c179af64a6
coord.md 新增 ARB-019/020/021 三章仲裁章节，修正 ARB-001。 - coord.md: 新增 ARB-019/020/021（student/parent/admin-portal 24 项） - coord.md: 修正 ARB-001（admin P2 预留/schema 文件名/classes 数据源） - 004 §4: 依赖图加 PBFF→DataAna+Msg - 004 §7.2: push-gateway→Redis 软失败标注 - 004 §11.4: 错误码前缀矩阵（11 服务+i18n key） - 004 §11.5: ActionState 信封规范（降级模式方案 B） - matrix §1: 依赖矩阵加 PBFF 边 - matrix §2: 移除 api-gateway 为 iam gRPC 消费方 - matrix §4: admin-portal→teacher-bff - matrix §5: 移除 /sse+鉴权头统一 - matrix §6: 错误码表补 i18n key 列 - 15 个 issue.md: 仲裁结论回写 - push-gateway_contract: 移除 /sse+鉴权头改 X-Internal-Token - packages/contracts: 新建包 ADMIN_* 权限点常量 AI: coord
109 lines
3.5 KiB
TypeScript
109 lines
3.5 KiB
TypeScript
/**
|
||
* 全局权限点常量（coord 维护）
|
||
*
|
||
* 命名规范（F7 裁决）：<RESOURCE>_<ACTION>[_<SCOPE>]
|
||
* - RESOURCE：大写资源名（USER/ROLE/CLASS/EXAM...）
|
||
* - ACTION：动作（CREATE/READ/UPDATE/DELETE/MANAGE...）
|
||
* - SCOPE（可选）：作用域（OWN/CLASS/GRADE/SCHOOL...）
|
||
*
|
||
* 维护方：
|
||
* - ADMIN_* → coord 维护（本文件）
|
||
* - IAM_* → iam 服务维护
|
||
* - ORG_* → iam 服务维护
|
||
* - CORE_EDU_* → core-edu 服务维护
|
||
* - CONTENT_* → content 服务维护
|
||
* - MSG_* → msg 服务维护
|
||
*
|
||
* 引用：
|
||
* - admin-portal_contract.md §1.2：admin-portal 路由权限点
|
||
* - ARB-021 §23.4：admin 命名空间 schema
|
||
* - coord-final-decisions F7：权限点命名规范
|
||
*/
|
||
|
||
// ============ ADMIN_* 权限点（admin-portal 专用） ============
|
||
// 来源：admin-portal_contract.md §1.2 + ARB-021 §23.4
|
||
// 维护方：coord
|
||
|
||
export const ADMIN_PERMISSIONS = {
|
||
/** 管理员仪表盘查看 */
|
||
ADMIN_DASHBOARD_VIEW: "ADMIN_DASHBOARD_VIEW",
|
||
/** 学校设置管理（L5 校级） */
|
||
ADMIN_SYSTEM_MANAGE: "ADMIN_SYSTEM_MANAGE",
|
||
/** 班级管理-全局查看（跨班级） */
|
||
ADMIN_CLASS_READ: "ADMIN_CLASS_READ",
|
||
/** 班级管理-全局编辑（跨班级） */
|
||
ADMIN_CLASS_MANAGE: "ADMIN_CLASS_MANAGE",
|
||
/** 教师管理-查看 */
|
||
ADMIN_TEACHER_READ: "ADMIN_TEACHER_READ",
|
||
/** 教师管理-编辑 */
|
||
ADMIN_TEACHER_MANAGE: "ADMIN_TEACHER_MANAGE",
|
||
/** 学生管理-查看 */
|
||
ADMIN_STUDENT_READ: "ADMIN_STUDENT_READ",
|
||
/** 学生管理-编辑 */
|
||
ADMIN_STUDENT_MANAGE: "ADMIN_STUDENT_MANAGE",
|
||
/** 审计日志查看（L5 校级） */
|
||
ADMIN_AUDIT_READ: "ADMIN_AUDIT_READ",
|
||
/** 审计日志导出 */
|
||
ADMIN_AUDIT_EXPORT: "ADMIN_AUDIT_EXPORT",
|
||
} as const;
|
||
|
||
export type AdminPermission = keyof typeof ADMIN_PERMISSIONS;
|
||
|
||
export const ADMIN_PERMISSION_VALUES: readonly string[] =
|
||
Object.values(ADMIN_PERMISSIONS);
|
||
|
||
/** admin 角色全权限通配符 */
|
||
export const ADMIN_WILDCARD = "*";
|
||
|
||
/** admin-portal 所有路由权限点映射 */
|
||
export const ADMIN_ROUTE_PERMISSIONS: Record<string, string> = {
|
||
"/admin/dashboard": ADMIN_PERMISSIONS.ADMIN_DASHBOARD_VIEW,
|
||
"/admin/users": "IAM_USER_READ", // 复用 iam 权限点
|
||
"/admin/roles": "IAM_ROLE_READ", // 复用 iam 权限点
|
||
"/admin/permissions": "IAM_PERMISSION_READ", // 复用 iam 权限点
|
||
"/admin/viewports": "IAM_VIEWPORT_READ", // 复用 iam 权限点
|
||
"/admin/organization": "ORG_MANAGE", // 复用 iam 权限点
|
||
"/admin/system": ADMIN_PERMISSIONS.ADMIN_SYSTEM_MANAGE,
|
||
"/admin/classes": ADMIN_PERMISSIONS.ADMIN_CLASS_READ,
|
||
"/admin/teachers": ADMIN_PERMISSIONS.ADMIN_TEACHER_READ,
|
||
"/admin/students": ADMIN_PERMISSIONS.ADMIN_STUDENT_READ,
|
||
"/admin/audit-logs": ADMIN_PERMISSIONS.ADMIN_AUDIT_READ,
|
||
} as const;
|
||
|
||
// ============ 权限点分组（admin-portal §2.4 GraphQL adminPermissions Query 用） ============
|
||
|
||
export interface PermissionGroup {
|
||
resource: string;
|
||
label: string;
|
||
permissions: string[];
|
||
}
|
||
|
||
/** 全量权限点分组（admin-portal GraphQL adminPermissions Query 返回） */
|
||
export const PERMISSION_GROUPS: PermissionGroup[] = [
|
||
{
|
||
resource: "ADMIN",
|
||
label: "管理员",
|
||
permissions: [...ADMIN_PERMISSION_VALUES],
|
||
},
|
||
{
|
||
resource: "IAM",
|
||
label: "身份与访问",
|
||
permissions: [
|
||
"IAM_USER_READ",
|
||
"IAM_USER_CREATE",
|
||
"IAM_USER_UPDATE",
|
||
"IAM_USER_DELETE",
|
||
"IAM_ROLE_READ",
|
||
"IAM_ROLE_MANAGE",
|
||
"IAM_PERMISSION_READ",
|
||
"IAM_VIEWPORT_READ",
|
||
"IAM_VIEWPORT_MANAGE",
|
||
],
|
||
},
|
||
{
|
||
resource: "ORG",
|
||
label: "组织",
|
||
permissions: ["ORG_MANAGE"],
|
||
},
|
||
];
|