refactor(auth): delegate access control to be-system

Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.

internal/services/channel_service.go

@@ -1,23 +1,21 @@
 package services
 
 import (
-	"agent-desk/internal/models"
-	"agent-desk/internal/pkg/dto"
-	"agent-desk/internal/pkg/dto/request"
-	"agent-desk/internal/pkg/dto/response"
-	"agent-desk/internal/pkg/enums"
-	"agent-desk/internal/pkg/errorsx"
-	"agent-desk/internal/pkg/httpx"
-	"agent-desk/internal/pkg/utils"
-	"agent-desk/internal/repositories"
-	"agent-desk/internal/wxwork"
-	"crypto/rand"
-	"encoding/base64"
+	"code.tczkiot.com/wlw/ai-agent/internal/models"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/dto"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/dto/request"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/dto/response"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/enums"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/errorsx"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/httpx"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/utils"
+	"code.tczkiot.com/wlw/ai-agent/internal/repositories"
+	"code.tczkiot.com/wlw/ai-agent/internal/wxwork"
 	"encoding/json"
 	"strings"
 	"time"
 
-	"agent-desk/internal/pkg/httpx/params"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/httpx/params"
 
 	"github.com/gin-gonic/gin"
 	"github.com/mlogclub/simple/common/strs"
@@ -271,7 +269,6 @@ func (s *channelService) ParseWebChannelConfig(raw string) (*dto.WebChannelConfi
 	if cfg.Width == "" {
 		cfg.Width = "380px"
 	}
-	cfg.UserTokenSecret = strings.TrimSpace(cfg.UserTokenSecret)
 	return cfg, nil
 }
 
@@ -296,91 +293,9 @@ func (s *channelService) ParseWechatMPChannelConfig(raw string) (*dto.WechatMPCh
 	if cfg.ThemeColor == "" {
 		cfg.ThemeColor = "#2563eb"
 	}
-	cfg.UserTokenSecret = strings.TrimSpace(cfg.UserTokenSecret)
 	return cfg, nil
 }
 
-func (s *channelService) GetUserTokenSecret(channel *models.Channel) string {
-	if channel == nil {
-		return ""
-	}
-	switch channel.ChannelType {
-	case enums.ChannelTypeWeb:
-		cfg, err := s.ParseWebChannelConfig(channel.ConfigJSON)
-		if err != nil {
-			return ""
-		}
-		return strings.TrimSpace(cfg.UserTokenSecret)
-	case enums.ChannelTypeWechatMP:
-		cfg, err := s.ParseWechatMPChannelConfig(channel.ConfigJSON)
-		if err != nil {
-			return ""
-		}
-		return strings.TrimSpace(cfg.UserTokenSecret)
-	default:
-		return ""
-	}
-}
-
-func (s *channelService) ResetUserTokenSecret(channelID int64, operator *dto.AuthPrincipal) (string, error) {
-	if operator == nil {
-		return "", errorsx.UnauthorizedI18n("error.auth.expired")
-	}
-	channel := s.Get(channelID)
-	if channel == nil || channel.Status == enums.StatusDeleted {
-		return "", errorsx.InvalidParamI18n("error.e0208")
-	}
-	if channel.ChannelType != enums.ChannelTypeWeb && channel.ChannelType != enums.ChannelTypeWechatMP {
-		return "", errorsx.InvalidParamI18n("error.e0196")
-	}
-	secret, err := generateUserTokenSecret()
-	if err != nil {
-		return "", err
-	}
-	var configJSON string
-	switch channel.ChannelType {
-	case enums.ChannelTypeWeb:
-		cfg, err := s.ParseWebChannelConfig(channel.ConfigJSON)
-		if err != nil {
-			return "", err
-		}
-		cfg.UserTokenSecret = secret
-		raw, err := json.Marshal(cfg)
-		if err != nil {
-			return "", err
-		}
-		configJSON = string(raw)
-	case enums.ChannelTypeWechatMP:
-		cfg, err := s.ParseWechatMPChannelConfig(channel.ConfigJSON)
-		if err != nil {
-			return "", err
-		}
-		cfg.UserTokenSecret = secret
-		raw, err := json.Marshal(cfg)
-		if err != nil {
-			return "", err
-		}
-		configJSON = string(raw)
-	}
-	if err := repositories.ChannelRepository.Updates(sqls.DB(), channelID, map[string]any{
-		"config_json":      configJSON,
-		"update_user_id":   operator.UserID,
-		"update_user_name": operator.Username,
-		"updated_at":       time.Now(),
-	}); err != nil {
-		return "", err
-	}
-	return secret, nil
-}
-
-func generateUserTokenSecret() (string, error) {
-	buf := make([]byte, 32)
-	if _, err := rand.Read(buf); err != nil {
-		return "", err
-	}
-	return base64.RawURLEncoding.EncodeToString(buf), nil
-}
-
 func (s *channelService) GetEnabledWxWorkKFChannelByOpenKfID(openKfID string) *models.Channel {
 	openKfID = strings.TrimSpace(openKfID)
 	if openKfID == "" {
@@ -467,13 +382,6 @@ func (s *channelService) buildChannelModel(id int64, req request.CreateChannelRe
 		if err != nil {
 			return nil, errorsx.InvalidParamI18n("error.e0060")
 		}
-		if strings.TrimSpace(cfg.UserTokenSecret) == "" {
-			secret, err := generateUserTokenSecret()
-			if err != nil {
-				return nil, err
-			}
-			cfg.UserTokenSecret = secret
-		}
 		configBytes, err := json.Marshal(cfg)
 		if err != nil {
 			return nil, err
@@ -490,13 +398,6 @@ func (s *channelService) buildChannelModel(id int64, req request.CreateChannelRe
 		if err != nil {
 			return nil, errorsx.InvalidParamI18n("error.e0201")
 		}
-		if strings.TrimSpace(cfg.UserTokenSecret) == "" {
-			secret, err := generateUserTokenSecret()
-			if err != nil {
-				return nil, err
-			}
-			cfg.UserTokenSecret = secret
-		}
 		configBytes, err := json.Marshal(cfg)
 		if err != nil {
 			return nil, err