refactor(access): 统一分层白名单权限语义

取消跨主体专属占用，按租户、用户组、用户、当前 API Key 和 scope 分层求交，并在任务落库前统一校验候选。\n\n增加旧 allow 规则归档清理迁移、脱敏审计工具和回滚运行手册，补齐主体隔离、deny 优先及列表与运行时一致性测试。

apps/api/internal/store/access_rules.go

@@ -41,11 +41,6 @@ type AccessRuleBatchInput struct {
 	DeleteResources []AccessRuleResourceInput `json:"deleteResources"`
 }
 
-type accessRuleResource struct {
-	Type string
-	ID   string
-}
-
 func (s *Store) ListAccessRules(ctx context.Context) ([]AccessRule, error) {
 	rows, err := s.pool.Query(ctx, `
 SELECT `+accessRuleColumns+`
@@ -368,191 +363,6 @@ WHERE u.id = $1::uuid
 	return &next, nil
 }
 
-func (s *Store) filterPlatformModelsByAccessRules(
-	ctx context.Context,
-	user *auth.User,
-	models []PlatformModel,
-	excludedSubjectTypes map[string]bool,
-) ([]PlatformModel, error) {
-	if len(models) == 0 {
-		return models, nil
-	}
-	resources := platformModelAccessResources(models)
-	if len(resources) == 0 {
-		return models, nil
-	}
-	rules, err := s.listActiveAccessRulesForResources(ctx, resources)
-	if err != nil {
-		return nil, err
-	}
-	if len(rules) == 0 {
-		return models, nil
-	}
-	if len(excludedSubjectTypes) > 0 {
-		rules = filterAccessRulesBySubjectType(rules, excludedSubjectTypes)
-		if len(rules) == 0 {
-			return models, nil
-		}
-	}
-	subjects := accessRuleSubjects(user)
-	level := 0
-	if user != nil {
-		level = auth.PermissionLevel(user.Roles)
-	}
-	filtered := models[:0]
-	for _, model := range models {
-		if platformModelAllowedByAccessRules(model, rules, subjects, level) {
-			filtered = append(filtered, model)
-		}
-	}
-	return filtered, nil
-}
-
-func filterAccessRulesBySubjectType(rules []AccessRule, excludedSubjectTypes map[string]bool) []AccessRule {
-	filtered := make([]AccessRule, 0, len(rules))
-	for _, rule := range rules {
-		if excludedSubjectTypes[rule.SubjectType] {
-			continue
-		}
-		filtered = append(filtered, rule)
-	}
-	return filtered
-}
-
-func (s *Store) listActiveAccessRulesForResources(ctx context.Context, resources []accessRuleResource) ([]AccessRule, error) {
-	values := make([]string, 0, len(resources))
-	for _, resource := range resources {
-		if resource.Type == "" || resource.ID == "" {
-			continue
-		}
-		values = append(values, resource.Type+":"+resource.ID)
-	}
-	if len(values) == 0 {
-		return nil, nil
-	}
-	rows, err := s.pool.Query(ctx, `
-SELECT `+accessRuleColumns+`
-FROM gateway_access_rules
-WHERE status = 'active'
-  AND (resource_type || ':' || resource_id::text) = ANY($1)
-ORDER BY priority ASC, created_at ASC`, values)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-	rules := make([]AccessRule, 0)
-	for rows.Next() {
-		item, err := scanAccessRule(rows)
-		if err != nil {
-			return nil, err
-		}
-		rules = append(rules, item)
-	}
-	return rules, rows.Err()
-}
-
-func candidateAccessResources(candidates []RuntimeModelCandidate) []accessRuleResource {
-	seen := map[string]bool{}
-	out := make([]accessRuleResource, 0, len(candidates)*3)
-	add := func(resourceType string, resourceID string) {
-		key := resourceType + ":" + resourceID
-		if resourceID == "" || seen[key] {
-			return
-		}
-		seen[key] = true
-		out = append(out, accessRuleResource{Type: resourceType, ID: resourceID})
-	}
-	for _, candidate := range candidates {
-		add("platform", candidate.PlatformID)
-		add("platform_model", candidate.PlatformModelID)
-		add("base_model", candidate.BaseModelID)
-	}
-	return out
-}
-
-func platformModelAccessResources(models []PlatformModel) []accessRuleResource {
-	seen := map[string]bool{}
-	out := make([]accessRuleResource, 0, len(models)*3)
-	add := func(resourceType string, resourceID string) {
-		key := resourceType + ":" + resourceID
-		if resourceID == "" || seen[key] {
-			return
-		}
-		seen[key] = true
-		out = append(out, accessRuleResource{Type: resourceType, ID: resourceID})
-	}
-	for _, model := range models {
-		add("platform", model.PlatformID)
-		add("platform_model", model.ID)
-		add("base_model", model.BaseModelID)
-	}
-	return out
-}
-
-func candidateAllowedByAccessRules(candidate RuntimeModelCandidate, rules []AccessRule, subjects map[string]bool, permissionLevel int) bool {
-	resourceKeys := map[string]bool{
-		"platform:" + candidate.PlatformID:            true,
-		"platform_model:" + candidate.PlatformModelID: true,
-		"base_model:" + candidate.BaseModelID:         candidate.BaseModelID != "",
-	}
-	allowByResource := map[string]bool{}
-	matchedAllowByResource := map[string]bool{}
-	for _, rule := range rules {
-		resourceKey := rule.ResourceType + ":" + rule.ResourceID
-		if !resourceKeys[resourceKey] {
-			continue
-		}
-		subjectKey := rule.SubjectType + ":" + rule.SubjectID
-		if rule.Effect == "deny" && subjects[subjectKey] {
-			return false
-		}
-		if rule.Effect == "allow" {
-			allowByResource[resourceKey] = true
-			if subjects[subjectKey] && permissionLevel >= rule.MinPermissionLevel {
-				matchedAllowByResource[resourceKey] = true
-			}
-		}
-	}
-	for resourceKey := range allowByResource {
-		if !matchedAllowByResource[resourceKey] {
-			return false
-		}
-	}
-	return true
-}
-
-func platformModelAllowedByAccessRules(model PlatformModel, rules []AccessRule, subjects map[string]bool, permissionLevel int) bool {
-	resourceKeys := map[string]bool{
-		"platform:" + model.PlatformID:    true,
-		"platform_model:" + model.ID:      true,
-		"base_model:" + model.BaseModelID: model.BaseModelID != "",
-	}
-	allowByResource := map[string]bool{}
-	matchedAllowByResource := map[string]bool{}
-	for _, rule := range rules {
-		resourceKey := rule.ResourceType + ":" + rule.ResourceID
-		if !resourceKeys[resourceKey] {
-			continue
-		}
-		subjectKey := rule.SubjectType + ":" + rule.SubjectID
-		if rule.Effect == "deny" && subjects[subjectKey] {
-			return false
-		}
-		if rule.Effect == "allow" {
-			allowByResource[resourceKey] = true
-			if subjects[subjectKey] && permissionLevel >= rule.MinPermissionLevel {
-				matchedAllowByResource[resourceKey] = true
-			}
-		}
-	}
-	for resourceKey := range allowByResource {
-		if !matchedAllowByResource[resourceKey] {
-			return false
-		}
-	}
-	return true
-}
-
 func accessRuleSubjects(user *auth.User) map[string]bool {
 	subjects := map[string]bool{}
 	if user == nil {