weichenandCursor
90f77eac93
Close P0 auth gaps for lineage/runs, stage ABAC fail-closed, and project:create; add IAM migrations 00021-23, me settings APIs, schema v2 manifests, orchestrator skeleton, and gate A regression coverage. Co-authored-by: Cursor <cursoragent@cursor.com>
26 lines
1.4 KiB
Go
26 lines
1.4 KiB
Go
package authz
|
|
|
|
// PermissionCatalogEntry 权限目录项。
|
|
type PermissionCatalogEntry struct {
|
|
Key string `json:"key"`
|
|
Resource string `json:"resource"`
|
|
Action string `json:"action"`
|
|
RiskLevel string `json:"risk_level"`
|
|
Description string `json:"description,omitempty"`
|
|
}
|
|
|
|
// PermissionCatalog 返回系统权限目录（与 DB seed 对齐，供前端渲染）。
|
|
func PermissionCatalog() []PermissionCatalogEntry {
|
|
return []PermissionCatalogEntry{
|
|
{Key: "project:create", Resource: "project", Action: "create", RiskLevel: "normal", Description: "创建新项目"},
|
|
{Key: "project:assign_lead", Resource: "project", Action: "assign_lead", RiskLevel: "elevated", Description: "指派项目负责人"},
|
|
{Key: PermManage, Resource: "system", Action: "manage", RiskLevel: "critical", Description: "系统权限管理"},
|
|
{Key: "workflow:config_visibility", Resource: "workflow", Action: "config_visibility", RiskLevel: "elevated"},
|
|
{Key: "doc:override_visibility", Resource: "document", Action: "override_visibility", RiskLevel: "elevated"},
|
|
{Key: "doc:export", Resource: "document", Action: "export", RiskLevel: "normal"},
|
|
{Key: "workflow:view_all", Resource: "workflow", Action: "view_all", RiskLevel: "normal"},
|
|
{Key: "workflow_defs.publish", Resource: "workflow_defs", Action: "publish", RiskLevel: "elevated"},
|
|
{Key: "templates.publish", Resource: "templates", Action: "publish", RiskLevel: "elevated"},
|
|
}
|
|
}
|