feat(identity): 支持用户和用户组批量管理
增加原子批量启用、禁用和删除接口及管理端多选操作，目标缺失时整批回滚。\n\n拆分管理端与 API Key 权限缓存并在弹窗保存后刷新候选；补齐失效规则一键清理样式、固定右侧操作列和 OpenAPI 契约。
This commit is contained in:
+190
-10
@@ -19,7 +19,7 @@
|
||||
"BearerAuth": []
|
||||
}
|
||||
],
|
||||
"description": "管理端返回用户组、租户、用户或 API Key 到平台、平台模型、基础模型的访问规则。",
|
||||
"description": "管理端返回用户组、租户、用户或 API Key 到平台、平台模型、基础模型的分层访问规则。主体当前层无 allow 时继承上级，存在 allow 时仅允许白名单，deny 始终优先。",
|
||||
"produces": [
|
||||
"application/json"
|
||||
],
|
||||
@@ -60,7 +60,7 @@
|
||||
"BearerAuth": []
|
||||
}
|
||||
],
|
||||
"description": "管理端创建一条访问控制规则。",
|
||||
"description": "管理端创建一条访问控制规则；同一主体层存在任意有效 allow 后该层启用白名单，deny 始终优先。",
|
||||
"consumes": [
|
||||
"application/json"
|
||||
],
|
||||
@@ -129,7 +129,7 @@
|
||||
"BearerAuth": []
|
||||
}
|
||||
],
|
||||
"description": "管理端为同一主体批量新增、更新或删除资源访问规则。",
|
||||
"description": "管理端为同一主体批量新增、更新或删除资源访问规则。清空该主体全部 allow 会恢复上级继承。",
|
||||
"consumes": [
|
||||
"application/json"
|
||||
],
|
||||
@@ -4844,6 +4844,75 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/admin/user-groups/batch": {
|
||||
"post": {
|
||||
"security": [
|
||||
{
|
||||
"BearerAuth": []
|
||||
}
|
||||
],
|
||||
"description": "管理端原子批量启用、禁用或删除最多 500 个用户组；删除时同步删除其访问规则，关联默认用户组外键按数据库约束置空。",
|
||||
"consumes": [
|
||||
"application/json"
|
||||
],
|
||||
"produces": [
|
||||
"application/json"
|
||||
],
|
||||
"tags": [
|
||||
"identity"
|
||||
],
|
||||
"summary": "批量操作用户组",
|
||||
"parameters": [
|
||||
{
|
||||
"description": "用户组批量操作",
|
||||
"name": "input",
|
||||
"in": "body",
|
||||
"required": true,
|
||||
"schema": {
|
||||
"$ref": "#/definitions/store.IdentityBatchInput"
|
||||
}
|
||||
}
|
||||
],
|
||||
"responses": {
|
||||
"200": {
|
||||
"description": "OK",
|
||||
"schema": {
|
||||
"$ref": "#/definitions/httpapi.IdentityBatchResponse"
|
||||
}
|
||||
},
|
||||
"400": {
|
||||
"description": "Bad Request",
|
||||
"schema": {
|
||||
"$ref": "#/definitions/httpapi.ErrorEnvelope"
|
||||
}
|
||||
},
|
||||
"401": {
|
||||
"description": "Unauthorized",
|
||||
"schema": {
|
||||
"$ref": "#/definitions/httpapi.ErrorEnvelope"
|
||||
}
|
||||
},
|
||||
"403": {
|
||||
"description": "Forbidden",
|
||||
"schema": {
|
||||
"$ref": "#/definitions/httpapi.ErrorEnvelope"
|
||||
}
|
||||
},
|
||||
"404": {
|
||||
"description": "Not Found",
|
||||
"schema": {
|
||||
"$ref": "#/definitions/httpapi.ErrorEnvelope"
|
||||
}
|
||||
},
|
||||
"500": {
|
||||
"description": "Internal Server Error",
|
||||
"schema": {
|
||||
"$ref": "#/definitions/httpapi.ErrorEnvelope"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/admin/user-groups/{groupID}": {
|
||||
"delete": {
|
||||
"security": [
|
||||
@@ -5089,6 +5158,75 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/admin/users/batch": {
|
||||
"post": {
|
||||
"security": [
|
||||
{
|
||||
"BearerAuth": []
|
||||
}
|
||||
],
|
||||
"description": "管理端原子批量启用、禁用或软删除最多 500 个用户；任一目标不存在时整批不变更。",
|
||||
"consumes": [
|
||||
"application/json"
|
||||
],
|
||||
"produces": [
|
||||
"application/json"
|
||||
],
|
||||
"tags": [
|
||||
"identity"
|
||||
],
|
||||
"summary": "批量操作用户",
|
||||
"parameters": [
|
||||
{
|
||||
"description": "用户批量操作",
|
||||
"name": "input",
|
||||
"in": "body",
|
||||
"required": true,
|
||||
"schema": {
|
||||
"$ref": "#/definitions/store.IdentityBatchInput"
|
||||
}
|
||||
}
|
||||
],
|
||||
"responses": {
|
||||
"200": {
|
||||
"description": "OK",
|
||||
"schema": {
|
||||
"$ref": "#/definitions/httpapi.IdentityBatchResponse"
|
||||
}
|
||||
},
|
||||
"400": {
|
||||
"description": "Bad Request",
|
||||
"schema": {
|
||||
"$ref": "#/definitions/httpapi.ErrorEnvelope"
|
||||
}
|
||||
},
|
||||
"401": {
|
||||
"description": "Unauthorized",
|
||||
"schema": {
|
||||
"$ref": "#/definitions/httpapi.ErrorEnvelope"
|
||||
}
|
||||
},
|
||||
"403": {
|
||||
"description": "Forbidden",
|
||||
"schema": {
|
||||
"$ref": "#/definitions/httpapi.ErrorEnvelope"
|
||||
}
|
||||
},
|
||||
"404": {
|
||||
"description": "Not Found",
|
||||
"schema": {
|
||||
"$ref": "#/definitions/httpapi.ErrorEnvelope"
|
||||
}
|
||||
},
|
||||
"500": {
|
||||
"description": "Internal Server Error",
|
||||
"schema": {
|
||||
"$ref": "#/definitions/httpapi.ErrorEnvelope"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/admin/users/{userID}": {
|
||||
"delete": {
|
||||
"security": [
|
||||
@@ -5600,7 +5738,7 @@
|
||||
"BearerAuth": []
|
||||
}
|
||||
],
|
||||
"description": "返回当前本地用户可管理的 API Key 访问规则。",
|
||||
"description": "返回当前本地用户拥有的 API Key 访问规则；不会混入其他用户或其他 API Key 的规则。",
|
||||
"produces": [
|
||||
"application/json"
|
||||
],
|
||||
@@ -5649,7 +5787,7 @@
|
||||
"BearerAuth": []
|
||||
}
|
||||
],
|
||||
"description": "当前本地用户为自己的 API Key 批量新增、更新或删除可访问资源。",
|
||||
"description": "当前本地用户为自己的 API Key 批量新增、更新或删除白名单/拒绝资源；Key 无 allow 时继承父级范围，存在 allow 后仅允许命中项。",
|
||||
"consumes": [
|
||||
"application/json"
|
||||
],
|
||||
@@ -5718,7 +5856,7 @@
|
||||
"BearerAuth": []
|
||||
}
|
||||
],
|
||||
"description": "按当前用户自身的用户、租户和用户组权限返回可分配给 API Key 的启用模型，不受任何 API Key 权限规则影响。",
|
||||
"description": "按当前用户自身的租户、用户组和用户分层白名单返回可分配给 API Key 的启用模型，不应用任何 API Key 层规则。",
|
||||
"produces": [
|
||||
"application/json"
|
||||
],
|
||||
@@ -5817,7 +5955,7 @@
|
||||
"BearerAuth": []
|
||||
}
|
||||
],
|
||||
"description": "返回指定 API Key 所属用户组允许、全局启用且符合 KEY scope 的平台来源，并附带已有规则有效性诊断。",
|
||||
"description": "返回全局启用、命中指定 API Key 的租户/用户组/用户基线且符合 Key scope 的可分配平台来源；当前 Key 的 allow/deny 不缩减候选，仅作为已有规则有效性诊断返回。",
|
||||
"produces": [
|
||||
"application/json"
|
||||
],
|
||||
@@ -7725,7 +7863,7 @@
|
||||
"BearerAuth": []
|
||||
}
|
||||
],
|
||||
"description": "按当前用户权限返回可用于 Playground 或 API 调用的模型列表。",
|
||||
"description": "按全局启用、租户、用户组、用户、当前 API Key 分层白名单及 scope 的交集返回可用于 Playground 或 API 调用的平台来源；其他主体规则不参与求值。",
|
||||
"produces": [
|
||||
"application/json"
|
||||
],
|
||||
@@ -7823,7 +7961,7 @@
|
||||
"BearerAuth": []
|
||||
}
|
||||
],
|
||||
"description": "按当前用户权限返回可用于 Playground 或 API 调用的模型列表。",
|
||||
"description": "按全局启用、租户、用户组、用户、当前 API Key 分层白名单及 scope 的交集返回可用于 Playground 或 API 调用的平台来源；其他主体规则不参与求值。",
|
||||
"produces": [
|
||||
"application/json"
|
||||
],
|
||||
@@ -10345,7 +10483,7 @@
|
||||
"BearerAuth": []
|
||||
}
|
||||
],
|
||||
"description": "按当前身份、API Key 访问规则及 scope 返回去重后的逻辑模型列表。",
|
||||
"description": "按全局启用、租户、用户组、用户、当前 API Key 分层白名单及 scope 的交集返回去重后的逻辑模型列表；其他主体规则不参与求值。",
|
||||
"produces": [
|
||||
"application/json"
|
||||
],
|
||||
@@ -11217,6 +11355,29 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"httpapi.IdentityBatchResponse": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"action": {
|
||||
"type": "string",
|
||||
"example": "disable"
|
||||
},
|
||||
"affectedCount": {
|
||||
"type": "integer",
|
||||
"example": 2
|
||||
},
|
||||
"ids": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"requestedCount": {
|
||||
"type": "integer",
|
||||
"example": 2
|
||||
}
|
||||
}
|
||||
},
|
||||
"httpapi.ImageVectorizeRequest": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
@@ -15263,6 +15424,25 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"store.IdentityBatchInput": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"action": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"enable",
|
||||
"disable",
|
||||
"delete"
|
||||
]
|
||||
},
|
||||
"ids": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"store.LocalLoginInput": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
|
||||
+132
-10
@@ -586,6 +586,22 @@ definitions:
|
||||
example: easyai-ai-gateway
|
||||
type: string
|
||||
type: object
|
||||
httpapi.IdentityBatchResponse:
|
||||
properties:
|
||||
action:
|
||||
example: disable
|
||||
type: string
|
||||
affectedCount:
|
||||
example: 2
|
||||
type: integer
|
||||
ids:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
requestedCount:
|
||||
example: 2
|
||||
type: integer
|
||||
type: object
|
||||
httpapi.ImageVectorizeRequest:
|
||||
properties:
|
||||
cleanupLevel:
|
||||
@@ -3353,6 +3369,19 @@ definitions:
|
||||
transactionType:
|
||||
type: string
|
||||
type: object
|
||||
store.IdentityBatchInput:
|
||||
properties:
|
||||
action:
|
||||
enum:
|
||||
- enable
|
||||
- disable
|
||||
- delete
|
||||
type: string
|
||||
ids:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
type: object
|
||||
store.LocalLoginInput:
|
||||
properties:
|
||||
account:
|
||||
@@ -4330,7 +4359,8 @@ info:
|
||||
paths:
|
||||
/api/admin/access-rules:
|
||||
get:
|
||||
description: 管理端返回用户组、租户、用户或 API Key 到平台、平台模型、基础模型的访问规则。
|
||||
description: 管理端返回用户组、租户、用户或 API Key 到平台、平台模型、基础模型的分层访问规则。主体当前层无 allow 时继承上级，存在
|
||||
allow 时仅允许白名单，deny 始终优先。
|
||||
produces:
|
||||
- application/json
|
||||
responses:
|
||||
@@ -4358,7 +4388,7 @@ paths:
|
||||
post:
|
||||
consumes:
|
||||
- application/json
|
||||
description: 管理端创建一条访问控制规则。
|
||||
description: 管理端创建一条访问控制规则；同一主体层存在任意有效 allow 后该层启用白名单，deny 始终优先。
|
||||
parameters:
|
||||
- description: 访问规则请求
|
||||
in: body
|
||||
@@ -4489,7 +4519,7 @@ paths:
|
||||
post:
|
||||
consumes:
|
||||
- application/json
|
||||
description: 管理端为同一主体批量新增、更新或删除资源访问规则。
|
||||
description: 管理端为同一主体批量新增、更新或删除资源访问规则。清空该主体全部 allow 会恢复上级继承。
|
||||
parameters:
|
||||
- description: 访问规则批量请求
|
||||
in: body
|
||||
@@ -7508,6 +7538,50 @@ paths:
|
||||
summary: 更新用户组
|
||||
tags:
|
||||
- identity
|
||||
/api/admin/user-groups/batch:
|
||||
post:
|
||||
consumes:
|
||||
- application/json
|
||||
description: 管理端原子批量启用、禁用或删除最多 500 个用户组；删除时同步删除其访问规则，关联默认用户组外键按数据库约束置空。
|
||||
parameters:
|
||||
- description: 用户组批量操作
|
||||
in: body
|
||||
name: input
|
||||
required: true
|
||||
schema:
|
||||
$ref: '#/definitions/store.IdentityBatchInput'
|
||||
produces:
|
||||
- application/json
|
||||
responses:
|
||||
"200":
|
||||
description: OK
|
||||
schema:
|
||||
$ref: '#/definitions/httpapi.IdentityBatchResponse'
|
||||
"400":
|
||||
description: Bad Request
|
||||
schema:
|
||||
$ref: '#/definitions/httpapi.ErrorEnvelope'
|
||||
"401":
|
||||
description: Unauthorized
|
||||
schema:
|
||||
$ref: '#/definitions/httpapi.ErrorEnvelope'
|
||||
"403":
|
||||
description: Forbidden
|
||||
schema:
|
||||
$ref: '#/definitions/httpapi.ErrorEnvelope'
|
||||
"404":
|
||||
description: Not Found
|
||||
schema:
|
||||
$ref: '#/definitions/httpapi.ErrorEnvelope'
|
||||
"500":
|
||||
description: Internal Server Error
|
||||
schema:
|
||||
$ref: '#/definitions/httpapi.ErrorEnvelope'
|
||||
security:
|
||||
- BearerAuth: []
|
||||
summary: 批量操作用户组
|
||||
tags:
|
||||
- identity
|
||||
/api/admin/users:
|
||||
get:
|
||||
description: 管理端返回网关用户列表及钱包摘要。
|
||||
@@ -7763,6 +7837,50 @@ paths:
|
||||
summary: 充值用户钱包余额
|
||||
tags:
|
||||
- billing
|
||||
/api/admin/users/batch:
|
||||
post:
|
||||
consumes:
|
||||
- application/json
|
||||
description: 管理端原子批量启用、禁用或软删除最多 500 个用户；任一目标不存在时整批不变更。
|
||||
parameters:
|
||||
- description: 用户批量操作
|
||||
in: body
|
||||
name: input
|
||||
required: true
|
||||
schema:
|
||||
$ref: '#/definitions/store.IdentityBatchInput'
|
||||
produces:
|
||||
- application/json
|
||||
responses:
|
||||
"200":
|
||||
description: OK
|
||||
schema:
|
||||
$ref: '#/definitions/httpapi.IdentityBatchResponse'
|
||||
"400":
|
||||
description: Bad Request
|
||||
schema:
|
||||
$ref: '#/definitions/httpapi.ErrorEnvelope'
|
||||
"401":
|
||||
description: Unauthorized
|
||||
schema:
|
||||
$ref: '#/definitions/httpapi.ErrorEnvelope'
|
||||
"403":
|
||||
description: Forbidden
|
||||
schema:
|
||||
$ref: '#/definitions/httpapi.ErrorEnvelope'
|
||||
"404":
|
||||
description: Not Found
|
||||
schema:
|
||||
$ref: '#/definitions/httpapi.ErrorEnvelope'
|
||||
"500":
|
||||
description: Internal Server Error
|
||||
schema:
|
||||
$ref: '#/definitions/httpapi.ErrorEnvelope'
|
||||
security:
|
||||
- BearerAuth: []
|
||||
summary: 批量操作用户
|
||||
tags:
|
||||
- identity
|
||||
/api/playground/api-keys:
|
||||
get:
|
||||
description: 返回当前本地用户可在 Playground 中直接使用的 API Key 和 secret。
|
||||
@@ -7938,7 +8056,8 @@ paths:
|
||||
- api-keys
|
||||
/api/v1/api-keys/{apiKeyID}/assignable-models:
|
||||
get:
|
||||
description: 返回指定 API Key 所属用户组允许、全局启用且符合 KEY scope 的平台来源，并附带已有规则有效性诊断。
|
||||
description: 返回全局启用、命中指定 API Key 的租户/用户组/用户基线且符合 Key scope 的可分配平台来源；当前 Key 的
|
||||
allow/deny 不缩减候选，仅作为已有规则有效性诊断返回。
|
||||
parameters:
|
||||
- description: API Key ID
|
||||
in: path
|
||||
@@ -8057,7 +8176,7 @@ paths:
|
||||
- api-keys
|
||||
/api/v1/api-keys/access-rules:
|
||||
get:
|
||||
description: 返回当前本地用户可管理的 API Key 访问规则。
|
||||
description: 返回当前本地用户拥有的 API Key 访问规则；不会混入其他用户或其他 API Key 的规则。
|
||||
produces:
|
||||
- application/json
|
||||
responses:
|
||||
@@ -8090,7 +8209,8 @@ paths:
|
||||
post:
|
||||
consumes:
|
||||
- application/json
|
||||
description: 当前本地用户为自己的 API Key 批量新增、更新或删除可访问资源。
|
||||
description: 当前本地用户为自己的 API Key 批量新增、更新或删除白名单/拒绝资源；Key 无 allow 时继承父级范围，存在 allow
|
||||
后仅允许命中项。
|
||||
parameters:
|
||||
- description: API Key 访问规则批量请求，subjectType 必须为 api_key
|
||||
in: body
|
||||
@@ -8133,7 +8253,7 @@ paths:
|
||||
/api/v1/api-keys/assignable-models:
|
||||
get:
|
||||
deprecated: true
|
||||
description: 按当前用户自身的用户、租户和用户组权限返回可分配给 API Key 的启用模型，不受任何 API Key 权限规则影响。
|
||||
description: 按当前用户自身的租户、用户组和用户分层白名单返回可分配给 API Key 的启用模型，不应用任何 API Key 层规则。
|
||||
produces:
|
||||
- application/json
|
||||
responses:
|
||||
@@ -9277,7 +9397,8 @@ paths:
|
||||
- agent-resources
|
||||
/api/v1/platform-models:
|
||||
get:
|
||||
description: 按当前用户权限返回可用于 Playground 或 API 调用的模型列表。
|
||||
description: 按全局启用、租户、用户组、用户、当前 API Key 分层白名单及 scope 的交集返回可用于 Playground 或 API
|
||||
调用的平台来源；其他主体规则不参与求值。
|
||||
parameters:
|
||||
- description: 模型可选场景；不传时保持原有行为
|
||||
enum:
|
||||
@@ -9339,7 +9460,8 @@ paths:
|
||||
- playground
|
||||
/api/v1/playground/models:
|
||||
get:
|
||||
description: 按当前用户权限返回可用于 Playground 或 API 调用的模型列表。
|
||||
description: 按全局启用、租户、用户组、用户、当前 API Key 分层白名单及 scope 的交集返回可用于 Playground 或 API
|
||||
调用的平台来源；其他主体规则不参与求值。
|
||||
parameters:
|
||||
- description: 模型可选场景；不传时保持原有行为
|
||||
enum:
|
||||
@@ -10974,7 +11096,7 @@ paths:
|
||||
- static
|
||||
/v1/models:
|
||||
get:
|
||||
description: 按当前身份、API Key 访问规则及 scope 返回去重后的逻辑模型列表。
|
||||
description: 按全局启用、租户、用户组、用户、当前 API Key 分层白名单及 scope 的交集返回去重后的逻辑模型列表；其他主体规则不参与求值。
|
||||
produces:
|
||||
- application/json
|
||||
responses:
|
||||
|
||||
Reference in New Issue
Block a user