chore: 合入 stash Ops hardening 与 migration 000041

Ask/catalog 权限与审计加固、量表读权限统一，以及未提交的 ops hardening 变更。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/integration/ask_ops_test.go

@@ -99,7 +99,47 @@ func TestAskOperations(t *testing.T) {
 
 	env, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ask/threads/"+threadID, nil, tok)
 	if code != 200 {
-		t.Fatalf("detail http=%d msg=%s", code, env.Message)
+		t.Fatalf("meta http=%d msg=%s", code, env.Message)
+	}
+	var meta map[string]any
+	_ = json.Unmarshal(env.Data, &meta)
+	if _, has := meta["messages"]; has {
+		t.Fatalf("meta must not include messages: %#v", meta)
+	}
+	if meta["id"] != threadID {
+		t.Fatalf("meta id mismatch: %#v", meta)
+	}
+
+	metaOnlyRole := uuid.New()
+	_, err = pool.Exec(ctx, `INSERT INTO admin_roles(id, name, system) VALUES ($1,$2,false)`,
+		metaOnlyRole, "ask_meta_"+metaOnlyRole.String()[:8])
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = pool.Exec(ctx, `INSERT INTO admin_role_permissions(role_id, code) VALUES ($1,'admin.ask.read')`, metaOnlyRole)
+	if err != nil {
+		t.Fatal(err)
+	}
+	metaUser := fmt.Sprintf("askmeta_%d", time.Now().UnixNano())
+	hash2, _ := bcrypt.GenerateFromPassword([]byte("meta-pass"), bcrypt.DefaultCost)
+	_, err = pool.Exec(ctx, `INSERT INTO admin_accounts(username, password_hash, role_id) VALUES ($1,$2,$3)`,
+		metaUser, string(hash2), metaOnlyRole)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM admin_accounts WHERE username=$1`, metaUser)
+		_, _ = pool.Exec(ctx, `DELETE FROM admin_roles WHERE id=$1`, metaOnlyRole)
+	})
+	metaTok := adminLogin(t, r, metaUser, "meta-pass")
+	_, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ask/threads/"+threadID+"/messages", nil, metaTok)
+	if code != http.StatusForbidden {
+		t.Fatalf("expected 403 without transcript.read, got %d", code)
+	}
+
+	env, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ask/threads/"+threadID+"/messages", nil, tok)
+	if code != 200 {
+		t.Fatalf("transcript http=%d msg=%s", code, env.Message)
 	}
 	var detail struct {
 		Messages []struct {
@@ -111,5 +151,26 @@ func TestAskOperations(t *testing.T) {
 	if len(detail.Messages) < 2 {
 		t.Fatalf("expected user+assistant, got %#v", detail.Messages)
 	}
+
+	env, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/audit-logs", nil, tok)
+	if code != 200 {
+		t.Fatalf("audit %d", code)
+	}
+	var audit struct {
+		Items []struct {
+			Action string `json:"action"`
+		} `json:"items"`
+	}
+	_ = json.Unmarshal(env.Data, &audit)
+	audited := false
+	for _, it := range audit.Items {
+		if it.Action == "ask.transcript.read" {
+			audited = true
+			break
+		}
+	}
+	if !audited {
+		t.Fatalf("missing ask.transcript.read audit: %#v", audit.Items)
+	}
 	_ = key
 }

apps/api/internal/integration/quality_feedback_test.go

@@ -132,5 +132,34 @@ func TestQualityFeedback(t *testing.T) {
 	if !okAudit {
 		t.Fatal("missing ask.feedback.create audit")
 	}
+
+	// cross-thread message_id must be rejected
+	env, key = doJSON(t, r, http.MethodPost, "/api/v1/ask/threads", map[string]any{
+		"profile_id": profileID, "scene": "self",
+	}, key)
+	otherThread := decodeData[map[string]any](t, env.Data)["id"].(string)
+	env, key = doJSON(t, r, http.MethodPost, "/api/v1/ask/threads/"+otherThread+"/messages", map[string]any{
+		"content": "另一线程",
+	}, key)
+	// fetch a message id from other thread via admin transcript
+	env, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ask/threads/"+otherThread+"/messages", nil, tok)
+	if code != 200 {
+		t.Fatalf("other transcript http=%d", code)
+	}
+	var otherDetail struct {
+		Messages []struct {
+			ID string `json:"id"`
+		} `json:"messages"`
+	}
+	_ = json.Unmarshal(env.Data, &otherDetail)
+	if len(otherDetail.Messages) == 0 {
+		t.Fatal("expected messages on other thread")
+	}
+	foreignMsg := otherDetail.Messages[0].ID
+	_, code = doAdminJSON(t, r, http.MethodPost, "/api/v1/admin/ask/threads/"+threadID+"/feedback",
+		map[string]any{"rating": 2, "tag": "other", "message_id": foreignMsg}, tok)
+	if code != http.StatusBadRequest {
+		t.Fatalf("expected 400 for foreign message_id, got %d", code)
+	}
 	_ = key
 }