feat(ECR-013A): Admin RBAC 实现并 Closed

角色权限、RequirePermission、/me permissions 与 migration 000015； Reviewer Approve → Closed。Next：ECR-013B Contract Definition。 Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-07 17:19:45 +08:00
parent 85ed0901bb
commit b5a05941d9
35 changed files with 1518 additions and 49 deletions
@@ -0,0 +1,59 @@
+ecr: ECR-013A
+capability: AdminGovernance
+bounded_context: Admin_RBAC
+parent: WAVE0-FROZEN
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Additive RBAC tables and AdminAccount.role_id.
+  Existing admin accounts migrate to seeded super_admin.
+  GET /admin/me gains permissions[]; old clients ignore unknown fields.
+
+entities:
+  - name: AdminRole
+    before: null
+    after:
+      fields: [id, name, system, created_at]
+  - name: AdminPermission
+    before: null
+    after:
+      fields: [code]
+      catalog:
+        - admin.users.read
+        - admin.users.membership.grant
+        - admin.users.ask_quota.grant
+        - admin.orders.read
+        - admin.audit.read
+        - admin.analytics.read
+        - admin.content.write
+        - admin.roles.read
+        - admin.roles.write
+  - name: AdminAccount
+    before:
+      fields: [id, username, password_hash, status]
+    after:
+      fields: [id, username, password_hash, status, role_id]
+
+apis:
+  - method: GET
+    path: /api/v1/admin/roles
+    change: added
+  - method: GET
+    path: /api/v1/admin/roles/{id}
+    change: added
+  - method: PUT
+    path: /api/v1/admin/roles/{id}/permissions
+    change: added
+  - method: GET
+    path: /api/v1/admin/me
+    change: modified
+    response_delta: "add role + permissions[]"
+
+security_impact:
+  - "RequirePermission on mutating admin routes"
+  - "403 + AuditLog on deny"
+
+observability_impact:
+  - "AuditLog on roles.permissions.update and permission denials"
@@ -0,0 +1,10 @@
+# CONTRACT_DIFF
+
+Per-implement-ECR instances live here.
+
+| File | ECR | Phase |
+|------|-----|-------|
+| [ECR-013A.yaml](ECR-013A.yaml) | ECR-013A | Contract Definition（Draft） |
+
+Template: `docs/WAVE0/contracts/contract_diff.template.yaml`  
+P0：无 contract_diff 不得 Approve coding。