8fdb25e6bd
后端： - 种子数据：超级管理员(admin/admin123)、super_admin 角色、22 条菜单(含按钮权限码)、角色绑定 - admin_menu 扩展 icon/component/hidden 字段(003_schema_ext.sql)，手动补齐 entity/do/table - auth 扩展：/auth/info、/auth/codes（仅登录），路由拆分公开/Profile/受保护三组 - 菜单路由：/menu/routes 返回 vben backend 动态路由树（按角色过滤、排序） - RBAC 管理：/admins、/roles、/menus CRUD（含角色绑定、重置密码、菜单授权） - 日志监控：/log/files、/log/tail（尾部读取+关键词过滤+路径穿越防护） - 安全加固：接口鉴权改为「方法+路径→权限码」自动映射，杜绝任意权限码越权 - 修复：gf v2.10.2 不自动替换→cmd 注入；MySQL driver 需显式引入 contrib - 全链路冒烟测试通过（含越权拒绝 30003）
22 lines
1.8 KiB
Go
22 lines
1.8 KiB
Go
-- 005_menu_paths.sql
|
|
-- Bind protected API endpoints to their required permission codes.
|
|
-- The AdminAuth middleware resolves the permission by matching
|
|
-- "<METHOD> <path>" against admin_menu.type=2 rows, then verifies the admin
|
|
-- owns it. Dynamic path params use {id} placeholders.
|
|
UPDATE admin_menu SET path='GET /admin/v1/admins' WHERE id=21; -- system:admin:list
|
|
UPDATE admin_menu SET path='POST /admin/v1/admins' WHERE id=22; -- system:admin:create
|
|
UPDATE admin_menu SET path='PUT /admin/v1/admins/{id}' WHERE id=23; -- system:admin:update
|
|
UPDATE admin_menu SET path='DELETE /admin/v1/admins/{id}' WHERE id=24; -- system:admin:delete
|
|
UPDATE admin_menu SET path='PUT /admin/v1/admins/{id}/password' WHERE id=25; -- system:admin:resetPwd
|
|
UPDATE admin_menu SET path='GET /admin/v1/roles' WHERE id=31; -- system:role:list
|
|
UPDATE admin_menu SET path='POST /admin/v1/roles' WHERE id=32; -- system:role:create
|
|
UPDATE admin_menu SET path='PUT /admin/v1/roles/{id}' WHERE id=33; -- system:role:update
|
|
UPDATE admin_menu SET path='DELETE /admin/v1/roles/{id}' WHERE id=34; -- system:role:delete
|
|
UPDATE admin_menu SET path='PUT /admin/v1/roles/{id}/menus' WHERE id=35; -- system:role:assignMenu
|
|
UPDATE admin_menu SET path='GET /admin/v1/menus/tree' WHERE id=41; -- system:menu:list
|
|
UPDATE admin_menu SET path='POST /admin/v1/menus' WHERE id=42; -- system:menu:create
|
|
UPDATE admin_menu SET path='PUT /admin/v1/menus/{id}' WHERE id=43; -- system:menu:update
|
|
UPDATE admin_menu SET path='DELETE /admin/v1/menus/{id}' WHERE id=44; -- system:menu:delete
|
|
UPDATE admin_menu SET path='GET /admin/v1/log/files' WHERE id=61; -- monitor:log:view
|
|
UPDATE admin_menu SET path='GET /admin/v1/log/tail' WHERE id=62; -- monitor:log:tail
|