From 0921f4d7f39dd2278c238b2af726c6cbe9f93577 Mon Sep 17 00:00:00 2001
From: yumoqing <yumoqing@gmail.com>
Date: Tue, 21 Jul 2026 18:07:12 +0800
Subject: [PATCH] fix: float fields + RBAC init script

---
 models/usage_logs.json |  2 +-
 scripts/init_rbac.py   | 85 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 86 insertions(+), 1 deletion(-)
 create mode 100644 scripts/init_rbac.py

diff --git a/models/usage_logs.json b/models/usage_logs.json
index 6bb25f0..4b28e7d 100644
--- a/models/usage_logs.json
+++ b/models/usage_logs.json
@@ -16,7 +16,7 @@
         {"name": "api_calls", "title": "API调用数", "type": "int", "default": 1},
         {"name": "engine_type", "title": "引擎类型", "type": "str", "length": 32},
         {"name": "tokens_used", "title": "Token消耗", "type": "int", "default": 0},
-        {"name": "cost_estimate", "title": "预估费用", "type": "float", "dec": 4},
+        {"name": "cost_estimate", "title": "预估费用", "type": "float", "length": 20, "dec": 4},
         {"name": "detail", "title": "详情JSON", "type": "text", "length": 2000},
         {"name": "created_at", "title": "创建时间", "type": "datetime"}
     ],
diff --git a/scripts/init_rbac.py b/scripts/init_rbac.py
new file mode 100644
index 0000000..4da17ce
--- /dev/null
+++ b/scripts/init_rbac.py
@@ -0,0 +1,85 @@
+# -*- coding:utf-8 -*-
+"""RAG Server RBAC 权限初始化"""
+import sys, os
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), 'pkgs', 'rag-pipeline'))
+
+from ahserver.serverenv import ServerEnv
+from sqlor.sqlor import DBPools
+from appPublic.jsonConfig import getConfig
+from appPublic.log import debug
+import asyncio
+
+config = getConfig('.')
+DBPools(config.databases)
+
+from rbac.userperm import UserPerm
+
+PUBLIC_PATHS = [
+    '/api/status',
+    '/api/engines',
+    '/api/kb/list',
+    '/',
+    '/index.ui',
+]
+
+LOGINED_PATHS = [
+    '/api/search',
+    '/api/ingest',
+    '/knowledge_bases_list/',
+    '/documents_list/',
+    '/engine_configs_list/',
+    '/subscriptions_list/',
+]
+
+
+async def init_perms():
+    sor = await DBPools().get_sor_context('rag')
+    up = UserPerm()
+    await up.init(sor)
+
+    # Create 'any' role for public access
+    recs = await sor.sqlExe("SELECT id FROM role WHERE id='any'", {})
+    if not recs:
+        await sor.sqlExe(
+            "INSERT INTO role (id, rolename, orgtypeid, roletype, del_flg) "
+            "VALUES ('any', 'any', '', 'any', '0')", {}
+        )
+
+    # Create 'logined' role
+    recs = await sor.sqlExe("SELECT id FROM role WHERE id='logined'", {})
+    if not recs:
+        await sor.sqlExe(
+            "INSERT INTO role (id, rolename, orgtypeid, roletype, del_flg) "
+            "VALUES ('logined', 'logined', '', 'logined', '0')", {}
+        )
+
+    # Register public paths
+    for path in PUBLIC_PATHS:
+        perm_id = f"perm_{path.replace('/', '_')}"
+        await sor.sqlExe(
+            f"INSERT IGNORE INTO permission (id, path, name) VALUES ('{perm_id}', '{path}', 'RAG {path}')",
+            {}
+        )
+        await sor.sqlExe(
+            f"INSERT IGNORE INTO rolepermission (role_id, permission_id) VALUES ('any', '{perm_id}')",
+            {}
+        )
+
+    # Register logined paths
+    for path in LOGINED_PATHS:
+        perm_id = f"perm_{path.replace('/', '_')}"
+        await sor.sqlExe(
+            f"INSERT IGNORE INTO permission (id, path, name) VALUES ('{perm_id}', '{path}', 'RAG {path}')",
+            {}
+        )
+        await sor.sqlExe(
+            f"INSERT IGNORE INTO rolepermission (role_id, permission_id) VALUES ('logined', '{perm_id}')",
+            {}
+        )
+
+    print(f"RBAC initialized: {len(PUBLIC_PATHS)} public + {len(LOGINED_PATHS)} logined paths")
+
+
+if __name__ == '__main__':
+    asyncio.run(init_perms())