完善风控登录权限和模型能力配置

tools/seed_test_rbac.py

@@ -26,13 +26,19 @@ id BETWEEN 9001 AND 9099` 会删掉该号段内**所有**权限（包括别的
 from __future__ import annotations
 
 import asyncio
+import sys
 from datetime import UTC, datetime, timedelta
+from pathlib import Path
 
 from sqlalchemy import text
 
-from app.core.contracts import RequestContext
-from app.infrastructure.db import SessionFactory
-from app.service.identity_service import IdentityService
+PROJECT_ROOT = Path(__file__).resolve().parents[1]
+if str(PROJECT_ROOT) not in sys.path:
+    sys.path.insert(0, str(PROJECT_ROOT))
+
+from app.core.contracts import RequestContext  # noqa: E402
+from app.infrastructure.db import SessionFactory  # noqa: E402
+from app.service.identity_service import IdentityService  # noqa: E402
 
 CUSTOMER_USER = "9001"
 RISK_USER = "9002"
@@ -94,6 +100,14 @@ PERMISSIONS: tuple[tuple[int, str, str, str, str], ...] = (
     (9044, "memory:candidate:confirm", "memory:candidate", "confirm", "self"),
     (9045, "memory:candidate:review", "memory:candidate", "review", "all"),
     (9046, "handover:read", "handover", "read", "all"),
+    # ---- 9047-9050：风控模块四个权限码 ----
+    # 风控 Service 和 Agent 工具都按这四个权限码失败关闭。此前依赖
+    # `grant_risk_permissions.py` 临时补种，重跑本脚本时会删除 9001-9099 号段内的
+    # 风控权限，导致登录成功后风控接口全部 403。这里纳入唯一权限定义源。
+    (9047, "risk:alert:read", "risk", "alert", "all"),
+    (9048, "risk:alert:write", "risk", "alert", "all"),
+    (9049, "risk:alert:scan", "risk", "alert", "all"),
+    (9050, "risk:report:mail", "risk", "report", "all"),
 )
 
 # 客户：业务侧自助能力（自己的会话、反馈、转人工、自己的记忆画像）。
@@ -104,7 +118,10 @@ CUSTOMER_PERMISSIONS = (
     9044,
 )
 # 风控专员：业务侧只读 + 跨客户记忆 + 审计只读，不含配置写权限。
-RISK_PERMISSIONS = (9001, 9002, 9003, 9010, 9011, 9012)
+RISK_PERMISSIONS = (
+    9001, 9002, 9003, 9010, 9011, 9012,
+    9047, 9048, 9049, 9050,
+)
 # 平台管理员：管理面全套（配置发布四态 + 模型端点 + 审计）。
 ADMIN_PERMISSIONS = tuple(row[0] for row in PERMISSIONS)
 
@@ -159,6 +176,24 @@ async def seed() -> None:
             text("DELETE FROM sys_role_permission WHERE role_id IN (9001,9002,9003)")
         )
         await session.execute(text("DELETE FROM sys_user_role WHERE user_id IN (9001,9002,9003)"))
+        # 风控权限在旧环境中可能由 `grant_risk_permissions.py` 自动分配了任意主键。
+        # 先按 permission_code 清掉角色绑定和旧主键，保证本次能用固定号段重建；
+        # 否则 `risk:report:mail` 已存在于 9001-9099 之外时会触发 permission_code 唯一键冲突。
+        await session.execute(text("""
+            DELETE rp FROM sys_role_permission rp
+            JOIN sys_permission p ON p.id = rp.permission_id
+            WHERE p.permission_code IN (
+                'risk:alert:read', 'risk:alert:write',
+                'risk:alert:scan', 'risk:report:mail'
+            )
+        """))
+        await session.execute(text("""
+            DELETE FROM sys_permission
+            WHERE permission_code IN (
+                'risk:alert:read', 'risk:alert:write',
+                'risk:alert:scan', 'risk:report:mail'
+            )
+        """))
         await session.execute(text("DELETE FROM sys_permission WHERE id BETWEEN 9001 AND 9099"))
         await session.execute(text("DELETE FROM sys_role WHERE id IN (9001,9002,9003)"))
         # 不再 DELETE sys_user：投顾域的 advisor_profile_tag 等表用 FK 引用它，库里有数据引用