fix(rbac): load_path特殊角色(any/anonymous/logined)直接用字面roleid——按name查错配downapp机构同名角色致客户403

scripts/load_path.py

@@ -87,6 +87,13 @@ async def register():
     env = ServerEnv()
     env.get_module_dbname = lambda m: "pipeline"
 
+    # 特殊角色（any/anonymous/logined）roleid 用字面值：role 表里全局 logined 行
+    # id='logined'（name=NULL），而按 name='logined' 查会错配到 downapp 机构的同名
+    # 角色行（缓存键为 downapp.logined，普通登录用户不命中→403）。
+    # RBAC 缓存键规则（rbac/userperm.py load_roleperms）：id in (any/anonymous/logined)
+    # 才映射全局键；其余按 orgtypeid.name。
+    SPECIAL_ROLES = {"any", "anonymous", "logined"}
+
     async with DBPools().sqlorContext("pipeline") as sor:
         total = 0
         for path, module, role_name in PERMS:
@@ -103,16 +110,20 @@ async def register():
                 })
                 total += 1
             # 补 role 关联（permission 已存在但 rolepermission 缺失时也要补，修复 /** 等历史漏关联）
-            role_sql = "SELECT id FROM role WHERE name=" + repr(role_name) + " LIMIT 1"
-            role_recs = await sor.sqlExe(role_sql, {})
-            if role_recs:
-                rp_sql = ("SELECT id FROM rolepermission WHERE roleid=" + repr(role_recs[0].id)
+            if role_name in SPECIAL_ROLES:
+                role_id = role_name
+            else:
+                role_sql = "SELECT id FROM role WHERE name=" + repr(role_name) + " LIMIT 1"
+                role_recs = await sor.sqlExe(role_sql, {})
+                role_id = role_recs[0].id if role_recs else None
+            if role_id:
+                rp_sql = ("SELECT id FROM rolepermission WHERE roleid=" + repr(role_id)
                           + " AND permid=" + repr(pid) + " LIMIT 1")
                 rp_existing = await sor.sqlExe(rp_sql, {})
                 if not rp_existing:
                     await sor.C("rolepermission", {
                         "id": getID(),
-                        "roleid": role_recs[0].id,
+                        "roleid": role_id,
                         "permid": pid
                     })