feat:新增投顾agent和nl2sqlagent

service/nl2sql/permission_service.py

@@ -0,0 +1,46 @@
+"""NL2SQL 请求级权限快照服务。"""
+from __future__ import annotations
+
+from nl2sql.permission import build_query_permission
+from model.sys_user import SysUser
+from repositories.nl2sql_permission import Nl2SqlPermissionRepo
+from repositories.sys_user import SysUserRepo
+
+
+def _denied_permission(user_id: int) -> dict:
+    """构造默认拒绝快照，避免把不存在用户的信息暴露给调用方。"""
+    return build_query_permission(
+        SysUser(id=user_id, user_type="UNKNOWN", employee_role=None, status="异常"),
+        None,
+        [],
+        [],
+        [],
+    )
+
+
+async def load_query_permission(
+    db,
+    user_id: int,
+    *,
+    user_repo_factory=SysUserRepo,
+    permission_repo_factory=Nl2SqlPermissionRepo,
+) -> dict:
+    """每次调用重新加载用户和 NL2SQL 权限，返回请求级权限快照。"""
+    user = await user_repo_factory(db).get(user_id)
+    if user is None or getattr(user, "status", None) != "正常":
+        return _denied_permission(user_id)
+    if getattr(user, "user_type", None) != "EMPLOYEE":
+        return _denied_permission(user_id)
+
+    repo = permission_repo_factory(db)
+    role = await repo.get_role_by_employee_role(user.employee_role)
+    table_permissions = await repo.list_table_permissions(role.id) if role else []
+    column_permissions = await repo.list_column_permissions(role.id) if role else []
+    sensitive_fields = await repo.list_sensitive_fields()
+    return build_query_permission(
+        user,
+        role,
+        table_permissions,
+        column_permissions,
+        sensitive_fields,
+    )