jackyu66gitandCursor
5ceb3ce749
落地管理员 RBAC/封禁/推送任务 stub，logout 解绑 device 并统一各页 ensureAccount，同时收口 P2 生日生成与状态文档。 Co-authored-by: Cursor <cursoragent@cursor.com>
46 lines
1.2 KiB
Markdown
46 lines
1.2 KiB
Markdown
# BD-2026-010 — Ops-E System
|
||
|
||
Status: Approved
|
||
**ECR:** ECR-010
|
||
**Date:** 2026-08-11
|
||
|
||
## Backend Change Boundary
|
||
|
||
### In
|
||
|
||
- `admin_accounts.role` TEXT NOT NULL DEFAULT `super` CHECK (`super`,`ops`)
|
||
- `users.status` CHECK (`active`,`banned`)（存量保持）
|
||
- 表 `push_jobs`
|
||
- AdminRepo：SetUserStatus · ListAdmins · UpdateAdminRole · PushJobs CRUD
|
||
- admin.Service：RequireSuper · Ban/Unban · role on Me
|
||
- DeviceAuth：banned → 40310 + revoke sessions
|
||
- Handler 路由挂载；OpenAPI
|
||
|
||
### Out
|
||
|
||
- 推送厂商 · Worker · 动态权限表 · Handler 直连 DB
|
||
|
||
### Ownership
|
||
|
||
| Layer | Owner |
|
||
|-------|--------|
|
||
| Repository | AdminRepo |
|
||
| Service | admin.Service |
|
||
| Handler | AdminHandler |
|
||
| Middleware | DeviceAuth / AdminAuth |
|
||
| UI | admin-h5 UserDetail / Push / Admins |
|
||
|
||
## Architecture Evidence
|
||
|
||
仍：Handler → Service → Repository；无新外部依赖。
|
||
|
||
## Failure / Rollback
|
||
|
||
- down migration 删 role 列与 push_jobs；封禁用户需人工恢复 status
|
||
- 错误码：40301 无权限 · 40310 用户已封禁
|
||
|
||
## Test Strategy
|
||
|
||
- integration：ops 403 写接口；ban/unban + DeviceAuth；push CRUD
|
||
- admin-h5 build
|