weichenandCursor
f6813cc272
Public errors now emit code, safe message, and request_id while keeping the legacy error field. Raw SQL, paths, tokens, and XSS payloads are stripped; the frontend branches on code instead of substring matching. Co-authored-by: Cursor <cursoragent@cursor.com>
21 lines
546 B
Go
21 lines
546 B
Go
package server
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"chat-agent-system/internal/authz"
|
|
)
|
|
|
|
// handleAdminPermissions GET /api/v1/admin/permissions — 权限目录（服务端权威）
|
|
func (s *Server) handleAdminPermissions(w http.ResponseWriter, r *http.Request) {
|
|
if _, ok := s.requirePrincipal(w, r); !ok {
|
|
return
|
|
}
|
|
if r.Method != http.MethodGet {
|
|
writeSafeError(w, r, http.StatusMethodNotAllowed, "method not allowed")
|
|
return
|
|
}
|
|
catalog := authz.PermissionCatalog()
|
|
writeJSONResponse(w, http.StatusOK, map[string]any{"permissions": catalog})
|
|
}
|