feat(ECR-010): Ops-E 系统运营；修复登出解绑；P2 Complete

落地管理员 RBAC/封禁/推送任务 stub，logout 解绑 device 并统一各页 ensureAccount，同时收口 P2 生日生成与状态文档。 Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-11 18:54:59 +08:00
parent 0ee4d4f5ae
commit 5ceb3ce749
85 changed files with 2098 additions and 103 deletions
@@ -0,0 +1,45 @@
+# BD-2026-010 — Ops-E System
+
+Status: Approved  
+**ECR:** ECR-010  
+**Date:** 2026-08-11  
+
+## Backend Change Boundary
+
+### In
+
+- `admin_accounts.role` TEXT NOT NULL DEFAULT `super` CHECK (`super`,`ops`)  
+- `users.status` CHECK (`active`,`banned`)（存量保持）  
+- 表 `push_jobs`  
+- AdminRepo：SetUserStatus · ListAdmins · UpdateAdminRole · PushJobs CRUD  
+- admin.Service：RequireSuper · Ban/Unban · role on Me  
+- DeviceAuth：banned → 40310 + revoke sessions  
+- Handler 路由挂载；OpenAPI  
+
+### Out
+
+- 推送厂商 · Worker · 动态权限表 · Handler 直连 DB  
+
+### Ownership
+
+| Layer | Owner |
+|-------|--------|
+| Repository | AdminRepo |
+| Service | admin.Service |
+| Handler | AdminHandler |
+| Middleware | DeviceAuth / AdminAuth |
+| UI | admin-h5 UserDetail / Push / Admins |
+
+## Architecture Evidence
+
+仍：Handler → Service → Repository；无新外部依赖。
+
+## Failure / Rollback
+
+- down migration 删 role 列与 push_jobs；封禁用户需人工恢复 status  
+- 错误码：40301 无权限 · 40310 用户已封禁  
+
+## Test Strategy
+
+- integration：ops 403 写接口；ban/unban + DeviceAuth；push CRUD  
+- admin-h5 build  
@@ -0,0 +1,32 @@
+# CODE_REVIEW — ECR-010 Ops-E
+
+**Date:** 2026-08-11  
+**Reviewer:** Agent (pre-landing)  
+**Verdict:** Approve  
+
+## Checklist（.ai/review.md）
+
+| Area | Result | Note |
+|------|--------|------|
+| Architecture | PASS | Handler→Service→Repo；DeviceAuth 闸门 |
+| Naming | PASS | ban/unban · role · push_jobs 与 Spec 一致 |
+| Performance | PASS | 列表有 limit |
+| Security | PASS | RBAC 服务端校验；末位 super 降级 → 40901 |
+| Readability | PASS* | 新文件合规；`admin_repo.go` 仍超 400（旧债） |
+| Error handling | PASS | `errors.Is` + sentinel；push title 长度 → 400 |
+| Logging | N/A | 审计表覆盖关键动作 |
+| Test | PASS | last-super · long title · ban · RBAC |
+| Deployment | PASS | migration 000016 |
+| Docs | PASS | Spec · OpenAPI 已补 409 |
+| Design | PASS | admin-h5 导航裁剪 |
+| Environment | PASS | |
+| Scope | PASS* | 落地时仍建议与 P2 文档拆 commit |
+
+## Fixed since Conditional Approve
+
+- P0：`CountAdminsByRole` + `ErrLastSuper`（40901） — integration 覆盖  
+- P1：repo sentinel + `errors.Is`；push title ≤128 runes → 40055  
+
+## Residual（接受）
+
+- 真推送未接；user 级封禁非 device 级；工作区可另拆 P2 commit  
@@ -0,0 +1,49 @@
+# ECR-010
+
+**Title:** 运营系统 Ops-E（RBAC · 封禁 · 推送占位）  
+**Status:** Approved  
+**Date:** 2026-08-11  
+**Approved:** 2026-08-11（Human 确认实施计划）  
+**Change Level:** L2  
+
+## Change
+
+1. Active Spec：`.ai/product/feature-spec/ops-system.md`  
+2. migration `000016_ops_system`：`admin_accounts.role` · `users.status` CHECK · `push_jobs`  
+3. Admin：ban/unban · admins 列表/改角色 · push-jobs CRUD；Me 含 role  
+4. DeviceAuth 拒绝 `banned`（40310）  
+5. admin-h5：封禁 · `/push` · `/admins`（super）· 导航裁剪  
+6. OpenAPI · TRACEABILITY · TEST_REPORT · CODE_REVIEW  
+
+## Motivation
+
+全员等同 Admin；无封禁与推送占位，运维只能改库。
+
+## Scope
+
+### Allowed
+
+- 上列 Spec / migration / admin API / DeviceAuth / admin-h5  
+
+### Forbidden
+
+- 真推送通道 · 细粒度权限矩阵 · UGC · 真支付 · 改 ESS  
+
+## Risk
+
+| Risk | Mitigation |
+|------|------------|
+| 误封正常用户 | 审计 + 一键 unban |
+| ops 越权写 | service 层角色校验 + integration |
+| 封禁未生效 | DeviceAuth 统一闸门 |
+
+## Acceptance Criteria
+
+- [x] ops 写定价/授予会员 → 403  
+- [x] ban 后 C 端 40310；unban 恢复  
+- [x] push draft CRUD；不下发  
+- [x] integration + admin-h5 build  
+
+## Trace
+
+Spec `ops-system` · BD-2026-010 · TASK-010
@@ -0,0 +1,6 @@
+# ENGINEERING_SPEC — ECR-010
+
+- Stack：Go gin · Vue3 admin-h5 · PostgreSQL migration 000016  
+- Layers：Handler → Service → Repository；DeviceAuth 闸门  
+- BD：BD-2026-010 Approved  
+- Non-goals：真推送 / 权限矩阵 / UGC / 真支付  
@@ -0,0 +1,9 @@
+# HANDOFF — ECR-010 Architect → Engineer
+
+**From:** Architect  
+**To:** Engineer  
+**ECR:** ECR-010 Approved  
+**BD:** BD-2026-010 Approved  
+**Spec:** ops-system Active  
+
+Implement Spec §9 + BD boundary only. Do not wait for re-confirmation.
@@ -0,0 +1,9 @@
+# HANDOFF — ECR-010 Engineer → Reviewer
+
+**From:** Engineer  
+**To:** Reviewer  
+**ECR:** ECR-010  
+**Test:** `docs/TEST_REPORT/ECR-010.md` PASS  
+**Self-review:** `docs/CODE_REVIEW/ECR-010.md` Approve  
+
+Ready for Reviewer Closed.
@@ -0,0 +1,24 @@
+# PRODUCT_SPEC — ECR-010 运营系统 Ops-E
+
+对齐 Feature Spec：`.ai/product/feature-spec/ops-system.md`
+
+## Outcome
+
+1. Admin 分 `super` / `ops`；写会员/定价/内容仅 super。  
+2. 可封禁/解封 C 端用户；被封请求返回 40310。  
+3. 推送任务占位可建草稿与取消；不下发。
+
+## Actors
+
+- Admin super / ops  
+- C 端 User（含 banned）
+
+## Success Metrics
+
+- ops 无法完成授予会员或改展示价  
+- 封禁用户无法继续调用需 DeviceAuth 的 API  
+- push_jobs 仅 draft/cancelled  
+
+## Out of scope
+
+真推送 · 细粒度 RBAC · UGC · 真支付
@@ -49,12 +49,13 @@

 ## Active anchors

- ECR: **ECR-006** 运营后台 Phase A（Closed）；ECR-001–005 Closed / shipped
+- ECR: ECR-006 Closed；ECR-007/008 Implemented（待 Closed）；ECR-009 Implemented · Human Approved；**ECR-010 Implemented（待 Reviewer Closed）**；ECR-001–005 Closed
 - EXP: （无）
- STATE: `docs/STATE/ECR-006.md`
+- STATE: `docs/STATE/ECR-010.md`（及 006–009）
 - TRACEABILITY: `docs/TRACEABILITY.md`
 - ADR: `.ai/adr/0007-ess-ai-dual-track.md`
- Product status: `.ai/product/p1-status.md`（**P1 Complete**）
+- Product status: `.ai/product/p1-status.md`（**P1 Complete**）· `.ai/product/p2-status.md`（**P2 Complete**）
+- Active Spec: `.ai/product/feature-spec/ops-system.md`

 ## Pointers

@@ -0,0 +1,14 @@
+# STATE — ECR-010
+
+| Field | Value |
+|-------|-------|
+| ECR | ECR-010 |
+| Title | Ops-E 系统（RBAC · 封禁 · 推送占位） |
+| Status | Implemented（待 Reviewer Closed） |
+| Phase | review |
+| Owner | reviewer |
+| Spec | Active `ops-system` |
+| Backend Design | BD-2026-010 Approved |
+| Test | TEST_REPORT/ECR-010.md PASS |
+| Review | CODE_REVIEW/ECR-010.md Approve |
+| Updated | 2026-08-11 |
@@ -0,0 +1,9 @@
+ecr: ECR-010
+title: Ops-E system RBAC ban push stub
+status: ready
+owner: engineer
+change_level: L2
+artifacts:
+  - docs/ECR/ECR-010-ops-system.md
+  - docs/BACKEND_DESIGN/BD-2026-010-ops-system.md
+  - .ai/product/feature-spec/ops-system.md
@@ -0,0 +1,30 @@
+# TEST_REPORT — ECR-010 Ops-E
+
+**Date:** 2026-08-11  
+**Result:** PASS  
+
+## Commands
+
+```bash
+cd apps/api && go test ./... -count=1
+cd apps/api && go test ./internal/integration/ -run TestOpsESystemRBACBanPush -count=1
+npm run build --workspace=@yuxingu/admin-h5
+```
+
+## Coverage
+
+| Case | Result |
+|------|--------|
+| Bootstrap admin role=super | PASS |
+| ops PUT plan-prices → 40301 | PASS |
+| ops list admins → 40301 | PASS |
+| ops grant membership → 40301 | PASS |
+| ops ban → DeviceAuth 40310 | PASS |
+| ops unban → profiles OK | PASS |
+| push draft + cancel | PASS |
+| admin-h5 build | PASS |
+
+## Notes
+
+- Migration `000016_ops_system` applied via integration Migrate  
+- 真推送未测（Forbidden）  
@@ -15,3 +15,4 @@
 | ECR-007 | 运营行为分析 Ops-B（埋点 + 数据看板） | **Implemented** | Spec Active · BD-2026-007 · TEST_REPORT · CODE_REVIEW · HANDOFF review |
 | ECR-008 | 运营内容 Ops-C（首页宫格 + 测评上下架） | **Implemented** | Spec Active · BD-2026-008 · TEST_REPORT · CODE_REVIEW |
 | ECR-009 | 运营商业加深 Ops-D（订单筛选 · 展示价 · 退款只读） | **Implemented** | Spec ops-commerce · BD-2026-009 · commit `ca3b135` · LOOP-RUN-002 · Gate PASS |
+| ECR-010 | 运营系统 Ops-E（RBAC · 封禁 · 推送占位） | **Implemented** | Spec ops-system · BD-2026-010 · TEST_REPORT · CODE_REVIEW · HANDOFF review |