From a128e10a9c2936fd07c7e5dc3b96674e6612a1c9 Mon Sep 17 00:00:00 2001
From: hashbk <littlefishyu2008@gmail.com>
Date: Sun, 11 Oct 2026 15:10:23 +0800
Subject: [PATCH] fix(rbac): replace dashboard super-admin-only access with
 dashboard.view permission

The dashboard was restricted to super administrators because the old
dashboard displayed sensitive connection logs. After the dashboard
refactor the content was streamlined to overview statistics only, but
the permission was never updated. Add a dedicated 'dashboard.view'
permission code to the RBAC catalog and replace @RequireSuperAdmin()
with @RequirePermission('dashboard.view') so that roles with this
permission can access the dashboard.

Closes #415
---
 src/modules/dashboard/dashboard.controller.ts       | 4 ++--
 src/modules/rbac/constants/permission-catalog.ts    | 4 +++-
 src/modules/rbac/rbac-authorization.service.spec.ts | 7 +++++--
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/src/modules/dashboard/dashboard.controller.ts b/src/modules/dashboard/dashboard.controller.ts
index 430241ec..b1543ed1 100644
--- a/src/modules/dashboard/dashboard.controller.ts
+++ b/src/modules/dashboard/dashboard.controller.ts
@@ -1,7 +1,7 @@
 import { Controller, Get, Query, UseGuards } from '@nestjs/common';
 import { DashboardService } from './dashboard.service';
 import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
-import { RequireSuperAdmin } from '../rbac/decorators/require-permission.decorator';
+import { RequirePermission } from '../rbac/decorators/require-permission.decorator';
 import {
   DashboardDataDto,
   DashboardTrendsDto,
@@ -9,7 +9,7 @@ import {
 
 @Controller('dashboard')
 @UseGuards(JwtAuthGuard)
-@RequireSuperAdmin()
+@RequirePermission('dashboard.view')
 export class DashboardController {
   constructor(private readonly dashboardService: DashboardService) {}
 
diff --git a/src/modules/rbac/constants/permission-catalog.ts b/src/modules/rbac/constants/permission-catalog.ts
index bdcbc094..903495fb 100644
--- a/src/modules/rbac/constants/permission-catalog.ts
+++ b/src/modules/rbac/constants/permission-catalog.ts
@@ -35,7 +35,8 @@ export type PermissionCode =
   | 'servers.control'
   | 'servers.config'
   | 'servers.disconnect'
-  | 'servers.ban';
+  | 'servers.ban'
+  | 'dashboard.view';
 
 export type SystemPermissionCode =
   'roles.create' | 'roles.edit' | 'roles.delete';
@@ -281,6 +282,7 @@ export const PERMISSION_CATALOG: readonly PermissionDefinition[] = [
     'roles.view',
     'users.view',
   ]),
+  definition('dashboard.view', 'dashboard', 'view', 'View dashboard'),
 ];
 
 export const PERMISSION_CODES: readonly PermissionCode[] =
diff --git a/src/modules/rbac/rbac-authorization.service.spec.ts b/src/modules/rbac/rbac-authorization.service.spec.ts
index aae3936c..17bd3d07 100644
--- a/src/modules/rbac/rbac-authorization.service.spec.ts
+++ b/src/modules/rbac/rbac-authorization.service.spec.ts
@@ -1156,10 +1156,13 @@ describe('RbacAuditService', () => {
     );
   });
 
-  it('keeps global dashboard aggregates super-administrator-only', () => {
+  it('requires dashboard.view permission instead of super-administrator', () => {
     expect(
       Reflect.getMetadata(REQUIRE_SUPER_ADMIN_KEY, DashboardController),
-    ).toBe(true);
+    ).toBeUndefined();
+    expect(
+      Reflect.getMetadata(REQUIRE_PERMISSION_KEY, DashboardController),
+    ).toEqual(['dashboard.view']);
   });
 
   it('separates delegated role viewing/assignment from owner-only definitions', () => {