chore: 合入 stash Ops hardening 与 migration 000041

Ask/catalog 权限与审计加固、量表读权限统一，以及未提交的 ops hardening 变更。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/handler/admin_ask_ops.go

@@ -16,6 +16,7 @@ import (
 func (h *AdminHandler) registerAskOps(authed *gin.RouterGroup) {
 	authed.GET("/ask/threads", middleware.RequireAdminPermission(h.Svc, admin.PermAskRead), h.ListAskThreads)
 	authed.GET("/ask/threads/:id", middleware.RequireAdminPermission(h.Svc, admin.PermAskRead), h.GetAskThread)
+	authed.GET("/ask/threads/:id/messages", middleware.RequireAdminPermission(h.Svc, admin.PermAskTranscriptRead), h.GetAskThreadMessages)
 }
 
 func (h *AdminHandler) ListAskThreads(c *gin.Context) {
@@ -44,7 +45,7 @@ func (h *AdminHandler) GetAskThread(c *gin.Context) {
 		response.Fail(c, http.StatusBadRequest, 40002, "invalid thread id")
 		return
 	}
-	detail, err := h.Svc.GetAskSessionDetail(c.Request.Context(), id)
+	meta, err := h.Svc.GetAskSessionMeta(c.Request.Context(), id)
 	if errors.Is(err, admin.ErrAskThreadNotFound) {
 		response.Fail(c, http.StatusNotFound, 40402, "ask thread not found")
 		return
@@ -53,5 +54,28 @@ func (h *AdminHandler) GetAskThread(c *gin.Context) {
 		response.Fail(c, http.StatusInternalServerError, 50020, "get ask thread failed")
 		return
 	}
+	response.OK(c, meta)
+}
+
+func (h *AdminHandler) GetAskThreadMessages(c *gin.Context) {
+	adminID, ok := middleware.AdminIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40102, "admin session invalid")
+		return
+	}
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40002, "invalid thread id")
+		return
+	}
+	detail, err := h.Svc.GetAskSessionTranscript(c.Request.Context(), adminID, id)
+	if errors.Is(err, admin.ErrAskThreadNotFound) {
+		response.Fail(c, http.StatusNotFound, 40402, "ask thread not found")
+		return
+	}
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50021, "get ask transcript failed")
+		return
+	}
 	response.OK(c, detail)
 }

apps/api/internal/handler/admin_content.go

@@ -16,7 +16,7 @@ import (
 func (h *AdminHandler) registerContent(authed *gin.RouterGroup) {
 	authed.GET("/home/tools", middleware.RequireAdminPermission(h.Svc, admin.PermContentWrite), h.ListHomeTools)
 	authed.PUT("/home/tools", middleware.RequireAdminPermission(h.Svc, admin.PermContentWrite), h.ReplaceHomeTools)
-	authed.GET("/scales", middleware.RequireAdminPermission(h.Svc, admin.PermContentWrite), h.ListScales)
+	authed.GET("/scales", middleware.RequireAnyAdminPermission(h.Svc, admin.PermExploreRead, admin.PermContentWrite), h.ListScales)
 	authed.PATCH("/scales/:id", middleware.RequireAdminPermission(h.Svc, admin.PermContentWrite), h.PatchScale)
 }
 

apps/api/internal/handler/admin_explore_scales.go

@@ -14,8 +14,8 @@ import (
 
 func (h *AdminHandler) registerExploreScales(authed *gin.RouterGroup) {
 	g := authed.Group("/explore")
-	g.GET("/scales", middleware.RequireAdminPermission(h.Svc, admin.PermExploreRead), h.ListExploreScales)
-	g.GET("/scales/:id", middleware.RequireAdminPermission(h.Svc, admin.PermExploreRead), h.GetExploreScale)
+	g.GET("/scales", middleware.RequireAnyAdminPermission(h.Svc, admin.PermExploreRead, admin.PermContentWrite), h.ListExploreScales)
+	g.GET("/scales/:id", middleware.RequireAnyAdminPermission(h.Svc, admin.PermExploreRead, admin.PermContentWrite), h.GetExploreScale)
 }
 
 func (h *AdminHandler) ListExploreScales(c *gin.Context) {

apps/api/internal/handler/admin_funnel_definition.go

@@ -14,8 +14,8 @@ import (
 
 func (h *AdminHandler) registerFunnelDefinitions(authed *gin.RouterGroup) {
 	g := authed.Group("/analytics")
-	g.GET("/funnel-definitions", middleware.RequireAdminPermission(h.Svc, admin.PermAnalyticsRead), h.ListFunnelDefinitions)
-	g.GET("/funnel-definitions/:id", middleware.RequireAdminPermission(h.Svc, admin.PermAnalyticsRead), h.GetFunnelDefinition)
+	g.GET("/funnel-definitions", middleware.RequireAdminPermission(h.Svc, admin.PermGrowthRead), h.ListFunnelDefinitions)
+	g.GET("/funnel-definitions/:id", middleware.RequireAdminPermission(h.Svc, admin.PermGrowthRead), h.GetFunnelDefinition)
 }
 
 func (h *AdminHandler) ListFunnelDefinitions(c *gin.Context) {

apps/api/internal/handler/admin_quality_feedback.go

@@ -68,6 +68,10 @@ func (h *AdminHandler) CreateAskFeedback(c *gin.Context) {
 		response.Fail(c, http.StatusNotFound, 40402, "ask thread not found")
 		return
 	}
+	if errors.Is(err, admin.ErrMessageNotInThread) {
+		response.Fail(c, http.StatusBadRequest, 40030, "message not in thread")
+		return
+	}
 	if err != nil {
 		response.Fail(c, http.StatusInternalServerError, 50026, "create feedback failed")
 		return

apps/api/internal/handler/ask_feedback.go

@@ -60,6 +60,10 @@ func (h *AskHandler) SubmitFeedback(c *gin.Context) {
 			response.Fail(c, http.StatusNotFound, 40410, msg)
 			return
 		}
+		if strings.Contains(msg, "message not in thread") {
+			response.Fail(c, http.StatusBadRequest, 40030, msg)
+			return
+		}
 		response.Fail(c, http.StatusInternalServerError, 50000, msg)
 		return
 	}