feat: add sync permissions functionality and UI integration

internal/bootstrap/routes.go

@@ -101,6 +101,7 @@ func registerDashboardRoleRoutes(group *gin.RouterGroup) {
 func registerDashboardPermissionRoutes(group *gin.RouterGroup) {
 	group.GET("/:id", dashboard.PermissionGetBy)
 	group.Any("/list", dashboard.PermissionAnyList)
+	group.POST("/sync", dashboard.PermissionPostSync)
 }
 
 func registerDashboardSessionRoutes(group *gin.RouterGroup) {

internal/handlers/dashboard/permission_handler.go

@@ -74,3 +74,16 @@ func PermissionGetBy(ctx *gin.Context) {
 		SortNo:    item.SortNo,
 	})
 }
+
+func PermissionPostSync(ctx *gin.Context) {
+	if _, err := services.AuthService.RequirePermission(ctx, constants.PermissionPermissionSync); err != nil {
+		httpx.WriteJSON(ctx, err)
+		return
+	}
+	result, err := services.PermissionService.SyncBuiltinPermissions()
+	if err != nil {
+		httpx.WriteJSON(ctx, err)
+		return
+	}
+	httpx.WriteJSON(ctx, result)
+}

internal/pkg/dto/response/admin_response.go

@@ -14,6 +14,12 @@ type PermissionResponse struct {
 	SortNo    int          `json:"sortNo"`
 }
 
+type PermissionSyncResponse struct {
+	Created              int `json:"created"`
+	Updated              int `json:"updated"`
+	RolePermissionsAdded int `json:"rolePermissionsAdded"`
+}
+
 type RoleResponse struct {
 	ID          int64        `json:"id"`
 	Name        string       `json:"name"`

internal/services/permission_service.go

@@ -2,7 +2,12 @@ package services
 
 import (
 	"agent-desk/internal/models"
+	"agent-desk/internal/pkg/constants"
+	"agent-desk/internal/pkg/dto/response"
+	"agent-desk/internal/pkg/enums"
 	"agent-desk/internal/repositories"
+	"fmt"
+	"time"
 
 	"agent-desk/internal/pkg/httpx/params"
 
@@ -65,3 +70,75 @@ func (s *permissionService) UpdateColumn(id int64, name string, value interface{
 func (s *permissionService) Delete(id int64) {
 	repositories.PermissionRepository.Delete(sqls.DB(), id)
 }
+
+func (s *permissionService) SyncBuiltinPermissions() (*response.PermissionSyncResponse, error) {
+	result := &response.PermissionSyncResponse{}
+	err := sqls.WithTransaction(func(ctx *sqls.TxContext) error {
+		permissions := make(map[string]*models.Permission, len(constants.Permissions))
+		now := time.Now()
+
+		for _, spec := range constants.Permissions {
+			permission := repositories.PermissionRepository.FindOne(ctx.Tx, sqls.NewCnd().Eq("code", spec.Code))
+			if permission == nil {
+				permission = &models.Permission{
+					Name: spec.Name, Code: spec.Code, Type: spec.Type, GroupName: spec.GroupName,
+					Method: spec.Method, APIPath: spec.APIPath, SortNo: spec.SortNo,
+					Status: enums.StatusOk, IsBuiltin: true,
+					AuditFields: systemPermissionAuditFields(now),
+				}
+				if err := repositories.PermissionRepository.Create(ctx.Tx, permission); err != nil {
+					return err
+				}
+				result.Created++
+			} else {
+				if err := repositories.PermissionRepository.Updates(ctx.Tx, permission.ID, map[string]any{
+					"name": spec.Name, "type": spec.Type, "group_name": spec.GroupName,
+					"method": spec.Method, "api_path": spec.APIPath, "sort_no": spec.SortNo,
+					"status": enums.StatusOk, "is_builtin": true,
+					"update_user_id":   constants.SystemAuditUserID,
+					"update_user_name": constants.SystemAuditUserName, "updated_at": now,
+				}); err != nil {
+					return err
+				}
+				permission = repositories.PermissionRepository.Get(ctx.Tx, permission.ID)
+				result.Updated++
+			}
+			permissions[spec.Code] = permission
+		}
+
+		for roleCode, specs := range constants.RolePermissions {
+			role := repositories.RoleRepository.GetByCode(ctx.Tx, roleCode)
+			if role == nil {
+				return fmt.Errorf("builtin role not found: %s", roleCode)
+			}
+			for _, spec := range specs {
+				permission := permissions[spec.Code]
+				if permission == nil {
+					return fmt.Errorf("builtin permission not found: %s", spec.Code)
+				}
+				if repositories.RolePermissionRepository.FindOne(ctx.Tx, sqls.NewCnd().Eq("role_id", role.ID).Eq("permission_id", permission.ID)) != nil {
+					continue
+				}
+				if err := repositories.RolePermissionRepository.Create(ctx.Tx, &models.RolePermission{
+					RoleID: role.ID, PermissionID: permission.ID,
+					AuditFields: systemPermissionAuditFields(now),
+				}); err != nil {
+					return err
+				}
+				result.RolePermissionsAdded++
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return result, nil
+}
+
+func systemPermissionAuditFields(now time.Time) models.AuditFields {
+	return models.AuditFields{
+		CreatedAt: now, CreateUserID: constants.SystemAuditUserID, CreateUserName: constants.SystemAuditUserName,
+		UpdatedAt: now, UpdateUserID: constants.SystemAuditUserID, UpdateUserName: constants.SystemAuditUserName,
+	}
+}

internal/services/permission_service_test.go

@@ -0,0 +1,100 @@
+package services
+
+import (
+	"agent-desk/internal/models"
+	"agent-desk/internal/pkg/constants"
+	"agent-desk/internal/pkg/enums"
+	"testing"
+	"time"
+
+	"github.com/glebarez/sqlite"
+	"github.com/mlogclub/simple/sqls"
+	"gorm.io/gorm"
+	"gorm.io/gorm/schema"
+)
+
+func TestPermissionServiceSyncBuiltinPermissions(t *testing.T) {
+	db := setupPermissionServiceTestDB(t)
+	now := time.Now()
+	for _, spec := range constants.Roles {
+		if err := db.Create(&models.Role{
+			Name: spec.Name, Code: spec.Code, Status: enums.StatusOk, IsSystem: true, SortNo: spec.SortNo,
+			AuditFields: models.AuditFields{CreatedAt: now, UpdatedAt: now},
+		}).Error; err != nil {
+			t.Fatalf("create role %s: %v", spec.Code, err)
+		}
+	}
+	customPermission := &models.Permission{
+		Name: "Custom permission", Code: "custom.keep", Type: "api", GroupName: "custom",
+		Status: enums.StatusOk, AuditFields: models.AuditFields{CreatedAt: now, UpdatedAt: now},
+	}
+	if err := db.Create(customPermission).Error; err != nil {
+		t.Fatalf("create custom permission: %v", err)
+	}
+	superAdmin := &models.Role{}
+	if err := db.First(superAdmin, "code = ?", constants.RoleCodeSuperAdmin).Error; err != nil {
+		t.Fatalf("find super admin role: %v", err)
+	}
+	if err := db.Create(&models.RolePermission{
+		RoleID: superAdmin.ID, PermissionID: customPermission.ID,
+		AuditFields: models.AuditFields{CreatedAt: now, UpdatedAt: now},
+	}).Error; err != nil {
+		t.Fatalf("create custom role permission: %v", err)
+	}
+
+	first, err := PermissionService.SyncBuiltinPermissions()
+	if err != nil {
+		t.Fatalf("first sync: %v", err)
+	}
+	if first.Created != len(constants.Permissions) || first.Updated != 0 {
+		t.Fatalf("unexpected first sync result: %+v", first)
+	}
+
+	wantRolePermissions := 0
+	for _, permissions := range constants.RolePermissions {
+		wantRolePermissions += len(permissions)
+	}
+	if first.RolePermissionsAdded != wantRolePermissions {
+		t.Fatalf("role permissions added=%d want=%d", first.RolePermissionsAdded, wantRolePermissions)
+	}
+
+	second, err := PermissionService.SyncBuiltinPermissions()
+	if err != nil {
+		t.Fatalf("second sync: %v", err)
+	}
+	if second.Created != 0 || second.Updated != len(constants.Permissions) || second.RolePermissionsAdded != 0 {
+		t.Fatalf("sync is not idempotent: %+v", second)
+	}
+
+	var permissionCount int64
+	if err := db.Model(&models.Permission{}).Count(&permissionCount).Error; err != nil {
+		t.Fatalf("count permissions: %v", err)
+	}
+	if permissionCount != int64(len(constants.Permissions)+1) {
+		t.Fatalf("permission count=%d want=%d", permissionCount, len(constants.Permissions)+1)
+	}
+	var customRolePermissionCount int64
+	if err := db.Model(&models.RolePermission{}).
+		Where("role_id = ? AND permission_id = ?", superAdmin.ID, customPermission.ID).
+		Count(&customRolePermissionCount).Error; err != nil {
+		t.Fatalf("count custom role permission: %v", err)
+	}
+	if customRolePermissionCount != 1 {
+		t.Fatalf("custom role permission was removed")
+	}
+}
+
+func setupPermissionServiceTestDB(t *testing.T) *gorm.DB {
+	t.Helper()
+	db, err := gorm.Open(sqlite.Open("file:"+t.Name()+"?mode=memory&cache=shared"), &gorm.Config{
+		NamingStrategy: schema.NamingStrategy{TablePrefix: "t_", SingularTable: true},
+	})
+	if err != nil {
+		t.Fatalf("open sqlite db: %v", err)
+	}
+	if err := db.AutoMigrate(&models.Role{}, &models.Permission{}, &models.RolePermission{}); err != nil {
+		t.Fatalf("migrate permission tables: %v", err)
+	}
+	sqls.SetDB(db)
+	return db
+}

web/app/dashboard/permissions/page.tsx

@@ -1,10 +1,14 @@
 "use client"
 
-import { KeyRoundIcon, RouteIcon, SearchIcon } from "lucide-react"
+import { useState } from "react"
+import { KeyRoundIcon, RouteIcon, SearchIcon, ShieldCheckIcon } from "lucide-react"
+import { toast } from "sonner"
 
+import { useConfirm } from "@/components/confirm-provider"
 import { DashboardListPage } from "@/components/dashboard/list"
 import { Badge } from "@/components/ui/badge"
-import { fetchPermissions, type AdminPermission } from "@/lib/api/admin"
+import { Button } from "@/components/ui/button"
+import { fetchPermissions, syncPermissions, type AdminPermission } from "@/lib/api/admin"
 import { Status } from "@/lib/generated/enums"
 import { useAppLocale, useI18n } from "@/i18n/provider"
 import { getPermissionDisplayName, getPermissionGroupName } from "@/lib/permission-i18n"
@@ -12,6 +16,8 @@ import { getPermissionDisplayName, getPermissionGroupName } from "@/lib/permissi
 export default function DashboardPermissionsPage() {
   const t = useI18n()
   const { locale } = useAppLocale()
+  const confirm = useConfirm()
+  const [syncing, setSyncing] = useState(false)
   const listStatusOptions = [
     { value: "all", label: t("status.all") },
     { value: String(Status.Ok), label: t("status.ok") },
@@ -19,6 +25,30 @@ export default function DashboardPermissionsPage() {
     { value: String(Status.Deleted), label: t("status.deleted") },
   ]
 
+  async function handleSync(reload: () => Promise<void>) {
+    const confirmed = await confirm({
+      title: t("permission.syncTitle"),
+      description: t("permission.syncDescription"),
+      confirmText: t("permission.sync"),
+    })
+    if (!confirmed || syncing) return
+
+    setSyncing(true)
+    try {
+      const result = await syncPermissions()
+      toast.success(t("permission.syncSuccess", {
+        created: result.created,
+        updated: result.updated,
+        rolePermissionsAdded: result.rolePermissionsAdded,
+      }))
+      await reload()
+    } catch (error) {
+      toast.error(error instanceof Error ? error.message : t("permission.syncFailed"))
+    } finally {
+      setSyncing(false)
+    }
+  }
+
   return (
     <DashboardListPage<AdminPermission>
       filters={[
@@ -51,6 +81,12 @@ export default function DashboardPermissionsPage() {
         },
       ]}
       fetchList={fetchPermissions}
+      renderToolbarActions={({ reload }) => (
+        <Button onClick={() => void handleSync(reload)} disabled={syncing}>
+          <ShieldCheckIcon className={syncing ? "animate-pulse" : undefined} />
+          {syncing ? t("permission.syncing") : t("permission.sync")}
+        </Button>
+      )}
       getItemId={(item) => item.id}
       columns={[
         {

web/lib/api/admin.ts

@@ -91,6 +91,12 @@ export type AdminPermission = {
   sortNo: number
 }
 
+export type PermissionSyncResult = {
+  created: number
+  updated: number
+  rolePermissionsAdded: number
+}
+
 export type ConversationTag = {
   id: number
   name: string
@@ -1240,6 +1246,12 @@ export function fetchPermissions(
   )
 }
 
+export function syncPermissions() {
+  return request<PermissionSyncResult>("/api/dashboard/permission/sync", {
+    method: "POST",
+  })
+}
+
 export function fetchConversations(
   query?: Record<string, string | number | undefined>
 ) {

web/messages/en-US.json

@@ -2196,6 +2196,12 @@
   "permission": {
     "loadFailed": "Could not load permissions.",
     "refresh": "Refresh",
+    "sync": "Sync Permissions",
+    "syncing": "Syncing...",
+    "syncTitle": "Sync Built-in Permissions",
+    "syncDescription": "Sync built-in permissions from code and add missing permissions to built-in roles. Existing role permissions will not be removed.",
+    "syncSuccess": "Permissions synced: {created} created, {updated} updated, {rolePermissionsAdded} role permissions added",
+    "syncFailed": "Could not sync permissions.",
     "filterKeyword": "Filter by permission name or code",
     "filterGroup": "Filter by group",
     "query": "Search",

web/messages/zh-CN.json

@@ -2196,6 +2196,12 @@
   "permission": {
     "loadFailed": "加载权限失败",
     "refresh": "刷新",
+    "sync": "同步权限",
+    "syncing": "同步中...",
+    "syncTitle": "同步内置权限",
+    "syncDescription": "将代码中的内置权限同步到数据库，并补齐内置角色缺失的权限。已有角色权限不会被删除。",
+    "syncSuccess": "权限同步完成：新增 {created}，更新 {updated}，补齐角色权限 {rolePermissionsAdded}",
+    "syncFailed": "权限同步失败",
     "filterKeyword": "按权限名称/编码筛选",
     "filterGroup": "按分组筛选",
     "query": "查询",