jackyu66gitandCursor
b5a05941d9
角色权限、RequirePermission、/me permissions 与 migration 000015； Reviewer Approve → Closed。Next：ECR-013B Contract Definition。 Co-authored-by: Cursor <cursoragent@cursor.com>
51 lines
1.2 KiB
Markdown
51 lines
1.2 KiB
Markdown
# PRODUCT_SPEC — ECR-013A Admin RBAC
|
||
|
||
对齐 Feature Spec：`.ai/product/feature-spec/ops-rbac.md`
|
||
Parent: **WAVE0-FROZEN** (`27f27a1`)
|
||
Phase: **Contract Definition**（No Coding）
|
||
|
||
## Meta
|
||
|
||
| 字段 | 值 |
|
||
|------|-----|
|
||
| ECR | ECR-013A |
|
||
| Status | Draft |
|
||
| Capability (L0) | `AdminGovernance` |
|
||
| Bounded Context (L1) | `Admin_RBAC` |
|
||
| Change Level | L2 |
|
||
|
||
## L0 Capability
|
||
|
||
| 字段 | 内容 |
|
||
|------|------|
|
||
| Capability ID | `AdminGovernance` |
|
||
| Purpose | 最小权限约束管理员运营动作 |
|
||
| Why now | 扁平 Admin 无法支撑多角色与越权审计 |
|
||
| Non-goals | AccountLifecycle(013B) · 真支付 · UGC · Prompt |
|
||
|
||
## L1 Bounded Context
|
||
|
||
见 `.ai/domain/boundary-rules.md` → `Admin_RBAC`。
|
||
|
||
## L2 Domain
|
||
|
||
`AdminRole` · `AdminPermission` · `AdminAccount.role_id` — glossary 已登记。
|
||
|
||
## L3 API
|
||
|
||
见 Spec §L3；`docs/CONTRACT_DIFF/ECR-013A.yaml`。
|
||
|
||
## L4 AC
|
||
|
||
Spec AC-F / AC-S / AC-P / AC-O 全表 — 实现轮 TEST_REPORT 必须引用 ID。
|
||
|
||
## Outcome（实现后）
|
||
|
||
1. 角色权限可配置且可审计
|
||
2. 缺权 403
|
||
3. `GET /me` 暴露 permissions 供 admin-h5 隐藏无权限入口（最小）
|
||
|
||
## Out of scope
|
||
|
||
ECR-013B；Payment；Community。
|