weichen/Agent-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(sysadmin): system permission checks and settings audit list

Browse Source 
Expose fine-grained system:* checks (admin grants all) and list
system_setting_policy_audits for settings change visibility.
This commit is contained in:
WeiCHEN
2026-09-23 10:11:46 +08:00
parent 9735578c1f
commit d49c8f8cfc
4 changed files with 89 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/postgres/goose/00065_2026-09-23-system-console-perms-and-settings-audit.sql
-50
View File
@@ -1,50 +0,0 @@
-- +goose Up
-- 系统管理台二期：细粒度 system:* 权限 + 通用设置审计表。
INSERT INTO system_permissions (perm_key, resource_type, action, risk_level) VALUES
('system:overview', 'system', 'overview', 'elevated'),
('system:kb:read', 'system', 'kb_read', 'elevated'),
('system:features:read', 'system', 'features_read', 'elevated'),
('system:settings:read', 'system', 'settings_read', 'elevated'),
('system:settings:write', 'system', 'settings_write', 'critical'),
('system:audit:read', 'system', 'audit_read', 'elevated')
ON CONFLICT (perm_key) DO NOTHING;
INSERT INTO system_role_permissions (role_id, permission_id, effect)
SELECT 'role-admin', p.id, 'allow'
FROM system_permissions p
WHERE p.perm_key IN (
'system:overview',
'system:kb:read',
'system:features:read',
'system:settings:read',
'system:settings:write',
'system:audit:read'
)
ON CONFLICT DO NOTHING;
CREATE TABLE IF NOT EXISTS system_settings_audits (
id BIGSERIAL PRIMARY KEY,
setting_key TEXT NOT NULL,
before_value JSONB,
after_value JSONB NOT NULL,
actor_user_id BIGINT NOT NULL,
request_id TEXT,
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
);
CREATE INDEX IF NOT EXISTS idx_system_settings_audits_key_created
ON system_settings_audits (setting_key, created_at DESC);
CREATE INDEX IF NOT EXISTS idx_system_settings_audits_created
ON system_settings_audits (created_at DESC);
-- +goose Down
DROP INDEX IF EXISTS idx_system_settings_audits_created;
DROP INDEX IF EXISTS idx_system_settings_audits_key_created;
DROP TABLE IF EXISTS system_settings_audits;
DELETE FROM system_role_permissions
WHERE permission_id IN (
SELECT id FROM system_permissions WHERE perm_key LIKE 'system:%'
);
DELETE FROM system_permissions WHERE perm_key LIKE 'system:%';