refactor(auth): delegate access control to be-system

Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.
This commit is contained in:
t
2026-08-21 00:41:07 +08:00
parent 3d47227fbd
commit 2bbf42b741
447 changed files with 1901 additions and 8920 deletions
+1 -348
View File
@@ -1,27 +1,6 @@
package constants
const (
RoleCodeSuperAdmin = "super_admin" // 超管
RoleCodeAdmin = "admin" // 管理员
RoleCodeCsTeamLeader = "cs_team_leader" // 客服组长
RoleCodeCsUser = "cs_user" // 客服
)
const (
AuthTokenPrefix = "ak_"
)
const (
ClientTypeAdminWeb = "admin_web"
)
const (
BootstrapAdminUsername = "admin"
BootstrapAdminPassword = "ChangeMe123!"
BootstrapAdminNickname = "Super Admin"
)
// Permission 权限结构体
// Permission 仅描述客服业务操作,由宿主系统执行权限验证
type Permission struct {
Name string
Code string
@@ -34,28 +13,6 @@ type Permission struct {
// 权限常量定义
var (
// 用户相关权限
PermissionUserView = Permission{Name: "查看用户", Code: "user.view", Type: "api", GroupName: "user", Method: "ANY", APIPath: "/api/dashboard/user/list", SortNo: 10}
PermissionUserCreate = Permission{Name: "创建用户", Code: "user.create", Type: "api", GroupName: "user", Method: "POST", APIPath: "/api/dashboard/user/create", SortNo: 20}
PermissionUserUpdate = Permission{Name: "更新用户", Code: "user.update", Type: "api", GroupName: "user", Method: "POST", APIPath: "/api/dashboard/user/update", SortNo: 30}
PermissionUserDelete = Permission{Name: "删除用户", Code: "user.delete", Type: "api", GroupName: "user", Method: "POST", APIPath: "/api/dashboard/user/delete", SortNo: 40}
PermissionUserAssignRole = Permission{Name: "分配用户角色", Code: "user.assignRole", Type: "api", GroupName: "user", Method: "POST", APIPath: "/api/dashboard/user/assign_role", SortNo: 50}
// 角色相关权限
PermissionRoleView = Permission{Name: "查看角色", Code: "role.view", Type: "api", GroupName: "role", Method: "ANY", APIPath: "/api/dashboard/role/list", SortNo: 110}
PermissionRoleCreate = Permission{Name: "创建角色", Code: "role.create", Type: "api", GroupName: "role", Method: "POST", APIPath: "/api/dashboard/role/create", SortNo: 120}
PermissionRoleUpdate = Permission{Name: "更新角色", Code: "role.update", Type: "api", GroupName: "role", Method: "POST", APIPath: "/api/dashboard/role/update", SortNo: 130}
PermissionRoleDelete = Permission{Name: "删除角色", Code: "role.delete", Type: "api", GroupName: "role", Method: "POST", APIPath: "/api/dashboard/role/delete", SortNo: 140}
PermissionRoleAssignPermission = Permission{Name: "分配角色权限", Code: "role.assignPermission", Type: "api", GroupName: "role", Method: "POST", APIPath: "/api/dashboard/role/assign_permission", SortNo: 150}
// 权限相关权限
PermissionPermissionView = Permission{Name: "查看权限", Code: "permission.view", Type: "api", GroupName: "permission", Method: "ANY", APIPath: "/api/dashboard/permission/list", SortNo: 210}
PermissionPermissionSync = Permission{Name: "同步权限", Code: "permission.sync", Type: "api", GroupName: "permission", Method: "POST", APIPath: "/api/dashboard/permission/sync", SortNo: 220}
// 会话相关权限
PermissionSessionView = Permission{Name: "查看会话", Code: "session.view", Type: "api", GroupName: "session", Method: "ANY", APIPath: "/api/dashboard/session/list", SortNo: 310}
PermissionSessionRevoke = Permission{Name: "踢除会话", Code: "session.revoke", Type: "api", GroupName: "session", Method: "POST", APIPath: "/api/dashboard/session/revoke", SortNo: 320}
// 客服会话相关权限
PermissionConversationView = Permission{Name: "查看会话", Code: "conversation.view", Type: "api", GroupName: "conversation", Method: "ANY", APIPath: "/api/dashboard/conversation/list", SortNo: 410}
PermissionConversationAssign = Permission{Name: "分配会话", Code: "conversation.assign", Type: "api", GroupName: "conversation", Method: "POST", APIPath: "/api/dashboard/conversation/assign", SortNo: 430}
@@ -63,8 +20,6 @@ var (
PermissionConversationClose = Permission{Name: "关闭会话", Code: "conversation.close", Type: "api", GroupName: "conversation", Method: "POST", APIPath: "/api/dashboard/conversation/close", SortNo: 450}
PermissionConversationSend = Permission{Name: "发送会话消息", Code: "conversation.send", Type: "api", GroupName: "conversation", Method: "POST", APIPath: "/api/dashboard/conversation/send_message", SortNo: 460}
PermissionConversationTag = Permission{Name: "管理会话标签", Code: "conversation.tag", Type: "api", GroupName: "conversation", Method: "POST", APIPath: "/api/dashboard/conversation/add_tag", SortNo: 470}
PermissionConversationHandover = Permission{Name: "处理会话交接", Code: "conversation.handover", Type: "api", GroupName: "conversation", Method: "ANY", APIPath: "/api/dashboard/conversation/handover_list", SortNo: 480}
PermissionConversationRecycle = Permission{Name: "回收会话", Code: "conversation.recycle", Type: "api", GroupName: "conversation", Method: "POST", APIPath: "/api/dashboard/conversation/recycle", SortNo: 490}
PermissionConversationLinkCustomer = Permission{Name: "关联会话客户", Code: "conversation.linkCustomer", Type: "api", GroupName: "conversation", Method: "POST", APIPath: "/api/dashboard/conversation/link_customer", SortNo: 495}
// 工单相关权限
@@ -118,8 +73,6 @@ var (
PermissionAgentCreate = Permission{Name: "创建客服", Code: "agent.create", Type: "api", GroupName: "agent", Method: "POST", APIPath: "/api/dashboard/agent/create", SortNo: 620}
PermissionAgentUpdate = Permission{Name: "更新客服", Code: "agent.update", Type: "api", GroupName: "agent", Method: "POST", APIPath: "/api/dashboard/agent/update", SortNo: 630}
PermissionAgentDelete = Permission{Name: "删除客服", Code: "agent.delete", Type: "api", GroupName: "agent", Method: "POST", APIPath: "/api/dashboard/agent/delete", SortNo: 640}
PermissionAgentUpdateStatus = Permission{Name: "更新客服状态", Code: "agent.updateStatus", Type: "api", GroupName: "agent", Method: "POST", APIPath: "/api/dashboard/agent/update_status", SortNo: 650}
PermissionAgentConfig = Permission{Name: "配置客服服务规则", Code: "agent.config", Type: "api", GroupName: "agent", Method: "POST", APIPath: "/api/dashboard/agent/update_service_config", SortNo: 660}
// 客服组相关权限
PermissionAgentTeamView = Permission{Name: "查看客服组", Code: "agentTeam.view", Type: "api", GroupName: "agentTeam", Method: "ANY", APIPath: "/api/dashboard/agent-team/list", SortNo: 710}
@@ -177,303 +130,3 @@ var (
PermissionMCPView = Permission{Name: "查看MCP调试信息", Code: "mcp.view", Type: "api", GroupName: "mcp", Method: "POST", APIPath: "/api/dashboard/mcp/list_tools", SortNo: 1710}
PermissionMCPCall = Permission{Name: "调用MCP工具", Code: "mcp.call", Type: "api", GroupName: "mcp", Method: "POST", APIPath: "/api/dashboard/mcp/call_tool", SortNo: 1720}
)
// Permissions 内置权限列表
var Permissions = []Permission{
PermissionUserView,
PermissionUserCreate,
PermissionUserUpdate,
PermissionUserDelete,
PermissionUserAssignRole,
PermissionRoleView,
PermissionRoleCreate,
PermissionRoleUpdate,
PermissionRoleDelete,
PermissionRoleAssignPermission,
PermissionPermissionView,
PermissionPermissionSync,
PermissionSessionView,
PermissionSessionRevoke,
PermissionConversationView,
PermissionConversationAssign,
PermissionConversationTransfer,
PermissionConversationClose,
PermissionConversationSend,
PermissionConversationTag,
PermissionConversationHandover,
PermissionConversationRecycle,
PermissionConversationLinkCustomer,
PermissionTicketView,
PermissionTicketCreate,
PermissionTicketUpdate,
PermissionTicketAssign,
PermissionTicketChangeStatus,
PermissionTicketProgress,
PermissionNotificationView,
PermissionNotificationUpdate,
PermissionQuickReplyView,
PermissionQuickReplyCreate,
PermissionQuickReplyUpdate,
PermissionQuickReplyDelete,
PermissionTagView,
PermissionTagCreate,
PermissionTagUpdate,
PermissionTagDelete,
PermissionCompanyView,
PermissionCompanyCreate,
PermissionCompanyUpdate,
PermissionCompanyDelete,
PermissionChannelView,
PermissionChannelCreate,
PermissionChannelUpdate,
PermissionChannelDelete,
PermissionWxWorkOutboxView,
PermissionWxWorkOutboxUpdate,
PermissionCustomerView,
PermissionCustomerCreate,
PermissionCustomerUpdate,
PermissionCustomerDelete,
PermissionAgentView,
PermissionAgentCreate,
PermissionAgentUpdate,
PermissionAgentDelete,
PermissionAgentUpdateStatus,
PermissionAgentConfig,
PermissionAgentTeamView,
PermissionAgentTeamCreate,
PermissionAgentTeamUpdate,
PermissionAgentTeamDelete,
PermissionAgentTeamScheduleView,
PermissionAgentTeamScheduleCreate,
PermissionAgentTeamScheduleUpdate,
PermissionAgentTeamScheduleDelete,
PermissionAgentTeamScheduleBatchGenerate,
PermissionAssetView,
PermissionAssetCreate,
PermissionAssetDelete,
PermissionAIAgentView,
PermissionAIAgentCreate,
PermissionAIAgentUpdate,
PermissionAIAgentDelete,
PermissionAIConfigView,
PermissionAIConfigCreate,
PermissionAIConfigUpdate,
PermissionAIConfigDelete,
PermissionKnowledgeBaseView,
PermissionKnowledgeBaseCreate,
PermissionKnowledgeBaseUpdate,
PermissionKnowledgeBaseDelete,
PermissionKnowledgeDocumentView,
PermissionKnowledgeDocumentCreate,
PermissionKnowledgeDocumentUpdate,
PermissionKnowledgeDocumentDelete,
PermissionKnowledgeFAQView,
PermissionKnowledgeFAQCreate,
PermissionKnowledgeFAQUpdate,
PermissionKnowledgeFAQDelete,
PermissionSkillDefinitionView,
PermissionSkillDefinitionCreate,
PermissionSkillDefinitionUpdate,
PermissionSkillDefinitionDelete,
PermissionMCPView,
PermissionMCPCall,
}
// PermissionMap 权限映射,用于通过 Code 查找 Permission
var PermissionMap = make(map[string]Permission)
// init 初始化 PermissionMap
func init() {
normalizeBuiltinPermissionNames()
for _, permission := range Permissions {
PermissionMap[permission.Code] = permission
}
}
func normalizeBuiltinPermissionNames() {
for i := range Permissions {
Permissions[i].Name = builtinPermissionName(Permissions[i].Code, Permissions[i].Name)
}
}
func builtinPermissionName(code string, fallback string) string {
if name, ok := builtinPermissionNameOverrides[code]; ok {
return name
}
resourceKey, actionKey, ok := splitPermissionCode(code)
if !ok {
return fallback
}
action, ok := builtinPermissionActionLabels[actionKey]
if !ok {
return fallback
}
resource, ok := builtinPermissionResourceLabels[resourceKey]
if !ok {
return fallback
}
return action + " " + resource
}
func splitPermissionCode(code string) (string, string, bool) {
for i := 0; i < len(code); i++ {
if code[i] == '.' {
return code[:i], code[i+1:], i > 0 && i < len(code)-1
}
}
return "", "", false
}
var builtinPermissionActionLabels = map[string]string{
"view": "View",
"create": "Create",
"update": "Update",
"delete": "Delete",
"assignRole": "Assign roles to",
"assignPermission": "Assign permissions to",
"sync": "Sync",
"revoke": "Revoke",
"assign": "Assign",
"transfer": "Transfer",
"close": "Close",
"send": "Send",
"tag": "Manage tags for",
"handover": "Handle handoffs for",
"recycle": "Recycle",
"linkCustomer": "Link customers to",
"changeStatus": "Change status for",
"progress": "Update progress for",
"updateStatus": "Update status for",
"config": "Configure service rules for",
"batchGenerate": "Batch generate",
"call": "Call",
}
var builtinPermissionResourceLabels = map[string]string{
"user": "users",
"role": "roles",
"permission": "permissions",
"session": "sessions",
"conversation": "conversations",
"ticket": "tickets",
"notification": "notifications",
"quickReply": "quick replies",
"tag": "tags",
"company": "companies",
"channel": "channels",
"wxworkOutbox": "WeCom outbox records",
"customer": "customers",
"agent": "agents",
"agentTeam": "agent teams",
"agentTeamSchedule": "agent team schedules",
"asset": "file assets",
"aiAgent": "AI Agents",
"aiConfig": "AI configurations",
"knowledgeBase": "knowledge bases",
"knowledgeDocument": "knowledge documents",
"knowledgeFAQ": "knowledge FAQs",
"skillDefinition": "Skill definitions",
"mcp": "MCP tools",
}
var builtinPermissionNameOverrides = map[string]string{
"user.assignRole": "Assign user roles",
"role.assignPermission": "Assign role permissions",
"session.revoke": "Revoke sessions",
"conversation.send": "Send conversation messages",
"conversation.linkCustomer": "Link conversation customer",
"ticket.changeStatus": "Change ticket status",
"ticket.progress": "Update ticket progress",
"agent.config": "Configure agent service rules",
"agentTeamSchedule.batchGenerate": "Batch generate agent team schedules",
"wxworkOutbox.update": "Handle WeCom outbox records",
"mcp.view": "View MCP debug information",
"mcp.call": "Call MCP tools",
}
type RoleSpec struct {
Name string
Code string
SortNo int
}
var Roles = []RoleSpec{
{Name: "Super Admin", Code: RoleCodeSuperAdmin, SortNo: 1},
{Name: "Admin", Code: RoleCodeAdmin, SortNo: 2},
{Name: "Support Team Lead", Code: RoleCodeCsTeamLeader, SortNo: 3},
{Name: "Support Agent", Code: RoleCodeCsUser, SortNo: 4},
}
var RolePermissions = map[string][]Permission{
RoleCodeSuperAdmin: Permissions,
RoleCodeAdmin: {
PermissionUserView, PermissionUserCreate, PermissionUserUpdate, PermissionUserAssignRole,
PermissionRoleView, PermissionRoleCreate, PermissionRoleUpdate, PermissionRoleAssignPermission,
PermissionPermissionView, PermissionPermissionSync,
PermissionSessionView, PermissionSessionRevoke,
PermissionConversationView, PermissionConversationAssign, PermissionConversationTransfer, PermissionConversationClose, PermissionConversationSend, PermissionConversationTag, PermissionConversationHandover, PermissionConversationRecycle, PermissionConversationLinkCustomer,
PermissionTicketView, PermissionTicketCreate, PermissionTicketUpdate, PermissionTicketAssign, PermissionTicketChangeStatus, PermissionTicketProgress,
PermissionNotificationView, PermissionNotificationUpdate,
PermissionQuickReplyView, PermissionQuickReplyCreate, PermissionQuickReplyUpdate, PermissionQuickReplyDelete,
PermissionTagView, PermissionTagCreate, PermissionTagUpdate, PermissionTagDelete,
PermissionCompanyView, PermissionCompanyCreate, PermissionCompanyUpdate, PermissionCompanyDelete,
PermissionChannelView, PermissionChannelCreate, PermissionChannelUpdate, PermissionChannelDelete, PermissionWxWorkOutboxView, PermissionWxWorkOutboxUpdate,
PermissionCustomerView, PermissionCustomerCreate, PermissionCustomerUpdate, PermissionCustomerDelete,
PermissionAgentView, PermissionAgentCreate, PermissionAgentUpdate, PermissionAgentDelete, PermissionAgentUpdateStatus, PermissionAgentConfig,
PermissionAgentTeamView, PermissionAgentTeamCreate, PermissionAgentTeamUpdate, PermissionAgentTeamDelete,
PermissionAgentTeamScheduleView, PermissionAgentTeamScheduleCreate, PermissionAgentTeamScheduleUpdate, PermissionAgentTeamScheduleDelete, PermissionAgentTeamScheduleBatchGenerate,
PermissionAssetView, PermissionAssetCreate, PermissionAssetDelete,
PermissionAIAgentView, PermissionAIAgentCreate, PermissionAIAgentUpdate, PermissionAIAgentDelete,
PermissionAIConfigView, PermissionAIConfigCreate, PermissionAIConfigUpdate, PermissionAIConfigDelete,
PermissionSkillDefinitionView, PermissionSkillDefinitionCreate, PermissionSkillDefinitionUpdate, PermissionSkillDefinitionDelete,
},
RoleCodeCsTeamLeader: {
PermissionUserView,
PermissionRoleView,
PermissionPermissionView,
PermissionSessionView,
PermissionConversationView, PermissionConversationClose, PermissionConversationSend, PermissionConversationTag, PermissionConversationHandover, PermissionConversationRecycle, PermissionConversationLinkCustomer,
PermissionTicketView, PermissionTicketCreate, PermissionTicketUpdate, PermissionTicketAssign, PermissionTicketChangeStatus, PermissionTicketProgress,
PermissionNotificationView, PermissionNotificationUpdate,
PermissionQuickReplyView, PermissionQuickReplyCreate, PermissionQuickReplyUpdate, PermissionQuickReplyDelete,
PermissionTagView, PermissionTagCreate, PermissionTagUpdate, PermissionTagDelete,
PermissionCompanyView,
PermissionChannelView, PermissionChannelCreate, PermissionChannelUpdate,
PermissionCustomerView, PermissionCustomerCreate, PermissionCustomerUpdate,
PermissionAgentView, PermissionAgentUpdate,
PermissionAgentTeamView,
PermissionAgentTeamScheduleView, PermissionAgentTeamScheduleCreate, PermissionAgentTeamScheduleUpdate, PermissionAgentTeamScheduleDelete, PermissionAgentTeamScheduleBatchGenerate,
PermissionAssetView, PermissionAssetCreate, PermissionAssetDelete,
PermissionAIAgentView, PermissionAIAgentCreate, PermissionAIAgentUpdate,
PermissionAIConfigView,
PermissionSkillDefinitionView, PermissionSkillDefinitionCreate, PermissionSkillDefinitionUpdate,
},
RoleCodeCsUser: {
PermissionUserView,
PermissionRoleView,
PermissionPermissionView,
PermissionConversationView,
PermissionTicketView, PermissionTicketCreate, PermissionTicketAssign, PermissionTicketChangeStatus, PermissionTicketProgress,
PermissionNotificationView, PermissionNotificationUpdate,
PermissionQuickReplyView,
PermissionTagView,
PermissionCompanyView,
PermissionChannelView,
PermissionCustomerView,
PermissionAssetView,
PermissionAgentView,
PermissionAgentTeamView,
PermissionAgentTeamScheduleView,
PermissionAIAgentView,
PermissionAIConfigView,
PermissionSkillDefinitionView,
},
}
func PermissionCodes() []string {
ret := make([]string, 0, len(Permissions))
for _, permission := range Permissions {
ret = append(ret, permission.Code)
}
return ret
}
-47
View File
@@ -1,47 +0,0 @@
package constants
import "testing"
func TestBuiltinAuthSeedNamesDefaultToEnglish(t *testing.T) {
t.Parallel()
if BootstrapAdminNickname != "Super Admin" {
t.Fatalf("BootstrapAdminNickname = %q, want %q", BootstrapAdminNickname, "Super Admin")
}
roles := map[string]string{}
for _, role := range Roles {
roles[role.Code] = role.Name
}
tests := map[string]string{
RoleCodeSuperAdmin: "Super Admin",
RoleCodeAdmin: "Admin",
RoleCodeCsTeamLeader: "Support Team Lead",
RoleCodeCsUser: "Support Agent",
}
for code, want := range tests {
if got := roles[code]; got != want {
t.Fatalf("role %s name = %q, want %q", code, got, want)
}
}
permissions := map[string]string{}
for _, permission := range Permissions {
permissions[permission.Code] = permission.Name
}
permissionTests := map[string]string{
"user.view": "View users",
"ticket.create": "Create tickets",
"conversation.send": "Send conversation messages",
"channel.view": "View channels",
"wxworkOutbox.view": "View WeCom outbox records",
"agent.view": "View agents",
}
for code, want := range permissionTests {
if got := permissions[code]; got != want {
t.Fatalf("permission %s name = %q, want %q", code, got, want)
}
}
}