feat: add setup_rbac_perms.sh + set_role_perm.py (ref Sage pattern)

build.sh

@@ -179,25 +179,12 @@ fi
 green "  OK"
 
 # ============================================================
-# 7b: 修复 RBAC 权限通配符 (bricks等静态资源目录需 /** 匹配子路径)
+# 7b: RBAC 权限初始化（参考 Sage setup_rbac_perms.sh）
 # ============================================================
-blue "[7b/10] RBAC 权限通配符修复..."
+blue "[7b/10] RBAC 权限初始化..."
-mysql -u test -ptest123 pccs -e "
+cp -f "${PKGDIR}/pccs/setup_rbac_perms.sh" "${CDIR}/setup_rbac_perms.sh"
-UPDATE permission SET path = CONCAT(path, '**') 
+cp -f "${PKGDIR}/pccs/set_role_perm.py" "${CDIR}/set_role_perm.py"
-WHERE path IN ('/pcpool/', '/pcc/', '/storage_mgr/', '/image_mgr/', '/pccs/', '/appbase/', '/imgs/', '/bricks/')
+bash "${CDIR}/setup_rbac_perms.sh" 2>&1 | tail -5
-AND path NOT LIKE '%**';
-" 2>/dev/null
-# 确保 /rbac/user/ 下所有文件有 any 角色权限
-mysql -u test -ptest123 pccs -e "
-INSERT IGNORE INTO rolepermission (id, roleid, permid)
-SELECT CONCAT('ANY_', p.id), 'any', p.id
-FROM permission p
-WHERE p.path LIKE '/rbac/user/%'
-AND NOT EXISTS (
-    SELECT 1 FROM rolepermission rp 
-    WHERE rp.roleid = 'any' AND rp.permid = p.id
-);
-" 2>/dev/null
 green "  OK"
 
 # ============================================================

set_role_perm.py

@@ -0,0 +1,63 @@
+"""
+set_role_perm.py — 为指定角色添加路径权限（参考 Sage 同款脚本）
+用法: python set_role_perm.py <role> <path>
+  role: any / logined / anonymous / orgtypeid.rolename
+  path: /rbac/user/login.ui 或 /bricks/** (支持 % 和 ** 通配符)
+"""
+import os, sys, asyncio
+sys.path[:0] = [os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), 'pkgs', p) 
+                for p in ['apppublic', 'sqlor', 'ahserver']]
+
+from sqlor.dbpools import DBPools
+from appPublic.jsonConfig import getConfig
+from appPublic.uniqueID import getID
+
+
+async def add_roleperm(sor, roleid, permid):
+    ns = {'roleid': roleid, 'permid': permid}
+    recs = await sor.R('rolepermission', ns.copy())
+    if recs:
+        print(f'  {roleid}, {permid} — 已存在, 跳过')
+        return
+    ns['id'] = getID()
+    await sor.C('rolepermission', ns)
+    print(f'  {roleid}, {permid} — 已添加')
+
+
+async def main():
+    config = getConfig('.')
+    db = DBPools(config.databases)
+
+    if len(sys.argv) < 3:
+        print(f'用法: {sys.argv[0]} <role> <path>')
+        sys.exit(1)
+
+    role = sys.argv[1]
+    path = sys.argv[2]
+
+    async with db.sqlorContext('pccs') as sor:
+        # 查询 permission: 支持通配符 ** 和 %
+        perms = None
+        if '%' in path or '**' in path:
+            like_path = path.replace('**', '%')
+            perms = await sor.sqlExe(
+                "SELECT * FROM permission WHERE path LIKE ${path}$",
+                {'path': like_path}
+            )
+        else:
+            perms = await sor.R('permission', {'path': path})
+
+        # 如果 permission 不存在，自动创建
+        if not perms:
+            from appPublic.dictObject import DictObject
+            perms = [DictObject(id=getID(), path=path)]
+            await sor.C('permission', perms[0].copy())
+            print(f'  permission 已创建: {path}')
+
+        # 添加角色权限
+        for p in perms:
+            await add_roleperm(sor, role, p.id)
+
+
+if __name__ == '__main__':
+    asyncio.run(main())

setup_rbac_perms.sh

@@ -0,0 +1,86 @@
+#!/bin/bash
+# setup_rbac_perms.sh — PCCS 权限初始化（参考 Sage 同款脚本）
+# 运行: cd /d/pccs && bash setup_rbac_perms.sh
+
+set -e
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+cd "$SCRIPT_DIR"
+
+PYTHON="${SCRIPT_DIR}/py3/bin/python3"
+
+set_perm() {
+    local role="$1"
+    local path="$2"
+    "$PYTHON" set_role_perm.py "$role" "$path"
+}
+
+echo "============================================"
+echo "  PCCS RBAC 权限初始化"
+echo "============================================"
+
+# === 1. Public: 登录/注册/认证 (any) ===
+echo ""
+echo ">>> [1/3] Public: 登录/注册/认证 (any)"
+
+PUBLIC_PATHS=(
+    "/rbac/user/login.ui"
+    "/rbac/userpassword_login.ui"
+    "/rbac/userpassword_login.dspy"
+    "/rbac/user/up_login.dspy"
+    "/rbac/phone_login.dspy"
+    "/rbac/user/register.ui"
+    "/rbac/user/register.dspy"
+    "/rbac/gen_sms_code.dspy"
+    "/rbac/qr_scan.ui"
+    "/rbac/user/logout.dspy"
+    "/rbac/user/code_login.dspy"
+    "/rbac/user/sms_register.dspy"
+    "/rbac/get_user_info.dspy"
+)
+
+for path in "${PUBLIC_PATHS[@]}"; do
+    set_perm "any" "$path"
+done
+echo "  OK (${#PUBLIC_PATHS[@]} paths)"
+
+# === 2. Logined: 已登录用户可访问 ===
+echo ""
+echo ">>> [2/3] Logined: 用户功能 (logined)"
+
+LOGINED_PATHS=(
+    "/rbac/user/myrole.ui"
+    "/rbac/user/edit_profile.dspy"
+    "/rbac/user/save_profile.dspy"
+    "/rbac/usermenu.ui"
+    "/index.ui"
+)
+
+for path in "${LOGINED_PATHS[@]}"; do
+    set_perm "logined" "$path"
+done
+echo "  OK (${#LOGINED_PATHS[@]} paths)"
+
+# === 3. Static: 静态资源目录通配符 (any) ===
+echo ""
+echo ">>> [3/3] Static: 静态资源目录 (any + /** 通配符)"
+
+STATIC_PATHS=(
+    "/bricks/**"
+    "/imgs/**"
+    "/appbase/**"
+    "/pcpool/**"
+    "/pcc/**"
+    "/storage_mgr/**"
+    "/image_mgr/**"
+    "/pccs/**"
+)
+
+for path in "${STATIC_PATHS[@]}"; do
+    set_perm "any" "$path"
+done
+echo "  OK (${#STATIC_PATHS[@]} paths)"
+
+echo ""
+echo "============================================"
+echo "  权限初始化完成"
+echo "============================================"