weichen
94732f3c87
Why: Existing RDM role commands must reach the Backend authority during UI and migration cutover without dual-writing RDM role tables. Evidence: The full Backend suite passed, including actor-bound role administration, owner compatibility, provider, and public-surface tests. Impact: Adds temporary trusted Host administration methods and completes the project-action catalog used by RDM. Refs: Focused role and permission system task 5
68 lines
5.0 KiB
Go
68 lines
5.0 KiB
Go
// Package catalog owns the trusted action catalog used by system, role, and
|
|
// project authorization. Callers cannot invent an action or its scope.
|
|
package catalog
|
|
|
|
type Scope string
|
|
|
|
const (
|
|
ScopeSystem Scope = "system"
|
|
ScopeProject Scope = "project"
|
|
)
|
|
|
|
type Descriptor struct {
|
|
ActionID string `json:"actionId"`
|
|
Label string `json:"label"`
|
|
Description string `json:"description"`
|
|
Group string `json:"group"`
|
|
Scope Scope `json:"scope"`
|
|
Protected bool `json:"protected"`
|
|
}
|
|
|
|
var descriptors = []Descriptor{
|
|
{ActionID: "system.settings.read", Label: "查看系统设置", Description: "查看系统范围的受管配置", Group: "系统设置", Scope: ScopeSystem, Protected: true},
|
|
{ActionID: "system.settings.write", Label: "修改系统设置", Description: "修改系统范围的受管配置", Group: "系统设置", Scope: ScopeSystem, Protected: true},
|
|
{ActionID: "system.users.view", Label: "查看用户", Description: "查看账号目录及获准资料", Group: "用户管理", Scope: ScopeSystem, Protected: true},
|
|
{ActionID: "system.users.create", Label: "创建用户", Description: "创建普通账号", Group: "用户管理", Scope: ScopeSystem, Protected: true},
|
|
{ActionID: "system.users.edit", Label: "编辑用户", Description: "编辑账号的非凭据资料", Group: "用户管理", Scope: ScopeSystem, Protected: true},
|
|
{ActionID: "system.users.disable", Label: "停用用户", Description: "停用或重新启用账号", Group: "用户管理", Scope: ScopeSystem, Protected: true},
|
|
{ActionID: "system.roles.view", Label: "查看角色", Description: "查看职位角色及绑定人数", Group: "角色管理", Scope: ScopeSystem, Protected: true},
|
|
{ActionID: "system.roles.manage", Label: "管理角色", Description: "创建、编辑和停用职位角色", Group: "角色管理", Scope: ScopeSystem, Protected: true},
|
|
{ActionID: "system.roles.assign", Label: "分配角色", Description: "替换用户唯一生效职位角色", Group: "角色管理", Scope: ScopeSystem, Protected: true},
|
|
{ActionID: "system.permissions.view", Label: "查看系统权限", Description: "查看系统授权、角色默认与上限", Group: "权限管理", Scope: ScopeSystem, Protected: true},
|
|
{ActionID: "system.permissions.manage", Label: "管理系统权限", Description: "配置明确系统授权与平台上限", Group: "权限管理", Scope: ScopeSystem, Protected: true},
|
|
{ActionID: "project.create", Label: "创建项目", Description: "创建新的项目", Group: "项目入口", Scope: ScopeSystem},
|
|
{ActionID: "project.settings", Label: "项目设置", Description: "修改本项目设置", Group: "项目管理", Scope: ScopeProject},
|
|
{ActionID: "project.archive", Label: "归档项目", Description: "归档或恢复本人创建的项目", Group: "项目管理", Scope: ScopeProject},
|
|
{ActionID: "project.stage.advance", Label: "推进项目阶段", Description: "推进本人创建项目的阶段", Group: "项目管理", Scope: ScopeProject},
|
|
{ActionID: "project.members.manage", Label: "管理项目成员", Description: "维护本项目成员", Group: "项目管理", Scope: ScopeProject},
|
|
{ActionID: "project.permissions.manage", Label: "管理项目权限", Description: "维护本项目成员权限覆盖", Group: "项目管理", Scope: ScopeProject},
|
|
{ActionID: "document.duties.assign", Label: "分配文档三权", Description: "分配本项目文档编制、审核和批准职责", Group: "文档职责", Scope: ScopeProject},
|
|
{ActionID: "document.read", Label: "读取文档", Description: "读取获准的项目文档", Group: "文档动作", Scope: ScopeProject},
|
|
{ActionID: "document.author", Label: "编制文档", Description: "履行已分配的文档编制职责", Group: "文档动作", Scope: ScopeProject},
|
|
{ActionID: "document.review", Label: "审核文档", Description: "履行已分配的文档审核职责", Group: "文档动作", Scope: ScopeProject},
|
|
{ActionID: "document.approve", Label: "批准文档", Description: "履行已分配的文档批准职责", Group: "文档动作", Scope: ScopeProject},
|
|
{ActionID: "document.publish", Label: "发布文档", Description: "发布已完成审签的项目文档", Group: "文档动作", Scope: ScopeProject},
|
|
{ActionID: "trace.edit", Label: "编辑追溯网", Description: "编辑本项目追溯关系", Group: "项目内容", Scope: ScopeProject},
|
|
{ActionID: "knowledge.publish", Label: "发布项目知识", Description: "发布或撤销本项目知识", Group: "项目内容", Scope: ScopeProject},
|
|
{ActionID: "project.audit.read", Label: "读取业务审计", Description: "读取获准项目的业务审计", Group: "项目内容", Scope: ScopeProject},
|
|
}
|
|
|
|
var descriptorByID = func() map[string]Descriptor {
|
|
out := make(map[string]Descriptor, len(descriptors))
|
|
for _, descriptor := range descriptors {
|
|
out[descriptor.ActionID] = descriptor
|
|
}
|
|
return out
|
|
}()
|
|
|
|
func DescriptorByID(id string) (Descriptor, bool) {
|
|
descriptor, ok := descriptorByID[id]
|
|
return descriptor, ok
|
|
}
|
|
|
|
func Catalog() []Descriptor {
|
|
out := make([]Descriptor, len(descriptors))
|
|
copy(out, descriptors)
|
|
return out
|
|
}
|