weichenandCursor
6219caf690
Add roles CRUD backed by system_roles tables, session list/revoke APIs, capabilities fallback for memory mode, and route all admin checks through AuthorizationService instead of hardcoded role-admin checks. Co-authored-by: Cursor <cursoragent@cursor.com>
41 lines
929 B
Go
41 lines
929 B
Go
package authz
|
|
|
|
// FallbackCapabilitiesByRoleID 在无 PG RBAC 时按 role_id 返回静态权限（与 IAM 种子对齐）。
|
|
func FallbackCapabilitiesByRoleID(roleID string) []string {
|
|
switch roleID {
|
|
case "role-admin":
|
|
return []string{
|
|
"project:create",
|
|
"project:assign_lead",
|
|
PermManage,
|
|
"workflow:config_visibility",
|
|
"doc:override_visibility",
|
|
"doc:export",
|
|
"workflow:view_all",
|
|
}
|
|
case "role-director":
|
|
return []string{
|
|
"project:create",
|
|
"project:assign_lead",
|
|
"workflow:config_visibility",
|
|
"doc:override_visibility",
|
|
"doc:export",
|
|
"workflow:view_all",
|
|
}
|
|
case "role-tech-lead":
|
|
return []string{
|
|
"project:create",
|
|
"project:assign_lead",
|
|
"doc:override_visibility",
|
|
"doc:export",
|
|
"workflow:view_all",
|
|
}
|
|
case "role-engineer":
|
|
return []string{"doc:export", "workflow:view_all"}
|
|
case "role-guest":
|
|
return []string{"doc:export"}
|
|
default:
|
|
return nil
|
|
}
|
|
}
|