Third_Dev_Dept/Migu2.0
18
0
Fork 0
Code Issues 2 Pull Requests Packages Projects Releases Wiki Activity

重构页面目录与 RBAC：扁平配置入口并对齐管理/运营页映射。

Browse Source 
下线运营总览幽灵页，补 ExpandKeysForScope / PlatformToMonitor，同步导航与角色配置 UI。

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
黄兆尉
2026-08-26 17:50:02 +08:00
co-authored by Cursor
parent 59ccd7934a
commit c5d5f7a726
20 changed files with 653 additions and 179 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MiGu.Server/Auth/PageCatalog.cs
+124 -18
View File
@@ -31,8 +31,12 @@ public static class PageCatalog
new("admin-dashboard", "总览", "概览", ScopePlatform),
new("admin-setup", "初始配置", "概览", ScopePlatform),
new("admin-map-monitor", "地图监控", "概览", ScopePlatform),
new("admin-playback", "调度回放", "概览", ScopePlatform),
new("admin-tasks", "任务管理", "概览", ScopePlatform),
new("admin-alarms", "报警管理", "概览", ScopePlatform),
new("admin-ops-log", "运维记录", "概览", ScopePlatform),
new("admin-notes", "运维备注", "概览", ScopePlatform),
new("admin-logs", "日志管理", "概览", ScopePlatform),
// ── 管理端 / Platform：设计与编排 ──
new("admin-maps", "地图管理", "设计与编排", ScopePlatform),
@@ -50,20 +54,18 @@ public static class PageCatalog
new("admin-data-center", "数据中心", "数据中心", ScopePlatform),
// ── 管理端 / Platform：平台配置中心（聚合页，每个 Key 对齐前端聚合路由 route.name） ──
new("admin-config-strategy", "调度策略", "平台配置中心", ScopePlatform),
new("admin-vehicle-hub", "车辆运维", "平台配置中心", ScopePlatform),
new("admin-config-facility", "设备接入", "平台配置中心", ScopePlatform),
new("admin-config-warehouse", "库位管理", "平台配置中心", ScopePlatform),
new("admin-config-business", "业务与集成", "平台配置中心", ScopePlatform),
new("admin-config-ops-center", "运维与回放", "平台配置中心", ScopePlatform),
new("admin-config-system-center", "系统与权限", "平台配置中心", ScopePlatform),
new("admin-config-ops-center", "监控配置", "平台配置中心", ScopePlatform),
new("admin-config-system", "系统配置", "平台配置中心", ScopePlatform),
new("admin-config-auth", "权限与角色", "平台配置中心", ScopePlatform),
// ── 运营端 / RCSMonitor ──
new("monitor-dashboard", "运营总览", "运营监控", ScopeMonitor),
new("monitor-vehicle-hub", "车辆运维", "运营监控", ScopeMonitor),
new("monitor-map", "地图监控", "运营监控", ScopeMonitor),
new("monitor-ops", "运维操作", "运营监控", ScopeMonitor),
new("monitor-notes", "运营备注", "运营监控", ScopeMonitor),
new("monitor-ops", "运维记录", "运营监控", ScopeMonitor),
new("monitor-notes", "运维备注", "运营监控", ScopeMonitor),
};
private static readonly HashSet<string> _keys =
@@ -76,21 +78,14 @@ public static class PageCatalog
["admin-config-vehicle"] = "admin-vehicle-hub",
["admin-config-fleet"] = "admin-vehicle-hub",
// 会话 16：平台配置中心入口按业务收敛为 6 个聚合页，旧 Key 迁移到对应聚合页 Key。
["admin-config-routing"] = "admin-config-strategy",
["admin-config-task"] = "admin-config-strategy",
["admin-config-traffic"] = "admin-config-strategy",
["admin-config-charge"] = "admin-config-strategy",
["admin-config-device"] = "admin-config-facility",
["admin-config-location"] = "admin-config-warehouse",
["admin-config-integrations"] = "admin-config-business",
["admin-config-scenario"] = "admin-config-business",
["admin-config-widget"] = "admin-config-business",
["admin-playback"] = "admin-config-ops-center",
["admin-config-ops"] = "admin-config-ops-center",
["admin-config-logs"] = "admin-config-ops-center",
["admin-config-logs"] = "admin-logs",
["admin-config-map-monitor"] = "admin-config-ops-center",
["admin-config-system"] = "admin-config-system-center",
["admin-config-auth"] = "admin-config-system-center",
["admin-config-system-center"] = "admin-config-system",
// 运营总览页已下线：旧角色勾选迁到地图监控，避免权限清单里出现幽灵页面。
["monitor-dashboard"] = "monitor-map",
["admin-data-center-stations"] = "admin-data-center",
["admin-data-center-docks"] = "admin-data-center",
["admin-data-center-handshake"] = "admin-data-center",
@@ -98,6 +93,64 @@ public static class PageCatalog
["admin-data-center-mag-control"] = "admin-data-center",
};
/// <summary>
/// 管理端页面 → 运营端对应页面。给运营角色勾页时，只能从「当前管理员已有的管理端页」映射出来。
/// 无对应运营页的管理端入口（如任务/报警）不出现在映射里。
/// </summary>
public static readonly IReadOnlyDictionary<string, string> PlatformToMonitor =
new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
{
["admin-map-monitor"] = "monitor-map",
["admin-vehicle-hub"] = "monitor-vehicle-hub",
["admin-ops-log"] = "monitor-ops",
["admin-notes"] = "monitor-notes",
};
/// <summary>仅运营端有的页面：不依赖管理端对应页，始终可授给运营角色。</summary>
public static readonly IReadOnlyList<string> MonitorOnlyPages =
new[] { "monitor-ops", "monitor-notes" };
/// <summary>
/// 把角色里勾选的页面展开到指定登录域：勾了运营监控的「运维记录」时，
/// 管理账号/通用角色进管理壳也能拿到对应的 admin-ops-log。
/// </summary>
public static HashSet<string> ExpandKeysForScope(IEnumerable<string> keys, string scope)
{
var scopeKeys = KeysForScope(scope).ToHashSet(StringComparer.OrdinalIgnoreCase);
var set = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
foreach (var raw in keys ?? Array.Empty<string>())
{
if (string.Equals(raw, Wildcard, StringComparison.OrdinalIgnoreCase))
{
foreach (var k in scopeKeys) set.Add(k);
return set;
}
var key = NormalizeKey(raw);
if (scopeKeys.Contains(key)) set.Add(key);
var counterpart = CounterpartForScope(key, scope);
if (counterpart != null && scopeKeys.Contains(counterpart)) set.Add(counterpart);
}
return set;
}
/// <summary>管理页 ↔ 运营页互认：monitor-ops → admin-ops-log（当前域是 Platform 时）。</summary>
public static string? CounterpartForScope(string key, string targetScope)
{
if (string.Equals(targetScope, ScopePlatform, StringComparison.OrdinalIgnoreCase))
{
foreach (var kv in PlatformToMonitor)
{
if (string.Equals(kv.Value, key, StringComparison.OrdinalIgnoreCase))
return kv.Key;
}
return null;
}
if (string.Equals(targetScope, ScopeMonitor, StringComparison.OrdinalIgnoreCase)
&& PlatformToMonitor.TryGetValue(key, out var monitorKey))
return monitorKey;
return null;
}
/// <summary>判断页面 Key 是否合法（用于角色保存时过滤掉脏数据 / 已下线页面）。</summary>
public static bool IsValidKey(string key) => _keys.Contains(key);
@@ -110,4 +163,57 @@ public static class PageCatalog
All.Where(p => string.Equals(p.Scope, scope, StringComparison.OrdinalIgnoreCase))
.Select(p => p.Key)
.ToList();
/// <summary>当前管理员在管理端拥有的页面 → 可授给运营端角色的页面集合。</summary>
public static HashSet<string> GrantableMonitorPages(IEnumerable<string>? actorPlatformPages)
{
var set = new HashSet<string>(MonitorOnlyPages, StringComparer.OrdinalIgnoreCase);
var list = (actorPlatformPages ?? Array.Empty<string>()).ToList();
if (list.Contains(Wildcard, StringComparer.OrdinalIgnoreCase)
|| HasAllKeys(list, KeysForScope(ScopePlatform)))
{
foreach (var k in KeysForScope(ScopeMonitor)) set.Add(k);
return set;
}
foreach (var p in list)
{
var key = NormalizeKey(p);
if (PlatformToMonitor.TryGetValue(key, out var monitorKey) && IsValidKey(monitorKey))
set.Add(monitorKey);
}
return set;
}
/// <summary>当前管理员可授给管理端角色的页面（不能超权：只能授自己已有的）。</summary>
public static HashSet<string> GrantablePlatformPages(IEnumerable<string>? actorPlatformPages)
{
var list = (actorPlatformPages ?? Array.Empty<string>()).ToList();
var all = KeysForScope(ScopePlatform);
if (list.Contains(Wildcard, StringComparer.OrdinalIgnoreCase) || HasAllKeys(list, all))
return all.ToHashSet(StringComparer.OrdinalIgnoreCase);
return list
.Select(NormalizeKey)
.Where(k => IsValidKey(k) && all.Contains(k, StringComparer.OrdinalIgnoreCase))
.ToHashSet(StringComparer.OrdinalIgnoreCase);
}
/// <summary>按角色归属域，算出当前管理员可勾选的页面 Key。</summary>
public static HashSet<string> GrantablePagesForRoleScope(
string roleScope, IEnumerable<string>? actorPlatformPages)
{
if (string.Equals(roleScope, ScopeMonitor, StringComparison.OrdinalIgnoreCase))
return GrantableMonitorPages(actorPlatformPages);
if (string.Equals(roleScope, ScopePlatform, StringComparison.OrdinalIgnoreCase))
return GrantablePlatformPages(actorPlatformPages);
// 通用域：管理端可授 + 运营端可授
var set = GrantablePlatformPages(actorPlatformPages);
set.UnionWith(GrantableMonitorPages(actorPlatformPages));
return set;
}
private static bool HasAllKeys(IEnumerable<string> have, IEnumerable<string> all)
{
var set = have.ToHashSet(StringComparer.OrdinalIgnoreCase);
return all.All(k => set.Contains(k));
}
}
MiGu.Server/Auth/RbacStore.cs
+65 -9
View File
@@ -16,7 +16,7 @@ namespace MiGu.Server.Auth;
///
/// 首次启动（rbac.json 不存在）时 seed 两个内置账号：
/// admin（超级管理员，scope=*，全部页面 / 操作）
/// ops （运营人员，scope=RCSMonitor，运营四页 + 运维操作码）
/// ops （运营人员，scope=RCSMonitor，运营监控页 + 运维操作码）
/// 初始密码取 appsettings <c>Auth:Users:{name}:Password</c>，缺省 admin/ops（开发弱口令，生产须改）。
/// </summary>
public sealed class RbacStore
@@ -58,9 +58,14 @@ public sealed class RbacStore
var snap = JsonSerializer.Deserialize<RbacSnapshot>(json, _jsonOpts);
if (snap is { Users.Count: > 0 })
{
_snapshot = Normalize(snap);
_snapshot = Normalize(snap, out var migrated);
_logger.LogInformation("RBAC 从 {File} 载入：{Users} 用户 / {Roles} 角色。",
_file, _snapshot.Users.Count, _snapshot.Roles.Count);
if (migrated)
{
Persist();
_logger.LogInformation("RBAC 已将下线页面 Key 迁移并写回 {File}。", _file);
}
return;
}
_logger.LogWarning("RBAC 文件 {File} 内容为空或无用户，回退到默认 seed。", _file);
@@ -82,21 +87,30 @@ public sealed class RbacStore
}
/// <summary>清洗加载结果：补默认、去重、过滤非法页面 Key，保证内置角色存在。</summary>
private static RbacSnapshot Normalize(RbacSnapshot snap)
/// <param name="migrated">任一角色页面 Key 被别名替换 / 丢弃 / 补齐时为 true，调用方应落盘。</param>
private static RbacSnapshot Normalize(RbacSnapshot snap, out bool migrated)
{
migrated = false;
snap.Roles ??= new();
snap.Users ??= new();
foreach (var r in snap.Roles)
{
r.Pages = (r.Pages ?? new())
var before = r.Pages ?? new();
var hadSystemHub = before.Any(p =>
string.Equals(p, "admin-config-system-center", StringComparison.OrdinalIgnoreCase));
var after = before
.Select(p => p == PageCatalog.Wildcard ? p : PageCatalog.NormalizeKey(p))
.Where(p => p == PageCatalog.Wildcard || PageCatalog.IsValidKey(p))
.Distinct(StringComparer.OrdinalIgnoreCase)
.ToList();
if (!SamePages(before, after)) migrated = true;
r.Pages = after;
r.Ops = (r.Ops ?? new()).Distinct().ToList();
r.WidgetGrants ??= new();
if (string.IsNullOrWhiteSpace(r.Scope)) r.Scope = PageCatalog.ScopePlatform;
BackfillKnownPageMigrations(r);
var countBeforeBackfill = r.Pages.Count;
BackfillKnownPageMigrations(r, hadSystemHub);
if (r.Pages.Count != countBeforeBackfill) migrated = true;
}
foreach (var u in snap.Users)
{
@@ -105,7 +119,12 @@ public sealed class RbacStore
return snap;
}
private static void BackfillKnownPageMigrations(RbacRole r)
private static bool SamePages(IReadOnlyList<string> a, IReadOnlyList<string> b) =>
a.Count == b.Count
&& !a.Except(b, StringComparer.OrdinalIgnoreCase).Any()
&& !b.Except(a, StringComparer.OrdinalIgnoreCase).Any();
private static void BackfillKnownPageMigrations(RbacRole r, bool hadSystemHub)
{
if (!string.Equals(r.Scope, PageCatalog.ScopePlatform, StringComparison.OrdinalIgnoreCase)
&& r.Scope != PageCatalog.Wildcard) return;
@@ -132,6 +151,25 @@ public sealed class RbacStore
&& r.Pages.Contains("admin-cars", StringComparer.OrdinalIgnoreCase)
&& r.Pages.Contains("admin-maps", StringComparer.OrdinalIgnoreCase))
r.Pages.Add("admin-setup");
// 日志管理、调度回放从监控配置聚合页拆出：原先有聚合页权限的角色补上新入口。
if (!r.Pages.Contains(PageCatalog.Wildcard)
&& r.Pages.Contains("admin-config-ops-center", StringComparer.OrdinalIgnoreCase))
{
if (!r.Pages.Contains("admin-logs", StringComparer.OrdinalIgnoreCase))
r.Pages.Add("admin-logs");
if (!r.Pages.Contains("admin-playback", StringComparer.OrdinalIgnoreCase))
r.Pages.Add("admin-playback");
}
// 「系统与权限」拆成系统配置 / 权限与角色。
if (!r.Pages.Contains(PageCatalog.Wildcard) && hadSystemHub)
{
if (!r.Pages.Contains("admin-config-system", StringComparer.OrdinalIgnoreCase))
r.Pages.Add("admin-config-system");
if (!r.Pages.Contains("admin-config-auth", StringComparer.OrdinalIgnoreCase))
r.Pages.Add("admin-config-auth");
}
}
private RbacSnapshot SeedDefault(IConfiguration config)
@@ -159,7 +197,7 @@ public sealed class RbacStore
{
Id = RoleOpsId, Name = "运营人员", Description = "运营监控端默认角色：可执行运维操作、查看监控",
Scope = PageCatalog.ScopeMonitor,
Pages = new() { "monitor-dashboard", "monitor-vehicle-hub", "monitor-map", "monitor-ops", "monitor-notes" },
Pages = new() { "monitor-vehicle-hub", "monitor-map", "monitor-ops", "monitor-notes" },
Ops = new()
{
"ops.car.pause", "ops.car.resume", "ops.car.gohome", "ops.car.resetSession",
@@ -250,6 +288,20 @@ public sealed class RbacStore
public bool CanUseScope(RbacUser user, string scope) =>
UsableScopes(user).Contains(scope, StringComparer.OrdinalIgnoreCase);
/// <summary>
/// 登录按账号角色自动选域：能进管理端则进管理端，否则进运营权限页。
/// 不再接受客户端挑选「运营端 / 管理端」。
/// </summary>
public string? ResolveLoginScope(RbacUser user)
{
var scopes = UsableScopes(user);
if (scopes.Contains(PageCatalog.ScopePlatform, StringComparer.OrdinalIgnoreCase))
return PageCatalog.ScopePlatform;
if (scopes.Contains(PageCatalog.ScopeMonitor, StringComparer.OrdinalIgnoreCase))
return PageCatalog.ScopeMonitor;
return null;
}
/// <summary>角色名（展示用，写入 AuthUserDto.Roles / JWT role claim）。</summary>
public List<string> RoleNamesOf(RbacUser user)
{
@@ -276,7 +328,7 @@ public sealed class RbacStore
foreach (var r in roles)
{
if (r.Pages.Contains(PageCatalog.Wildcard)) pages.UnionWith(scopeKeys);
else foreach (var p in r.Pages) if (scopeKeys.Contains(p)) pages.Add(p);
else pages.UnionWith(PageCatalog.ExpandKeysForScope(r.Pages, scope));
foreach (var o in r.Ops)
{
@@ -486,7 +538,11 @@ public sealed class RbacStore
{
if (pages is null) return new();
if (pages.Contains(PageCatalog.Wildcard)) return new() { PageCatalog.Wildcard };
return pages.Where(PageCatalog.IsValidKey).Distinct().ToList();
return pages
.Select(PageCatalog.NormalizeKey)
.Where(p => p == PageCatalog.Wildcard || PageCatalog.IsValidKey(p))
.Distinct(StringComparer.OrdinalIgnoreCase)
.ToList();
}
private static string NormalizeScope(string? scope) => scope switch