zhaowei.huang
a5dd632898
- 新增 PageCatalog / RbacModels / RbacStore / RbacController：用户、角色、页面/操作/控件授权落盘 data/rbac.json，支持运行时增删改并即时生效 - 密码改用 PBKDF2-SHA256(100k 迭代 + 16B 随机盐) 存储，校验走 FixedTimeEquals 防时序攻击；对外 DTO 绝不外泄盐/哈希 - AuthController 登录 / me / switch-scope 统一收敛到 BuildSession，按角色在当前 scope 的并集计算有效权限并签发 JWT - EffectivePermissions 增加 AllowedPages；移除旧的硬编码 UserStore - Program.cs 注册 RbacStore、新增 RbacAdmin 授权策略（ops claim 含 * 或 auth.manage），并按 SimpleLite:FollowParent 决定是否注册停机清理钩子
46 lines
1.5 KiB
C#
46 lines
1.5 KiB
C#
namespace MiGu.Server.Configs;
|
|
|
|
public record WidgetGrantDto(string WidgetId, string Visibility);
|
|
|
|
public record AuthRole(
|
|
string Id, string Name, string Scope,
|
|
List<string> Permissions,
|
|
List<WidgetGrantDto> WidgetGrants);
|
|
|
|
public record AuthUser(string Id, string Username, List<string> Roles, bool Enabled);
|
|
|
|
public record AuthRoleConfig(List<AuthRole> Roles, List<AuthUser> Users)
|
|
{
|
|
public static AuthRoleConfig Default() => new(
|
|
Roles: new List<AuthRole>
|
|
{
|
|
new("role-admin", "管理员", "Platform",
|
|
new List<string> { "*" },
|
|
new List<WidgetGrantDto>()),
|
|
new("role-ops", "运营", "RCSMonitor",
|
|
new List<string>
|
|
{
|
|
"ops.car.pause", "ops.car.resume", "ops.car.gohome",
|
|
"ops.task.pause", "ops.task.cancel", "ops.task.reassign",
|
|
"ops.task.boostPriority", "monitor.note.write"
|
|
},
|
|
new List<WidgetGrantDto>
|
|
{
|
|
new("MapEditor", "readonly"),
|
|
new("CadToolbar", "hidden")
|
|
})
|
|
},
|
|
Users: new List<AuthUser>
|
|
{
|
|
new("u-admin", "admin", new List<string> { "role-admin" }, true),
|
|
new("u-ops", "ops", new List<string> { "role-ops" }, true)
|
|
});
|
|
}
|
|
|
|
public record EffectivePermissions(
|
|
string UserId,
|
|
int Version,
|
|
List<string> AllowedOps,
|
|
List<WidgetGrantDto> VisibleWidgets,
|
|
List<string> AllowedPages);
|