AI260626/group_fqcd_jr
13
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

chore: 权限号段根治——9041-9046 并进种子；修正 grant 脚本与种子 9020-9034 的 id 映射冲突

Browse Source
This commit is contained in:
lzf_0626
2026-09-12 12:09:55 +08:00
parent 2bb056e516
commit cdb2de3e45
3 changed files with 65 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/grant_advisor_role.py
+25 -28
View File
@@ -5,27 +5,33 @@
投顾这条线合并进来后，`bootstrap.py` 有 **10 处 `allowed_roles` 引用了 `advisor`**，
`financial_nl2sql_service.py:272` 还硬编码检查 `{"advisor","operator","admin","super_admin"}`，
`promotion_material_service.py:164` 直接按 `"advisor" in context.roles` 走业务分支 ——
但 `sys_role` 里**没有这个角色**，`sys_permission` 里也没有投顾那 16 个权限码
（`seed_test_rbac.py` 只建到 9019）。结果是：投顾登录后拿不到任何投顾权限，
但 `seed_test_rbac.py` **只重建 customer / risk_operator / admin 三个角色**，
`sys_role` 里没有 `advisor`。结果是：投顾登录后拿不到任何投顾权限，
所有投顾接口一律 403，而报错看起来像"权限配错了"，实际是**角色根本不存在**。
## 号段为什么是 9041（重要，2026-09-12 修正）
投顾那 13 个业务权限码**已由投顾线（`bbf623a`）并进 `seed_test_rbac.py` 的 9020-9034**，
但那个种子**漏了 3 个治理类权限码**（`product-governance:*`），而治理接口直接要求它们。
本脚本现在只补这 3 个（**9041-9043**）+ 建角色 + 绑定。
⚠️ 本脚本**此前**用 9020-9035 定义过整套 16 个权限，与种子的 9020-9034 **id→code 映射不同**。
若库里还留着那批旧数据，跑一次种子会把 9020-9034 换成种子的语义，而 `advisor` 角色（9004）
的绑定**不在种子的清理范围内**（种子只清 role_id 9001-9003），于是它的绑定会指向**错误的权限码**。
**处置顺序：先跑 `seed_test_rbac.py`（对齐 9001-9034），再跑本脚本（补 9041-9043 并重建绑定）。**
## 权限怎么分
| 类别 | 权限码 | 给谁 |
|---|---|---|
| 投顾工作流（10） | `asset-allocation:generate:self`、`investment-goal:read:self` / `:review` / `:publish`、`portfolio-analysis:read:self`、`product-comparison:read:self`、`product-recommendation:read:self` / `:generate:self` / `:review` / `:publish` | `advisor` + `admin` |
| 治理类（6） | `asset-allocation:backtest`、`product-governance:read` / `:review` / `:sync`、`profile-governance:read` / `:review` | **只给 `admin`** |
| 投顾工作流（10） | `asset-allocation:generate:self`、`investment-goal:read:self` / `:review` / `:publish`、`portfolio-analysis:read:self`、`product-comparison:read:self`、`product-recommendation:read:self` / `:generate:self` / `:review` / `:publish` | `advisor` + `admin` —— **定义在种子的 9020-9034** |
| 治理类（3，本脚本建） | `product-governance:read` / `:review` / `:sync` | **只给 `admin`** |
| 治理类（种子已含） | `asset-allocation:backtest`、`profile-governance:read` / `:review` | **只给 `admin`** |
`review` / `publish` 也给投顾，与项目既有决策一致 —— 此前已裁定**不做双人复核**
（`admin` 发布配置时也是"创建人自审"）。治理类不给投顾：那是平台侧的活。
## ⚠️ 与 `seed_test_rbac.py` 的冲突
那个脚本是 **DELETE 重建**语义，它的
`DELETE FROM sys_permission WHERE id BETWEEN 9001 AND 9099` 会**清掉本脚本建的权限**
（本脚本用 9020-9035）。将来若要在种子里固化投顾权限，请把它并进
`seed_test_rbac.py` 的 `PERMISSIONS` 常量，而不是只跑本脚本。
本脚本自身**只增不删**：重复执行只补齐缺失项，不动任何已有绑定。
用法：
@@ -53,25 +59,16 @@ ADVISOR_ROLE_ID = 9004
ADVISOR_ROLE_CODE = "advisor"
ADVISOR_ROLE_NAME = "投资顾问"
#: 权限 id 从 9020 起，避开种子已用的 9001-9019。
#: 权限 id 从 9041 起。两个硬约束：
#: 1. 种子 `seed_test_rbac.py` 已占 9001-9034（含投顾线的 9020-9034）；
#: 2. 库里曾有一批 9020-9035 是本脚本用**旧号段**建的，与种子的 9020-9034
#: **id→code 映射不同** —— 整体挪到 9041 之后，与两侧都不冲突。
#: 只定义种子里**缺**的这 3 个治理类权限码；其余 13 个由种子提供。
#: (id, permission_code, resource, action, data_scope)
ADVISOR_PERMISSIONS: tuple[tuple[int, str, str, str, str], ...] = (
(9020, "asset-allocation:generate:self", "asset-allocation", "generate", "self"),
(9021, "asset-allocation:backtest", "asset-allocation", "backtest", "all"),
(9022, "investment-goal:read:self", "investment-goal", "read", "self"),
(9023, "investment-goal:review", "investment-goal", "review", "all"),
(9024, "investment-goal:publish", "investment-goal", "publish", "all"),
(9025, "portfolio-analysis:read:self", "portfolio-analysis", "read", "self"),
(9026, "product-comparison:read:self", "product-comparison", "read", "self"),
(9027, "product-recommendation:read:self", "product-recommendation", "read", "self"),
(9028, "product-recommendation:generate:self", "product-recommendation", "generate", "self"),
(9029, "product-recommendation:review", "product-recommendation", "review", "all"),
(9030, "product-recommendation:publish", "product-recommendation", "publish", "all"),
(9031, "product-governance:read", "product-governance", "read", "all"),
(9032, "product-governance:review", "product-governance", "review", "all"),
(9033, "product-governance:sync", "product-governance", "sync", "all"),
(9034, "profile-governance:read", "profile-governance", "read", "all"),
(9035, "profile-governance:review", "profile-governance", "review", "all"),
(9041, "product-governance:read", "product-governance", "read", "all"),
(9042, "product-governance:review", "product-governance", "review", "all"),
(9043, "product-governance:sync", "product-governance", "sync", "all"),
)
#: 投顾拿哪些 —— 工作流那 10 个；治理类 6 个只给 admin。