refactor(access): 统一分层白名单权限语义

取消跨主体专属占用，按租户、用户组、用户、当前 API Key 和 scope 分层求交，并在任务落库前统一校验候选。\n\n增加旧 allow 规则归档清理迁移、脱敏审计工具和回滚运行手册，补齐主体隔离、deny 优先及列表与运行时一致性测试。
2026-08-03 15:43:49 +08:00
parent c9393af43a
commit 7376d6fab6
20 changed files with 1490 additions and 513 deletions
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage:
+  AI_GATEWAY_ACCESS_RULE_AUDIT_DATABASE_URL='postgresql://...' \
+    scripts/acceptance/export-access-rule-audit.sh export --output <before.json>
+
+  AI_GATEWAY_ACCESS_RULE_AUDIT_DATABASE_URL='postgresql://...' \
+    scripts/acceptance/export-access-rule-audit.sh verify \
+      --before <before.json> --output <after.json>
+
+Use a SELECT-only database role. The output contains grouped counts and
+SHA-256 digests only; API Key secrets and subject/resource identifiers are not
+exported.
+EOF
+}
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+repository_root=$(cd "$script_dir/../.." && pwd)
+
+[[ $# -ge 1 ]] || {
+  usage >&2
+  exit 64
+}
+[[ -n ${AI_GATEWAY_ACCESS_RULE_AUDIT_DATABASE_URL:-} ]] || {
+  echo 'AI_GATEWAY_ACCESS_RULE_AUDIT_DATABASE_URL is required' >&2
+  exit 64
+}
+
+case $1 in
+  export)
+    [[ ${2:-} == --output && $# -eq 3 ]] || {
+      usage >&2
+      exit 64
+    }
+    ;;
+  verify)
+    [[ ${2:-} == --before && ${4:-} == --output && $# -eq 5 ]] || {
+      usage >&2
+      exit 64
+    }
+    ;;
+  *)
+    usage >&2
+    exit 64
+    ;;
+esac
+
+umask 077
+(
+  cd "$repository_root/apps/api"
+  go run ./cmd/access-rule-audit "$@"
+)