weichen
b739f358f8
Archive real PI acceptance for member run/edit vs submit duty gates; register ISSUE/LESSON and refresh MATRIX/gap/authz matrix evidence.
1.9 KiB
1.9 KiB
API 授权矩阵 v2（Phase 0 基线）
基线 commit：
bb3f3a1b93eaf4bbd4a7c26a70714a3320d455d3
策略：默认拒绝；未知路由拒绝；跨项目 403/404 统一。
| 路由 | Resource | Action | Owner | 负例（未授权） |
|---|---|---|---|---|
| POST /api/v1/auth/login | session | create | auth | 匿名可访问（公开） |
| GET /api/v1/auth/me | user | read_self | auth | 401 无 token |
| GET /api/v1/projects | project | list | projectworkflow | 401 匿名 |
| POST /api/v1/projects | project | create | projectworkflow | 401；403 无 project:create |
| GET /api/v1/projects/{id} | project | read | authz | 403 非成员 |
| GET /api/v1/projects/{id}/lineage | lineage | read | projectworkflow | 403 跨项目 |
| GET /api/v1/projects/{id}/workflows/{key}/runs | workflow_run | list | projectworkflow | 403 跨项目 |
| POST /api/v1/projects/{id}/workflows/{key}/run | task | run | bizdev+stage | 403 错 task/stage |
| GET /api/v1/tasks/runs/{id} | task_run | view | taskrun | 403 非 owner/非 owner 成员 |
| POST /api/v1/tasks/runs/{id}/cancel | task_run | cancel | taskrun | 403 取消他人 |
| POST /api/v1/chat/stream | chat | send | chat+stage | 403 无阶段权限 |
| GET /api/v1/docgov/* | document | * | docgov+duty | view：成员；run/edit：成员（deny_only_submit）；submit/review/approve：对应职责，403 |
| POST /api/v1/docgov/content | document | edit | docgov+member | 403 非项目成员或锁定态 |
| POST /api/v1/docgov/submit-review | document | submit | docgov+author | 403 非编制职责人 |
| POST /api/v1/tasks/run | task | run | bizdev+member | 403 非成员 / 非活动阶段；不再要求编制职责 |
| GET /api/v1/admin/* | admin | * | authz RBAC | 403 非 admin/细粒度 perm |
| GET /health, /api/v1/health | system | health | server | 公开 |
完整路由枚举见 internal/server/server.go Routes()；Phase 1 起每个项目子资源必须经 requireProjectAccess。