feat: add sync permissions functionality and UI integration

internal/bootstrap/routes.go

@@ -101,6 +101,7 @@ func registerDashboardRoleRoutes(group *gin.RouterGroup) {
 func registerDashboardPermissionRoutes(group *gin.RouterGroup) {
 	group.GET("/:id", dashboard.PermissionGetBy)
 	group.Any("/list", dashboard.PermissionAnyList)
+	group.POST("/sync", dashboard.PermissionPostSync)
 }
 
 func registerDashboardSessionRoutes(group *gin.RouterGroup) {

internal/handlers/dashboard/permission_handler.go

@@ -74,3 +74,16 @@ func PermissionGetBy(ctx *gin.Context) {
 		SortNo:    item.SortNo,
 	})
 }
+
+func PermissionPostSync(ctx *gin.Context) {
+	if _, err := services.AuthService.RequirePermission(ctx, constants.PermissionPermissionSync); err != nil {
+		httpx.WriteJSON(ctx, err)
+		return
+	}
+	result, err := services.PermissionService.SyncBuiltinPermissions()
+	if err != nil {
+		httpx.WriteJSON(ctx, err)
+		return
+	}
+	httpx.WriteJSON(ctx, result)
+}

internal/pkg/dto/response/admin_response.go

@@ -14,6 +14,12 @@ type PermissionResponse struct {
 	SortNo    int          `json:"sortNo"`
 }
 
+type PermissionSyncResponse struct {
+	Created              int `json:"created"`
+	Updated              int `json:"updated"`
+	RolePermissionsAdded int `json:"rolePermissionsAdded"`
+}
+
 type RoleResponse struct {
 	ID          int64        `json:"id"`
 	Name        string       `json:"name"`

internal/services/permission_service.go

@@ -2,7 +2,12 @@ package services
 
 import (
 	"agent-desk/internal/models"
+	"agent-desk/internal/pkg/constants"
+	"agent-desk/internal/pkg/dto/response"
+	"agent-desk/internal/pkg/enums"
 	"agent-desk/internal/repositories"
+	"fmt"
+	"time"
 
 	"agent-desk/internal/pkg/httpx/params"
 
@@ -65,3 +70,75 @@ func (s *permissionService) UpdateColumn(id int64, name string, value interface{
 func (s *permissionService) Delete(id int64) {
 	repositories.PermissionRepository.Delete(sqls.DB(), id)
 }
+
+func (s *permissionService) SyncBuiltinPermissions() (*response.PermissionSyncResponse, error) {
+	result := &response.PermissionSyncResponse{}
+	err := sqls.WithTransaction(func(ctx *sqls.TxContext) error {
+		permissions := make(map[string]*models.Permission, len(constants.Permissions))
+		now := time.Now()
+
+		for _, spec := range constants.Permissions {
+			permission := repositories.PermissionRepository.FindOne(ctx.Tx, sqls.NewCnd().Eq("code", spec.Code))
+			if permission == nil {
+				permission = &models.Permission{
+					Name: spec.Name, Code: spec.Code, Type: spec.Type, GroupName: spec.GroupName,
+					Method: spec.Method, APIPath: spec.APIPath, SortNo: spec.SortNo,
+					Status: enums.StatusOk, IsBuiltin: true,
+					AuditFields: systemPermissionAuditFields(now),
+				}
+				if err := repositories.PermissionRepository.Create(ctx.Tx, permission); err != nil {
+					return err
+				}
+				result.Created++
+			} else {
+				if err := repositories.PermissionRepository.Updates(ctx.Tx, permission.ID, map[string]any{
+					"name": spec.Name, "type": spec.Type, "group_name": spec.GroupName,
+					"method": spec.Method, "api_path": spec.APIPath, "sort_no": spec.SortNo,
+					"status": enums.StatusOk, "is_builtin": true,
+					"update_user_id":   constants.SystemAuditUserID,
+					"update_user_name": constants.SystemAuditUserName, "updated_at": now,
+				}); err != nil {
+					return err
+				}
+				permission = repositories.PermissionRepository.Get(ctx.Tx, permission.ID)
+				result.Updated++
+			}
+			permissions[spec.Code] = permission
+		}
+
+		for roleCode, specs := range constants.RolePermissions {
+			role := repositories.RoleRepository.GetByCode(ctx.Tx, roleCode)
+			if role == nil {
+				return fmt.Errorf("builtin role not found: %s", roleCode)
+			}
+			for _, spec := range specs {
+				permission := permissions[spec.Code]
+				if permission == nil {
+					return fmt.Errorf("builtin permission not found: %s", spec.Code)
+				}
+				if repositories.RolePermissionRepository.FindOne(ctx.Tx, sqls.NewCnd().Eq("role_id", role.ID).Eq("permission_id", permission.ID)) != nil {
+					continue
+				}
+				if err := repositories.RolePermissionRepository.Create(ctx.Tx, &models.RolePermission{
+					RoleID: role.ID, PermissionID: permission.ID,
+					AuditFields: systemPermissionAuditFields(now),
+				}); err != nil {
+					return err
+				}
+				result.RolePermissionsAdded++
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return result, nil
+}
+
+func systemPermissionAuditFields(now time.Time) models.AuditFields {
+	return models.AuditFields{
+		CreatedAt: now, CreateUserID: constants.SystemAuditUserID, CreateUserName: constants.SystemAuditUserName,
+		UpdatedAt: now, UpdateUserID: constants.SystemAuditUserID, UpdateUserName: constants.SystemAuditUserName,
+	}
+}

internal/services/permission_service_test.go

@@ -0,0 +1,100 @@
+package services
+
+import (
+	"agent-desk/internal/models"
+	"agent-desk/internal/pkg/constants"
+	"agent-desk/internal/pkg/enums"
+	"testing"
+	"time"
+
+	"github.com/glebarez/sqlite"
+	"github.com/mlogclub/simple/sqls"
+	"gorm.io/gorm"
+	"gorm.io/gorm/schema"
+)
+
+func TestPermissionServiceSyncBuiltinPermissions(t *testing.T) {
+	db := setupPermissionServiceTestDB(t)
+	now := time.Now()
+	for _, spec := range constants.Roles {
+		if err := db.Create(&models.Role{
+			Name: spec.Name, Code: spec.Code, Status: enums.StatusOk, IsSystem: true, SortNo: spec.SortNo,
+			AuditFields: models.AuditFields{CreatedAt: now, UpdatedAt: now},
+		}).Error; err != nil {
+			t.Fatalf("create role %s: %v", spec.Code, err)
+		}
+	}
+	customPermission := &models.Permission{
+		Name: "Custom permission", Code: "custom.keep", Type: "api", GroupName: "custom",
+		Status: enums.StatusOk, AuditFields: models.AuditFields{CreatedAt: now, UpdatedAt: now},
+	}
+	if err := db.Create(customPermission).Error; err != nil {
+		t.Fatalf("create custom permission: %v", err)
+	}
+	superAdmin := &models.Role{}
+	if err := db.First(superAdmin, "code = ?", constants.RoleCodeSuperAdmin).Error; err != nil {
+		t.Fatalf("find super admin role: %v", err)
+	}
+	if err := db.Create(&models.RolePermission{
+		RoleID: superAdmin.ID, PermissionID: customPermission.ID,
+		AuditFields: models.AuditFields{CreatedAt: now, UpdatedAt: now},
+	}).Error; err != nil {
+		t.Fatalf("create custom role permission: %v", err)
+	}
+
+	first, err := PermissionService.SyncBuiltinPermissions()
+	if err != nil {
+		t.Fatalf("first sync: %v", err)
+	}
+	if first.Created != len(constants.Permissions) || first.Updated != 0 {
+		t.Fatalf("unexpected first sync result: %+v", first)
+	}
+
+	wantRolePermissions := 0
+	for _, permissions := range constants.RolePermissions {
+		wantRolePermissions += len(permissions)
+	}
+	if first.RolePermissionsAdded != wantRolePermissions {
+		t.Fatalf("role permissions added=%d want=%d", first.RolePermissionsAdded, wantRolePermissions)
+	}
+
+	second, err := PermissionService.SyncBuiltinPermissions()
+	if err != nil {
+		t.Fatalf("second sync: %v", err)
+	}
+	if second.Created != 0 || second.Updated != len(constants.Permissions) || second.RolePermissionsAdded != 0 {
+		t.Fatalf("sync is not idempotent: %+v", second)
+	}
+
+	var permissionCount int64
+	if err := db.Model(&models.Permission{}).Count(&permissionCount).Error; err != nil {
+		t.Fatalf("count permissions: %v", err)
+	}
+	if permissionCount != int64(len(constants.Permissions)+1) {
+		t.Fatalf("permission count=%d want=%d", permissionCount, len(constants.Permissions)+1)
+	}
+	var customRolePermissionCount int64
+	if err := db.Model(&models.RolePermission{}).
+		Where("role_id = ? AND permission_id = ?", superAdmin.ID, customPermission.ID).
+		Count(&customRolePermissionCount).Error; err != nil {
+		t.Fatalf("count custom role permission: %v", err)
+	}
+	if customRolePermissionCount != 1 {
+		t.Fatalf("custom role permission was removed")
+	}
+}
+
+func setupPermissionServiceTestDB(t *testing.T) *gorm.DB {
+	t.Helper()
+	db, err := gorm.Open(sqlite.Open("file:"+t.Name()+"?mode=memory&cache=shared"), &gorm.Config{
+		NamingStrategy: schema.NamingStrategy{TablePrefix: "t_", SingularTable: true},
+	})
+	if err != nil {
+		t.Fatalf("open sqlite db: %v", err)
+	}
+	if err := db.AutoMigrate(&models.Role{}, &models.Permission{}, &models.RolePermission{}); err != nil {
+		t.Fatalf("migrate permission tables: %v", err)
+	}
+	sqls.SetDB(db)
+	return db
+}