From da1dc34b60e335cb11d12dacc608f3b02101cb0a Mon Sep 17 00:00:00 2001
From: yumoqing <yumoqing@gmail.com>
Date: Sun, 6 Sep 2026 14:31:04 +0800
Subject: [PATCH] =?UTF-8?q?fix(rbac):=20load=5Fpath=E7=89=B9=E6=AE=8A?=
 =?UTF-8?q?=E8=A7=92=E8=89=B2(any/anonymous/logined)=E7=9B=B4=E6=8E=A5?=
 =?UTF-8?q?=E7=94=A8=E5=AD=97=E9=9D=A2roleid=E2=80=94=E2=80=94=E6=8C=89nam?=
 =?UTF-8?q?e=E6=9F=A5=E9=94=99=E9=85=8Ddownapp=E6=9C=BA=E6=9E=84=E5=90=8C?=
 =?UTF-8?q?=E5=90=8D=E8=A7=92=E8=89=B2=E8=87=B4=E5=AE=A2=E6=88=B7403?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 scripts/load_path.py | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/scripts/load_path.py b/scripts/load_path.py
index 21a9d88..83fc21a 100644
--- a/scripts/load_path.py
+++ b/scripts/load_path.py
@@ -87,6 +87,13 @@ async def register():
     env = ServerEnv()
     env.get_module_dbname = lambda m: "pipeline"
 
+    # 特殊角色（any/anonymous/logined）roleid 用字面值：role 表里全局 logined 行
+    # id='logined'（name=NULL），而按 name='logined' 查会错配到 downapp 机构的同名
+    # 角色行（缓存键为 downapp.logined，普通登录用户不命中→403）。
+    # RBAC 缓存键规则（rbac/userperm.py load_roleperms）：id in (any/anonymous/logined)
+    # 才映射全局键；其余按 orgtypeid.name。
+    SPECIAL_ROLES = {"any", "anonymous", "logined"}
+
     async with DBPools().sqlorContext("pipeline") as sor:
         total = 0
         for path, module, role_name in PERMS:
@@ -103,16 +110,20 @@ async def register():
                 })
                 total += 1
             # 补 role 关联（permission 已存在但 rolepermission 缺失时也要补，修复 /** 等历史漏关联）
-            role_sql = "SELECT id FROM role WHERE name=" + repr(role_name) + " LIMIT 1"
-            role_recs = await sor.sqlExe(role_sql, {})
-            if role_recs:
-                rp_sql = ("SELECT id FROM rolepermission WHERE roleid=" + repr(role_recs[0].id)
+            if role_name in SPECIAL_ROLES:
+                role_id = role_name
+            else:
+                role_sql = "SELECT id FROM role WHERE name=" + repr(role_name) + " LIMIT 1"
+                role_recs = await sor.sqlExe(role_sql, {})
+                role_id = role_recs[0].id if role_recs else None
+            if role_id:
+                rp_sql = ("SELECT id FROM rolepermission WHERE roleid=" + repr(role_id)
                           + " AND permid=" + repr(pid) + " LIMIT 1")
                 rp_existing = await sor.sqlExe(rp_sql, {})
                 if not rp_existing:
                     await sor.C("rolepermission", {
                         "id": getID(),
-                        "roleid": role_recs[0].id,
+                        "roleid": role_id,
                         "permid": pid
                     })