From 68e70fd6e2ae4525062f61cd7dc4439986a3dda4 Mon Sep 17 00:00:00 2001 From: liuwenxin <1009266660@qq.com> Date: Thu, 5 Nov 2026 19:31:01 +0800 Subject: [PATCH] =?UTF-8?q?fix(=E6=9D=83=E9=99=90):=20=E4=BF=AE=E5=A4=8D?= =?UTF-8?q?=E4=B8=9A=E5=8A=A1=E6=8E=A5=E5=85=A5=E9=A2=84=E8=A7=88=E6=9D=83?= =?UTF-8?q?=E9=99=90=E6=98=A0=E5=B0=84?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 业务接入预览属于只读预演，不应要求执行导入权限。\n将预览接口映射到 tplus:preview，并增加路由权限回归，避免只读角色被错误拒绝。\n\n影响范围：T+ 工作台业务接入预览接口与权限策略。\n\nCo-Authored-By: Claude Code --- backend/app/services/authorization_policy.py | 2 ++ backend/tests/unit/test_authorization_policy.py | 9 +++++++++ 2 files changed, 11 insertions(+) diff --git a/backend/app/services/authorization_policy.py b/backend/app/services/authorization_policy.py index d3d4f5f..f158573 100644 --- a/backend/app/services/authorization_policy.py +++ b/backend/app/services/authorization_policy.py @@ -58,6 +58,8 @@ def permission_for(module, name, method, *, params=None, body=None): if module == "system.tplus": return "tplus:" + ("view" if method == "GET" else "retry" if name == "retry" else "collect") if module == "system.tplus_workbench": + if name == "business_sync_preview": + return "tplus:preview" if name.startswith("business_sync_"): return "tplus:view" if method == "GET" else "tplus:import" if name == "work_report": diff --git a/backend/tests/unit/test_authorization_policy.py b/backend/tests/unit/test_authorization_policy.py index 18cdb71..7c23ef0 100644 --- a/backend/tests/unit/test_authorization_policy.py +++ b/backend/tests/unit/test_authorization_policy.py @@ -30,5 +30,14 @@ def test_全部受保护接口都有权限映射(): assert not missing, missing +def test_业务接入预览只需要预览权限(): + assert permission_for( + 'system.tplus_workbench', + 'business_sync_preview', + 'POST', + body={}, + ) == 'tplus:preview' + + def test_未知接口没有默认放行(): assert permission_for('future_module','new_action','GET') is None