refactor(auth): delegate access control to be-system
Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.
This commit is contained in:
t
@@ -1,255 +0,0 @@
|
||||
package migration
|
||||
|
||||
import (
|
||||
"agent-desk/internal/models"
|
||||
"agent-desk/internal/pkg/constants"
|
||||
"agent-desk/internal/pkg/enums"
|
||||
"agent-desk/internal/repositories"
|
||||
"errors"
|
||||
"log/slog"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/mlogclub/simple/sqls"
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
"gorm.io/gorm"
|
||||
)
|
||||
|
||||
func init() {
|
||||
register(2, "init auth builtin data", func() error {
|
||||
return sqls.WithTransaction(func(ctx *sqls.TxContext) error {
|
||||
permissions, err := ensurePermissions(ctx.Tx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
roles, err := ensureRoles(ctx.Tx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if err = ensureRolePermissions(ctx.Tx, roles, permissions); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return ensureBootstrapAdmin(ctx.Tx, roles[constants.RoleCodeSuperAdmin])
|
||||
})
|
||||
})
|
||||
}
|
||||
|
||||
func ensurePermissions(tx *gorm.DB) (map[string]*models.Permission, error) {
|
||||
permissions := make(map[string]*models.Permission, len(constants.Permissions))
|
||||
now := time.Now()
|
||||
|
||||
for _, spec := range constants.Permissions {
|
||||
permission := repositories.PermissionRepository.FindOne(tx, sqls.NewCnd().Eq("code", spec.Code))
|
||||
if permission == nil {
|
||||
permission = &models.Permission{
|
||||
Name: spec.Name,
|
||||
Code: spec.Code,
|
||||
Type: spec.Type,
|
||||
GroupName: spec.GroupName,
|
||||
Method: spec.Method,
|
||||
APIPath: spec.APIPath,
|
||||
SortNo: spec.SortNo,
|
||||
Status: enums.StatusOk,
|
||||
IsBuiltin: true,
|
||||
AuditFields: models.AuditFields{
|
||||
CreatedAt: now,
|
||||
CreateUserID: constants.SystemAuditUserID,
|
||||
CreateUserName: constants.SystemAuditUserName,
|
||||
UpdatedAt: now,
|
||||
UpdateUserID: constants.SystemAuditUserID,
|
||||
UpdateUserName: constants.SystemAuditUserName,
|
||||
},
|
||||
}
|
||||
if err := repositories.PermissionRepository.Create(tx, permission); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// slog.Info("initialized builtin permission", "code", spec.Code)
|
||||
} else {
|
||||
if err := repositories.PermissionRepository.Updates(tx, permission.ID, map[string]any{
|
||||
"name": spec.Name,
|
||||
"type": spec.Type,
|
||||
"group_name": spec.GroupName,
|
||||
"method": spec.Method,
|
||||
"api_path": spec.APIPath,
|
||||
"sort_no": spec.SortNo,
|
||||
"status": enums.StatusOk,
|
||||
"is_builtin": true,
|
||||
"update_user_id": constants.SystemAuditUserID,
|
||||
"update_user_name": constants.SystemAuditUserName,
|
||||
"updated_at": now,
|
||||
}); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
permission = repositories.PermissionRepository.Get(tx, permission.ID)
|
||||
}
|
||||
permissions[spec.Code] = permission
|
||||
}
|
||||
|
||||
return permissions, nil
|
||||
}
|
||||
|
||||
func ensureRoles(tx *gorm.DB) (map[string]*models.Role, error) {
|
||||
roles := make(map[string]*models.Role, len(constants.Roles))
|
||||
now := time.Now()
|
||||
|
||||
for _, spec := range constants.Roles {
|
||||
role := repositories.RoleRepository.GetByCode(tx, spec.Code)
|
||||
if role == nil {
|
||||
role = &models.Role{
|
||||
Name: spec.Name,
|
||||
Code: spec.Code,
|
||||
Status: enums.StatusOk,
|
||||
IsSystem: true,
|
||||
SortNo: spec.SortNo,
|
||||
AuditFields: models.AuditFields{
|
||||
CreatedAt: now,
|
||||
CreateUserID: constants.SystemAuditUserID,
|
||||
CreateUserName: constants.SystemAuditUserName,
|
||||
UpdatedAt: now,
|
||||
UpdateUserID: constants.SystemAuditUserID,
|
||||
UpdateUserName: constants.SystemAuditUserName,
|
||||
},
|
||||
}
|
||||
if err := repositories.RoleRepository.Create(tx, role); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// slog.Info("initialized builtin role", "code", spec.Code)
|
||||
} else {
|
||||
if err := repositories.RoleRepository.Updates(tx, role.ID, map[string]any{
|
||||
"name": spec.Name,
|
||||
"sort_no": spec.SortNo,
|
||||
"status": enums.StatusOk,
|
||||
"is_system": true,
|
||||
"update_user_id": constants.SystemAuditUserID,
|
||||
"update_user_name": constants.SystemAuditUserName,
|
||||
"updated_at": now,
|
||||
}); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
role = repositories.RoleRepository.Get(tx, role.ID)
|
||||
}
|
||||
roles[spec.Code] = role
|
||||
}
|
||||
|
||||
return roles, nil
|
||||
}
|
||||
|
||||
func ensureRolePermissions(tx *gorm.DB, roles map[string]*models.Role, permissions map[string]*models.Permission) error {
|
||||
now := time.Now()
|
||||
|
||||
for roleCode, rolePermissions := range constants.RolePermissions {
|
||||
role := roles[roleCode]
|
||||
if role == nil {
|
||||
return errors.New("builtin role not found: " + roleCode)
|
||||
}
|
||||
|
||||
for _, permissionSpec := range rolePermissions {
|
||||
permission := permissions[permissionSpec.Code]
|
||||
if permission == nil {
|
||||
return errors.New("builtin permission not found: " + permissionSpec.Code)
|
||||
}
|
||||
|
||||
exists := repositories.RolePermissionRepository.FindOne(tx, sqls.NewCnd().
|
||||
Eq("role_id", role.ID).
|
||||
Eq("permission_id", permission.ID))
|
||||
if exists != nil {
|
||||
continue
|
||||
}
|
||||
|
||||
if err := repositories.RolePermissionRepository.Create(tx, &models.RolePermission{
|
||||
RoleID: role.ID,
|
||||
PermissionID: permission.ID,
|
||||
AuditFields: models.AuditFields{
|
||||
CreatedAt: now,
|
||||
CreateUserID: constants.SystemAuditUserID,
|
||||
CreateUserName: constants.SystemAuditUserName,
|
||||
UpdatedAt: now,
|
||||
UpdateUserID: constants.SystemAuditUserID,
|
||||
UpdateUserName: constants.SystemAuditUserName,
|
||||
},
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func ensureBootstrapAdmin(tx *gorm.DB, superAdminRole *models.Role) error {
|
||||
if superAdminRole == nil {
|
||||
return errors.New("super admin role not found")
|
||||
}
|
||||
|
||||
username := constants.BootstrapAdminUsername
|
||||
nickname := constants.BootstrapAdminNickname
|
||||
password := constants.BootstrapAdminPassword
|
||||
|
||||
if strings.TrimSpace(password) == "" {
|
||||
password = "ChangeMe123!"
|
||||
slog.Warn("bootstrap admin password is empty, using default password", "username", username)
|
||||
}
|
||||
|
||||
user := repositories.UserRepository.FindOne(tx, sqls.NewCnd().Eq("username", username))
|
||||
now := time.Now()
|
||||
if user == nil {
|
||||
hashedPassword, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
user = &models.User{
|
||||
Username: username,
|
||||
Nickname: nickname,
|
||||
Password: string(hashedPassword),
|
||||
Status: enums.StatusOk,
|
||||
Remark: "bootstrap super admin",
|
||||
AuditFields: models.AuditFields{
|
||||
CreatedAt: now,
|
||||
CreateUserID: constants.SystemAuditUserID,
|
||||
CreateUserName: constants.SystemAuditUserName,
|
||||
UpdatedAt: now,
|
||||
UpdateUserID: constants.SystemAuditUserID,
|
||||
UpdateUserName: constants.SystemAuditUserName,
|
||||
},
|
||||
}
|
||||
if err := repositories.UserRepository.Create(tx, user); err != nil {
|
||||
return err
|
||||
}
|
||||
slog.Warn("initialized bootstrap admin user", "username", username)
|
||||
} else {
|
||||
if err := repositories.UserRepository.Updates(tx, user.ID, map[string]any{
|
||||
"nickname": nickname,
|
||||
"status": enums.StatusOk,
|
||||
"update_user_id": constants.SystemAuditUserID,
|
||||
"update_user_name": constants.SystemAuditUserName,
|
||||
"updated_at": now,
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
user = repositories.UserRepository.Get(tx, user.ID)
|
||||
}
|
||||
|
||||
exists := repositories.UserRoleRepository.FindOne(tx, sqls.NewCnd().
|
||||
Eq("user_id", user.ID).
|
||||
Eq("role_id", superAdminRole.ID))
|
||||
if exists != nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
return repositories.UserRoleRepository.Create(tx, &models.UserRole{
|
||||
UserID: user.ID,
|
||||
RoleID: superAdminRole.ID,
|
||||
AuditFields: models.AuditFields{
|
||||
CreatedAt: now,
|
||||
CreateUserID: constants.SystemAuditUserID,
|
||||
CreateUserName: constants.SystemAuditUserName,
|
||||
UpdatedAt: now,
|
||||
UpdateUserID: constants.SystemAuditUserID,
|
||||
UpdateUserName: constants.SystemAuditUserName,
|
||||
},
|
||||
})
|
||||
}
|
||||
@@ -1,21 +0,0 @@
|
||||
package migration
|
||||
|
||||
import "github.com/mlogclub/simple/sqls"
|
||||
|
||||
func init() {
|
||||
register(4, "sync ai agent permissions", func() error {
|
||||
return sqls.WithTransaction(func(ctx *sqls.TxContext) error {
|
||||
permissions, err := ensurePermissions(ctx.Tx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
roles, err := ensureRoles(ctx.Tx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return ensureRolePermissions(ctx.Tx, roles, permissions)
|
||||
})
|
||||
})
|
||||
}
|
||||
@@ -1,7 +1,7 @@
|
||||
package migration
|
||||
|
||||
import (
|
||||
"agent-desk/internal/models"
|
||||
"code.tczkiot.com/wlw/ai-agent/internal/models"
|
||||
|
||||
"github.com/mlogclub/simple/sqls"
|
||||
)
|
||||
|
||||
@@ -1,21 +0,0 @@
|
||||
package migration
|
||||
|
||||
import "github.com/mlogclub/simple/sqls"
|
||||
|
||||
func init() {
|
||||
register(7, "sync notification permissions", func() error {
|
||||
return sqls.WithTransaction(func(ctx *sqls.TxContext) error {
|
||||
permissions, err := ensurePermissions(ctx.Tx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
roles, err := ensureRoles(ctx.Tx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return ensureRolePermissions(ctx.Tx, roles, permissions)
|
||||
})
|
||||
})
|
||||
}
|
||||
@@ -1,21 +0,0 @@
|
||||
package migration
|
||||
|
||||
import "github.com/mlogclub/simple/sqls"
|
||||
|
||||
func init() {
|
||||
register(9, "sync wxwork outbox permissions", func() error {
|
||||
return sqls.WithTransaction(func(ctx *sqls.TxContext) error {
|
||||
permissions, err := ensurePermissions(ctx.Tx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
roles, err := ensureRoles(ctx.Tx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return ensureRolePermissions(ctx.Tx, roles, permissions)
|
||||
})
|
||||
})
|
||||
}
|
||||
@@ -1,8 +1,8 @@
|
||||
package migration
|
||||
|
||||
import (
|
||||
"agent-desk/internal/models"
|
||||
"agent-desk/internal/services"
|
||||
"code.tczkiot.com/wlw/ai-agent/internal/models"
|
||||
"code.tczkiot.com/wlw/ai-agent/internal/services"
|
||||
"errors"
|
||||
"log/slog"
|
||||
"sync"
|
||||
|
||||
Reference in New Issue
Block a user