WeiCHEN
b627134c62
Seed fine-grained console permissions (goose 00065), gate admin handlers by system:* keys, and persist settings change audits for all upserts. KB ops and whitelist consumers stay deferred.
37 lines
1.1 KiB
Go
37 lines
1.1 KiB
Go
package authz
|
||
|
||
// 系统管理台细粒度权限（phase-2）。
|
||
// 本阶段不改 authz schema / 迁移：系统管理员（role-admin / perm:manage）
|
||
// 拥有全部 system:*；非管理员 fail-closed。目录键仅供前端/文档可见。
|
||
const (
|
||
PermSystemOverview = "system:overview"
|
||
PermSystemKBRead = "system:kb:read"
|
||
PermSystemFeaturesRead = "system:features:read"
|
||
PermSystemSettingsRead = "system:settings:read"
|
||
PermSystemSettingsWrite = "system:settings:write"
|
||
PermSystemAuditRead = "system:audit:read"
|
||
)
|
||
|
||
// SystemConsolePermissions 返回全部 system:* 键（目录与测试用）。
|
||
func SystemConsolePermissions() []string {
|
||
return []string{
|
||
PermSystemOverview,
|
||
PermSystemKBRead,
|
||
PermSystemFeaturesRead,
|
||
PermSystemSettingsRead,
|
||
PermSystemSettingsWrite,
|
||
PermSystemAuditRead,
|
||
}
|
||
}
|
||
|
||
// IsSystemConsolePermission 判定是否为系统管理台细粒度权限键。
|
||
func IsSystemConsolePermission(perm string) bool {
|
||
switch perm {
|
||
case PermSystemOverview, PermSystemKBRead, PermSystemFeaturesRead,
|
||
PermSystemSettingsRead, PermSystemSettingsWrite, PermSystemAuditRead:
|
||
return true
|
||
default:
|
||
return false
|
||
}
|
||
}
|