fix: RBAC perm init into build.sh — set_role_perm pipeline schema + load_path.sh venv

build.sh

@@ -116,5 +116,13 @@ for d in sd_projects sd_iterations; do
 done
 
 
+# 11. Initialize RBAC path permissions (all modules' scripts/load_path.py)
+echo "=== RBAC permission init ==="
+if [ -f "$cdir/load_path.sh" ]; then
+    bash "$cdir/load_path.sh" || echo "  WARN: load_path.sh failed (DB not ready?)"
+else
+    echo "  WARN: load_path.sh not found"
+fi
+
 chmod +x "$cdir/start.sh" "$cdir/stop.sh" 2>/dev/null || true
 echo "=== Build complete ==="

load_path.sh

@@ -1,5 +1,9 @@
-for s in $(ls ls pkgs/*/scripts/load_path.py)
+#!/usr/bin/env bash
+# 初始化所有模块的 RBAC 路径权限（调用各模块 scripts/load_path.py）
+set -e
+cdir=$(cd "$(dirname "$0")" && pwd)
+for s in $(ls "$cdir"/pkgs/*/scripts/load_path.py 2>/dev/null)
 do
-	echo $s
+	echo "==> $s"
-	python $s
+	"$cdir/py3/bin/python" "$s"
 done

set_role_perm.py

@@ -1,11 +1,11 @@
 #!/usr/bin/env python3
 """
 Register a single RBAC permission for pipeline modules.
-Called by init_perms.py or directly.
+Called by load_path.py or directly.
 
 Usage:
   python set_role_perm.py <role> <path>
-  python set_role_perm.py admin /pipeline_core/pipelines/*.dspy
+  python set_role_perm.py logined /pipeline-sdlc/workspace_edit.xterm
 """
 import sys, os, asyncio
 
@@ -23,40 +23,36 @@ from ahserver.globalEnv import initEnv
 
 
 async def main(role, path):
-    config = getConfig(os.path.join(ROOT_DIR, 'conf', 'config.json'),
+    config = getConfig(ROOT_DIR,
                        NS={'workdir': ROOT_DIR, 'ProgramPath': ProgramPath()})
     DBPools(config.databases)
     initEnv()
     env = ServerEnv()
     env.get_module_dbname = lambda m: 'pipeline' if 'pipeline' in m else 'sage'
 
-    # Determine module from path
+    # pipeline RBAC schema: permission (id, path) + rolepermission (roleid, permid)
-    parts = path.strip('/').split('/')
+    async with DBPools().sqlorContext('pipeline') as sor:
-    module = parts[0] if parts else 'app'
+        recs = await sor.R('permission', {'path': path})
+        if not recs:
+            permid = getID()
+            await sor.C('permission', {'id': permid, 'path': path})
+        else:
+            permid = recs[0].id
 
-    async with DBPools().sqlorContext('sage') as sor:
+        rp = await sor.R('rolepermission', {'roleid': role, 'permid': permid})
-        existing = await sor.sqlExe(
+        if rp:
-            "SELECT id FROM role_path WHERE module=${m}$ AND path=${p}$ AND role_name=${r}$",
-            {'m': module, 'p': path, 'r': role})
-        if existing:
             print(f'Permission exists: {role} {path}')
             return
 
-        await sor.C('role_path', {
+        await sor.C('rolepermission', {'id': getID(), 'roleid': role, 'permid': permid})
-            'id': getID(),
-            'module': module,
-            'path': path,
-            'role_name': role,
-            'description': f'Auto-registered: {role} -> {path}'
-        })
         print(f'Registered: {role} -> {path}')
 
 
 if __name__ == '__main__':
     if len(sys.argv) != 3:
         print(f"Usage: {sys.argv[0]} <role> <path>")
-        print(f"  roles: guest, logined, admin")
+        print(f"  roles: any, anonymous, logined, admin, owner.superuser ...")
-        print(f"  path example: /pipeline_core/index.ui")
+        print(f"  path example: /pipeline-sdlc/workspace_edit.xterm")
         sys.exit(1)
 
     asyncio.run(main(sys.argv[1], sys.argv[2]))