Repository navigation
sec/sec24-07-mantou：鉴权精确匹配与内置超管 - #332
Conversation
- 鉴权中间件、部门管理、资料修改不再比较用户名 admin，统一以启用中的 内置超管角色（code=super_admin 且 is_system=1）判定，并写入请求上下文 - 新增幂等启动引导：确保内置超管角色存在并把 admin 绑定到该角色 - 授予/撤销内置超管角色仅限超管操作，防止持有角色分配权限的用户自我提权 - 无模型/表结构变更，种子数据与回滚见 docs/release/rbac-super-admin.md
- CheckAuth 以 c.FullPath() 模板 + 方法与角色授予比较，:param 不再作为通配；
/* 与末尾 * 只对模板做前缀匹配，开头/中间/多个 * 的授予不再生效
- 未命中路由（FullPath 为空）对非超管返回 403，超管交给 gin 返回 404
- AIOps 代理 /api/v1/*path 由 registerAIOps 登记内置接口目录，按最具体模板
（静态段优先）还原后再比较；目录外请求只认覆盖代理模板本身的授予
- 新增 GET /api/user/permissions：返回 {version:2, super_admin, permissions}，
权限码为 "METHOD /模板"，与中间件同源展开；超管返回 ["*"]；/api/user/codes 不变
- 回归测试使用真实 handler 路由注册，覆盖三处外溢：
events/:namespace/:name vs events/nodes/:node_name、
cloud/account/:id/status vs account/batch/status、cloud/:id/status vs cloud/batch/status
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e7cc52538d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if len(roleIds) == 0 { | ||
| roles, err := h.svc.GetUserRoles(ctx.Request.Context(), userID) |
There was a problem hiding this comment.
When a non-super-admin with access to /api/role/revoke_users submits role_ids: [] for a user holding a disabled built-in super-admin role, this check allows the request. GetUserRoles delegates to roleDAO.GetRoles, which filters on cl_system_roles.status = 1, so the protected role is absent from this result, while RevokeRolesFromUser deletes all of the target user's role bindings for an empty list. This bypasses the protection applied to explicit role IDs and prevents the affected user's super-admin access from returning when the role is re-enabled. Query the target's bindings without filtering disabled roles for this guard.
Useful? React with 👍 / 👎.
合入分支
sec/sec24-07-mantou，tipe7cc52538d874bf948c63ff91ad6da7b8786e1ec。SEC-24 鉴权改为方法加 gin 路由模板精确比较，并新增权限码 v2 接口。SEC-07 以内置超管角色取代 admin 用户名特判。