diff --git a/dashboard/lib/navigation.tsx b/dashboard/lib/navigation.tsx index 7d18d52..41f3685 100644 --- a/dashboard/lib/navigation.tsx +++ b/dashboard/lib/navigation.tsx @@ -31,7 +31,7 @@ export type DashboardNavMenuItem = { export type DashboardNavItemConfig = DashboardNavMenuItem & { /** * 与后端 Permission.Code 一致；缺省表示任意已登录管理员可见 - * （对应控制台接口尚未 RequirePermission 的模块，如接入站点、AI Agent） + * （对应控制台接口尚未 RequirePermission 的模块） */ requiredPermission?: string; }; @@ -182,6 +182,7 @@ export const dashboardNavSections: DashboardNavSectionConfig[] = [ title: "接入渠道", url: "/channels", icon: , + requiredPermission: "channel.view", }, ], }, @@ -204,6 +205,7 @@ export const dashboardNavSections: DashboardNavSectionConfig[] = [ title: "AI Agent", url: "/ai-agents", icon: , + requiredPermission: "aiAgent.view", }, { title: "Skills", diff --git a/internal/controllers/dashboard/ai_agent_controller.go b/internal/controllers/dashboard/ai_agent_controller.go index a6bf6b2..82d959e 100644 --- a/internal/controllers/dashboard/ai_agent_controller.go +++ b/internal/controllers/dashboard/ai_agent_controller.go @@ -5,6 +5,7 @@ import ( "strings" "cs-agent/internal/models" + "cs-agent/internal/pkg/constants" "cs-agent/internal/pkg/dto/request" "cs-agent/internal/pkg/dto/response" "cs-agent/internal/pkg/enums" @@ -23,6 +24,9 @@ type AIAgentController struct { } func (c *AIAgentController) AnyList() *web.JsonResult { + if _, err := services.AuthService.RequirePermission(c.Ctx, constants.PermissionAIAgentView); err != nil { + return web.JsonError(err) + } cnd := params.NewPagedSqlCnd(c.Ctx, params.QueryFilter{ParamName: "status"}, params.QueryFilter{ParamName: "name", Op: params.Like}, @@ -37,6 +41,9 @@ func (c *AIAgentController) AnyList() *web.JsonResult { } func (c *AIAgentController) GetList_all() *web.JsonResult { + if _, err := services.AuthService.RequirePermission(c.Ctx, constants.PermissionAIAgentView); err != nil { + return web.JsonError(err) + } list := services.AIAgentService.Find(sqls.NewCnd().Where("status = ?", enums.StatusOk).Desc("sort_no").Desc("id")) results := make([]response.AIAgentResponse, 0, len(list)) for _, item := range list { @@ -46,6 +53,9 @@ func (c *AIAgentController) GetList_all() *web.JsonResult { } func (c *AIAgentController) GetBy(id int64) *web.JsonResult { + if _, err := services.AuthService.RequirePermission(c.Ctx, constants.PermissionAIAgentView); err != nil { + return web.JsonError(err) + } item := services.AIAgentService.Get(id) if item == nil { return web.JsonErrorMsg("AI Agent 不存在") @@ -54,11 +64,15 @@ func (c *AIAgentController) GetBy(id int64) *web.JsonResult { } func (c *AIAgentController) PostCreate() *web.JsonResult { + operator, err := services.AuthService.RequirePermission(c.Ctx, constants.PermissionAIAgentCreate) + if err != nil { + return web.JsonError(err) + } req := request.CreateAIAgentRequest{} if err := params.ReadJSON(c.Ctx, &req); err != nil { return web.JsonError(err) } - item, err := services.AIAgentService.CreateAIAgent(req, services.AuthService.GetAuthPrincipal(c.Ctx)) + item, err := services.AIAgentService.CreateAIAgent(req, operator) if err != nil { return web.JsonError(err) } @@ -66,28 +80,39 @@ func (c *AIAgentController) PostCreate() *web.JsonResult { } func (c *AIAgentController) PostUpdate() *web.JsonResult { + operator, err := services.AuthService.RequirePermission(c.Ctx, constants.PermissionAIAgentUpdate) + if err != nil { + return web.JsonError(err) + } req := request.UpdateAIAgentRequest{} if err := params.ReadJSON(c.Ctx, &req); err != nil { return web.JsonError(err) } - if err := services.AIAgentService.UpdateAIAgent(req, services.AuthService.GetAuthPrincipal(c.Ctx)); err != nil { + if err := services.AIAgentService.UpdateAIAgent(req, operator); err != nil { return web.JsonError(err) } return web.JsonSuccess() } func (c *AIAgentController) PostDelete() *web.JsonResult { + operator, err := services.AuthService.RequirePermission(c.Ctx, constants.PermissionAIAgentDelete) + if err != nil { + return web.JsonError(err) + } req := request.DeleteAIAgentRequest{} if err := params.ReadJSON(c.Ctx, &req); err != nil { return web.JsonError(err) } - if err := services.AIAgentService.DeleteAIAgent(req.ID, services.AuthService.GetAuthPrincipal(c.Ctx)); err != nil { + if err := services.AIAgentService.DeleteAIAgent(req.ID, operator); err != nil { return web.JsonError(err) } return web.JsonSuccess() } func (c *AIAgentController) PostUpdate_sort() *web.JsonResult { + if _, err := services.AuthService.RequirePermission(c.Ctx, constants.PermissionAIAgentUpdate); err != nil { + return web.JsonError(err) + } var ids []int64 if err := c.Ctx.ReadJSON(&ids); err != nil { return web.JsonError(err) @@ -99,11 +124,15 @@ func (c *AIAgentController) PostUpdate_sort() *web.JsonResult { } func (c *AIAgentController) PostUpdate_status() *web.JsonResult { + operator, err := services.AuthService.RequirePermission(c.Ctx, constants.PermissionAIAgentUpdate) + if err != nil { + return web.JsonError(err) + } req := request.UpdateAIAgentStatusRequest{} if err := params.ReadJSON(c.Ctx, &req); err != nil { return web.JsonError(err) } - if err := services.AIAgentService.UpdateStatus(req.ID, req.Status, services.AuthService.GetAuthPrincipal(c.Ctx)); err != nil { + if err := services.AIAgentService.UpdateStatus(req.ID, req.Status, operator); err != nil { return web.JsonError(err) } return web.JsonSuccess() diff --git a/internal/migration/000002_init_auth_data.go b/internal/migration/000002_init_auth_data.go index 3dec044..118d5ac 100644 --- a/internal/migration/000002_init_auth_data.go +++ b/internal/migration/000002_init_auth_data.go @@ -96,7 +96,7 @@ func ensureRoles(tx *gorm.DB) (map[string]*models.Role, error) { now := time.Now() for _, spec := range constants.Roles { - role := repositories.RoleRepository.FindOne(tx, sqls.NewCnd().Eq("code", spec.Code)) + role := repositories.RoleRepository.GetByCode(tx, spec.Code) if role == nil { role = &models.Role{ Name: spec.Name, diff --git a/internal/migration/000004_sync_ai_agent_permissions.go b/internal/migration/000004_sync_ai_agent_permissions.go new file mode 100644 index 0000000..8411949 --- /dev/null +++ b/internal/migration/000004_sync_ai_agent_permissions.go @@ -0,0 +1,29 @@ +package migration + +import ( + "cs-agent/internal/pkg/constants" + + "github.com/mlogclub/simple/sqls" +) + +func init() { + register(4, "sync ai agent permissions", func() error { + return sqls.WithTransaction(func(ctx *sqls.TxContext) error { + permissions, err := ensurePermissions(ctx.Tx) + if err != nil { + return err + } + + roles, err := ensureRoles(ctx.Tx) + if err != nil { + return err + } + + if err = ensureRolePermissions(ctx.Tx, roles, permissions); err != nil { + return err + } + + return ensureBootstrapAdmin(ctx.Tx, roles[constants.RoleCodeSuperAdmin]) + }) + }) +} diff --git a/internal/pkg/constants/auth.go b/internal/pkg/constants/auth.go index 973c6ff..35882f8 100644 --- a/internal/pkg/constants/auth.go +++ b/internal/pkg/constants/auth.go @@ -147,6 +147,12 @@ var ( PermissionAssetCreate = Permission{Name: "上传文件资源", Code: "asset.create", Type: "api", GroupName: "asset", Method: "POST", APIPath: "/api/dashboard/asset/create", SortNo: 1220} PermissionAssetDelete = Permission{Name: "删除文件资源", Code: "asset.delete", Type: "api", GroupName: "asset", Method: "POST", APIPath: "/api/dashboard/asset/delete", SortNo: 1230} + // AI Agent 相关权限 + PermissionAIAgentView = Permission{Name: "查看 AI Agent", Code: "aiAgent.view", Type: "api", GroupName: "aiAgent", Method: "ANY", APIPath: "/api/dashboard/ai-agent/list", SortNo: 1310} + PermissionAIAgentCreate = Permission{Name: "创建 AI Agent", Code: "aiAgent.create", Type: "api", GroupName: "aiAgent", Method: "POST", APIPath: "/api/dashboard/ai-agent/create", SortNo: 1320} + PermissionAIAgentUpdate = Permission{Name: "更新 AI Agent", Code: "aiAgent.update", Type: "api", GroupName: "aiAgent", Method: "POST", APIPath: "/api/dashboard/ai-agent/update", SortNo: 1330} + PermissionAIAgentDelete = Permission{Name: "删除 AI Agent", Code: "aiAgent.delete", Type: "api", GroupName: "aiAgent", Method: "POST", APIPath: "/api/dashboard/ai-agent/delete", SortNo: 1340} + // AI 配置相关权限 PermissionAIConfigView = Permission{Name: "查看 AI 配置", Code: "aiConfig.view", Type: "api", GroupName: "aiConfig", Method: "ANY", APIPath: "/api/dashboard/ai-config/list", SortNo: 1390} PermissionAIConfigCreate = Permission{Name: "创建 AI 配置", Code: "aiConfig.create", Type: "api", GroupName: "aiConfig", Method: "POST", APIPath: "/api/dashboard/ai-config/create", SortNo: 1400} @@ -259,6 +265,10 @@ var Permissions = []Permission{ PermissionAssetView, PermissionAssetCreate, PermissionAssetDelete, + PermissionAIAgentView, + PermissionAIAgentCreate, + PermissionAIAgentUpdate, + PermissionAIAgentDelete, PermissionAIConfigView, PermissionAIConfigCreate, PermissionAIConfigUpdate, @@ -326,6 +336,7 @@ var RolePermissions = map[string][]Permission{ PermissionAgentTeamView, PermissionAgentTeamCreate, PermissionAgentTeamUpdate, PermissionAgentTeamDelete, PermissionAgentTeamScheduleView, PermissionAgentTeamScheduleCreate, PermissionAgentTeamScheduleUpdate, PermissionAgentTeamScheduleDelete, PermissionAgentTeamScheduleBatchGenerate, PermissionAssetView, PermissionAssetCreate, PermissionAssetDelete, + PermissionAIAgentView, PermissionAIAgentCreate, PermissionAIAgentUpdate, PermissionAIAgentDelete, PermissionAIConfigView, PermissionAIConfigCreate, PermissionAIConfigUpdate, PermissionAIConfigDelete, PermissionSkillDefinitionView, PermissionSkillDefinitionCreate, PermissionSkillDefinitionUpdate, PermissionSkillDefinitionDelete, }, @@ -347,6 +358,7 @@ var RolePermissions = map[string][]Permission{ PermissionAgentTeamView, PermissionAgentTeamScheduleView, PermissionAgentTeamScheduleCreate, PermissionAgentTeamScheduleUpdate, PermissionAgentTeamScheduleDelete, PermissionAgentTeamScheduleBatchGenerate, PermissionAssetView, PermissionAssetCreate, PermissionAssetDelete, + PermissionAIAgentView, PermissionAIAgentCreate, PermissionAIAgentUpdate, PermissionAIConfigView, PermissionSkillDefinitionView, PermissionSkillDefinitionCreate, PermissionSkillDefinitionUpdate, }, @@ -366,6 +378,7 @@ var RolePermissions = map[string][]Permission{ PermissionAgentView, PermissionAgentTeamView, PermissionAgentTeamScheduleView, + PermissionAIAgentView, PermissionAIConfigView, PermissionSkillDefinitionView, }, diff --git a/internal/repositories/role_repository.go b/internal/repositories/role_repository.go index 1a18276..a82d692 100644 --- a/internal/repositories/role_repository.go +++ b/internal/repositories/role_repository.go @@ -99,3 +99,7 @@ func (r *roleRepository) UpdateColumn(db *gorm.DB, id int64, name string, value func (r *roleRepository) Delete(db *gorm.DB, id int64) { db.Delete(&models.Role{}, "id = ?", id) } + +func (r *roleRepository) GetByCode(db *gorm.DB, code string) *models.Role { + return r.FindOne(db, sqls.NewCnd().Eq("code", code)) +}