jackyu66gitandCursor
b5a05941d9
角色权限、RequirePermission、/me permissions 与 migration 000015； Reviewer Approve → Closed。Next：ECR-013B Contract Definition。 Co-authored-by: Cursor <cursoragent@cursor.com>
60 lines
1.5 KiB
YAML
60 lines
1.5 KiB
YAML
ecr: ECR-013A
|
|
capability: AdminGovernance
|
|
bounded_context: Admin_RBAC
|
|
parent: WAVE0-FROZEN
|
|
change:
|
|
type: additive
|
|
breaking_change: false
|
|
migration_required: true
|
|
compatibility_notes: >
|
|
Additive RBAC tables and AdminAccount.role_id.
|
|
Existing admin accounts migrate to seeded super_admin.
|
|
GET /admin/me gains permissions[]; old clients ignore unknown fields.
|
|
|
|
entities:
|
|
- name: AdminRole
|
|
before: null
|
|
after:
|
|
fields: [id, name, system, created_at]
|
|
- name: AdminPermission
|
|
before: null
|
|
after:
|
|
fields: [code]
|
|
catalog:
|
|
- admin.users.read
|
|
- admin.users.membership.grant
|
|
- admin.users.ask_quota.grant
|
|
- admin.orders.read
|
|
- admin.audit.read
|
|
- admin.analytics.read
|
|
- admin.content.write
|
|
- admin.roles.read
|
|
- admin.roles.write
|
|
- name: AdminAccount
|
|
before:
|
|
fields: [id, username, password_hash, status]
|
|
after:
|
|
fields: [id, username, password_hash, status, role_id]
|
|
|
|
apis:
|
|
- method: GET
|
|
path: /api/v1/admin/roles
|
|
change: added
|
|
- method: GET
|
|
path: /api/v1/admin/roles/{id}
|
|
change: added
|
|
- method: PUT
|
|
path: /api/v1/admin/roles/{id}/permissions
|
|
change: added
|
|
- method: GET
|
|
path: /api/v1/admin/me
|
|
change: modified
|
|
response_delta: "add role + permissions[]"
|
|
|
|
security_impact:
|
|
- "RequirePermission on mutating admin routes"
|
|
- "403 + AuditLog on deny"
|
|
|
|
observability_impact:
|
|
- "AuditLog on roles.permissions.update and permission denials"
|