2026-09-05 17:39:16 +08:00
|
|
|
|
# RBAC 联调种子对照
|
|
|
|
|
|
|
|
|
|
|
|
> 开发期 JWT 可手工签发；`sub` / `roles` 与下表对齐。
|
|
|
|
|
|
> 客户 Token：`sub` = `customer_id`。员工 Token：`sub` = `staff_id`。
|
|
|
|
|
|
|
|
|
|
|
|
## 内部员工（core_staff）
|
|
|
|
|
|
|
|
|
|
|
|
| staff_id | 角色 roles | 用途 |
|
|
|
|
|
|
| --- | --- | --- |
|
|
|
|
|
|
| STAFF-10086 | advisor | 主代理人，名下 10 客户 |
|
|
|
|
|
|
| STAFF-10087 | advisor | 跨权限测：1010 仅其名下 |
|
|
|
|
|
|
| STAFF-10088 | advisor | 5 客户 |
|
|
|
|
|
|
| STAFF-10089 | advisor | 4 客户 |
|
|
|
|
|
|
| STAFF-10090 | advisor | 3 客户 |
|
|
|
|
|
|
| STAFF-10091 | advisor, compliance | 双角色权限并集 |
|
|
|
|
|
|
| STAFF-20001 | analyst | 分析 Agent |
|
|
|
|
|
|
| STAFF-20002 | analyst | 分析 Agent |
|
2026-09-09 21:32:59 +08:00
|
|
|
|
| STAFF-30001 | risk_officer, **risk_demo** | 风控 Agent · 模拟交易演示 |
|
|
|
|
|
|
| STAFF-30002 | risk_officer, **risk_demo** | 风控 Agent |
|
2026-09-05 17:39:16 +08:00
|
|
|
|
| STAFF-40001 | compliance | 合规审计台 |
|
|
|
|
|
|
| STAFF-40002 | compliance | 合规审计台 |
|
|
|
|
|
|
| STAFF-50001 | ops | 运营统计 A-08 |
|
|
|
|
|
|
|
|
|
|
|
|
## 推荐验收用例
|
|
|
|
|
|
|
|
|
|
|
|
| 操作者 | 目标 customer_id | 预期 |
|
|
|
|
|
|
| --- | --- | --- |
|
|
|
|
|
|
| STAFF-10086 | CUST-9527 | 允许 |
|
|
|
|
|
|
| STAFF-10086 | CUST-1010 | **403**（归属 10087） |
|
|
|
|
|
|
| CUST-9527 | CUST-1001 数据 | **403**（非本人） |
|
|
|
|
|
|
| STAFF-20001 | 聚合 SQL | 允许（脱敏/聚合） |
|
|
|
|
|
|
| STAFF-30001 | 任意客户读 | 允许 |
|
|
|
|
|
|
| STAFF-40001 | 审计 API | 允许；写 L2 **403** |
|
|
|
|
|
|
|
|
|
|
|
|
## 客户（登录 C 端）
|
|
|
|
|
|
|
|
|
|
|
|
| customer_id | 正式等级 | 代理人 | 特殊场景 |
|
|
|
|
|
|
| --- | --- | --- | --- |
|
|
|
|
|
|
| CUST-9527 | C3 | 10086 | 主 demo |
|
|
|
|
|
|
| CUST-1001 | C1 | 10086 | R-02 买 PROD-XYZ999 |
|
|
|
|
|
|
| CUST-1002 | C2 | 10086 | C-04 盈亏 -12% |
|
|
|
|
|
|
| CUST-1010 | C3 | **10087** | 10086 越权测 |
|
|
|
|
|
|
| CUST-3001 | C3 | 10086 | R-01 大额交易 |
|
|
|
|
|
|
| CUST-4001 | C5 | 10087 | 高龄 70 + R5 持仓 |
|
|
|
|
|
|
| CUST-4002 | C1 | 10086 | 持有 R4 产品冲突 |
|
|
|
|
|
|
|
|
|
|
|
|
## 产品适当性
|
|
|
|
|
|
|
|
|
|
|
|
| product_id | min_risk | 说明 |
|
|
|
|
|
|
| --- | --- | --- |
|
|
|
|
|
|
| PROD-110022 | R1 | C1 可买 |
|
|
|
|
|
|
| PROD-XYZ999 | R5 | C1/C2 应拒 |
|
|
|
|
|
|
|
|
|
|
|
|
查询员工角色：
|
|
|
|
|
|
|
|
|
|
|
|
```python
|
|
|
|
|
|
from app.repository.core_ro import CoreReadOnlyRepository
|
|
|
|
|
|
CoreReadOnlyRepository().get_staff("STAFF-10086")
|
|
|
|
|
|
```
|
