WeiCHEN
b627134c62
Seed fine-grained console permissions (goose 00065), gate admin handlers by system:* keys, and persist settings change audits for all upserts. KB ops and whitelist consumers stay deferred.
47 lines
1.1 KiB
Go
47 lines
1.1 KiB
Go
package authz
|
|
|
|
// FallbackCapabilitiesByRoleID 在无 PG RBAC 时按 role_id 返回静态权限（与 IAM 种子对齐）。
|
|
func FallbackCapabilitiesByRoleID(roleID string) []string {
|
|
switch roleID {
|
|
case "role-admin":
|
|
return []string{
|
|
"project:create",
|
|
"project:assign_lead",
|
|
PermManage,
|
|
PermSystemOverview,
|
|
PermSystemKBRead,
|
|
PermSystemFeaturesRead,
|
|
PermSystemSettingsRead,
|
|
PermSystemSettingsWrite,
|
|
PermSystemAuditRead,
|
|
"workflow:config_visibility",
|
|
"doc:override_visibility",
|
|
"doc:export",
|
|
"workflow:view_all",
|
|
}
|
|
case "role-director":
|
|
return []string{
|
|
"project:create",
|
|
"project:assign_lead",
|
|
"workflow:config_visibility",
|
|
"doc:override_visibility",
|
|
"doc:export",
|
|
"workflow:view_all",
|
|
}
|
|
case "role-tech-lead":
|
|
return []string{
|
|
"project:create",
|
|
"project:assign_lead",
|
|
"doc:override_visibility",
|
|
"doc:export",
|
|
"workflow:view_all",
|
|
}
|
|
case "role-engineer":
|
|
return []string{"doc:export", "workflow:view_all"}
|
|
case "role-guest":
|
|
return []string{"doc:export"}
|
|
default:
|
|
return nil
|
|
}
|
|
}
|