feat(ai-agent): add permissions for AI Agent management and update related logic

dashboard/lib/navigation.tsx

@@ -31,7 +31,7 @@ export type DashboardNavMenuItem = {
 export type DashboardNavItemConfig = DashboardNavMenuItem & {
   /**
    * 与后端 Permission.Code 一致；缺省表示任意已登录管理员可见
-   * （对应控制台接口尚未 RequirePermission 的模块，如接入站点、AI Agent）
+   * （对应控制台接口尚未 RequirePermission 的模块）
    */
   requiredPermission?: string;
 };
@@ -182,6 +182,7 @@ export const dashboardNavSections: DashboardNavSectionConfig[] = [
         title: "接入渠道",
         url: "/channels",
         icon: <GlobeIcon />,
+        requiredPermission: "channel.view",
       },
     ],
   },
@@ -204,6 +205,7 @@ export const dashboardNavSections: DashboardNavSectionConfig[] = [
         title: "AI Agent",
         url: "/ai-agents",
         icon: <MessageSquareMoreIcon />,
+        requiredPermission: "aiAgent.view",
       },
       {
         title: "Skills",

internal/controllers/dashboard/ai_agent_controller.go

@@ -5,6 +5,7 @@ import (
 	"strings"
 
 	"cs-agent/internal/models"
+	"cs-agent/internal/pkg/constants"
 	"cs-agent/internal/pkg/dto/request"
 	"cs-agent/internal/pkg/dto/response"
 	"cs-agent/internal/pkg/enums"
@@ -23,6 +24,9 @@ type AIAgentController struct {
 }
 
 func (c *AIAgentController) AnyList() *web.JsonResult {
+	if _, err := services.AuthService.RequirePermission(c.Ctx, constants.PermissionAIAgentView); err != nil {
+		return web.JsonError(err)
+	}
 	cnd := params.NewPagedSqlCnd(c.Ctx,
 		params.QueryFilter{ParamName: "status"},
 		params.QueryFilter{ParamName: "name", Op: params.Like},
@@ -37,6 +41,9 @@ func (c *AIAgentController) AnyList() *web.JsonResult {
 }
 
 func (c *AIAgentController) GetList_all() *web.JsonResult {
+	if _, err := services.AuthService.RequirePermission(c.Ctx, constants.PermissionAIAgentView); err != nil {
+		return web.JsonError(err)
+	}
 	list := services.AIAgentService.Find(sqls.NewCnd().Where("status = ?", enums.StatusOk).Desc("sort_no").Desc("id"))
 	results := make([]response.AIAgentResponse, 0, len(list))
 	for _, item := range list {
@@ -46,6 +53,9 @@ func (c *AIAgentController) GetList_all() *web.JsonResult {
 }
 
 func (c *AIAgentController) GetBy(id int64) *web.JsonResult {
+	if _, err := services.AuthService.RequirePermission(c.Ctx, constants.PermissionAIAgentView); err != nil {
+		return web.JsonError(err)
+	}
 	item := services.AIAgentService.Get(id)
 	if item == nil {
 		return web.JsonErrorMsg("AI Agent 不存在")
@@ -54,11 +64,15 @@ func (c *AIAgentController) GetBy(id int64) *web.JsonResult {
 }
 
 func (c *AIAgentController) PostCreate() *web.JsonResult {
+	operator, err := services.AuthService.RequirePermission(c.Ctx, constants.PermissionAIAgentCreate)
+	if err != nil {
+		return web.JsonError(err)
+	}
 	req := request.CreateAIAgentRequest{}
 	if err := params.ReadJSON(c.Ctx, &req); err != nil {
 		return web.JsonError(err)
 	}
-	item, err := services.AIAgentService.CreateAIAgent(req, services.AuthService.GetAuthPrincipal(c.Ctx))
+	item, err := services.AIAgentService.CreateAIAgent(req, operator)
 	if err != nil {
 		return web.JsonError(err)
 	}
@@ -66,28 +80,39 @@ func (c *AIAgentController) PostCreate() *web.JsonResult {
 }
 
 func (c *AIAgentController) PostUpdate() *web.JsonResult {
+	operator, err := services.AuthService.RequirePermission(c.Ctx, constants.PermissionAIAgentUpdate)
+	if err != nil {
+		return web.JsonError(err)
+	}
 	req := request.UpdateAIAgentRequest{}
 	if err := params.ReadJSON(c.Ctx, &req); err != nil {
 		return web.JsonError(err)
 	}
-	if err := services.AIAgentService.UpdateAIAgent(req, services.AuthService.GetAuthPrincipal(c.Ctx)); err != nil {
+	if err := services.AIAgentService.UpdateAIAgent(req, operator); err != nil {
 		return web.JsonError(err)
 	}
 	return web.JsonSuccess()
 }
 
 func (c *AIAgentController) PostDelete() *web.JsonResult {
+	operator, err := services.AuthService.RequirePermission(c.Ctx, constants.PermissionAIAgentDelete)
+	if err != nil {
+		return web.JsonError(err)
+	}
 	req := request.DeleteAIAgentRequest{}
 	if err := params.ReadJSON(c.Ctx, &req); err != nil {
 		return web.JsonError(err)
 	}
-	if err := services.AIAgentService.DeleteAIAgent(req.ID, services.AuthService.GetAuthPrincipal(c.Ctx)); err != nil {
+	if err := services.AIAgentService.DeleteAIAgent(req.ID, operator); err != nil {
 		return web.JsonError(err)
 	}
 	return web.JsonSuccess()
 }
 
 func (c *AIAgentController) PostUpdate_sort() *web.JsonResult {
+	if _, err := services.AuthService.RequirePermission(c.Ctx, constants.PermissionAIAgentUpdate); err != nil {
+		return web.JsonError(err)
+	}
 	var ids []int64
 	if err := c.Ctx.ReadJSON(&ids); err != nil {
 		return web.JsonError(err)
@@ -99,11 +124,15 @@ func (c *AIAgentController) PostUpdate_sort() *web.JsonResult {
 }
 
 func (c *AIAgentController) PostUpdate_status() *web.JsonResult {
+	operator, err := services.AuthService.RequirePermission(c.Ctx, constants.PermissionAIAgentUpdate)
+	if err != nil {
+		return web.JsonError(err)
+	}
 	req := request.UpdateAIAgentStatusRequest{}
 	if err := params.ReadJSON(c.Ctx, &req); err != nil {
 		return web.JsonError(err)
 	}
-	if err := services.AIAgentService.UpdateStatus(req.ID, req.Status, services.AuthService.GetAuthPrincipal(c.Ctx)); err != nil {
+	if err := services.AIAgentService.UpdateStatus(req.ID, req.Status, operator); err != nil {
 		return web.JsonError(err)
 	}
 	return web.JsonSuccess()

internal/migration/000002_init_auth_data.go

@@ -96,7 +96,7 @@ func ensureRoles(tx *gorm.DB) (map[string]*models.Role, error) {
 	now := time.Now()
 
 	for _, spec := range constants.Roles {
-		role := repositories.RoleRepository.FindOne(tx, sqls.NewCnd().Eq("code", spec.Code))
+		role := repositories.RoleRepository.GetByCode(tx, spec.Code)
 		if role == nil {
 			role = &models.Role{
 				Name:     spec.Name,

internal/migration/000004_sync_ai_agent_permissions.go

@@ -0,0 +1,29 @@
+package migration
+
+import (
+	"cs-agent/internal/pkg/constants"
+
+	"github.com/mlogclub/simple/sqls"
+)
+
+func init() {
+	register(4, "sync ai agent permissions", func() error {
+		return sqls.WithTransaction(func(ctx *sqls.TxContext) error {
+			permissions, err := ensurePermissions(ctx.Tx)
+			if err != nil {
+				return err
+			}
+
+			roles, err := ensureRoles(ctx.Tx)
+			if err != nil {
+				return err
+			}
+
+			if err = ensureRolePermissions(ctx.Tx, roles, permissions); err != nil {
+				return err
+			}
+
+			return ensureBootstrapAdmin(ctx.Tx, roles[constants.RoleCodeSuperAdmin])
+		})
+	})
+}

internal/pkg/constants/auth.go

@@ -147,6 +147,12 @@ var (
 	PermissionAssetCreate = Permission{Name: "上传文件资源", Code: "asset.create", Type: "api", GroupName: "asset", Method: "POST", APIPath: "/api/dashboard/asset/create", SortNo: 1220}
 	PermissionAssetDelete = Permission{Name: "删除文件资源", Code: "asset.delete", Type: "api", GroupName: "asset", Method: "POST", APIPath: "/api/dashboard/asset/delete", SortNo: 1230}
 
+	// AI Agent 相关权限
+	PermissionAIAgentView   = Permission{Name: "查看 AI Agent", Code: "aiAgent.view", Type: "api", GroupName: "aiAgent", Method: "ANY", APIPath: "/api/dashboard/ai-agent/list", SortNo: 1310}
+	PermissionAIAgentCreate = Permission{Name: "创建 AI Agent", Code: "aiAgent.create", Type: "api", GroupName: "aiAgent", Method: "POST", APIPath: "/api/dashboard/ai-agent/create", SortNo: 1320}
+	PermissionAIAgentUpdate = Permission{Name: "更新 AI Agent", Code: "aiAgent.update", Type: "api", GroupName: "aiAgent", Method: "POST", APIPath: "/api/dashboard/ai-agent/update", SortNo: 1330}
+	PermissionAIAgentDelete = Permission{Name: "删除 AI Agent", Code: "aiAgent.delete", Type: "api", GroupName: "aiAgent", Method: "POST", APIPath: "/api/dashboard/ai-agent/delete", SortNo: 1340}
+
 	// AI 配置相关权限
 	PermissionAIConfigView   = Permission{Name: "查看 AI 配置", Code: "aiConfig.view", Type: "api", GroupName: "aiConfig", Method: "ANY", APIPath: "/api/dashboard/ai-config/list", SortNo: 1390}
 	PermissionAIConfigCreate = Permission{Name: "创建 AI 配置", Code: "aiConfig.create", Type: "api", GroupName: "aiConfig", Method: "POST", APIPath: "/api/dashboard/ai-config/create", SortNo: 1400}
@@ -259,6 +265,10 @@ var Permissions = []Permission{
 	PermissionAssetView,
 	PermissionAssetCreate,
 	PermissionAssetDelete,
+	PermissionAIAgentView,
+	PermissionAIAgentCreate,
+	PermissionAIAgentUpdate,
+	PermissionAIAgentDelete,
 	PermissionAIConfigView,
 	PermissionAIConfigCreate,
 	PermissionAIConfigUpdate,
@@ -326,6 +336,7 @@ var RolePermissions = map[string][]Permission{
 		PermissionAgentTeamView, PermissionAgentTeamCreate, PermissionAgentTeamUpdate, PermissionAgentTeamDelete,
 		PermissionAgentTeamScheduleView, PermissionAgentTeamScheduleCreate, PermissionAgentTeamScheduleUpdate, PermissionAgentTeamScheduleDelete, PermissionAgentTeamScheduleBatchGenerate,
 		PermissionAssetView, PermissionAssetCreate, PermissionAssetDelete,
+		PermissionAIAgentView, PermissionAIAgentCreate, PermissionAIAgentUpdate, PermissionAIAgentDelete,
 		PermissionAIConfigView, PermissionAIConfigCreate, PermissionAIConfigUpdate, PermissionAIConfigDelete,
 		PermissionSkillDefinitionView, PermissionSkillDefinitionCreate, PermissionSkillDefinitionUpdate, PermissionSkillDefinitionDelete,
 	},
@@ -347,6 +358,7 @@ var RolePermissions = map[string][]Permission{
 		PermissionAgentTeamView,
 		PermissionAgentTeamScheduleView, PermissionAgentTeamScheduleCreate, PermissionAgentTeamScheduleUpdate, PermissionAgentTeamScheduleDelete, PermissionAgentTeamScheduleBatchGenerate,
 		PermissionAssetView, PermissionAssetCreate, PermissionAssetDelete,
+		PermissionAIAgentView, PermissionAIAgentCreate, PermissionAIAgentUpdate,
 		PermissionAIConfigView,
 		PermissionSkillDefinitionView, PermissionSkillDefinitionCreate, PermissionSkillDefinitionUpdate,
 	},
@@ -366,6 +378,7 @@ var RolePermissions = map[string][]Permission{
 		PermissionAgentView,
 		PermissionAgentTeamView,
 		PermissionAgentTeamScheduleView,
+		PermissionAIAgentView,
 		PermissionAIConfigView,
 		PermissionSkillDefinitionView,
 	},

internal/repositories/role_repository.go

@@ -99,3 +99,7 @@ func (r *roleRepository) UpdateColumn(db *gorm.DB, id int64, name string, value
 func (r *roleRepository) Delete(db *gorm.DB, id int64) {
 	db.Delete(&models.Role{}, "id = ?", id)
 }
+
+func (r *roleRepository) GetByCode(db *gorm.DB, code string) *models.Role {
+	return r.FindOne(db, sqls.NewCnd().Eq("code", code))
+}