chore: initialize project repository

2026-09-09 21:55:37 +08:00
commit b1497fd2c6
167 changed files with 17690 additions and 0 deletions
@@ -0,0 +1,89 @@
+"""造 RBAC 测试数据，验证真实链路身份加载与越权拦截。
+
+数据使用 9001/9002 号段，便于清理，不影响业务数据。
+"""
+
+from __future__ import annotations
+
+import asyncio
+from datetime import UTC, datetime
+
+from sqlalchemy import text
+
+from app.core.contracts import RequestContext
+from app.infrastructure.db import SessionFactory
+from app.service.identity_service import IdentityService
+
+CUSTOMER_USER = "9001"
+RISK_USER = "9002"
+
+
+async def seed() -> None:
+    now = datetime.now(UTC).replace(tzinfo=None)
+    async with SessionFactory() as session:
+        await session.execute(text("DELETE FROM sys_role_permission WHERE role_id IN (9001,9002)"))
+        await session.execute(text("DELETE FROM sys_user_role WHERE user_id IN (9001,9002)"))
+        await session.execute(text("DELETE FROM sys_permission WHERE id=9001"))
+        await session.execute(text("DELETE FROM sys_role WHERE id IN (9001,9002)"))
+        await session.execute(text("DELETE FROM sys_user WHERE id IN (9001,9002)"))
+        await session.execute(
+            text(
+                "INSERT INTO sys_user (id, user_no, username, password_hash, user_type,"
+                " professional_investor_status, fund_account_status, status, created_at, updated_at)"
+                " VALUES (9001,'T-CUST','cust_t','x','customer','none','closed','正常',:now,:now),"
+                "        (9002,'T-RISK','risk_t','x','employee','none','closed','正常',:now,:now)"
+            ),
+            {"now": now},
+        )
+        await session.execute(
+            text(
+                "INSERT INTO sys_role (id, role_code, role_name, status, created_at, updated_at)"
+                " VALUES (9001,'customer','客户','active',:now,:now),"
+                "        (9002,'risk_operator','风控专员','active',:now,:now)"
+            ),
+            {"now": now},
+        )
+        await session.execute(
+            text(
+                "INSERT INTO sys_permission"
+                " (id, permission_code, resource, action, data_scope, created_at, updated_at)"
+                " VALUES (9001,'agent:run','agent','run','self',:now,:now)"
+            ),
+            {"now": now},
+        )
+        await session.execute(
+            text(
+                "INSERT INTO sys_user_role (user_id, role_id, assigned_at)"
+                " VALUES (9001,9001,:now),(9002,9002,:now)"
+            ),
+            {"now": now},
+        )
+        await session.execute(
+            text(
+                "INSERT INTO sys_role_permission (role_id, permission_id, created_at)"
+                " VALUES (9001,9001,:now),(9002,9001,:now)"
+            ),
+            {"now": now},
+        )
+        await session.commit()
+
+
+async def verify() -> None:
+    service = IdentityService()
+    for label, user_id in (("customer", CUSTOMER_USER), ("risk_operator", RISK_USER)):
+        context = await service.resolve(
+            RequestContext(user_id=user_id, trace_id="verify-trace")
+        )
+        print(
+            f"{label:14s} roles={context.roles} permissions={context.permissions} "
+            f"portal={context.portal} data_scope={context.data_scope}"
+        )
+
+
+async def main() -> None:
+    await seed()
+    await verify()
+
+
+if __name__ == "__main__":
+    asyncio.run(main())