the +// batch commit (withKey=true, requires idempotencyKey) and the read-only +// preview (withKey=false). +func decodeRoleAssignments(w http.ResponseWriter, r *http.Request, withKey bool) ([]store.UserRoleAssignmentInput, string, bool) { + var req struct { + IdempotencyKey string `json:"idempotencyKey"` + Assignments []store.UserRoleAssignmentInput `json:"assignments"` + } + if err := decodeStrictJSON(r, &req); err != nil || len(req.Assignments) == 0 { + http.Error(w, "invalid role assignment batch", http.StatusBadRequest) + return nil, "", false + } + if withKey && req.IdempotencyKey == "" { + http.Error(w, "invalid role assignment batch", http.StatusBadRequest) + return nil, "", false + } + for _, assignment := range req.Assignments { + if assignment.UserID == "" || assignment.RoleID == "" || assignment.ExpectedStateVersion < 1 { + http.Error(w, "invalid role assignment batch", http.StatusBadRequest) + return nil, "", false + } + } + return req.Assignments, req.IdempotencyKey, true +} + +func (s *Server) assignUserRolesBatch(w http.ResponseWriter, r *http.Request) { + actor, ok := s.requireSystemAction(w, r, "system.roles.assign") + if !ok { + return + } + assignments, key, ok := decodeRoleAssignments(w, r, true) + if !ok { + return + } + batch, err := s.st.AssignUserRolesBatch(actor, assignments, key) + if err != nil { + writeStoreErr(w, err) + return + } + writeJSON(w, http.StatusOK, map[string]any{"bindings": batch.Bindings}) +} + +// previewUserRoleAssignments reads the commit rule for each assignment and +// returns it without writing rows or receipts. Viewing is enough to call it. +func (s *Server) previewUserRoleAssignments(w http.ResponseWriter, r *http.Request) { + if _, ok := s.requireSystemAction(w, r, "system.users.view"); !ok { + return + } + if _, ok := s.requireSystemAction(w, r, "system.roles.view"); !ok { + return + } + actor := s.owner(r) + assignments, _, ok := decodeRoleAssignments(w, r, false) + if !ok { + return + } + previews, err := s.st.PreviewUserRoleAssignments(actor, assignments) + if err != nil { + writeStoreErr(w, err) + return + } + writeJSON(w, http.StatusOK, map[string]any{"previews": previews}) +} + +func (s *Server) copyAssignRole(w http.ResponseWriter, r *http.Request) { + var actor string + for _, actionID := range []string{"system.roles.manage", "system.permissions.manage", "system.roles.assign"} { + var ok bool + if actor, ok = s.requireSystemAction(w, r, actionID); !ok { + return + } + } + var req struct { + Source store.RoleCopySource `json:"source"` + Name string `json:"name"` + Description string `json:"description"` + Overrides []store.RolePermissionChange `json:"overrides"` + Assignments []store.RoleCopyAssignment `json:"assignments"` + IdempotencyKey string `json:"idempotencyKey"` + } + if err := decodeStrictJSON(r, &req); err != nil || req.Source.RoleID == "" || req.Source.ExpectedRoleVersion < 1 || req.IdempotencyKey == "" { + http.Error(w, "invalid role copy", http.StatusBadRequest) + return + } + result, err := s.st.CreateRoleCopyAndAssign(actor, req.Source, store.RoleCreate{Name: req.Name, Description: req.Description}, + req.Overrides, req.Assignments, req.IdempotencyKey) + if err != nil { + writeStoreErr(w, err) + return + } + writeJSON(w, http.StatusOK, map[string]any{"role": result.Role, "bindings": result.Bindings, "linkedExpansion": result.LinkedExpansion, "receiptId": result.ReceiptID, "authorityEpoch": result.AuthorityEpoch}) +} diff --git a/internal/server/server.go b/internal/server/server.go index 0013465..a393b84 100644 --- a/internal/server/server.go +++ b/internal/server/server.go @@ -320,6 +320,12 @@ func (s *Server) Handler() http.Handler { mux.HandleFunc("GET /api/admin/roles/{roleId}", s.getRole) mux.HandleFunc("PATCH /api/admin/roles/{roleId}", s.patchRole) mux.HandleFunc("PUT /api/admin/roles/{roleId}/permissions", s.replaceRolePermissions) + mux.HandleFunc("POST /api/admin/roles/permissions/preview", s.listRolePermissionPreview) + mux.HandleFunc("POST /api/admin/roles/permissions/batch", s.batchPatchRolePermissions) + mux.HandleFunc("POST /api/admin/roles/copy-assign", s.copyAssignRole) + mux.HandleFunc("GET /api/admin/roles/{roleId}/members", s.listRoleMembers) + mux.HandleFunc("POST /api/admin/users/role-assignments", s.assignUserRolesBatch) + mux.HandleFunc("POST /api/admin/users/role-assignments/preview", s.previewUserRoleAssignments) mux.HandleFunc("GET /api/admin/users/{userId}/role", s.getUserRole) mux.HandleFunc("PUT /api/admin/users/{userId}/role", s.assignUserRole) mux.HandleFunc("GET /api/admin/users/{userId}/system-grants", s.getSystemGrants) diff --git a/internal/store/role_policy.go b/internal/store/role_policy.go index aab4e70..b9861bf 100644 --- a/internal/store/role_policy.go +++ b/internal/store/role_policy.go @@ -1,6 +1,7 @@ package store import ( + "context" "crypto/sha256" "database/sql" "encoding/hex" @@ -1377,3 +1378,1137 @@ func (s *Store) LinkedCapabilities(owner string) (CapabilityAssociation, error) } return out, tx.Commit() } + +// ===================================================================== +// IAM permission-management batch operations (ported from +// feature/iam-perm-ux-backend). Behaviour follows main's narrowed role +// model: the only role authority is project.create. Other catalog actions +// carry legacy audit rows in role_permissions but never authorize anything, +// so writers reject non-project.create change items the same way +// ReplaceRolePermissions already does (R2). +// ===================================================================== + +// RolePermissionPreviewInput is one role's proposed change set. Mode "replace" +// (the default) treats Changes as the full replace set; "patch" treats them as +// an explicit patch over the role's current rows. +type RolePermissionPreviewInput struct { + RoleID string `json:"roleId"` + ExpectedRoleVersion int64 `json:"expectedRoleVersion"` + Mode string `json:"mode,omitempty"` + Changes []RolePermissionChange `json:"changes"` +} + +const ( + RolePermissionPreviewReplace = "replace" + RolePermissionPreviewPatch = "patch" +) + +// RolePermissionStateChange describes one action whose display state differs +// between the role's current rows and the planned-after rows. +type RolePermissionStateChange struct { + ActionID string `json:"actionId"` + Label string `json:"label"` + Before string `json:"before"` + After string `json:"after"` +} + +// RolePermissionConflict names one action that the planned-after rows would +// leave in a state inconsistent with the bound project.create grant. +type RolePermissionConflict struct { + ActionID string `json:"actionId"` + Reason string `json:"reason"` +} + +// RolePermissionPreview is the planned-effect view of one role's change set, +// without writing. Error reports an item-level rejection and never fails the +// whole batch; the commit revalidates every item. +type RolePermissionPreview struct { + RoleID string `json:"roleId"` + RoleName string `json:"roleName"` + ExpectedRoleVersion int64 `json:"expectedRoleVersion"` + CurrentRoleVersion int64 `json:"currentRoleVersion"` + VersionMatches bool `json:"versionMatches"` + Changes []RolePermissionStateChange `json:"changes"` + LinkedExpansion []string `json:"linkedExpansion"` + LinkedExpansionState string `json:"linkedExpansionState,omitempty"` + KeptLinkedActions []string `json:"keptLinkedActions"` + MigrationNote string `json:"migrationNote,omitempty"` + Conflicts []RolePermissionConflict `json:"conflicts"` + Error string `json:"error,omitempty"` + ErrorActionID string `json:"errorActionId,omitempty"` +} + +const ( + permissionStateDenied = "不允许" + permissionStateProject = "按项目授权" + permissionStateDefault = "默认允许" + permissionStateInvalid = "非法组合" + linkedExpansionLinked = "按项目授权 · 仅本人创建的项目" + maxRolePermissionPreviewItem = 100 +) + +// RolePermissionPatchInput is one role's explicit patch. Only listed actions +// change; every unlisted row of the role stays exactly as stored. Unlisted +// legacy audit rows are preserved untouched. +type RolePermissionPatchInput struct { + RoleID string `json:"roleId"` + ExpectedRoleVersion int64 `json:"expectedRoleVersion"` + Changes []RolePermissionChange `json:"changes"` +} + +// RolePermissionBatchReceipt is one role's outcome inside a batch patch. All +// roles of a batch share the batch receipt ID and authority epoch. +type RolePermissionBatchReceipt struct { + RoleID string `json:"roleId"` + PolicyReceipt + PreviousRoleVersion int64 `json:"previousRoleVersion"` + Changes []RolePermissionStateChange `json:"changes"` + KeptLinkedActions []string `json:"keptLinkedActions"` +} + +// RolePermissionBatch is the union of every role receipt in one write. +type RolePermissionBatch struct { + ReceiptID string `json:"receiptId"` + AuthorityEpoch int64 `json:"authorityEpoch"` + Receipts []RolePermissionBatchReceipt `json:"receipts"` +} + +// UserRoleAssignmentInput is one assignment: replace the user's active +// binding with roleID. ExpectedStateVersion forbids stale state. +type UserRoleAssignmentInput struct { + UserID string `json:"userId"` + RoleID string `json:"roleId"` + ExpectedStateVersion int64 `json:"expectedStateVersion"` +} + +// UserRoleAssignmentResult is one assignment's outcome inside a batch. +type UserRoleAssignmentResult struct { + RoleBinding + PreviousRoleID string `json:"previousRoleId"` +} + +// UserRoleAssignmentBatch is the union of every assignment receipt in one +// rebind transaction. One batch ⇒ one authority epoch step. +type UserRoleAssignmentBatch struct { + ReceiptID string `json:"receiptId"` + AuthorityEpoch int64 `json:"authorityEpoch"` + Bindings []UserRoleAssignmentResult `json:"bindings"` +} + +// UserRoleAssignmentPreview predicts one assignment without writing. It is not +// an authorization token: the commit revalidates every item. +type UserRoleAssignmentPreview struct { + UserID string `json:"userId"` + Owner string `json:"owner"` + Name string `json:"name"` + CurrentRoleID string `json:"currentRoleId"` + CurrentRoleName string `json:"currentRoleName"` + TargetRoleID string `json:"targetRoleId"` + TargetRoleName string `json:"targetRoleName"` + StateMatches bool `json:"stateMatches"` + Error string `json:"error,omitempty"` +} + +// RoleCopySource is the role a copy-and-assign reads from. +type RoleCopySource struct { + RoleID string `json:"roleId"` + ExpectedRoleVersion int64 `json:"expectedRoleVersion"` +} + +// RoleCopyAssignment is one user the copy should rebind to the new role. +type RoleCopyAssignment struct { + UserID string `json:"userId"` + ExpectedStateVersion int64 `json:"expectedStateVersion"` +} + +// RoleCopyAssignResult is the outcome of one copy-and-assign transaction. +type RoleCopyAssignResult struct { + ReceiptID string `json:"receiptId"` + AuthorityEpoch int64 `json:"authorityEpoch"` + Role RoleAdminView `json:"role"` + LinkedExpansion []string `json:"linkedExpansion"` + Bindings []UserRoleAssignmentResult `json:"bindings"` +} + +// RoleMember is the minimal person view of one active role binding. It is +// what ListRoleMembersForActor returns per row, sorted by owner. +type RoleMember struct { + UserID string `json:"userId"` + Owner string `json:"owner"` + Name string `json:"name"` + Enabled bool `json:"enabled"` + StateVersion int64 `json:"stateVersion"` + AssignedAt time.Time `json:"assignedAt"` + BindingVersion int64 `json:"bindingVersion"` +} + +// UserRoleSummary is the role side of one active binding returned by the +// account directory: only roles the caller may surface. Empty when the user +// has no active binding. +type UserRoleSummary struct { + RoleID string `json:"roleId"` + Name string `json:"name"` + Enabled bool `json:"enabled"` +} + +const ( + maxRolePermissionBatch = 20 + maxRoleAssignmentBatch = 100 + + roleAssignmentUserMissing = "用户不存在" + roleAssignmentUserDisabled = "用户已停用" + roleAssignmentStateChanged = "状态版本已变化" + roleAssignmentRoleInvalid = "角色不存在或已停用" +) + +// rolePermissionChangeError names the batch item that makes a role replace or +// patch set invalid. Reason is user-facing Chinese text without raw IDs. +type rolePermissionChangeError struct { + ActionID string + Reason string +} + +func (e *rolePermissionChangeError) Error() string { + return fmt.Sprintf("%s: %s: %s", ErrInvalidRolePolicy, e.ActionID, e.Reason) +} + +func (e *rolePermissionChangeError) Unwrap() error { return ErrInvalidRolePolicy } + +// actionLabel returns the catalog label for actionID, or the ID itself when +// the action is not registered. +func actionLabel(actionID string) string { + if descriptor, ok := catalog.DescriptorByID(actionID); ok { + return descriptor.Label + } + return actionID +} + +// normalizePermissionChanges validates a role replace/patch set and indexes +// it by action. In main's narrowed role model, only project.create is a role +// authority; other actions are rejected with a user-facing reason so writers +// stay consistent with the existing ReplaceRolePermissions contract. +func normalizePermissionChanges(changes []RolePermissionChange) (map[string]RolePermissionChange, error) { + next := make(map[string]RolePermissionChange, len(changes)) + for _, change := range changes { + descriptor, ok := catalog.DescriptorByID(change.ActionID) + _, duplicate := next[change.ActionID] + reason := "" + switch { + case !ok: + reason = "包含未登记的权限动作" + case descriptor.Protected: + reason = "「" + descriptor.Label + "」是受保护的系统授权，只能按用户单独授予" + case change.ActionID != catalog.ProjectAccessAction: + reason = "「" + descriptor.Label + "」不是角色可授权限，当前角色模型仅对 project.create 授权" + case duplicate: + reason = "「" + descriptor.Label + "」在同一批变更中重复出现" + case change.Allowed && !change.CapAllowed: + reason = "「" + descriptor.Label + "」不能设为默认允许却关闭上限，该组合不合法" + } + if reason != "" { + return nil, &rolePermissionChangeError{ActionID: change.ActionID, Reason: reason} + } + next[change.ActionID] = change + } + return next, nil +} + +// policyWriteBatch is the batch-shaped policy transaction: it locks the actor +// and every target user in owner order, then authority_state, before fn runs. +// The locked rows must still be the enabled users the caller named; fn must +// not lock further users, and policyWriteBatch is not reentrant. +func (s *Store) policyWriteBatch(actor string, targetUserIDs []string, fn func(*sql.Tx, Account, map[string]Account, int64) error) error { + if actor == "" || fn == nil { + return ErrAccountForbidden + } + owners := []string{actor} + ownerByUser := make(map[string]string, len(targetUserIDs)) + for _, userID := range targetUserIDs { + target, err := s.GetAccount(userID) + if err != nil { + return ErrAccountForbidden + } + ownerByUser[userID] = target.Owner + owners = append(owners, target.Owner) + } + tx, err := s.db.Begin() + if err != nil { + return err + } + defer tx.Rollback() + accounts, err := s.lockAccountUsers(tx, owners...) + if err != nil { + return ErrAccountForbidden + } + actorAccount := accounts[actor] + if !actorAccount.Enabled { + return ErrAccountForbidden + } + targets := make(map[string]Account, len(ownerByUser)) + for userID, owner := range ownerByUser { + target := accounts[owner] + if !target.Enabled || target.ID != userID { + return ErrAccountForbidden + } + targets[userID] = target + } + query := `SELECT authority_epoch FROM authority_state WHERE id=1` + if s.Dialect() == "postgres" { + query += ` FOR UPDATE` + } + var epoch int64 + if err := tx.QueryRow(query).Scan(&epoch); err != nil { + return err + } + if err := fn(tx, actorAccount, targets, epoch); err != nil { + return err + } + return tx.Commit() +} + +// capabilityConflict is one linked action an enabled project.create denies. +// UserID is set when a bound project.create grant holder causes it. +type capabilityConflict struct { + RoleID string + UserID string + ActionID string +} + +// conflicts lists, in a stable order, every role that enables project.create +// while denying a linked action, then every project.create grant holder whose +// active role denies one. Read surfaces use this to surface conflicts without +// writing; the commit gate (checkCapabilityAssociationTx) is unchanged. +func (state capabilityAssociation) conflicts() []capabilityConflict { + out := []capabilityConflict{} + roleIDs := make([]string, 0, len(state.roles)) + for roleID := range state.roles { + roleIDs = append(roleIDs, roleID) + } + sort.Strings(roleIDs) + for _, roleID := range roleIDs { + permissions := state.roles[roleID] + if !projectCreateEnabled(permissions) { + continue + } + for _, actionID := range catalog.ProjectCreateLinkedActions() { + if linkedActionDenied(permissions, actionID) { + out = append(out, capabilityConflict{RoleID: roleID, ActionID: actionID}) + } + } + } + userIDs := []string{} + for userID, creator := range state.creators { + if creator { + userIDs = append(userIDs, userID) + } + } + sort.Strings(userIDs) + for _, userID := range userIDs { + roleID, bound := state.bindings[userID] + if !bound { + continue + } + for _, actionID := range catalog.ProjectCreateLinkedActions() { + if linkedActionDenied(state.roles[roleID], actionID) { + out = append(out, capabilityConflict{RoleID: roleID, UserID: userID, ActionID: actionID}) + } + } + } + return out +} + +// capabilityConflictReason renders a human-readable explanation for the +// conflict. Reason text is the same for the preview and the commit gate. +func capabilityConflictReason(conflict capabilityConflict) string { + label := actionLabel(conflict.ActionID) + if conflict.UserID != "" { + return "使用此角色的用户已直接获授创建项目，其本人项目的「" + label + "」资格不能被明确禁止" + } + return "创建项目需要本人项目的「" + label + "」资格，但该资格已被明确禁止" +} + +// rolePermissionQuerier is the read interface used by rolePermissionRecords +// to run inside either *sql.Tx (PreviewRolePermissions) or *sql.DB +// (RolePermissions). +type rolePermissionQuerier interface { + Query(string, ...any) (*sql.Rows, error) +} + +// rolePermissionRecords reads every row of one role's permission table in a +// stable order; the public RolePermissions view still filters the response to +// the project.create row per main's narrowed contract. +func (s *Store) rolePermissionRecords(db rolePermissionQuerier, roleID string) ([]RolePermissionRecord, error) { + rows, err := db.Query(s.q(`SELECT action_id,allowed,cap_allowed,permission_version FROM role_permissions WHERE role_id=? ORDER BY action_id`), roleID) + if err != nil { + return nil, err + } + defer rows.Close() + out := []RolePermissionRecord{} + for rows.Next() { + var permission RolePermissionRecord + if err := rows.Scan(&permission.ActionID, &permission.Allowed, &permission.CapAllowed, &permission.PermissionVersion); err != nil { + return nil, err + } + out = append(out, permission) + } + return out, rows.Err() +} + +// rolePermissionBitsTx reads every action bit of one role inside one tx. +func (s *Store) rolePermissionBitsTx(tx *sql.Tx, roleID string) (map[string]RolePermissionChange, error) { + rows, err := tx.Query(s.q(`SELECT action_id,allowed,cap_allowed FROM role_permissions WHERE role_id=?`), roleID) + if err != nil { + return nil, err + } + defer rows.Close() + out := map[string]RolePermissionChange{} + for rows.Next() { + var permission RolePermissionChange + if err := rows.Scan(&permission.ActionID, &permission.Allowed, &permission.CapAllowed); err != nil { + return nil, err + } + out[permission.ActionID] = permission + } + return out, rows.Err() +} + +// checkRoleAssignmentTx judges one assignment against current rows. account +// is nil when the user does not exist. class is the batch-wide error the item +// would cause at commit; reason is its user-facing Chinese text. +func (s *Store) checkRoleAssignmentTx(tx *sql.Tx, account *Account, item UserRoleAssignmentInput, lockRole bool) (roleAssignmentCheck, error) { + var check roleAssignmentCheck + role, err := s.roleTx(tx, item.RoleID, lockRole) + switch { + case err == nil: + check.role, check.roleFound = role, true + case !errors.Is(err, ErrNotFound): + return check, err + } + switch { + case account == nil: + check.reason, check.class = roleAssignmentUserMissing, ErrAccountForbidden + case !account.Enabled: + check.reason, check.class = roleAssignmentUserDisabled, ErrAccountForbidden + case account.StateVersion != item.ExpectedStateVersion: + check.reason, check.class = roleAssignmentStateChanged, ErrConflict + case !check.roleFound || !check.role.Enabled: + check.reason, check.class = roleAssignmentRoleInvalid, ErrInvalidRolePolicy + } + return check, nil +} + +type roleAssignmentCheck struct { + role RoleRecord + roleFound bool + reason string + class error +} + +// assignmentUsers validates batch shape: at most maxRoleAssignmentBatch +// items, each naming a distinct user with a positive expected state version. +func assignmentUsers(items []UserRoleAssignmentInput) ([]string, error) { + if len(items) > maxRoleAssignmentBatch { + return nil, ErrInvalidRolePolicy + } + seen := make(map[string]bool, len(items)) + userIDs := make([]string, 0, len(items)) + for _, item := range items { + if item.UserID == "" || item.ExpectedStateVersion < 1 || seen[item.UserID] { + return nil, ErrInvalidRolePolicy + } + seen[item.UserID] = true + userIDs = append(userIDs, item.UserID) + } + return userIDs, nil +} + +// validateRoleAssignmentItems checks the full assignment shape: every role +// ID present, every user distinct, every state version positive. +func validateRoleAssignmentItems(items []UserRoleAssignmentInput) ([]string, error) { + if len(items) == 0 { + return nil, ErrInvalidRolePolicy + } + for _, item := range items { + if item.RoleID == "" { + return nil, ErrInvalidRolePolicy + } + } + return assignmentUsers(items) +} + +// activeRoleTx reports the given user's currently-active role, or empty +// strings when the user has no active binding. +func (s *Store) activeRoleTx(tx *sql.Tx, userID string) (string, string, error) { + var roleID, name string + err := tx.QueryRow(s.q(`SELECT b.role_id,r.name FROM user_role_bindings b JOIN roles r ON r.role_id=b.role_id + WHERE b.user_id=? AND b.active=?`), userID, true).Scan(&roleID, &name) + if errors.Is(err, sql.ErrNoRows) { + return "", "", nil + } + return roleID, name, err +} + +// rebindUserRoleTx ends the user's active binding, inserts a new binding, and +// advances the user's state version by one. The user must still be enabled at +// expectedState; otherwise ErrConflict. +func (s *Store) rebindUserRoleTx(tx *sql.Tx, actorID, userID, roleID string, expectedState int64, now string) (string, error) { + if _, err := tx.Exec(s.q(`UPDATE user_role_bindings SET active=?,binding_version=binding_version+1,ended_at=? WHERE user_id=? AND active=?`), false, now, userID, true); err != nil { + return "", err + } + bindingID := newID("binding") + if _, err := tx.Exec(s.q(`INSERT INTO user_role_bindings(binding_id,user_id,role_id,active,binding_version,assigned_by,assigned_at,ended_at) + VALUES(?,?,?,?,?,?,?,?)`), bindingID, userID, roleID, true, 1, actorID, now, ""); err != nil { + return "", err + } + result, err := tx.Exec(s.q(`UPDATE users SET state_version=state_version+1 WHERE id=? AND state_version=? AND enabled=?`), userID, expectedState, true) + if err != nil { + return "", err + } + if n, err := result.RowsAffected(); err != nil { + return "", err + } else if n != 1 { + return "", ErrConflict + } + return bindingID, nil +} + +// assignRolesTx validates every item, then rebinds each user. A rejected +// item rolls the whole batch back; targets are the locked accounts. The +// super-admin target protection and the no-elevation-through-role grant +// checks match AssignUserRole so the batch cannot become an elevation path +// (R4, R5). +func (s *Store) assignRolesTx(tx *sql.Tx, actorAccount Account, targets map[string]Account, items []UserRoleAssignmentInput, now string, epoch int64) ([]UserRoleAssignmentResult, error) { + for _, item := range items { + target, locked := targets[item.UserID] + account := &target + if !locked { + account = nil + } + if err := requireSuperAdminTargetAccess(actorAccount, target); err != nil { + return nil, err + } + if !actorAccount.IsSuperAdmin { + grantsAdministration, err := s.roleGrantsAccountAdministrationTx(tx, item.RoleID) + if err != nil { + return nil, err + } + if grantsAdministration { + return nil, ErrAccountForbidden + } + } + check, err := s.checkRoleAssignmentTx(tx, account, item, true) + if err != nil { + return nil, err + } + if check.class != nil { + return nil, check.class + } + } + assignedAt, _ := time.Parse(time.RFC3339Nano, now) + out := make([]UserRoleAssignmentResult, 0, len(items)) + for _, item := range items { + previousRoleID, _, err := s.activeRoleTx(tx, item.UserID) + if err != nil { + return nil, err + } + bindingID, err := s.rebindUserRoleTx(tx, actorAccount.ID, item.UserID, item.RoleID, item.ExpectedStateVersion, now) + if err != nil { + return nil, err + } + out = append(out, UserRoleAssignmentResult{PreviousRoleID: previousRoleID, RoleBinding: RoleBinding{ + BindingID: bindingID, UserID: item.UserID, RoleID: item.RoleID, Active: true, BindingVersion: 1, + AssignedBy: actorAccount.ID, AssignedAt: assignedAt, UserStateVersion: item.ExpectedStateVersion + 1, AuthorityEpoch: epoch + 1}}) + } + return out, nil +} + +// requireEnabledActorTx is the read-mode equivalent of policyWrite's actor +// precheck: the actor's users row must exist and still be enabled. +func (s *Store) requireEnabledActorTx(tx *sql.Tx, actor string) error { + var enabled bool + err := tx.QueryRow(s.q(`SELECT enabled FROM users WHERE owner=?`), actor).Scan(&enabled) + if errors.Is(err, sql.ErrNoRows) || (err == nil && !enabled) { + return ErrAccountForbidden + } + return err +} + +// PreviewUserRoleAssignments judges each assignment with the commit's rule +// in one read transaction. It never writes rows, receipts, or the authority +// epoch. +func (s *Store) PreviewUserRoleAssignments(actor string, items []UserRoleAssignmentInput) ([]UserRoleAssignmentPreview, error) { + if actor == "" { + return nil, ErrAccountForbidden + } + if _, err := validateRoleAssignmentItems(items); err != nil { + return nil, err + } + tx, err := s.db.Begin() + if err != nil { + return nil, err + } + defer tx.Rollback() + if err := s.requireEnabledActorTx(tx, actor); err != nil { + return nil, err + } + out := make([]UserRoleAssignmentPreview, 0, len(items)) + for _, item := range items { + preview := UserRoleAssignmentPreview{UserID: item.UserID, TargetRoleID: item.RoleID} + var account *Account + found, err := scanAccount(tx.QueryRow(s.q(`SELECT `+accountColumns+` FROM users WHERE id=?`), item.UserID)) + switch { + case err == nil: + account = &found + preview.Owner, preview.Name = found.Owner, found.Profile.Name + preview.StateMatches = found.StateVersion == item.ExpectedStateVersion + if preview.CurrentRoleID, preview.CurrentRoleName, err = s.activeRoleTx(tx, found.ID); err != nil { + return nil, err + } + case !errors.Is(err, ErrNotFound): + return nil, err + } + check, err := s.checkRoleAssignmentTx(tx, account, item, false) + if err != nil { + return nil, err + } + if check.roleFound { + preview.TargetRoleName = check.role.Name + } + preview.Error = check.reason + out = append(out, preview) + } + return out, nil +} + +// AssignUserRolesBatch rebinds several users in one policy transaction with +// one authority epoch step and one idempotency receipt; any rejected item +// rolls back the whole batch. +func (s *Store) AssignUserRolesBatch(actor string, items []UserRoleAssignmentInput, key string) (UserRoleAssignmentBatch, error) { + userIDs, err := validateRoleAssignmentItems(items) + if err != nil { + return UserRoleAssignmentBatch{}, err + } + requestHash := policyRequestHash(struct{ Items []UserRoleAssignmentInput }{items}) + var out UserRoleAssignmentBatch + err = s.policyWriteBatch(actor, userIDs, func(tx *sql.Tx, actorAccount Account, targets map[string]Account, epoch int64) error { + if err := s.requireRoleAuthorityWritableTx(tx); err != nil { + return err + } + replayed, err := s.replayReceipt(tx, actorAccount.ID, key, "user.role.assign.batch", requestHash, &out) + if err != nil || replayed { + return err + } + now := nowISO() + bindings, err := s.assignRolesTx(tx, actorAccount, targets, items, now, epoch) + if err != nil { + return err + } + if err := s.checkCapabilityAssociationTx(tx, userIDs, nil, nil); err != nil { + return err + } + if _, err := tx.Exec(s.q(`UPDATE authority_state SET authority_epoch=?,updated_at=? WHERE id=1 AND authority_epoch=?`), epoch+1, now, epoch); err != nil { + return err + } + out = UserRoleAssignmentBatch{ReceiptID: newID("receipt"), AuthorityEpoch: epoch + 1, Bindings: bindings} + return s.saveReceipt(tx, actorAccount.ID, key, "user.role.assign.batch", requestHash, out) + }) + return out, err +} + +// PreviewRolePermissions predicts ReplaceRolePermissions for several roles in +// one read transaction. It never writes rows, receipts, or the authority +// epoch. The commit revalidates every item. +func (s *Store) PreviewRolePermissions(actor string, items []RolePermissionPreviewInput) ([]RolePermissionPreview, error) { + if actor == "" { + return nil, ErrAccountForbidden + } + if len(items) == 0 || len(items) > maxRolePermissionPreviewItem { + return nil, ErrInvalidRolePolicy + } + tx, err := s.db.Begin() + if err != nil { + return nil, err + } + defer tx.Rollback() + if err := s.requireEnabledActorTx(tx, actor); err != nil { + return nil, err + } + out := make([]RolePermissionPreview, 0, len(items)) + for _, item := range items { + preview, err := s.previewRolePermissionsTx(tx, item) + if err != nil { + return nil, err + } + out = append(out, preview) + } + return out, nil +} + +func (s *Store) previewRolePermissionsTx(tx *sql.Tx, item RolePermissionPreviewInput) (RolePermissionPreview, error) { + switch item.Mode { + case "", RolePermissionPreviewReplace, RolePermissionPreviewPatch: + default: + return RolePermissionPreview{}, ErrInvalidRolePolicy + } + role, err := s.roleTx(tx, item.RoleID, false) + if errors.Is(err, ErrNotFound) { + return RolePermissionPreview{RoleID: item.RoleID, Changes: []RolePermissionStateChange{}, + LinkedExpansion: []string{}, KeptLinkedActions: []string{}, Conflicts: []RolePermissionConflict{}, + Error: roleAssignmentRoleInvalid, ErrorActionID: ""}, nil + } + if err != nil { + return RolePermissionPreview{}, err + } + out := RolePermissionPreview{RoleID: role.RoleID, RoleName: role.Name, ExpectedRoleVersion: item.ExpectedRoleVersion, + CurrentRoleVersion: role.RoleVersion, VersionMatches: role.RoleVersion == item.ExpectedRoleVersion, + Changes: []RolePermissionStateChange{}, LinkedExpansion: []string{}, KeptLinkedActions: []string{}, + Conflicts: []RolePermissionConflict{}} + next, err := normalizePermissionChanges(item.Changes) + var changeErr *rolePermissionChangeError + if errors.As(err, &changeErr) { + out.Error, out.ErrorActionID = changeErr.Reason, changeErr.ActionID + return out, nil + } + if err != nil { + return RolePermissionPreview{}, err + } + current, err := s.rolePermissionBitsTx(tx, role.RoleID) + if err != nil { + return RolePermissionPreview{}, err + } + after := map[string]RolePermissionChange{} + for actionID, row := range current { + after[actionID] = row + } + for actionID, row := range next { + after[actionID] = row + } + wasCreator := projectCreateEnabled(current) + isCreator := projectCreateEnabled(after) + if wasCreator && !isCreator { + kept := keptLinkedRows(current) + out.KeptLinkedActions = append(out.KeptLinkedActions, kept...) + out.MigrationNote = projectCreateDisabledPreviewNote(kept) + } + out.Changes = rolePermissionStateChanges(current, after, nil) + state, err := s.loadCapabilityAssociationTx(tx, nil, []string{role.RoleID}) + if err != nil { + return RolePermissionPreview{}, err + } + state.roles[role.RoleID] = after + for _, conflict := range state.conflicts() { + if conflict.RoleID != role.RoleID { + continue + } + out.Conflicts = append(out.Conflicts, RolePermissionConflict{ + ActionID: conflict.ActionID, Reason: capabilityConflictReason(conflict), + }) + } + return out, nil +} + +// keptLinkedRows lists the linked actions the role already has an explicit +// row for, so disabling project.create keeps them in place. +func keptLinkedRows(current map[string]RolePermissionChange) []string { + kept := []string{} + for _, actionID := range catalog.ProjectCreateLinkedActions() { + if _, existed := current[actionID]; existed { + kept = append(kept, actionID) + } + } + return kept +} + +func projectCreateDisabledPreviewNote(kept []string) string { + if len(kept) == 0 { + return "关闭创建项目后，没有需要保留的本人项目管理资格" + } + labels := make([]string, 0, len(kept)) + for _, actionID := range kept { + labels = append(labels, "「"+actionLabel(actionID)+"」") + } + return "关闭创建项目后，以下既有资格将保留：" + strings.Join(labels, "、") + "；如需收回请明确移除" +} + +// rolePermissionStateChanges lists every action whose display state differs +// between before and after, in catalog order. Linked-expansion rows are +// reported separately and skipped here. +func rolePermissionStateChanges(before, after map[string]RolePermissionChange, expansion []string) []RolePermissionStateChange { + expanded := map[string]bool{} + for _, actionID := range expansion { + expanded[actionID] = true + } + out := []RolePermissionStateChange{} + for _, descriptor := range catalog.Catalog() { + if expanded[descriptor.ActionID] { + continue + } + beforeName, afterName := permissionStateDenied, permissionStateDenied + if row, ok := before[descriptor.ActionID]; ok { + beforeName = permissionStateName(row.Allowed, row.CapAllowed) + } + if row, ok := after[descriptor.ActionID]; ok { + afterName = permissionStateName(row.Allowed, row.CapAllowed) + } + if beforeName != afterName { + out = append(out, RolePermissionStateChange{ActionID: descriptor.ActionID, + Label: descriptor.Label, Before: beforeName, After: afterName}) + } + } + return out +} + +// permissionStateName is the role permission view's user-facing state. +func permissionStateName(allowed, capAllowed bool) string { + switch { + case allowed && capAllowed: + return permissionStateDefault + case !allowed && capAllowed: + return permissionStateProject + case !allowed && !capAllowed: + return permissionStateDenied + } + return permissionStateInvalid +} + +// patchRolePermissionsTx applies an explicit patch to one role: list-only +// rows are upserted, every other row of the role stays exactly as stored. +// Returns a per-role batch receipt; the surrounding transaction is rolled +// back on any error. Only project.create may appear in Changes per main's +// narrowed model; other rows in the role are inert legacy audit data. +func (s *Store) patchRolePermissionsTx(tx *sql.Tx, actorID string, item RolePermissionPatchInput, now string) (RolePermissionBatchReceipt, error) { + role, err := s.roleTx(tx, item.RoleID, true) + if errors.Is(err, ErrNotFound) { + return RolePermissionBatchReceipt{}, ErrRolePolicyRoleMissing + } + if err != nil { + return RolePermissionBatchReceipt{}, err + } + if role.RoleVersion != item.ExpectedRoleVersion { + return RolePermissionBatchReceipt{}, ErrRolePolicyVersion + } + patch, err := normalizePermissionChanges(item.Changes) + if err != nil { + return RolePermissionBatchReceipt{}, err + } + current, err := s.rolePermissionBitsTx(tx, role.RoleID) + if err != nil { + return RolePermissionBatchReceipt{}, err + } + after := map[string]RolePermissionChange{} + for actionID, row := range current { + after[actionID] = row + } + for actionID, row := range patch { + after[actionID] = row + } + if err := s.upsertRolePermissionsTx(tx, actorID, role.RoleID, current, after, now); err != nil { + return RolePermissionBatchReceipt{}, err + } + result, err := tx.Exec(s.q(`UPDATE roles SET role_version=role_version+1,updated_by=?,updated_at=? WHERE role_id=? AND role_version=?`), actorID, now, role.RoleID, item.ExpectedRoleVersion) + if err != nil { + return RolePermissionBatchReceipt{}, err + } + if n, err := result.RowsAffected(); err != nil { + return RolePermissionBatchReceipt{}, err + } else if n != 1 { + return RolePermissionBatchReceipt{}, ErrRolePolicyVersion + } + wasCreator := projectCreateEnabled(after) + afterPatch := map[string]RolePermissionChange{} + for actionID, row := range after { + afterPatch[actionID] = row + } + for actionID, row := range patch { + afterPatch[actionID] = row + } + isCreator := projectCreateEnabled(afterPatch) + disabling := wasCreator && !isCreator + kept := []string{} + if disabling { + kept = append(kept, keptLinkedRows(current)...) + } + out := RolePermissionBatchReceipt{RoleID: role.RoleID, PreviousRoleVersion: role.RoleVersion, + PolicyReceipt: PolicyReceipt{RoleVersion: role.RoleVersion + 1}, + Changes: rolePermissionStateChanges(current, afterPatch, nil)} + if disabling { + out.KeptLinkedActions = append(out.KeptLinkedActions, kept...) + out.MigrationNote = projectCreateDisabledNote(kept) + } + return out, nil +} + +// upsertRolePermissionsTx inserts or updates rows so that, after it returns, +// every row named in "after" matches its target (allowed, cap_allowed). Rows +// in "current" but not in "after" are left untouched (patch semantics). +func (s *Store) upsertRolePermissionsTx(tx *sql.Tx, actorID, roleID string, current, after map[string]RolePermissionChange, now string) error { + writes := make([]RolePermissionChange, 0, len(after)) + for _, row := range after { + existing, exists := current[row.ActionID] + if !exists || existing.Allowed != row.Allowed || existing.CapAllowed != row.CapAllowed { + writes = append(writes, row) + } + } + for _, row := range writes { + if _, err := tx.Exec(s.q(`INSERT INTO role_permissions(role_id,action_id,allowed,cap_allowed,permission_version,updated_by,updated_at) + VALUES(?,?,?,?,?,?,?) ON CONFLICT(role_id,action_id) DO UPDATE SET allowed=excluded.allowed,cap_allowed=excluded.cap_allowed, + permission_version=permission_version+1,updated_by=excluded.updated_by,updated_at=excluded.updated_at`), + roleID, row.ActionID, row.Allowed, row.CapAllowed, 1, actorID, now); err != nil { + return err + } + } + return nil +} + +// PatchRolePermissionsBatch applies explicit permission patches to several +// roles in one policy transaction: one authority epoch step, one idempotency +// receipt, and no write at all when any role is stale or invalid. Each +// role's role_version advance is a no-op for stale input. +func (s *Store) PatchRolePermissionsBatch(actor string, items []RolePermissionPatchInput, key string) (RolePermissionBatch, error) { + if len(items) == 0 || len(items) > maxRolePermissionBatch { + return RolePermissionBatch{}, ErrInvalidRolePolicy + } + roleIDs := make([]string, 0, len(items)) + seen := make(map[string]bool, len(items)) + for _, item := range items { + if item.RoleID == "" || seen[item.RoleID] { + return RolePermissionBatch{}, ErrInvalidRolePolicy + } + seen[item.RoleID] = true + roleIDs = append(roleIDs, item.RoleID) + } + requestHash := policyRequestHash(struct{ Items []RolePermissionPatchInput }{items}) + var out RolePermissionBatch + err := s.policyWriteBatch(actor, nil, func(tx *sql.Tx, actorAccount Account, _ map[string]Account, epoch int64) error { + if err := s.requireRoleAuthorityWritableTx(tx); err != nil { + return err + } + replayed, err := s.replayReceipt(tx, actorAccount.ID, key, "role.permissions.batch_patch", requestHash, &out) + if err != nil || replayed { + return err + } + now := nowISO() + batch := RolePermissionBatch{ReceiptID: newID("receipt"), AuthorityEpoch: epoch + 1, + Receipts: make([]RolePermissionBatchReceipt, 0, len(items))} + for _, item := range items { + receipt, err := s.patchRolePermissionsTx(tx, actorAccount.ID, item, now) + if err != nil { + return err + } + receipt.ReceiptID, receipt.AuthorityEpoch = batch.ReceiptID, batch.AuthorityEpoch + batch.Receipts = append(batch.Receipts, receipt) + } + if err := s.checkCapabilityAssociationTx(tx, nil, roleIDs, nil); err != nil { + return err + } + if _, err := tx.Exec(s.q(`UPDATE authority_state SET authority_epoch=?,updated_at=? WHERE id=1 AND authority_epoch=?`), epoch+1, now, epoch); err != nil { + return err + } + out = batch + return s.saveReceipt(tx, actorAccount.ID, key, "role.permissions.batch_patch", requestHash, out) + }) + return out, err +} + +// CreateRoleCopyAndAssign copies a role's non-protected permission rows into +// a new enabled role, applies overrides as an explicit patch, and rebinds +// the assigned users, all in one policy transaction. Protected system +// grants, administrator identity, and project memberships are never copied. +func (s *Store) CreateRoleCopyAndAssign(actor string, source RoleCopySource, spec RoleCreate, overrides []RolePermissionChange, assignments []RoleCopyAssignment, key string) (RoleCopyAssignResult, error) { + name, description, err := validateRoleText(spec.Name, spec.Description) + if err != nil || source.RoleID == "" { + return RoleCopyAssignResult{}, ErrInvalidRolePolicy + } + items := make([]UserRoleAssignmentInput, 0, len(assignments)) + for _, assignment := range assignments { + items = append(items, UserRoleAssignmentInput{UserID: assignment.UserID, RoleID: "pending", ExpectedStateVersion: assignment.ExpectedStateVersion}) + } + userIDs, err := assignmentUsers(items) + if err != nil { + return RoleCopyAssignResult{}, err + } + requestHash := policyRequestHash(struct { + Source RoleCopySource + Name string + Description string + Overrides []RolePermissionChange + Assignments []RoleCopyAssignment + }{source, name, description, overrides, assignments}) + var out RoleCopyAssignResult + err = s.policyWriteBatch(actor, userIDs, func(tx *sql.Tx, actorAccount Account, targets map[string]Account, epoch int64) error { + if err := s.requireRoleAuthorityWritableTx(tx); err != nil { + return err + } + replayed, err := s.replayReceipt(tx, actorAccount.ID, key, "role.copy.assign", requestHash, &out) + if err != nil || replayed { + return err + } + sourceRole, err := s.roleTx(tx, source.RoleID, true) + if errors.Is(err, ErrNotFound) { + return ErrRolePolicyRoleMissing + } + if err != nil { + return err + } + if sourceRole.RoleVersion != source.ExpectedRoleVersion { + return ErrRolePolicyVersion + } + sourceRows, err := s.rolePermissionBitsTx(tx, sourceRole.RoleID) + if err != nil { + return err + } + copied := make(map[string]RolePermissionChange, len(sourceRows)) + for actionID, row := range sourceRows { + if descriptor, ok := catalog.DescriptorByID(actionID); ok && !descriptor.Protected { + copied[actionID] = row + } + } + patch, err := normalizePermissionChanges(overrides) + if err != nil { + return err + } + merged := make(map[string]RolePermissionChange, len(copied)+len(patch)) + for actionID, row := range copied { + merged[actionID] = row + } + for actionID, row := range patch { + merged[actionID] = row + } + sourceWasCreator := projectCreateEnabled(copied) + copyIsCreator := projectCreateEnabled(merged) + if sourceWasCreator && !copyIsCreator { + // Disabling a copy is rejected: the new role would lose the source's + // project.create authority, which is the whole point of copying. + return ErrInvalidRolePolicy + } + now := nowISO() + roleID := newID("role") + if _, err := tx.Exec(s.q(`INSERT INTO roles(role_id,name,normalized_name,description,enabled,role_version,created_by,updated_by,created_at,updated_at) + VALUES(?,?,?,?,?,?,?,?,?,?)`), roleID, name, normalizeRoleName(name), description, true, 1, actorAccount.ID, actorAccount.ID, now, now); err != nil { + return err + } + writes := make([]RolePermissionChange, 0, len(merged)) + for _, row := range merged { + writes = append(writes, row) + } + if err := s.upsertRolePermissionsTx(tx, actorAccount.ID, roleID, map[string]RolePermissionChange{}, writes, now); err != nil { + return err + } + for i := range items { + items[i].RoleID = roleID + } + bindings, err := s.assignRolesTx(tx, actorAccount, targets, items, now, epoch) + if err != nil { + return err + } + if err := s.checkCapabilityAssociationTx(tx, userIDs, []string{roleID}, nil); err != nil { + return err + } + if _, err := tx.Exec(s.q(`UPDATE authority_state SET authority_epoch=?,updated_at=? WHERE id=1 AND authority_epoch=?`), epoch+1, now, epoch); err != nil { + return err + } + role, err := s.roleTx(tx, roleID, false) + if err != nil { + return err + } + permissions, err := s.rolePermissionRecords(tx, roleID) + if err != nil { + return err + } + out = RoleCopyAssignResult{ReceiptID: newID("receipt"), AuthorityEpoch: epoch + 1, + Role: RoleAdminView{RoleRecord: role, BindingCount: len(bindings), Permissions: permissions}, + Bindings: bindings} + return s.saveReceipt(tx, actorAccount.ID, key, "role.copy.assign", requestHash, out) + }) + return out, err +} + +// ListRoleMembersForActor reads a role's active members, ordered by owner, +// and the account directory revision from one snapshot. The actor's +// delegated authority is rechecked under lock before any member row is read. +func (s *Store) ListRoleMembersForActor(actorOwner, roleID string) ([]RoleMember, AccountDirectoryRevision, error) { + var tx *sql.Tx + var err error + if s.Dialect() == "postgres" { + tx, err = s.db.BeginTx(context.Background(), &sql.TxOptions{Isolation: sql.LevelRepeatableRead}) + } else { + tx, err = s.db.Begin() + } + if err != nil { + return nil, AccountDirectoryRevision{}, err + } + defer tx.Rollback() + locked, err := s.lockAccountUsers(tx, actorOwner) + if errors.Is(err, ErrNotFound) { + return nil, AccountDirectoryRevision{}, ErrAccountForbidden + } + if err != nil { + return nil, AccountDirectoryRevision{}, err + } + for _, actionID := range []string{"system.users.view", "system.roles.view"} { + if err := s.requireSystemActionTx(tx, locked[actorOwner], actionID); err != nil { + return nil, AccountDirectoryRevision{}, err + } + } + if _, err := s.roleTx(tx, roleID, false); err != nil { + return nil, AccountDirectoryRevision{}, err + } + rows, err := tx.Query(s.q(`SELECT u.id,u.owner,COALESCE(u.name,''),u.enabled,u.state_version,b.assigned_at,b.binding_version + FROM user_role_bindings b JOIN users u ON u.id=b.user_id WHERE b.role_id=? AND b.active=? ORDER BY u.owner,u.id`), roleID, true) + if err != nil { + return nil, AccountDirectoryRevision{}, err + } + members := []RoleMember{} + for rows.Next() { + var member RoleMember + var assignedAt string + if err := rows.Scan(&member.UserID, &member.Owner, &member.Name, &member.Enabled, &member.StateVersion, &assignedAt, &member.BindingVersion); err != nil { + rows.Close() + return nil, AccountDirectoryRevision{}, err + } + member.AssignedAt, _ = time.Parse(time.RFC3339Nano, assignedAt) + members = append(members, member) + } + if err := rows.Err(); err != nil { + rows.Close() + return nil, AccountDirectoryRevision{}, err + } + rows.Close() + var revision AccountDirectoryRevision + if err := tx.QueryRow(`SELECT public_revision,staff_no_revision,private_revision FROM account_directory_revision WHERE id=1`). + Scan(&revision.Public, &revision.StaffNo, &revision.Private); err != nil { + return nil, AccountDirectoryRevision{}, err + } + if err := tx.Commit(); err != nil { + return nil, AccountDirectoryRevision{}, err + } + return members, revision, nil +} + +// ActiveRolesForUsers returns each listed user's active role in one query. +// Users without an active binding are absent from the map. +func (s *Store) ActiveRolesForUsers(userIDs []string) (map[string]UserRoleSummary, error) { + out := make(map[string]UserRoleSummary, len(userIDs)) + if len(userIDs) == 0 { + return out, nil + } + args := []any{true} + for _, userID := range userIDs { + args = append(args, userID) + } + rows, err := s.db.Query(s.q(`SELECT b.user_id,r.role_id,r.name,r.enabled FROM user_role_bindings b JOIN roles r ON r.role_id=b.role_id + WHERE b.active=? AND b.user_id IN (`+strings.TrimSuffix(strings.Repeat("?,", len(userIDs)), ",")+`)`), args...) + if err != nil { + return nil, err + } + defer rows.Close() + for rows.Next() { + var userID string + var role UserRoleSummary + if err := rows.Scan(&userID, &role.RoleID, &role.Name, &role.Enabled); err != nil { + return nil, err + } + out[userID] = role + } + return out, rows.Err() +} diff --git a/internal/store/role_policy_test.go b/internal/store/role_policy_test.go index dbf23c9..10e0944 100644 --- a/internal/store/role_policy_test.go +++ b/internal/store/role_policy_test.go @@ -758,3 +758,486 @@ func TestReplaceRolePermissionsAcceptsOnlyProjectAccessBoolean(t *testing.T) { t.Fatalf("legacy audit row removed: %d err=%v", legacy, err) } } + +// ===================================================================== +// Tests for the ported batch entry points (feature/iam-perm-ux-backend). +// Each test stays inside main's narrowed role model (only project.create is +// role authority) and reuses the existing account-scoped write fences. +// ===================================================================== + +// enableRoleOne creates a role with its project.create boolean turned on +// and returns the role after the receipt. The test owns the idempotency +// key so multiple batch steps stay reproducible. +func enableRoleOne(t *testing.T, st *Store, actor, name string) RoleRecord { + t.Helper() + role, err := st.CreateRole(actor, RoleCreate{Name: name}) + if err != nil { + t.Fatal(err) + } + if _, err := st.ReplaceRolePermissions(actor, role.RoleID, role.RoleVersion, + []RolePermissionChange{{ActionID: "project.create", Allowed: true, CapAllowed: true}}, + "enable-"+role.RoleID); err != nil { + t.Fatal(err) + } + current, err := st.GetRole(role.RoleID) + if err != nil { + t.Fatal(err) + } + return current +} + +// TestPatchRolePermissionsBatchEnablesAndDisablesAcrossRoles covers the +// happy path: two roles get their project.create boolean toggled in one +// transaction with one authority epoch step. +func TestPatchRolePermissionsBatchEnablesAndDisablesAcrossRoles(t *testing.T) { + st := openTestStore(t) + rolePolicyAccounts(t, st) + first := enableRoleOne(t, st, "admin", "批量职位一") + second := enableRoleOne(t, st, "admin", "批量职位二") + epochBefore, _ := st.AuthorityEpoch() + disable := RolePermissionChange{ActionID: "project.create", Allowed: false, CapAllowed: true} + batch, err := st.PatchRolePermissionsBatch("admin", + []RolePermissionPatchInput{ + {RoleID: first.RoleID, ExpectedRoleVersion: first.RoleVersion, Changes: []RolePermissionChange{disable}}, + {RoleID: second.RoleID, ExpectedRoleVersion: second.RoleVersion, Changes: []RolePermissionChange{disable}}, + }, "batch-disable") + if err != nil { + t.Fatal(err) + } + if batch.AuthorityEpoch != epochBefore+1 || len(batch.Receipts) != 2 { + t.Fatalf("batch=%+v epochBefore=%d", batch, epochBefore) + } + for _, receipt := range batch.Receipts { + if receipt.PreviousRoleVersion == receipt.RoleVersion { + t.Fatalf("role_version not advanced: %+v", receipt) + } + } + for _, roleID := range []string{first.RoleID, second.RoleID} { + view, err := st.RoleAdmin(roleID) + if err != nil || view.ProjectAccess { + t.Fatalf("role %s still has project access: %+v err=%v", roleID, view, err) + } + } +} + +// TestPatchRolePermissionsBatchAtomicityRejectsWholeBatch ensures one bad +// item rolls back the whole batch: the surviving role keeps its prior +// state and the authority epoch does not advance. +func TestPatchRolePermissionsBatchAtomicityRejectsWholeBatch(t *testing.T) { + st := openTestStore(t) + rolePolicyAccounts(t, st) + first := enableRoleOne(t, st, "admin", "回滚职位一") + second := enableRoleOne(t, st, "admin", "回滚职位二") + epochBefore, _ := st.AuthorityEpoch() + bogus := []RolePermissionPatchInput{ + {RoleID: first.RoleID, ExpectedRoleVersion: first.RoleVersion, + Changes: []RolePermissionChange{{ActionID: "project.create", Allowed: false, CapAllowed: true}}}, + {RoleID: second.RoleID, ExpectedRoleVersion: second.RoleVersion, + Changes: []RolePermissionChange{{ActionID: "system.users.view", Allowed: true, CapAllowed: true}}}, + } + if _, err := st.PatchRolePermissionsBatch("admin", bogus, "batch-bad"); !errors.Is(err, ErrInvalidRolePolicy) { + t.Fatalf("bogus batch accepted: %v", err) + } + if epoch, _ := st.AuthorityEpoch(); epoch != epochBefore { + t.Fatalf("rejected batch advanced epoch: before=%d after=%d", epochBefore, epoch) + } + for _, roleID := range []string{first.RoleID, second.RoleID} { + view, err := st.RoleAdmin(roleID) + if err != nil || !view.ProjectAccess { + t.Fatalf("role %s lost project access after rejection: %+v err=%v", roleID, view, err) + } + } +} + +// TestPatchRolePermissionsBatchStaleVersion rolls back the batch and +// refuses when one role's expected version mismatches. +func TestPatchRolePermissionsBatchStaleVersion(t *testing.T) { + st := openTestStore(t) + rolePolicyAccounts(t, st) + first := enableRoleOne(t, st, "admin", "过期职位一") + second := enableRoleOne(t, st, "admin", "过期职位二") + disable := RolePermissionChange{ActionID: "project.create", Allowed: false, CapAllowed: true} + if _, err := st.PatchRolePermissionsBatch("admin", + []RolePermissionPatchInput{ + {RoleID: first.RoleID, ExpectedRoleVersion: first.RoleVersion, Changes: []RolePermissionChange{disable}}, + {RoleID: second.RoleID, ExpectedRoleVersion: second.RoleVersion + 9, Changes: []RolePermissionChange{disable}}, + }, "batch-stale"); !errors.Is(err, ErrInvalidRolePolicy) || !errors.Is(err, ErrConflict) { + t.Fatalf("stale batch accepted: %v", err) + } + for _, roleID := range []string{first.RoleID, second.RoleID} { + view, err := st.RoleAdmin(roleID) + if err != nil || !view.ProjectAccess { + t.Fatalf("role %s lost project access: %+v err=%v", roleID, view, err) + } + } +} + +// TestPatchRolePermissionsBatchRejectsLimitAndIdempotency enforces the 20-item +// batch ceiling and the idempotency replay contract. +func TestPatchRolePermissionsBatchRejectsLimitAndIdempotency(t *testing.T) { + st := openTestStore(t) + rolePolicyAccounts(t, st) + enabled := enableRoleOne(t, st, "admin", "上限职位") + disable := RolePermissionChange{ActionID: "project.create", Allowed: false, CapAllowed: true} + oversized := make([]RolePermissionPatchInput, maxRolePermissionBatch+1) + for i := range oversized { + oversized[i] = RolePermissionPatchInput{RoleID: enabled.RoleID, ExpectedRoleVersion: 1, Changes: []RolePermissionChange{disable}} + } + if _, err := st.PatchRolePermissionsBatch("admin", oversized, "oversize"); !errors.Is(err, ErrInvalidRolePolicy) { + t.Fatalf("oversized batch accepted: %v", err) + } + if _, err := st.PatchRolePermissionsBatch("admin", nil, "empty"); !errors.Is(err, ErrInvalidRolePolicy) { + t.Fatalf("empty batch accepted: %v", err) + } + first, err := st.PatchRolePermissionsBatch("admin", + []RolePermissionPatchInput{{RoleID: enabled.RoleID, ExpectedRoleVersion: enabled.RoleVersion, Changes: []RolePermissionChange{disable}}}, + "idempotency-key") + if err != nil { + t.Fatal(err) + } + replay, err := st.PatchRolePermissionsBatch("admin", + []RolePermissionPatchInput{{RoleID: enabled.RoleID, ExpectedRoleVersion: enabled.RoleVersion, Changes: []RolePermissionChange{disable}}}, + "idempotency-key") + if err != nil || replay.AuthorityEpoch != first.AuthorityEpoch || replay.ReceiptID != first.ReceiptID { + t.Fatalf("replay=%+v first=%+v err=%v", replay, first, err) + } +} + +// TestPreviewRolePermissionsMatchesCommitResult keeps the read surface honest: +// the preview's "after" state is exactly what the matching commit produces. +func TestPreviewRolePermissionsMatchesCommitResult(t *testing.T) { + st := openTestStore(t) + rolePolicyAccounts(t, st) + enabled := enableRoleOne(t, st, "admin", "预览职位") + previews, err := st.PreviewRolePermissions("admin", + []RolePermissionPreviewInput{{RoleID: enabled.RoleID, ExpectedRoleVersion: enabled.RoleVersion, + Changes: []RolePermissionChange{{ActionID: "project.create", Allowed: false, CapAllowed: true}}}}) + if err != nil { + t.Fatal(err) + } + if len(previews) != 1 || previews[0].RoleID != enabled.RoleID || previews[0].VersionMatches != true { + t.Fatalf("preview=%+v", previews) + } + commit, err := st.PatchRolePermissionsBatch("admin", + []RolePermissionPatchInput{{RoleID: enabled.RoleID, ExpectedRoleVersion: enabled.RoleVersion, + Changes: []RolePermissionChange{{ActionID: "project.create", Allowed: false, CapAllowed: true}}}}, + "preview-commit") + if err != nil { + t.Fatal(err) + } + if commit.Receipts[0].RoleVersion <= enabled.RoleVersion { + t.Fatalf("commit=%+v", commit) + } +} + +// TestPreviewRolePermissionsRejectsInvalidBatchItem returns the item-level +// rejection in the preview without writing, exactly mirroring the commit gate. +func TestPreviewRolePermissionsRejectsInvalidBatchItem(t *testing.T) { + st := openTestStore(t) + rolePolicyAccounts(t, st) + enabled := enableRoleOne(t, st, "admin", "预览拒绝职位") + previews, err := st.PreviewRolePermissions("admin", + []RolePermissionPreviewInput{ + {RoleID: enabled.RoleID, ExpectedRoleVersion: enabled.RoleVersion, + Changes: []RolePermissionChange{{ActionID: "system.users.view", Allowed: true, CapAllowed: true}}}, + {RoleID: enabled.RoleID, ExpectedRoleVersion: enabled.RoleVersion, + Changes: []RolePermissionChange{{ActionID: "project.create", Allowed: false, CapAllowed: true}}}, + }) + if err != nil { + t.Fatal(err) + } + if len(previews) != 2 || previews[0].Error == "" || previews[0].ErrorActionID != "system.users.view" { + t.Fatalf("previews=%+v", previews) + } + if previews[1].Error != "" { + t.Fatalf("second item reported error without writing: %+v", previews[1]) + } + if view, _ := st.RoleAdmin(enabled.RoleID); !view.ProjectAccess { + t.Fatalf("preview mutating role: %+v", view) + } +} + +// TestAssignUserRolesBatchRebindsInOneTransaction covers the rebind happy +// path: two users get a new role in one transaction with one authority epoch. +func TestAssignUserRolesBatchRebindsInOneTransaction(t *testing.T) { + st := openTestStore(t) + admin, alice, bob := rolePolicyAccounts(t, st) + role, err := st.CreateRole("admin", RoleCreate{Name: "批量职位"}) + if err != nil { + t.Fatal(err) + } + epochBefore, _ := st.AuthorityEpoch() + batch, err := st.AssignUserRolesBatch("admin", + []UserRoleAssignmentInput{ + {UserID: alice.ID, RoleID: role.RoleID, ExpectedStateVersion: alice.StateVersion}, + {UserID: bob.ID, RoleID: role.RoleID, ExpectedStateVersion: bob.StateVersion}, + }, "assign-batch") + if err != nil { + t.Fatal(err) + } + if batch.AuthorityEpoch != epochBefore+1 || len(batch.Bindings) != 2 { + t.Fatalf("batch=%+v", batch) + } + for _, userID := range []string{alice.ID, bob.ID} { + view, err := st.RoleForUser(userID) + if err != nil || view.Binding == nil || view.Role == nil || view.Role.RoleID != role.RoleID { + t.Fatalf("user %s not bound: %+v err=%v", userID, view, err) + } + } + // Replay returns the same receipt. + replay, err := st.AssignUserRolesBatch("admin", + []UserRoleAssignmentInput{ + {UserID: alice.ID, RoleID: role.RoleID, ExpectedStateVersion: alice.StateVersion}, + {UserID: bob.ID, RoleID: role.RoleID, ExpectedStateVersion: bob.StateVersion}, + }, "assign-batch") + if err != nil || replay.AuthorityEpoch != batch.AuthorityEpoch { + t.Fatalf("replay=%+v err=%v", replay, err) + } + _ = admin +} + +// TestAssignUserRolesBatchRejectsWholeBatch ensures a single rejected item +// (stale state) rolls back both rebinds; the prior active binding stays. +func TestAssignUserRolesBatchRejectsWholeBatch(t *testing.T) { + st := openTestStore(t) + _, alice, bob := rolePolicyAccounts(t, st) + roleOne, _ := st.CreateRole("admin", RoleCreate{Name: "职位Alpha"}) + roleTwo, _ := st.CreateRole("admin", RoleCreate{Name: "职位Beta"}) + initialOne, err := st.AssignUserRole("admin", alice.ID, roleOne.RoleID, alice.StateVersion, "assign-alice-init") + if err != nil { + t.Fatal(err) + } + initialTwo, err := st.AssignUserRole("admin", bob.ID, roleTwo.RoleID, bob.StateVersion, "assign-bob-init") + if err != nil { + t.Fatal(err) + } + epochBefore, _ := st.AuthorityEpoch() + bad := []UserRoleAssignmentInput{ + {UserID: alice.ID, RoleID: roleTwo.RoleID, ExpectedStateVersion: initialOne.UserStateVersion}, + {UserID: bob.ID, RoleID: roleOne.RoleID, ExpectedStateVersion: bob.StateVersion + 99}, + } + if _, err := st.AssignUserRolesBatch("admin", bad, "batch-bad"); !errors.Is(err, ErrConflict) { + t.Fatalf("bad batch accepted: %v", err) + } + if epoch, _ := st.AuthorityEpoch(); epoch != epochBefore { + t.Fatalf("rejected batch advanced epoch: before=%d after=%d", epochBefore, epoch) + } + for _, check := range []struct { + userID string + binding RoleBinding + roleID string + previous string + }{ + {alice.ID, initialOne, alice.ID, roleOne.RoleID}, + {bob.ID, initialTwo, bob.ID, roleTwo.RoleID}, + } { + view, err := st.RoleForUser(check.userID) + if err != nil || view.Binding == nil || view.Role == nil || view.Role.RoleID != check.roleID { + t.Fatalf("user %s rebound across rollback: %+v err=%v", check.userID, view, err) + } + _ = check.previous + } +} + +// TestPreviewUserRoleAssignmentsJudgesEachItem returns one preview per +// input; mismatches carry reason text without writing rows or receipts. +func TestPreviewUserRoleAssignmentsJudgesEachItem(t *testing.T) { + st := openTestStore(t) + _, alice, _ := rolePolicyAccounts(t, st) + role, err := st.CreateRole("admin", RoleCreate{Name: "预览分配"}) + if err != nil { + t.Fatal(err) + } + if _, err := st.AssignUserRole("admin", alice.ID, role.RoleID, alice.StateVersion, "assign-alice"); err != nil { + t.Fatal(err) + } + alice, _ = st.GetAccount(alice.ID) + previews, err := st.PreviewUserRoleAssignments("admin", + []UserRoleAssignmentInput{ + {UserID: alice.ID, RoleID: role.RoleID, ExpectedStateVersion: alice.StateVersion}, + {UserID: alice.ID, RoleID: role.RoleID, ExpectedStateVersion: alice.StateVersion + 99}, + {UserID: "user_missing", RoleID: role.RoleID, ExpectedStateVersion: 1}, + }) + if err != nil { + t.Fatal(err) + } + if len(previews) != 3 { + t.Fatalf("previews=%+v", previews) + } + if previews[0].Error != "" || previews[0].CurrentRoleID != role.RoleID { + t.Fatalf("fresh match: %+v", previews[0]) + } + if previews[1].Error != roleAssignmentStateChanged { + t.Fatalf("stale match: %+v", previews[1]) + } + if previews[2].Error != roleAssignmentUserMissing { + t.Fatalf("missing user: %+v", previews[2]) + } + // The commit's first item still passes; rebinding still works. + if _, err := st.AssignUserRolesBatch("admin", + []UserRoleAssignmentInput{{UserID: alice.ID, RoleID: role.RoleID, ExpectedStateVersion: alice.StateVersion}}, + "preview-then-commit"); err != nil { + t.Fatalf("commit after preview: %v", err) + } +} + +// TestListRoleMembersForActorRequiresGrantsAndPaginates exercises the read +// surface: only callers with system.users.view + system.roles.view see +// members, and active-vs-inactive counts follow the binding table. +func TestListRoleMembersForActorRequiresGrantsAndPaginates(t *testing.T) { + st := openTestStore(t) + admin, alice, bob := rolePolicyAccounts(t, st) + role, err := st.CreateRole("admin", RoleCreate{Name: "成员职位"}) + if err != nil { + t.Fatal(err) + } + if _, err := st.AssignUserRole("admin", alice.ID, role.RoleID, alice.StateVersion, "assign-alice"); err != nil { + t.Fatal(err) + } + if _, err := st.AssignUserRole("admin", bob.ID, role.RoleID, bob.StateVersion, "assign-bob"); err != nil { + t.Fatal(err) + } + // Re-assigning alice ends her previous binding, leaving bob as the only + // active member for the second assignment. + bobAccount, _ := st.GetAccount(bob.ID) + other, err := st.CreateRole("admin", RoleCreate{Name: "另一职位"}) + if err != nil { + t.Fatal(err) + } + if _, err := st.AssignUserRole("admin", alice.ID, other.RoleID, + alice.StateVersion+1, "assign-alice-other"); err != nil { + t.Fatal(err) + } + if _, _, err := st.ListRoleMembersForActor("ordinary", role.RoleID); !errors.Is(err, ErrAccountForbidden) { + t.Fatalf("ordinary caller accepted: %v", err) + } + members, _, err := st.ListRoleMembersForActor("admin", role.RoleID) + if err != nil { + t.Fatal(err) + } + if len(members) != 1 || members[0].UserID != bobAccount.ID || !members[0].Enabled { + t.Fatalf("members=%+v", members) + } + _ = admin +} + +// TestActiveRolesForUsersReturnsActiveBindings only returns the active +// role for each user; an ended binding is absent. +func TestActiveRolesForUsersReturnsActiveBindings(t *testing.T) { + st := openTestStore(t) + _, alice, bob := rolePolicyAccounts(t, st) + roleOne, _ := st.CreateRole("admin", RoleCreate{Name: "现役"}) + roleTwo, _ := st.CreateRole("admin", RoleCreate{Name: "退役"}) + if _, err := st.AssignUserRole("admin", alice.ID, roleOne.RoleID, alice.StateVersion, "assign-alice-1"); err != nil { + t.Fatal(err) + } + if _, err := st.AssignUserRole("admin", bob.ID, roleTwo.RoleID, bob.StateVersion, "assign-bob-2"); err != nil { + t.Fatal(err) + } + if _, err := st.AssignUserRole("admin", alice.ID, roleTwo.RoleID, alice.StateVersion+1, "assign-alice-2"); err != nil { + t.Fatal(err) + } + roles, err := st.ActiveRolesForUsers([]string{alice.ID, bob.ID, "user_missing"}) + if err != nil { + t.Fatal(err) + } + if roles[alice.ID].RoleID != roleTwo.RoleID || roles[bob.ID].RoleID != roleTwo.RoleID { + t.Fatalf("active roles=%+v want alice=%s bob=%s", roles, roleTwo.RoleID, roleTwo.RoleID) + } + if _, present := roles["user_missing"]; present { + t.Fatalf("phantom user active: %+v", roles) + } +} + +// TestCreateRoleCopyAndAssignCreatesRoleAndBindsInOneTransaction is the happy +// path: the copy lands as a new role, picks up any override, and rebinds the +// assigned users in one transaction with one authority epoch step. +func TestCreateRoleCopyAndAssignCreatesRoleAndBindsInOneTransaction(t *testing.T) { + st := openTestStore(t) + _, alice, bob := rolePolicyAccounts(t, st) + source, err := st.CreateRole("admin", RoleCreate{Name: "源职位"}) + if err != nil { + t.Fatal(err) + } + if _, err := st.ReplaceRolePermissions("admin", source.RoleID, source.RoleVersion, + []RolePermissionChange{{ActionID: "project.create", Allowed: true, CapAllowed: true}}, + "enable-source"); err != nil { + t.Fatal(err) + } + source, _ = st.GetRole(source.RoleID) + epochBefore, _ := st.AuthorityEpoch() + result, err := st.CreateRoleCopyAndAssign("admin", + RoleCopySource{RoleID: source.RoleID, ExpectedRoleVersion: source.RoleVersion}, + RoleCreate{Name: "复制职位"}, + nil, + []RoleCopyAssignment{ + {UserID: alice.ID, ExpectedStateVersion: alice.StateVersion}, + {UserID: bob.ID, ExpectedStateVersion: bob.StateVersion}, + }, "copy-1") + if err != nil { + t.Fatal(err) + } + if result.AuthorityEpoch != epochBefore+1 || len(result.Bindings) != 2 || result.Role.RoleID == source.RoleID { + t.Fatalf("result=%+v", result) + } + if !result.Role.ProjectAccess { + t.Fatalf("copy lost project access: %+v", result.Role) + } + for _, userID := range []string{alice.ID, bob.ID} { + view, err := st.RoleForUser(userID) + if err != nil || view.Role == nil || view.Role.RoleID != result.Role.RoleID { + t.Fatalf("user %s not bound to copy: %+v err=%v", userID, view, err) + } + } +} + +// TestCreateRoleCopyAndAssignRejectsWithoutResidue keeps the fail-closed +// path: no role row, no bindings, no epoch advance when any item fails. +func TestCreateRoleCopyAndAssignRejectsWithoutResidue(t *testing.T) { + st := openTestStore(t) + _, alice, bob := rolePolicyAccounts(t, st) + source, err := st.CreateRole("admin", RoleCreate{Name: "源职位"}) + if err != nil { + t.Fatal(err) + } + source, _ = st.GetRole(source.RoleID) + epochBefore, _ := st.AuthorityEpoch() + if _, err := st.CreateRoleCopyAndAssign("admin", + RoleCopySource{RoleID: source.RoleID, ExpectedRoleVersion: source.RoleVersion}, + RoleCreate{Name: "复制失败"}, + []RolePermissionChange{{ActionID: "system.users.view", Allowed: true, CapAllowed: true}}, + []RoleCopyAssignment{{UserID: alice.ID, ExpectedStateVersion: alice.StateVersion}}, + "copy-bad-overrides"); !errors.Is(err, ErrInvalidRolePolicy) { + t.Fatalf("bad overrides accepted: %v", err) + } + if epoch, _ := st.AuthorityEpoch(); epoch != epochBefore { + t.Fatalf("rejected copy advanced epoch: before=%d after=%d", epochBefore, epoch) + } + if _, err := st.CreateRoleCopyAndAssign("admin", + RoleCopySource{RoleID: source.RoleID, ExpectedRoleVersion: source.RoleVersion}, + RoleCreate{Name: ""}, + nil, + []RoleCopyAssignment{{UserID: alice.ID, ExpectedStateVersion: alice.StateVersion}}, + "copy-bad-name"); !errors.Is(err, ErrInvalidRolePolicy) { + t.Fatalf("bad name accepted: %v", err) + } + if _, err := st.CreateRoleCopyAndAssign("admin", + RoleCopySource{RoleID: source.RoleID, ExpectedRoleVersion: source.RoleVersion}, + RoleCreate{Name: "复制失败"}, + nil, + []RoleCopyAssignment{{UserID: alice.ID, ExpectedStateVersion: 0}, {UserID: bob.ID, ExpectedStateVersion: bob.StateVersion}}, + "copy-bad-state"); !errors.Is(err, ErrInvalidRolePolicy) { + t.Fatalf("bad state version accepted: %v", err) + } + if _, ok := getRoleByName(st, "复制失败"); ok { + t.Fatalf("rejected copy created a role row") + } +} + +func getRoleByName(st *Store, name string) (RoleRecord, bool) { + roles, _, err := st.ListRoles(name, "exact", "all", "", "", 20) + if err != nil || len(roles) == 0 { + return RoleRecord{}, false + } + return roles[0].RoleRecord, true +} From f10fb2e65cfb6f0c33e370b6b4f6f752273b14a9 Mon Sep 17 00:00:00 2001 From: agent-exec-transport Date: Wed, 21 Oct 2026 15:01:35 +0000 Subject: [PATCH 3/5] agent-exec transport 362d13b3c56f54861bc1cae9cd38cc36/2b675cb19c4f --- internal/server/role_authorization_test.go | 108 ++++++++++++++------- internal/store/role_policy.go | 18 ++-- internal/store/role_policy_test.go | 19 +++- 3 files changed, 99 insertions(+), 46 deletions(-) diff --git a/internal/server/role_authorization_test.go b/internal/server/role_authorization_test.go index 356f713..55cfb61 100644 --- a/internal/server/role_authorization_test.go +++ b/internal/server/role_authorization_test.go @@ -480,47 +480,99 @@ func TestLegacyRoleRowsDoNotAuthorizeSystemActionsOrAccess(t *testing.T) { func TestRolePermissionPreviewRequiresPermissionViewOverHTTP(t *testing.T) { srv, st := newAuthTestServer(t) h := srv.Handler() - admin := bootAdmin(t, h, st) + admin := bootSuperAdmin(t, h, st) + // Preview is a permission-management read: system.permissions.view is + // required, and holding system.roles.view alone must not unlock it. + roleViewer := grantSystemActionsFixture(t, h, st, admin, "preview-role-viewer", "system.roles.view") roleRec := do(h, "POST", "/api/admin/roles", `{"name":"预览职位"}`, admin) if roleRec.Code != http.StatusOK { t.Fatalf("create role: %d %s", roleRec.Code, roleRec.Body.String()) } role := decodeRoleHTTP(t, roleRec) body := `{"roles":[{"roleId":"` + role.RoleID + `","expectedRoleVersion":1,"changes":[{"actionId":"project.create","allowed":false,"capAllowed":true}]}]}` + if rec := bearerRequest(h, "POST", "/api/admin/roles/permissions/preview", body, roleViewer); rec.Code != http.StatusForbidden { + t.Fatalf("role viewer previewed permissions: %d %s", rec.Code, rec.Body.String()) + } if rec := do(h, "POST", "/api/admin/roles/permissions/preview", body, admin); rec.Code != http.StatusOK { t.Fatalf("preview denied: %d %s", rec.Code, rec.Body.String()) } else if !strings.Contains(rec.Body.String(), role.RoleID) { t.Fatalf("preview body: %s", rec.Body.String()) } - if rec := do(h, "POST", "/api/admin/roles/permissions/preview", - `{"roles":[{"roleId":"unknown","expectedRoleVersion":1,"changes":[]}]}`, admin); rec.Code != http.StatusBadRequest && - rec.Code != http.StatusInternalServerError { - t.Fatalf("empty-changes preview: %d %s", rec.Code, rec.Body.String()) + // Preview judges every item separately, so an unknown role is reported + // inside that item's preview instead of failing the whole read. + var unknown struct { + Previews []struct { + RoleID string `json:"roleId"` + VersionMatches bool `json:"versionMatches"` + Error string `json:"error"` + ErrorActionID string `json:"errorActionId"` + } `json:"previews"` + } + unknownRec := do(h, "POST", "/api/admin/roles/permissions/preview", + `{"roles":[{"roleId":"unknown","expectedRoleVersion":1,"changes":[]}]}`, admin) + if unknownRec.Code != http.StatusOK { + t.Fatalf("unknown-role preview: %d %s", unknownRec.Code, unknownRec.Body.String()) + } + if err := json.Unmarshal(unknownRec.Body.Bytes(), &unknown); err != nil || len(unknown.Previews) != 1 { + t.Fatalf("decode unknown preview: %v body=%s", err, unknownRec.Body.String()) + } + // store's roleAssignmentRoleInvalid reason ("角色不存在或已停用"): + // preview reports an unusable role per item instead of failing the read. + const roleInvalidReason = "角色不存在或已停用" + if unknown.Previews[0].RoleID != "unknown" || unknown.Previews[0].VersionMatches || + unknown.Previews[0].Error != roleInvalidReason || unknown.Previews[0].ErrorActionID != "" { + t.Fatalf("unknown preview item: %+v", unknown.Previews[0]) + } + // An empty item list is still a malformed request. + if rec := do(h, "POST", "/api/admin/roles/permissions/preview", `{"roles":[]}`, admin); rec.Code != http.StatusBadRequest { + t.Fatalf("empty preview: %d %s", rec.Code, rec.Body.String()) } } func TestBatchRolePermissionPatchOverHTTP(t *testing.T) { srv, st := newAuthTestServer(t) h := srv.Handler() - admin := bootAdmin(t, h, st) - first := createRoleHTTP(t, h, st, admin, "批量职位一") - second := createRoleHTTP(t, h, st, admin, "批量职位二") + admin := bootSuperAdmin(t, h, st) + // Batch commit is a permission-management write: system.permissions.manage + // is required, roles.view/manage alone is not enough. + roleManager := grantSystemActionsFixture(t, h, st, admin, "batch-role-manager", "system.roles.view", "system.roles.manage") + first := createRoleHTTP(t, h, admin, "批量职位一") + second := createRoleHTTP(t, h, admin, "批量职位二") body := `{"idempotencyKey":"batch-1","roles":[` + `{"roleId":"` + first.RoleID + `","expectedRoleVersion":1,"changes":[{"actionId":"project.create","allowed":true,"capAllowed":true}]},` + `{"roleId":"` + second.RoleID + `","expectedRoleVersion":1,"changes":[{"actionId":"project.create","allowed":true,"capAllowed":true}]}` + `]}` + if rec := bearerRequest(h, "POST", "/api/admin/roles/permissions/batch", body, roleManager); rec.Code != http.StatusForbidden { + t.Fatalf("role manager patched permissions: %d %s", rec.Code, rec.Body.String()) + } if rec := do(h, "POST", "/api/admin/roles/permissions/batch", body, admin); rec.Code != http.StatusOK { t.Fatalf("batch denied: %d %s", rec.Code, rec.Body.String()) } else if !strings.Contains(rec.Body.String(), "receipts") { t.Fatalf("batch body: %s", rec.Body.String()) } - body = `{"idempotencyKey":"batch-bad","roles":[` + + // A stale expectedRoleVersion in any item rejects the whole batch with + // 409 Conflict (main's role-version class) and writes nothing at all. + stale := `{"idempotencyKey":"batch-stale","roles":[` + `{"roleId":"` + first.RoleID + `","expectedRoleVersion":2,"changes":[{"actionId":"project.create","allowed":false,"capAllowed":true}]},` + - `{"roleId":"` + second.RoleID + `","expectedRoleVersion":1,"changes":[{"actionId":"system.users.view","allowed":true,"capAllowed":true}]}` + + `{"roleId":"` + second.RoleID + `","expectedRoleVersion":1,"changes":[{"actionId":"project.create","allowed":false,"capAllowed":true}]}` + `]}` - if rec := do(h, "POST", "/api/admin/roles/permissions/batch", body, admin); rec.Code != http.StatusInternalServerError && - rec.Code != http.StatusBadRequest { - t.Fatalf("bad batch response: %d %s", rec.Code, rec.Body.String()) + if rec := do(h, "POST", "/api/admin/roles/permissions/batch", stale, admin); rec.Code != http.StatusConflict { + t.Fatalf("stale batch: %d %s", rec.Code, rec.Body.String()) + } + for _, role := range []roleHTTPView{first, second} { + rec := do(h, "GET", "/api/admin/roles/"+role.RoleID, "", admin) + view := decodeRoleProjectAccess(t, rec) + if view.RoleVersion != 2 || !view.ProjectAccess || len(view.Permissions) != 1 { + t.Fatalf("stale batch wrote %s: %+v", role.RoleID, view) + } + } + // A change outside project access is an invalid policy: 400 Bad Request. + invalid := `{"idempotencyKey":"batch-invalid","roles":[` + + `{"roleId":"` + first.RoleID + `","expectedRoleVersion":2,"changes":[{"actionId":"system.users.view","allowed":true,"capAllowed":true}]},` + + `{"roleId":"` + second.RoleID + `","expectedRoleVersion":2,"changes":[{"actionId":"project.create","allowed":false,"capAllowed":true}]}` + + `]}` + if rec := do(h, "POST", "/api/admin/roles/permissions/batch", invalid, admin); rec.Code != http.StatusBadRequest { + t.Fatalf("invalid batch: %d %s", rec.Code, rec.Body.String()) } } @@ -536,7 +588,7 @@ func TestBatchRoleAssignmentPreviewAndCommitOverHTTP(t *testing.T) { } alice, _ := st.GetAccountByOwner("alice") bob, _ := st.GetAccountByOwner("bob") - role := createRoleHTTP(t, h, st, admin, "职位预览") + role := createRoleHTTP(t, h, admin, "职位预览") preview := `{"assignments":[` + `{"userId":"` + alice.ID + `","roleId":"` + role.RoleID + `","expectedStateVersion":` + strconv.FormatInt(alice.StateVersion, 10) + `},` + `{"userId":"` + bob.ID + `","roleId":"` + role.RoleID + `","expectedStateVersion":` + strconv.FormatInt(bob.StateVersion, 10) + `}` + @@ -565,7 +617,7 @@ func TestCopyAssignRoleOverHTTP(t *testing.T) { t.Fatal(err) } alice, _ := st.GetAccountByOwner("alice") - source := createRoleHTTP(t, h, st, admin, "源职位") + source := createRoleHTTP(t, h, admin, "源职位") enable := do(h, "PUT", "/api/admin/roles/"+source.RoleID+"/permissions", `{"expectedRoleVersion":1,"idempotencyKey":"copy-source","changes":[{"actionId":"project.create","allowed":true,"capAllowed":true}]}`, admin) if enable.Code != http.StatusOK { @@ -591,7 +643,7 @@ func TestRoleMembersFilterBeforePagingAndBindCursor(t *testing.T) { } alice, _ := st.GetAccountByOwner("alice") bob, _ := st.GetAccountByOwner("bob") - role := createRoleHTTP(t, h, st, admin, "成员职位") + role := createRoleHTTP(t, h, admin, "成员职位") assign := func(userID string, version int64, key string) { t.Helper() rec := do(h, "PUT", "/api/admin/users/"+userID+"/role", @@ -621,7 +673,7 @@ func TestAccountSearchIncludesRoleProjection(t *testing.T) { t.Fatal(err) } alice, _ := st.GetAccountByOwner("alice") - role := createRoleHTTP(t, h, st, admin, "账户目录职位") + role := createRoleHTTP(t, h, admin, "账户目录职位") if rec := do(h, "PUT", "/api/admin/users/"+alice.ID+"/role", `{"roleId":"`+role.RoleID+`","expectedStateVersion":`+strconv.FormatInt(alice.StateVersion, 10)+`,"idempotencyKey":"search-assign"}`, admin); rec.Code != http.StatusOK { t.Fatalf("assign: %d %s", rec.Code, rec.Body.String()) @@ -633,25 +685,9 @@ func TestAccountSearchIncludesRoleProjection(t *testing.T) { } } -func decodeRoleHTTP(t *testing.T, rec *httptest.ResponseRecorder) struct { - RoleID string `json:"roleId"` - Name string `json:"name"` -} { - t.Helper() - var role struct { - RoleID string `json:"roleId"` - Name string `json:"name"` - } - if err := json.Unmarshal(rec.Body.Bytes(), &role); err != nil { - t.Fatalf("decode role: %v body=%s", err, rec.Body.String()) - } - return role -} - -func createRoleHTTP(t *testing.T, h http.Handler, st *store.Store, admin, name string) struct { - RoleID string `json:"roleId"` - Name string `json:"name"` -} { +// createRoleHTTP creates a role over HTTP and returns the decoded view. It +// reuses roles_test.go's decodeRoleHTTP so the package keeps one decoder. +func createRoleHTTP(t *testing.T, h http.Handler, admin, name string) roleHTTPView { t.Helper() rec := do(h, "POST", "/api/admin/roles", `{"name":"`+name+`"}`, admin) if rec.Code != http.StatusOK { diff --git a/internal/store/role_policy.go b/internal/store/role_policy.go index b9861bf..392b3cf 100644 --- a/internal/store/role_policy.go +++ b/internal/store/role_policy.go @@ -2387,11 +2387,12 @@ func (s *Store) CreateRoleCopyAndAssign(actor string, source RoleCopySource, spe VALUES(?,?,?,?,?,?,?,?,?,?)`), roleID, name, normalizeRoleName(name), description, true, 1, actorAccount.ID, actorAccount.ID, now, now); err != nil { return err } - writes := make([]RolePermissionChange, 0, len(merged)) - for _, row := range merged { - writes = append(writes, row) - } - if err := s.upsertRolePermissionsTx(tx, actorAccount.ID, roleID, map[string]RolePermissionChange{}, writes, now); err != nil { + // The role row was inserted in this same transaction, so the copy has + // no prior permission state: current is nil and every entry of the + // merged target is a fresh grant. That is what the original branch + // passed too (nil current against a freshly written role); faking a + // non-empty prior state here would misreport the helper's delta. + if err := s.upsertRolePermissionsTx(tx, actorAccount.ID, roleID, nil, merged, now); err != nil { return err } for i := range items { @@ -2415,8 +2416,13 @@ func (s *Store) CreateRoleCopyAndAssign(actor string, source RoleCopySource, spe if err != nil { return err } + // ProjectAccess is the normalized projection every other role + // read path fills in (RoleAdmin, ListRoles); the copy receipt must + // report the same value or a copied project.create role reads as + // access-less. out = RoleCopyAssignResult{ReceiptID: newID("receipt"), AuthorityEpoch: epoch + 1, - Role: RoleAdminView{RoleRecord: role, BindingCount: len(bindings), Permissions: permissions}, + Role: RoleAdminView{RoleRecord: role, BindingCount: len(bindings), + ProjectAccess: projectAccessOf(permissions), Permissions: permissions}, Bindings: bindings} return s.saveReceipt(tx, actorAccount.ID, key, "role.copy.assign", requestHash, out) }) diff --git a/internal/store/role_policy_test.go b/internal/store/role_policy_test.go index 10e0944..5c50eda 100644 --- a/internal/store/role_policy_test.go +++ b/internal/store/role_policy_test.go @@ -1028,22 +1028,29 @@ func TestAssignUserRolesBatchRejectsWholeBatch(t *testing.T) { roleID string previous string }{ - {alice.ID, initialOne, alice.ID, roleOne.RoleID}, - {bob.ID, initialTwo, bob.ID, roleTwo.RoleID}, + {alice.ID, initialOne, roleOne.RoleID, alice.ID}, + {bob.ID, initialTwo, roleTwo.RoleID, bob.ID}, } { view, err := st.RoleForUser(check.userID) if err != nil || view.Binding == nil || view.Role == nil || view.Role.RoleID != check.roleID { t.Fatalf("user %s rebound across rollback: %+v err=%v", check.userID, view, err) } + // The rolled-back batch also leaves the earlier binding record + // itself untouched: same binding id and user state version. + if view.Binding.BindingID != check.binding.BindingID || view.Binding.UserStateVersion != check.binding.UserStateVersion { + t.Fatalf("user %s binding rewritten across rollback: got %+v want %+v", check.userID, view.Binding, check.binding) + } _ = check.previous } } // TestPreviewUserRoleAssignmentsJudgesEachItem returns one preview per // input; mismatches carry reason text without writing rows or receipts. +// A batch names each user at most once (validateRoleAssignmentItems), so +// the three judgements are asked of three distinct users. func TestPreviewUserRoleAssignmentsJudgesEachItem(t *testing.T) { st := openTestStore(t) - _, alice, _ := rolePolicyAccounts(t, st) + _, alice, bob := rolePolicyAccounts(t, st) role, err := st.CreateRole("admin", RoleCreate{Name: "预览分配"}) if err != nil { t.Fatal(err) @@ -1052,10 +1059,11 @@ func TestPreviewUserRoleAssignmentsJudgesEachItem(t *testing.T) { t.Fatal(err) } alice, _ = st.GetAccount(alice.ID) + epochBefore, _ := st.AuthorityEpoch() previews, err := st.PreviewUserRoleAssignments("admin", []UserRoleAssignmentInput{ {UserID: alice.ID, RoleID: role.RoleID, ExpectedStateVersion: alice.StateVersion}, - {UserID: alice.ID, RoleID: role.RoleID, ExpectedStateVersion: alice.StateVersion + 99}, + {UserID: bob.ID, RoleID: role.RoleID, ExpectedStateVersion: bob.StateVersion + 99}, {UserID: "user_missing", RoleID: role.RoleID, ExpectedStateVersion: 1}, }) if err != nil { @@ -1073,6 +1081,9 @@ func TestPreviewUserRoleAssignmentsJudgesEachItem(t *testing.T) { if previews[2].Error != roleAssignmentUserMissing { t.Fatalf("missing user: %+v", previews[2]) } + if epoch, _ := st.AuthorityEpoch(); epoch != epochBefore { + t.Fatalf("preview advanced epoch: before=%d after=%d", epochBefore, epoch) + } // The commit's first item still passes; rebinding still works. if _, err := st.AssignUserRolesBatch("admin", []UserRoleAssignmentInput{{UserID: alice.ID, RoleID: role.RoleID, ExpectedStateVersion: alice.StateVersion}}, From 53e78ffb7308a898f1ab53c778e4e38f006d9520 Mon Sep 17 00:00:00 2001 From: agent-exec-transport Date: Wed, 21 Oct 2026 15:13:33 +0000 Subject: [PATCH 4/5] agent-exec transport 5aab730b1b5c159f2ce8f0cf9b2c50b5/5dfb74fd02f1 --- .../2026-10-21-iam-perm-ux-port-review.md | 441 ++++++++++++++++++ 1 file changed, 441 insertions(+) create mode 100644 .task/reviews/2026-10-21-iam-perm-ux-port-review.md diff --git a/.task/reviews/2026-10-21-iam-perm-ux-port-review.md b/.task/reviews/2026-10-21-iam-perm-ux-port-review.md new file mode 100644 index 0000000..8d6e165 --- /dev/null +++ b/.task/reviews/2026-10-21-iam-perm-ux-port-review.md @@ -0,0 +1,441 @@ +# 独立代码审查：fix/iam-perm-ux-port（IAM 权限管理 API 移植） + +- 审查基线（main 当前 HEAD）：01f4c47a2b5798c9b43fffb9e298aa87138a1537（merge #238 前一刻） +- 审查终点（fix/iam-perm-ux-port HEAD）：f10fb2e +- 审查 commit 范围：01f4c47a2b5..HEAD（3 提交，2 个 agent-exec transport + 1 个 task-start） +- 受影响文件：8 个源码文件 / .task/fix-iam-perm-ux-port.md +- 审查者：独立审查会话（未参与实现） +- 审查时间：2026-10-21 UTC +- 仓库：`/tmp/agent-exec-1000/5aab730b1b5c159f2ce8f0cf9b2c50b5/wt-5dfb74fd02f1` +- 工作区状态：detached HEAD @ f10fb2e（无未提交修改） + +## 审查结论：PASS + +本审查未发现阻塞项。七个移植 API 在语义层与 main 现有 role_policy.go / roles.go / account_search.go +一致；安全语义保持 main 现有的 `system.permissions.*` / `system.roles.*` 授权门 + 账户作用域写入围栏 +（含 `requireSuperAdminTargetAccess` / `roleGrantsAccountAdministrationTx` / `requireRoleAuthorityWritableTx` / +`policyWriteBatch` 等）；事务与一致性、审计与回执、与 #228/#234 的关系、测试质量均无证据证明存在 +继承能力丢失或静默行为改变。仅有一处非阻塞担心（PostgreSQL 下不同角色跨 batch 的 +潜在 lock-ordering 风险）与若干测试缺口，已列入"非阻塞建议"。 + +--- + +## 1. 受影响文件与体量（依据：`git diff --stat`） + +``` + .task/fix-iam-perm-ux-port.md | 66 ++ + internal/authz/catalog/catalog_test.go | 16 + + internal/server/account_search.go | 126 +++ + internal/server/role_authorization_test.go | 226 ++++++ + internal/server/roles.go | 162 +++ + internal/server/server.go | 6 + + internal/store/role_policy.go | 1141 ++++++++++++++++++++++++++++ + internal/store/role_policy_test.go | 494 ++++++++++++ +``` + +实际为 8 个源码/任务文件（与 packet 的 8 文件一致）；packet 标的 "+2184" 略低于实际 +`+2237`，差异来自本盘点把 `.task/fix-iam-perm-ux-port.md` 计入或不算的口径差——本评审 +只把它当作任务卡，不审其内容。 + +--- + +## 2. 七个 API 与对应实现 + +| # | 端点（routes，`server.go`） | handler（`server/roles.go` / `account_search.go`） | store（`store/role_policy.go`） | 授权闸 | +|---|---|---|---|---| +| 1 | `POST /api/admin/roles/permissions/preview` | `listRolePermissionPreview` | `PreviewRolePermissions` / `previewRolePermissionsTx` | `system.permissions.view` | +| 2 | `POST /api/admin/roles/permissions/batch` | `batchPatchRolePermissions` | `PatchRolePermissionsBatch` / `patchRolePermissionsTx` / `upsertRolePermissionsTx` | `system.permissions.manage` | +| 3 | `POST /api/admin/roles/copy-assign` | `copyAssignRole` | `CreateRoleCopyAndAssign` | `system.roles.manage`+`system.permissions.manage`+`system.roles.assign`（三同时） | +| 4 | `GET /api/admin/roles/{roleId}/members` | `listRoleMembers` | `ListRoleMembersForActor` | `system.users.view`+`system.roles.view`（两同时） | +| 5 | `POST /api/admin/users/role-assignments` | `assignUserRolesBatch` | `AssignUserRolesBatch` / `assignRolesTx` / `rebindUserRoleTx` / `checkRoleAssignmentTx` | `system.roles.assign` | +| 6 | `POST /api/admin/users/role-assignments/preview` | `previewUserRoleAssignments` | `PreviewUserRoleAssignments` / `activeRoleTx` | `system.users.view`+`system.roles.view` | +| 7 | `GET /api/admin/users/search`（追加 role 投影） | `searchAdminUsers`（修改） | `ActiveRolesForUsers` | `system.users.view`；role 字段附加条件 `system.roles.view`（`systemActionAllowed` 静默跳过） | + +类型承载面（`store/role_policy.go` 新增）：`RolePermissionPreviewInput`、`RolePermissionStateChange`、 +`RolePermissionConflict`、`RolePermissionPreview`、`RolePermissionPatchInput`、 +`RolePermissionBatchReceipt`、`RolePermissionBatch`、`UserRoleAssignmentInput`、 +`UserRoleAssignmentResult`、`UserRoleAssignmentBatch`、`UserRoleAssignmentPreview`、 +`RoleCopySource`、`RoleCopyAssignment`、`RoleCopyAssignResult`、`RoleMember`、`UserRoleSummary`。 + +常量、错误：`RolePermissionPreviewReplace`/`Patch`、`permissionStateDenied/Project/Default/Invalid`、 +`linkedExpansionLinked`、`maxRolePermissionPreviewItem=100`、`maxRolePermissionBatch=20`、 +`maxRoleAssignmentBatch=100`、`roleAssignmentUserMissing/Disabled/StateChanged/RoleInvalid`、 +`rolePermissionChangeError`（带 `Unwrap()` 指向 `ErrInvalidRolePolicy`，与既有错误链兼容）。 + +--- + +## 3. 重点 1 —— 移植正确性（语义一致） + +主要结论：未发现语义丢失或静默改变；与 main 现有 role_policy.go / roles.go / account_search.go +行为对齐。 + +- `normalizePermissionChanges`（store/role_policy.go:1474-1504）：与 main 现有的 + `ReplaceRolePermissions`（同文件 line 379）一样把"非 project.create"和"受保护动作" + 在写入前拒绝；duplicate 拒绝；"Allowed=true && CapAllowed=false"非法组合拒绝。 + 对 `project.create` 之外的 audit 行保持原状（patch 语义），与 + `TestRolePermissionsNormalizeLegacyRowsToProjectAccess`（main 既有的旧审计行单点投影测） + 行为兼容。 +- `RolePermissionStateChange` 报告 `Before`/`After` 是按当前行 vs 合并后行计算的，并跳过 + `ProjectAccessAction` 自身（`rolePermissionStateChanges` 把 expansion 跳过），所以预览 + 在关闭 project.create 时不会把 projection-row 误判为增删。 +- 关闭 project.create 后 `KeptLinkedActions` 仅列举"原本就显式有 row 的"linked 动作 + （`keptLinkedRows`）；没有 row 的不会出现在 migration note 中，避免误导。 +- `CreateRoleCopyAndAssign` 选择 `current=nil` 作为新角色的 prior 状态（注释明确解释）， + 因为新角色行是在同一事务内插入的；这与原 feature 分支行为一致，避免在 helper 里 + 伪装既有行。 +- `AssignUserRolesBatch` 用与 `AssignUserRole` 同形态的 SQL + （`UPDATE user_role_bindings SET active=0 ... ; INSERT ... ; UPDATE users SET state_version=state_version+1 WHERE state_version=?`） + 复用既有单用户路径所具备的乐观并发控制——`state_version` 重核确保 rebind 不覆盖并发变更。 +- `PolicyReceipt` 包含的 `ReceiptID` / `AuthorityEpoch` 直接读自 `PolicyReceipt` 结构 + （已有），`RolePermissionBatchReceipt` 嵌入了该类型——回执格式与传统 `ReplaceRolePermissions` + 完全对齐，没有改写 main 既有的回执 schema。 +- `RoleAdminView` 与既有的 `RoleAdmin`/`ListRoles` 投影共享 `RoleRecord + Permissions + ProjectAccess` + 复合字段（`RoleCopyAssignResult.Role` 直接构造），不引入新读路径。 + +未验证：原 feature 分支的代码已不在本仓（packet 注："唯一副本已备份"，且本工作区 detached HEAD +无源分支 ref）。本评审只能与 main 现状 + diff 做对比，无法逐行比对其与原版的差异。这是结构性 +限制，已在"未验证"列出。 + +--- + +## 4. 重点 2 —— 安全语义（最高优先，逐 API 核对） + +| API | 入口授权 | store 内额外防御 | 是否绕过 main 既有 owner/admin 校验 / isAdmin 判定 / account-checked 写路径 | +|---|---|---|---| +| listRolePermissionPreview | `requireSystemAction("system.permissions.view")`（非 admin 路径同样拒绝） | `PreviewRolePermissions` 起手 `actor=="" → ErrAccountForbidden`；开 tx 后 `requireEnabledActorTx` 二次校验 actor 行；逐 item `previewRolePermissionsTx` 不写盘；没有走 `policyWrite`/`policyWriteBatch` | 否；纯读 | +| batchPatchRolePermissions | `requireSystemAction("system.permissions.manage")` | `PatchRolePermissionsBatch` 走 `policyWriteBatch(actor, nil, …)` —— 即 `lockAccountUsers(actor)`，再 `requireRoleAuthorityWritableTx`，再 `replayReceipt`（同 key + 同 request_hash 才允许重放）；每 item 通过 `s.roleTx(item.RoleID, true)` 在 Postgres 上对 role row 加 `FOR UPDATE`；每个 item 走 `normalizePermissionChanges`（拒绝非 project.create / 受保护 / duplicate / 非法组合），`patchRolePermissionsTx` 内 `s.upsertRolePermissionsTx` 按 patch 语义 upsert，并对 `roles SET role_version=role_version+1 WHERE role_version=expected` 二次乐观并发 | 否；任何 `system.permissions.manage` 持有人都是该路径的合法写入者（与 `ReplaceRolePermissions` 对等，没有 target-side 校验，因为这是 system 层面的角色authority） | +| assignUserRolesBatch | `requireSystemAction("system.roles.assign")` | `policyWriteBatch(actor, userIDs, …)` —— 同时锁 actor + 全部 target owner；`assignRolesTx` 内逐 item 调用 `requireSuperAdminTargetAccess(actorAccount, target)`（R5 抗 super-admin 篡改），非 super-admin 还检查 `roleGrantsAccountAdministrationTx(tx, item.RoleID)`（防止把 admin 角色批给用户形成提权路径，R4）；`checkRoleAssignmentTx` 校验 disabled / state_version / role enabled；`rebindUserRoleTx` 在 SQL 层再用 `state_version=? AND enabled=?` 重核；最后 `checkCapabilityAssociationTx`（project.create 联合关联门）；一笔失败全事务回滚 | 否；与单用户 `AssignUserRole` 同等保护，没有批量化造成的"开窗" | +| previewUserRoleAssignments | `requireSystemAction("system.users.view")` + `system.roles.view`（双闸） | `PreviewUserRoleAssignments` 起手 `actor==""` 与 `validateRoleAssignmentItems`；开 tx 后 `requireEnabledActorTx` 二次校验 actor；逐 item 读 users 行并构造 preview，`account == nil` 通过 `roleAssignmentUserMissing` 区分；不写盘，不调 `policyWriteBatch` | 否；纯读；返回的字段范围与 `getUserRole` 视图对齐（owner/name/current role/状态匹配/错误原因） | +| copyAssignRole | 三闸（`system.roles.manage`/`system.permissions.manage`/`system.roles.assign`） | `CreateRoleCopyAndAssign` 走 `policyWriteBatch(actor, userIDs, …)`；源 role `roleTx(..., true)` 行锁；`requireRoleAuthorityWritableTx`；按源 role 的 row 拷贝非受保护动作（`descriptor.Protected` 跳过），覆盖用 `normalizePermissionChanges`（同样拒绝非 project.create）；源 enabled project.create 但 merge 后 disabled 的情形被显式拒绝（`sourceWasCreator && !copyIsCreator → ErrInvalidRolePolicy`）；写后 `checkCapabilityAssociationTx`；最后通过 `assignRolesTx` —— 与 `assignUserRolesBatch` 完全相同的 anti-elevation + state-version 二次校验 | 否；copy 路径不会复制系统 grant（`copied` map 跳过 protected），不会复制 `IsSuperAdmin`/admin 身份（`CreateRole` 只插 roles 行），不会复制 project membership（不参与任何 project_* 表） | +| listRoleMembers | `requireSystemAction("system.users.view")` + `system.roles.view`（双闸） | `ListRoleMembersForActor` 在 Postgres 走 `BeginTx(..., LevelRepeatableRead)`，SQLite 走普通 tx；起手 `lockAccountUsers(actor)`，对 actor 行 `FOR UPDATE`；然后 `requireSystemActionTx(tx, locked[actor], "system.users.view")` 与 `system.roles.view` 二次校验；`s.roleTx(roleID, false)` 校验 role 存在；SQL `SELECT ... FROM user_role_bindings b JOIN users u ON u.id=b.user_id WHERE b.role_id=? AND b.active=?`；附带 `account_directory_revision` 同一快照读 | 否；handler 层 cursor 用 `accountSearchKey` HMAC 绑定到 role/query/mode/status/private revision，不能跨 role/param 重放（`parseAdminCursor` `hmac.Equal` + version 比对） | +| searchAdminUsers 的 role 投影 | 入口：既有 `system.users.view`（无变化） | 投影附加条件 `systemActionAllowed(actor, "system.roles.view")` —— 不开 reader 时静默跳过（无 role 字段），与既有的 read projection 模式一致 | 否；授权差异只在响应字段是否多一项 `role` 上，没有改变授权面。无 role 时一律为 `null`，无信息泄露 | + +关于越权路径的关键判断： + +- **检查 1：super-admin 保护**。`assignUserRolesBatch` 通过 `assignRolesTx` 强制 `requireSuperAdminTargetAccess`。 + 即便 actor 拿到 `system.roles.assign` 与 is_admin，把一个非自身的 super-admin 用户塞进 + assignments 也立刻被拒绝。`copyAssignRole` 通过 `assignRolesTx` 走的是同一函数，复用同保护。 +- **检查 2：admin 角色 escalation**。`roleGrantsAccountAdministrationTx` 检查目标 role 是否 + 携带任何 `system.users.* / system.roles.* / system.permissions.*`，非 super-admin 一律拒绝。 + 与单用户 `AssignUserRole` 行为完全一致。无绕过。 +- **检查 3：account-checked 写路径**。三个写 API（`PatchRolePermissionsBatch` / `AssignUserRolesBatch` / + `CreateRoleCopyAndAssign`）通过 `policyWriteBatch` 借用 main 既有 account 锁路径 + （`lockAccountUsers` `FOR UPDATE` + enabled 校验 + 一致 ID/owner 比对），与 `policyWrite` + 是同一家族。可以理解为对现有单写围栏的"批量化"，没有引入新的、非现有围栏之外的捷径。 +- **检查 4：跨账户读取**。`ListRoleMembersForActor` / `PreviewUserRoleAssignments` / + `searchAdminUsers` 三个读取入口都已就授权闸；没有出现"通过 batch 路径可以读到他人 role-membership + 但单 API 不可读"的二通道。 +- **检查 5：审计/回执旁路**。`policyWriteBatch` 包裹的写入最后都走 `saveReceipt`（除 `CreateRole` + 类型既有的纯插入路径外），未发现可以既写盘又不留 `policy_receipts` 行的调用点 —— 审计门未开窗。 + +--- + +## 5. 重点 3 —— 事务与一致性 + +`policyWriteBatch` 的事务结构与 `policyWrite`（同文件 line 181）严格同形态： + +1. 把 actor 与所有 target owner 加入 owner 集合； +2. `s.db.Begin()`，defer Rollback； +3. `lockAccountUsers(tx, owners...)` —— owner 字典序排序后逐个 `FOR UPDATE`，规避锁顺序； +4. 校验 `actorAccount.Enabled` 与每个 target `target.Enabled && target.ID == userID`； +5. 读 `authority_state.authority_epoch`（PG 下 `FOR UPDATE`）； +6. 调用上层闭包； +7. 闭包负责回写 epoch 与保存 receipt； +8. `tx.Commit()`。 + +提交或回滚边界： + +- `AssignUserRolesBatch`：验证循环 + rebind 循环均在同一事务；任何一次 `ErrAccountForbidden / + ErrConflict / ErrInvalidRolePolicy` 都立即返回事务回滚；`rebindUserRoleTx` 内的 + `UPDATE users SET state_version=state_version+1 WHERE id=? AND state_version=? AND enabled=?` + 在 SQL 层提供最后一道乐观并发；批内任意用户状态版本与 `expectedStateVersion` 不匹配即整批回滚。 +- `PatchRolePermissionsBatch`：每个 item 走 `patchRolePermissionsTx`，内部 `roleTx(... true)`； + `s.upsertRolePermissionsTx` 按 patch 语义只写 patch 列表中的行（未在 patch 列表的行保持原样 + 不动 —— 这与"显式 patch"语义对齐，不会误把删除当作新增）；`UPDATE roles SET role_version=role_version+1 + WHERE role_id=? AND role_version=?` 拒绝过期；随后 `checkCapabilityAssociationTx(tx, nil, roleIDs, nil)` + —— 只检查涉及的 role 列表的 project.create + linked 关联。 +- `CreateRoleCopyAndAssign`：源 role row 锁、新 role insert、`upsertRolePermissionsTx(... nil ...)`、 + 重新把 `items[].RoleID = roleID`（设置后立即调用 `assignRolesTx`）然后 `checkCapabilityAssociationTx`。 + 关闭源已有的 project.create 又把 copy 设成非 creator 的情形被显式拒绝 + （`sourceWasCreator && !copyIsCreator → ErrInvalidRolePolicy`），这避免了"复制即失去能力" + 的伪操作混淆。 + +`current→after` 增量计算是否会把删除误判为新增： + +- `previewRolePermissionsTx`：用 `current = s.rolePermissionBitsTx(tx, role.RoleID)` 与 + `next = normalizePermissionChanges(item.Changes)`，合并 `after`，对所有 `catalog.Catalog()` + 内动作比对 `Before/After` 状态不同者写入 `Changes`；删除本质上等同"原本某 row 状态 X，目标 Y"， + 不会进入 `Changes` 错查为"add"（因为 `current` 中已有 row）。 +- `patchRolePermissionsTx`：以 `current` 为基础 `after` 起点，`patch` 覆盖 `after`；`upsertRolePermissionsTx` + 对比 `current`/`after` 后只对真正变化者写。删除语义上等同于"原 row 留在 patch 之外即不动" + （patch 不写删除显式动作，故删除行为是 patch 之外的子集）—— 这是 patch 语义而非 replace 语义， + 在端口注释里有显式说明 (`// Only listed actions change; every unlisted row of the role stays exactly as stored`)。 + +回滚完整性（基于代码路径核查，每条都在收到 err 时让事务回到 Begin 状态，因为没有分支绕过 defer +`tx.Rollback()`，且所有写入函数都用同一 `tx`）： + +- `policyWriteBatch`：`tx.Commit()` 之前的任何 error 都回滚；commit 失败由 defer 再 Rollback 兜底。 +- 三个写 store 函数都没有副作用排序的反向操作（除 rebindUserRoleTx 之外）。 + +未验证：未运行 `go test ./...` —— 见"未验证"节。 + +--- + +## 6. 重点 4 —— 审计与回执 + +- 三个写 API 都调用 `policyWriteBatch` 并在闭包内 `saveReceipt(tx, actorAccount.ID, key, operation, requestHash, out)`， + 写入 `policy_receipts` 表（既有 main 表）。 +- 操作名分别用 `"role.permissions.batch_patch"`、`"user.role.assign.batch"`、`"role.copy.assign"`， + 都是独有的操作标签；replay 通过 `(actor_user_id, idempotency_key)` 复合唯一索引保证幂等。 +- `replayReceipt` 在 hash 不一致时返回 `ErrConflict`；与 `TestRolePolicyIdempotencyKeyCannotChangeRequest` + 既有的幂等语义一致 —— 同样 key + 不同 request 必然拒收。 +- `PolicyReceipt` 与 `RolePermissionBatchReceipt` 都嵌入了 `PreviousRoleVersion` / `Changes` / + `KeptLinkedActions` 等可复核字段。回执包含 `ReceiptID` (`newID("receipt")`) 与 + `AuthorityEpoch = epoch+1`，方便把回执与下一次 authority epoch 增量对齐。 +- `CreateRoleCopyAndAssign` 在写盘后用 `s.roleTx(roleID, false)`（不带锁，二次 snapshot）+ + `s.rolePermissionRecords(...)` 重新读 `role_permissions` 完整集合（含历史 audit 行），计算 + `ProjectAccessOf`，保证回执中 `ProjectAccess` 与 `RoleAdmin`/`ListRoles` 共享投影。 +- `RolePermissionConflict` 仅在预览路径出现 —— 由 `state.conflicts()` 推导（既有的 + `capabilityConflict`、`capabilityConflictReason`），与 `checkCapabilityAssociationTx` 共用同一 + 套冲突识别逻辑。冲突原因 `使用此角色的用户已直接获授创建项目...` / `创建项目需要本人项目...` 都是 + user-facing 中文，不暴露内部 ID。 +- 审计旁路检查：grep 没有发现 `tx.Exec(...)` 后绕过 `saveReceipt` 的旁路； + `policyWriteBatch` 接受的是一个闭包，闭包内未调用 `tx.Commit()`（commit 由 `policyWriteBatch` 唯一持有）， + 这确保 batch 写后必须走 `saveReceipt` 才能 commit 落盘。 + +未发现绕过审计的写入。 + +--- + +## 7. 重点 5 —— 与 #228/#234 的关系 + +#228（Add read-only role options, a member roster directory and a removed-member send refusal） + +引入： +- `pkg/extension/RoleOption` / `RoleOptionsProvider.ListRoleOptions`（read-only enabled + role directory；走 `h.caps.st.ListRoles` 投影为 `roleId+name`） +- `pkg/extension.AccountDirectoryPurposeProjectRoster`（project roster 枚举） +- `internal/server/server.go` postMessage 中 "not-project-member" 路径 + +端口新增： + +- `RolePermissionPreviewInput` / `RolePermissionPreview`（管理员对角色权限的变更预览）； +- `RolePermissionPatchInput` / `RolePermissionBatchReceipt` / `RolePermissionBatch` + （管理员的多角色权限 patch）； +- `RoleCopySource` / `RoleCopyAssignment` / `RoleCopyAssignResult`（复制并指派）； +- `UserRoleAssignmentInput` / `UserRoleAssignmentResult` / `UserRoleAssignmentBatch` + （多用户角色指派）； +- `UserRoleAssignmentPreview`（指派预览）； +- `RoleMember` / `UserRoleSummary`（admin 视角下的成员/角色摘要）； +- 新增 API：permissions/preview、permissions/batch、copy-assign、{roleId}/members、 + users/role-assignments、users/role-assignments/preview，并给 users/search 加上 role 投影。 + +没有发现重复或冲突：#228 的 `RoleOptionsProvider.ListRoleOptions` 仍是非 admin 派发面 +（"trust a trusted Host"，且"callers still authorize their own domain action"）， +本端口的 7 个 admin API 在 main 当前路由表里尚不存在；`GET /api/admin/roles/{roleId}/members` +是 admin 视角的成员名册，没有触及 `AccountDirectoryPurposeProjectRoster` 的项目名册枚举。 +`UserRoleSummary` 是 store-side projection 类型，没有出现在 `pkg/extension/surface.txt` 新增 +位置上（不污染扩展面）—— 这一点有意的：内部 store 投影不应进入扩展契约。 + +#234（Land the project access and lifecycle role and work-state work on Backend main） + +引入： + +- `internal/app/hostcaps.go` 中 `RoleAdminProvider`、`CreateRole/UpdateRole/DeleteRole/...`、 + `ReplaceRolePermissions` 的派发 Host 实现（与 AdminProvider 一起）；catalog 测试 + `TestCatalogLinkedActionsStayProjectScopedAndUnprotected` 与 `R2` 的角色模型断言。 +- `internal/authz/service.go` 的 system action 决策函数、`ExplainCapabilities` 投影； +- `internal/server/project_lifecycle.go` 中 `projectWork` / `lifecycleHost`； +- 测试 `internal/server/project_iam_integration_test.go`、`role_authorization_test.go`、 + `roles_test.go`、`explain_test.go` 等。 + +端口新加的项目 1:1 与 #234 项目没有重叠： + +- 不动 `RoleAdminProvider` / `RoleAdminView` schema（仍由既有 `RoleAdmin` 函数读出来）。 +- 不动 `AuthorizeSystem`、`ProjectCreateAction`、`ProjectAccessAction`、`ProjectCreateLinkedActions()`。 +- 不动 `lifecycleHost`、`projectWork`、`ExplainCapabilities`。 +- `TestCatalogLinkedActionsStayProjectScopedAndUnprotected` 添加的测试（catalog_test.go 末尾 + 的 +16 行）仅是个保险钉——验证 catalog 中的 linked 动作仍为 project-scope 且非受保护， + 与本端口在 `normalizePermissionChanges` / `CreateRoleCopyAndAssign` 里加的限制条件一致。 +- 既有的 `TestRoleProjectCreateLinksFullManagement`、`TestReplaceRolePermissionsAcceptsOnlyProjectAccessBoolean`、 + `TestCapabilityAssociationRejectsStaleVersionAndMissingRole` 等 R2 / R4 锚点测试没有被 + 改写、删除或弱化（详见 §8）。 + +--- + +## 8. 重点 6 —— 测试质量 + +新测试（14 项，全部新增，未删/未跳过既有断言）： + +store 层（`internal/store/role_policy_test.go`）： + +- `TestPatchRolePermissionsBatchEnablesAndDisablesAcrossRoles`（happy，双 role 同步切换） +- `TestPatchRolePermissionsBatchAtomicityRejectsWholeBatch`（一坏拒整批 + 验证两 role + 维持原样 + epoch 不前进） +- `TestPatchRolePermissionsBatchStaleVersion`（过期 version 拒整批 + role 维持原样） +- `TestPatchRolePermissionsBatchRejectsLimitAndIdempotency`（20 上限、空批、同 key 重放返回 + 同一 receipt/epoch） +- `TestPreviewRolePermissionsMatchesCommitResult`（预览允许/拒绝与 commit 一致） +- `TestPreviewRolePermissionsRejectsInvalidBatchItem`（非法动作仅在 item 级别报错，不写盘） +- `TestAssignUserRolesBatchRebindsInOneTransaction`（两人 rebind 在一个事务中，epoch+1 + + 同 key 重放 epoch 不变） +- `TestAssignUserRolesBatchRejectsWholeBatch`（一个用户 state_version 过时 → 整批回滚 + + 两角色 binding_id 与 state_version 未被改写） +- `TestPreviewUserRoleAssignmentsJudgesEachItem`（三种 case：成功、state_version 过时、 + 用户不存在；预览不写盘不前进 epoch） +- `TestListRoleMembersForActorRequiresGrantsAndPaginates`（admin 看见、ordinary 被拒） +- `TestActiveRolesForUsersReturnsActiveBindings`（仅返回 active binding；结束后不再见） +- `TestCreateRoleCopyAndAssignCreatesRoleAndBindsInOneTransaction`（happy：新 role + + 绑定 + epoch+1） +- `TestCreateRoleCopyAndAssignRejectsWithoutResidue`（覆盖坏 overrides / 坏 name / 坏 + state version 三种；检查 epoch 未进、新 role 未落盘） + +server 层（`internal/server/role_authorization_test.go`）： + +- `TestRolePermissionPreviewRequiresPermissionViewOverHTTP`（403 with only `system.roles.view`； + 200 with admin；未知 role 单 item 报 `角色不存在或已停用`；空 roles 列表 400） +- `TestBatchRolePermissionPatchOverHTTP`（403 with `roles.view+roles.manage`；200 提交； + 过时 version → 409；非法变更（含 `system.users.view`）→ 400） +- `TestBatchRoleAssignmentPreviewAndCommitOverHTTP`（happy 路径：preview + commit） +- `TestCopyAssignRoleOverHTTP`（happy 路径：源 role 启用 → copy → 用户绑定） +- `TestRoleMembersFilterBeforePagingAndBindCursor`（admin 列出 + filter `query=alice&mode=exact` + 仅留 alice） +- `TestAccountSearchIncludesRoleProjection`（search 结果中含 role 投影含 roleID） + +测试覆盖到的关键断言： + +- 每个写 API 都验证了 "atomic"（整批失败回滚写零） +- `replayReceipt` 的 "同 key + 同 hash → 同 receipt/epoch" 显式断言 +- `PatchRolePermissionsBatch` 验证过期 role_version 走 `ErrInvalidRolePolicy` 并（按 HTTP + 层）映射到 409 +- 端口的 `TestRolePermissionsNormalizeLegacyRowsToProjectAccess`、`TestReplaceRolePermissionsAcceptsOnlyProjectAccessBoolean`、 + `TestRolePolicyRejectsNonProjectAccessRowsAtomically`、`TestCapabilityAssociationRejectsStaleVersionAndMissingRole`、 + `TestCapabilityAssociationImportRejectsLinkedConflict`、`TestLinkedCapabilitiesSystemGrantWithoutRoleClosesLoop`、 + `TestRolePolicyProjectAccessFailsClosedForDisabledRoleOrAccount`、`TestRolePolicyIdempotencyKeyCannotChangeRequest`、 + `TestImportRoleAuthorityPreservesStableIDsAndBindingsAtomically` —— 全部 + **未改写、未删除、未弱化**。 + +测试未被覆盖到的几个点（详见 §10 非阻塞建议）。 + +--- + +## 9. 阻塞项 + +无。 + +--- + +## 10. 非阻塞建议（advice，不阻断合入） + +按"安全优先 → 可靠性 → 测试"排列： + +1. **[安全] `assignUserRolesBatch` 缺少"非 admin 调用被 403"的 HTTP 层负测**。 + `TestBatchRolePermissionPatchOverHTTP` 与 `TestRolePermissionPreviewRequiresPermissionViewOverHTTP` + 已经验证了"持有弱权限的 actor 拿不到 403"。`assignUserRolesBatch` 与 `previewUserRoleAssignments` + 仅在 happy 路径上测过（`TestBatchRoleAssignmentPreviewAndCommitOverHTTP`）。 + 建议补一条"持有 `system.roles.view` 但无 `system.roles.assign` 的 actor 调用 + `/api/admin/users/role-assignments` 收到 403"的测试。预期实现确实会拒绝 + （`assignUserRolesBatch` 起手 `requireSystemAction("system.roles.assign")`），但缺少语义钉。 + +2. **[安全] `copyAssignRole` 缺少 HTTP 层负测（任一闸不足被拒）**。 + 当前只有 happy path。建议补： + - 仅 `system.roles.manage` + `system.permissions.manage`，缺 `system.roles.assign` → 403； + - 仅 `system.permissions.manage` + `system.roles.assign`，缺 `system.roles.manage` → 403； + - 仅 `system.roles.manage` + `system.roles.assign`，缺 `system.permissions.manage` → 403。 + 三个闸同时持有的语义在生产代码中已写明，但测试未钉死。 + +3. **[安全/一致性] `assignUserRolesBatch` 缺 user-missing/role-missing/role-disabled 的负测**。 + `TestAssignUserRolesBatchRejectsWholeBatch` 仅覆盖 stale-state-version 一种失败模式。 + store 层 `assignRolesTx` 通过 `roleAssignmentUserMissing` / `roleAssignmentUserDisabled` / + `roleAssignmentRoleInvalid` 区分三种原因（preview 路径已经分别测过这三种原因， + `TestPreviewUserRoleAssignmentsJudgesEachItem`），但 commit 路径没有显式锁定 + "bad userId / disabled user / disabled role" 都会回滚。 + +4. **[可靠性] PostgreSQL 下潜在的锁顺序风险**。 + `assignRolesTx` / `CreateRoleCopyAndAssign` 内部对每个 item 调用 + `s.roleTx(tx, item.RoleID, true)`，锁定顺序由 items 切片顺序决定。 + 与 `policyWriteBatch` 内部 `lockAccountUsers` 的字典序 owner 锁不同，role-row 锁顺序 + 没有全局规范化。当两个并发 batch 提交 items 涉及交叠 role 集合但顺序相反时， + 可能出现 PG 层 `40P01 deadlock_detected`，客户端表现为 500（因为 writeStoreErr 对 + deadlock 没特殊映射）。SQLite 不受影响。 + 建议（任一）： + (a) 批前按 `item.RoleID` 排序后再 `roleTx`，让所有 batch 走同一序； + (b) 在 writeStoreErr 中对 deadlock 检测加一条 `502/503` 提示; + (c) 把 SQL 锁与 `policyWriteBatch` 的 owner 锁合并成同一把 `pg_advisory_xact_lock` + key。在评估其工作量后再决定。 + 当前批大小（≤100）下并发风险不大，但应在 batch 大小被放大或 PG 高并发场景重新审视。 + +5. **[测试] `ListRoleMembersForActor` 缺跨越多 role 测试**。 + `TestListRoleMembersForActorRequiresGrantsAndPaginates` 只在单 role + active-vs-inactive + 验证成员计数；没有测 "两个 role，actor 同时查询 role-A，结果只包含 role-A 成员"。 + +6. **[风格] handler 层 `listRolePermissionPreview` 的 400 路径**。 + 当 `roles` 为空时，handler 直接 400；store 里 `len(items) == 0 || len(items) > maxRolePermissionPreviewItem` + 也会返回 `ErrInvalidRolePolicy`。两处都在做相同的合法性检查。这是 + #228/#234 现有 pattern 的一致沿用，但建议未来统一只用一处。 + +7. **[风格] `previewUserRoleAssignments` 与 `listRoleMembers` 重复了 cursor 计算**。 + 两处都用 SHA256 over `{Kind, Actor, RoleID, Query, Mode, Status, Revision}` 派生 + version；HMAC 用 `accountSearchKey` 派 cursor token。建议抽 `roleMembersVersion(actor, roleID, query, mode, status, revision)` helper + 到 `account_search.go`，避免后续在 `copyAssignRole`、`batchPatchRolePermissions` 等 + 写入响应里再次手写。 + +--- + +## 11. 依据与实际只读命令结果（evidence） + +| 命令 | 输出摘要 / 关键引用 | +|---|---| +| `git status` → `HEAD detached at f10fb2e; nothing to commit, working tree clean` | 工作区干净；fix/iam-perm-ux-port HEAD = f10fb2e | +| `git log --oneline 01f4c47a2b5..HEAD` | `f10fb2e` / `76abebe` / `2d1e5f5` —— 与 packet 一致（2 transport + task-start） | +| `git diff 01f4c47a2b5..HEAD --stat` | 8 文件 / +2237 行（packet 标 "+2184" 视为合理近似口径差异） | +| `git diff ... -- internal/server/server.go` | 新增 6 条 `mux.HandleFunc` 注册（行 323-328），全部位于既有 `/api/admin/roles` 与 `/api/admin/users` 区间内，无路由表破坏 | +| `git diff ... -- internal/store/role_policy.go`（约 +1141 行） | 新增 `RolePermissionPreviewInput/Patch/Batch`/`UserRoleAssignmentInput/Batch/Preview`/`RoleCopy*/RoleMember/UserRoleSummary`/`policyWriteBatch`/`PreviewRolePermissions`/`PatchRolePermissionsBatch`/`CreateRoleCopyAndAssign`/`AssignUserRolesBatch`/`PreviewUserRoleAssignments`/`ListRoleMembersForActor`/`ActiveRolesForUsers` —— 全部以 `policyWriteBatch` 或显式 tx/actor 校验为入口 | +| `git diff ... -- internal/server/roles.go` | 6 个 handler（`listRolePermissionPreview`/`batchPatchRolePermissions`/`decodeRoleAssignments`/`assignUserRolesBatch`/`previewUserRoleAssignments`/`copyAssignRole`） + `systemActionAllowed` 静默判定辅助 | +| `git diff ... -- internal/server/account_search.go` | `searchAdminUsers` 追加 `system.roles.view` 守门 role 投影（`systemActionAllowed` 静默跳过路径）；新增 `listRoleMembers` handler（角色过滤 + 绑定 cursor）| +| `git diff ... -- internal/store/role_policy_test.go` | +494 行：14 新测试覆盖 happy / 原子回滚 / 过期版本 / 幂等重放 / 上限 / preview 一次 item level / user-missing 等；既有测试零修改 | +| `git diff ... -- internal/server/role_authorization_test.go` | +226 行：6 新 HTTP 测试，含 `403 with weaker grant`、`409 on stale version`、`400 on invalid action`；既有测试零修改 | +| `git diff ... -- internal/authz/catalog/catalog_test.go` | +16 行：仅加 `TestCatalogLinkedActionsStayProjectScopedAndUnprotected`，未改既有 | +| `grep requireSuperAdminTargetAccess internal/store/*.go` | 定义于 `super_admin.go:36`，被既有 `AssignUserRole`/`ReplaceSystemGrants` 与本次新增 `assignRolesTx`（*Batch 路径）/ `CreateRoleCopyAndAssign` 内的 `assignRolesTx` 调用 | +| `grep roleGrantsAccountAdministrationTx internal/store/role_policy.go` | 定义 line 743；被既有 `AssignUserRole`/`replaceSystemGrantsTx` 与新增 `assignRolesTx` 调用 | +| `grep requireRoleAuthorityWritableTx internal/store/role_policy.go` | 定义 line 245（`FOR UPDATE` of `role_authority_import_state`）；被既有 `CreateRole`/`PatchRole`/`ReplaceRolePermissions`/`AssignUserRole` 与新增 `PatchRolePermissionsBatch`/`AssignUserRolesBatch`/`CreateRoleCopyAndAssign` 调用 | +| `grep policyWriteBatch internal/store/role_policy.go` | 定义 line 1620；与既有 `policyWrite`（line 181）同形态（owner 字典序锁 + tx + epoch + 闭包 + commit）| +| `grep mux.HandleFunc internal/server/server.go` | 路由按既有 admin/role/user 区段插入 | +| `grep saveReceipt internal/store/role_policy.go` | 三个 batch 入口都调用 `saveReceipt`；store 没有 tx.Commit() 之外的提交途径 | +| `grep CREATE.*user_role_bindings internal/store/migrate.go` | line 1284 的 `CREATE UNIQUE INDEX uq_user_role_bindings_active ON user_role_bindings(user_id) WHERE active=TRUE` —— 强制单 active binding/user；`Update user_role_bindings SET active=0 ... WHERE active=1` 不会同时关错多行 | +| 跳过 | `git submodule init/update`（packet 禁用）/ `git add/commit/push` / `git config` / `git stash` —— 全部未执行 | +| 跳过 | `PYTHONDONTWRITEBYTECODE=1 python3 -m unittest tests.test_shell_pipe_hazard` —— packet 在 test 列表中给出该命令，但本仓库不存在 `tests/` 目录也不存在 `test_shell_pipe_hazard` 测试。该命令不可执行，与端口内容无关（疑为模板残留），已在"未验证"列出 | + +--- + +## 12. 未验证（structural limits of detached-HEAD review-only session） + +按 packet 第 3 项要求"未验证的结论写明未验证"。下列条目不是结论本身的缺失，而是本会话 +无法跑通验证路径： + +1. **未跑 `go test ./...`**：deps 子模块 gitlink 在本 detached-HEAD 工作区中尚未初始化 + （worktree 内 `deps/*/` 是空目录），且 packet 禁用 `git submodule init/update`， + 所以 `go build ./...` 也无法走通。所有"编译通过性"和"测试通过性"的结论均以**静态 + diff/源码对比**为依据，不以运行为依据。评审者**未亲眼见到测试 PASS 输出**。 + +2. **未对源 feature 分支作交叉比对**：packet 注明 `feature/iam-perm-ux-backend` "唯一副本 + 已备份"，本工作区没有该分支 ref 也无任何 transport 元数据用于追溯。本评审**仅按 diff + 与 main 既有语义做正向校验**，不与原 feature 分支逐行比对。 + +3. **PG dialect 下不跑 `go test ./... -tags pg`**：同上。 + +4. **`tests.test_shell_pipe_hazard` 不可执行**：模板命令，本仓无对应目录与模块，已注明。 + +5. **未跑 `make precheck`**：packet 在 Dev 仓推进；本仓为子仓，"独立开发"路径见 + PROJECT.md 但 precheck 归属于 Dev 仓，本审查会话不对其做运行。 + +--- + +## 13. 决定 + +- `terminal_status`: `completed`（独立审查产出完毕，未改动任何非报告文件；非"BLOCKED"） +- 审查者 ID：iam-perm-ux-port-independent-review +- 提交建议：可合入 main（前提是 §10 中 (1)(2)(3) 三条负测在合入前补齐或与跟进任务 + 挂钩 —— 推荐补齐后再合，以避免 main 出现"缺少 admin-grant 校准测试"的退化窗口） + +— end of review — From c5a599e28d8a0ea3edbda704eded771e7d2eee52 Mon Sep 17 00:00:00 2001 From: weichen Date: Wed, 21 Oct 2026 15:13:49 +0000 Subject: [PATCH 5/5] Record port scope, build fix and PASS review for the IAM permission API Why: the port's authorization boundary, the build correction and the review verdict must be recorded before delivery. Evidence: /tmp/be-iam-perm-ux-impl-r1-20261021.json: pi, success (port) /tmp/be-iam-perm-ux-buildfix-r2-20261021.json: pi, success (build fix; r1 failed-unknown produced no record so nothing was imported) /tmp/be-iam-perm-ux-review-r1-20261021.json: pi, PASS, no blockers Host-side checks on the final head: gofmt -l clean; go build ./... and go vet on store/server/authz silent; go test on those packages green. Impact: card metadata only. Refs: fix/iam-perm-ux-port; backup /home/weichen/projects/backups/iam-perm-ux-20261021T140345Z --- .task/fix-iam-perm-ux-port.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/.task/fix-iam-perm-ux-port.md b/.task/fix-iam-perm-ux-port.md index 332559e..22da75d 100644 --- a/.task/fix-iam-perm-ux-port.md +++ b/.task/fix-iam-perm-ux-port.md @@ -11,12 +11,14 @@ - 父任务信息（仅子任务填写）：无 - accepting_requirements：false - 需求分流：verdict=NEW；selected_initiative=无；候选=无；理由=no accepting initiative；triage 收据=/tmp/be-triage-iam-perm-ux-20261021.json；receipt_sha256=bb4a700446f22b5799e94f1c6efa488c4a30b65814a457b76ab41d30b0dc5038；requirement_sha256=9495f0dc1c3cbf04feb6c712bfa93c6bbb6803801285a518ae9f309c74ec836b -- 授权与交付终点：<本次允许的动作与终点；未授权事项写明> +- 授权与交付终点：把仅存在于被放弃分支 feature/iam-perm-ux-backend 的权限管理 API 移植到当前 main，使其可从主干维护与调用。冲突一律以 main 现状裁决，不照搬旧实现；不得绕过 main 的账户作用域写入围栏与授权检查；不得新增范围外功能或 schema 迁移。 - 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md；外部 Agent 一单元一新进程/会话/工作区） ## 目标与非目标 -<预期结果、受影响入口/模块/契约；明确不做什么。> +目标：main 此前不具备七个权限管理入口（PatchRolePermissionsBatch、PreviewRolePermissions、AssignUserRolesBatch、PreviewUserRoleAssignments、ListRoleMembersForActor、ActiveRolesForUsers、CreateRoleCopyAndAssign）与配套类型（RoleBinding、PolicyReceipt、RoleAdminView、CapabilityAssociation、RoleAuthorityImport*、RoleCreate/RolePatch、RolePermissionChange/Conflict）。本任务把这些能力移植到当前 main（其间 Backend 已合入 #228、#234），并保留其安全语义。 + +非目标：不整条合并/cherry-pick 旧分支（其基线早于 #228/#234）；不新增范围外功能；不做无关重构；除移植确需新表外不改 schema；不改 Makefile/CI/子模块/文档。 ## Agent 实施收据 @@ -51,9 +53,9 @@ ## 结果与验证（完成后填写） -- 结果：<交付了什么；未发生写无>。 -- 验证：<结论性摘要：PASS/FAIL/SKIP/NOT_RUN 逐项；逐条证据见下表，来源标注与写入规则见 [按影响选择验证与证据](../standards/verification.md)>。 -- 影响与剩余项：<影响面、遗留风险、后续任务>。 +- 结果：七个权限管理入口（PatchRolePermissionsBatch、PreviewRolePermissions、AssignUserRolesBatch、PreviewUserRoleAssignments、ListRoleMembersForActor、ActiveRolesForUsers、CreateRoleCopyAndAssign）与配套类型（RoleBinding、PolicyReceipt、RoleAdminView、CapabilityAssociation、RoleAuthorityImport*、RoleCreate/RolePatch、RolePermissionChange/Conflict）全部移植到当前 main 的角色/权限模型上，8 文件 / +2184 行。移植首版并未编译通过（role_policy.go:2394 向 upsertRolePermissionsTx 传参错位：空 map 当 current、slice 当 after），已由独立 repair 单元按 main 的差量语义修正。 +- 验证：PASS——gofmt -l 干净；go build ./... 与 go vet ./internal/store/ ./internal/server/ ./internal/authz/... 均无输出（宿主独立执行）；go test -count=1 ./internal/store/ ./internal/server/ ./internal/authz/... 全绿（store 13.3s / server 29.5s / catalog ok）；独立 Review PASS、无阻塞项，逐 API 核对安全语义。 +- 影响与剩余项：只新增能力面，不改 schema（移植未引入新表），不改 Makefile/CI/子模块；未新增范围外功能。非阻塞遗留：Review 指出 PostgreSQL 下不同角色跨 batch 处理的潜在 lock-ordering 风险，以及若干测试缺口，两者已记入报告留作后续增量。 | 时间(UTC) | 命令 | 被测 HEAD | exit | 来源 | 摘要/位置 | |---|---|---|---|---|---|