From e62320b7323e7f5ee5be6855ca59d8a65edbdb1d Mon Sep 17 00:00:00 2001
From: p <p@p.cn>
Date: Thu, 13 Aug 2026 17:49:28 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20RBAC=20perm=20init=20into=20build.sh=20?=
 =?UTF-8?q?=E2=80=94=20set=5Frole=5Fperm=20pipeline=20schema=20+=20load=5F?=
 =?UTF-8?q?path.sh=20venv?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 build.sh         |  8 ++++++++
 load_path.sh     | 10 +++++++---
 set_role_perm.py | 36 ++++++++++++++++--------------------
 3 files changed, 31 insertions(+), 23 deletions(-)

diff --git a/build.sh b/build.sh
index ad07605..976788a 100644
--- a/build.sh
+++ b/build.sh
@@ -116,5 +116,13 @@ for d in sd_projects sd_iterations; do
 done
 
 
+# 11. Initialize RBAC path permissions (all modules' scripts/load_path.py)
+echo "=== RBAC permission init ==="
+if [ -f "$cdir/load_path.sh" ]; then
+    bash "$cdir/load_path.sh" || echo "  WARN: load_path.sh failed (DB not ready?)"
+else
+    echo "  WARN: load_path.sh not found"
+fi
+
 chmod +x "$cdir/start.sh" "$cdir/stop.sh" 2>/dev/null || true
 echo "=== Build complete ==="
diff --git a/load_path.sh b/load_path.sh
index ac3c4a9..0861b83 100644
--- a/load_path.sh
+++ b/load_path.sh
@@ -1,5 +1,9 @@
-for s in $(ls ls pkgs/*/scripts/load_path.py)
+#!/usr/bin/env bash
+# 初始化所有模块的 RBAC 路径权限（调用各模块 scripts/load_path.py）
+set -e
+cdir=$(cd "$(dirname "$0")" && pwd)
+for s in $(ls "$cdir"/pkgs/*/scripts/load_path.py 2>/dev/null)
 do
-	echo $s
-	python $s
+	echo "==> $s"
+	"$cdir/py3/bin/python" "$s"
 done
diff --git a/set_role_perm.py b/set_role_perm.py
index 1a4097f..71531b8 100644
--- a/set_role_perm.py
+++ b/set_role_perm.py
@@ -1,11 +1,11 @@
 #!/usr/bin/env python3
 """
 Register a single RBAC permission for pipeline modules.
-Called by init_perms.py or directly.
+Called by load_path.py or directly.
 
 Usage:
   python set_role_perm.py <role> <path>
-  python set_role_perm.py admin /pipeline_core/pipelines/*.dspy
+  python set_role_perm.py logined /pipeline-sdlc/workspace_edit.xterm
 """
 import sys, os, asyncio
 
@@ -23,40 +23,36 @@ from ahserver.globalEnv import initEnv
 
 
 async def main(role, path):
-    config = getConfig(os.path.join(ROOT_DIR, 'conf', 'config.json'),
+    config = getConfig(ROOT_DIR,
                        NS={'workdir': ROOT_DIR, 'ProgramPath': ProgramPath()})
     DBPools(config.databases)
     initEnv()
     env = ServerEnv()
     env.get_module_dbname = lambda m: 'pipeline' if 'pipeline' in m else 'sage'
 
-    # Determine module from path
-    parts = path.strip('/').split('/')
-    module = parts[0] if parts else 'app'
+    # pipeline RBAC schema: permission (id, path) + rolepermission (roleid, permid)
+    async with DBPools().sqlorContext('pipeline') as sor:
+        recs = await sor.R('permission', {'path': path})
+        if not recs:
+            permid = getID()
+            await sor.C('permission', {'id': permid, 'path': path})
+        else:
+            permid = recs[0].id
 
-    async with DBPools().sqlorContext('sage') as sor:
-        existing = await sor.sqlExe(
-            "SELECT id FROM role_path WHERE module=${m}$ AND path=${p}$ AND role_name=${r}$",
-            {'m': module, 'p': path, 'r': role})
-        if existing:
+        rp = await sor.R('rolepermission', {'roleid': role, 'permid': permid})
+        if rp:
             print(f'Permission exists: {role} {path}')
             return
 
-        await sor.C('role_path', {
-            'id': getID(),
-            'module': module,
-            'path': path,
-            'role_name': role,
-            'description': f'Auto-registered: {role} -> {path}'
-        })
+        await sor.C('rolepermission', {'id': getID(), 'roleid': role, 'permid': permid})
         print(f'Registered: {role} -> {path}')
 
 
 if __name__ == '__main__':
     if len(sys.argv) != 3:
         print(f"Usage: {sys.argv[0]} <role> <path>")
-        print(f"  roles: guest, logined, admin")
-        print(f"  path example: /pipeline_core/index.ui")
+        print(f"  roles: any, anonymous, logined, admin, owner.superuser ...")
+        print(f"  path example: /pipeline-sdlc/workspace_edit.xterm")
         sys.exit(1)
 
     asyncio.run(main(sys.argv[1], sys.argv[2]))