merge: modular-decouple residual goose 00065

.doc/ops/short-term/2026-09-23-modular-decouple-residual.md

@@ -2,7 +2,7 @@
 title: "模块解耦残余重构（巨型文件 + W4 + Sysadmin 二期）"
 task_id: modular-decouple-residual-b-2026-09-23
 continues: modular-decouple-residual-2026-09-23
-status: in_progress
+status: done
 # prior task closed for scope expand (deploy); continued by -b
 created: 2026-09-23
 updated: 2026-09-23
@@ -17,8 +17,8 @@ write_scope: ["internal", "scripts", "web", ".doc"]
 allowed_environments: []
 head_sha: "3337bf4a4298cc0e50b2cc867a7f39d66cdd3275"
 mutex: "modular-decouple-residual"
-review_state: pending
-integration_state: pending
+review_state: accepted_gates
+integration_state: landed_local_dev_701c565f
 deployment: not_required
 cleanup: pending
 cleanup_owner: "独立维护者"

deploy/postgres/goose/00065_2026-09-23-system-console-perms-and-settings-audit.sql

@@ -0,0 +1,50 @@
+-- +goose Up
+-- 系统管理台二期：细粒度 system:* 权限 + 通用设置审计表。
+INSERT INTO system_permissions (perm_key, resource_type, action, risk_level) VALUES
+    ('system:overview', 'system', 'overview', 'elevated'),
+    ('system:kb:read', 'system', 'kb_read', 'elevated'),
+    ('system:features:read', 'system', 'features_read', 'elevated'),
+    ('system:settings:read', 'system', 'settings_read', 'elevated'),
+    ('system:settings:write', 'system', 'settings_write', 'critical'),
+    ('system:audit:read', 'system', 'audit_read', 'elevated')
+ON CONFLICT (perm_key) DO NOTHING;
+
+INSERT INTO system_role_permissions (role_id, permission_id, effect)
+SELECT 'role-admin', p.id, 'allow'
+FROM system_permissions p
+WHERE p.perm_key IN (
+    'system:overview',
+    'system:kb:read',
+    'system:features:read',
+    'system:settings:read',
+    'system:settings:write',
+    'system:audit:read'
+)
+ON CONFLICT DO NOTHING;
+
+CREATE TABLE IF NOT EXISTS system_settings_audits (
+    id              BIGSERIAL PRIMARY KEY,
+    setting_key     TEXT NOT NULL,
+    before_value    JSONB,
+    after_value     JSONB NOT NULL,
+    actor_user_id   BIGINT NOT NULL,
+    request_id      TEXT,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_system_settings_audits_key_created
+    ON system_settings_audits (setting_key, created_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_system_settings_audits_created
+    ON system_settings_audits (created_at DESC);
+
+-- +goose Down
+DROP INDEX IF EXISTS idx_system_settings_audits_created;
+DROP INDEX IF EXISTS idx_system_settings_audits_key_created;
+DROP TABLE IF EXISTS system_settings_audits;
+
+DELETE FROM system_role_permissions
+WHERE permission_id IN (
+    SELECT id FROM system_permissions WHERE perm_key LIKE 'system:%'
+);
+DELETE FROM system_permissions WHERE perm_key LIKE 'system:%';