feat(permission): add business write permission (BWP) for system administrators (#813) by actiontech-bot · Pull Request #613 · actiontech/dms

actiontech-bot · 2026-05-12T06:07:07Z

User description

Add BusinessWritePermission field to User model, allowing system administrators to have their business write capabilities toggled independently of resource management.

Key changes:

User model extended with business_write_permission field (default: true)
Permission functions (CanOpGlobal, IsUserProjectAdmin, GetCanOpDBUsers) extended with isBusinessWrite parameter
Candidate set filtering respects BWP=off for system administrators
Notification entry filters out BWP-disabled admins
Project director role migration (idempotent B-class)
dms-common API extended with GetUserOpPermissionWithBWP

Fixes actiontech/dms-ee#813

Description

新增 BusinessWritePermission 字段至 User 模型，控制系统管理员业务写权
修改 OpPermission 及相关权限校验函数，添加 isBusinessWrite 参数
更新 API、Swagger 定义及数据库模型以支持新字段
增加单元测试覆盖业务写权及权限判断逻辑，更新国际化提示信息

Diagram Walkthrough

flowchart LR
  A["新增 BusinessWritePermission 字段"] --> B["修改 User 模型与新增/更新接口"]
  B --> C["更新权限检查函数 (CanOpGlobal, CanOpProject 等)"]
  C --> D["调整 API、Swagger、数据库模型"]
  D --> E["添加并修改单元测试与国际化消息"]

File Walkthrough

Relevant files

Enhancement

20 files

user.go `为用户增添 BusinessWritePermission 字段及接口更新`	+4/-0
cloudbeaver.go `修改 opPermissionVerifyUsecase 调用增加 isBusinessWrite 参数`	+1/-1
environment_tag.go `更新 CanOpProject 调用，传入业务写权标志`	+3/-3
maintenance_time.go `调整 CanOpGlobal 权限调用传入业务写权标志`	+1/-1
op_permission.go `删除冗余权限项，调整系统管理员权限判断逻辑`	+1/-7
op_permission_verify.go `扩展权限验证接口，添加 isBusinessWrite 参数及辅助函数`	+105/-16
project.go `调整项目更新中的权限判断传入业务写权参数`	+1/-1
role.go `更新角色操作中全局权限检查调用逻辑`	+3/-3
user.go `为用户结构新增 BusinessWritePermission 字段及更新相关逻辑`	+91/-54
user_group.go `修改用户组操作中全局权限校验调用更新参数`	+3/-3
business_tag.go `更新业务标签接口中权限检查调用的参数调整`	+3/-3
cloudbeaver.go `传递 userRepo 参数以支持 BusinessWritePermission 校验`	+2/-2
configuration.go `更新配置服务中全局权限调用，增加业务写权参数`	+24/-4
member.go `调整项目成员服务调用 IsUserProjectAdmin 传入业务写权标志`	+1/-1
service.go `更新服务初始化时 opPermissionVerifyUsecase 创建方式`	+2/-2
user.go `修改新增及更新用户接口传递 BusinessWritePermission 字段`	+69/-47
convert.go `更新数据转换逻辑包含 BusinessWritePermission 字段`	+9/-7
model.go `更新数据库模型增加 BusinessWritePermission 字段定义`	+4/-1
sql_workbench_service.go `调整 SQL Workbench 中全局权限调用传参更新`	+3/-3
user.go `新增 GetUserOpPermissionWithBWP 接口支持业务写权字段`	+26/-0

Tests

2 files

op_permission_verify_test.go `增加单元测试覆盖业务写权相关逻辑`	+491/-0
user_test.go `添加用户业务写权逻辑的单元测试案例`	+276/-0

Documentation

6 files

message_zh.go `增加修改业务写权提示国际化消息`	+1/-0
user.go `添加 BusinessWritePermission 字段到用户 API 定义`	+6/-0
swagger.json `更新 Swagger JSON 定义包含业务写权字段`	+26/-1
swagger.yaml `更新 Swagger YAML 文件，添加 BusinessWritePermission 属性`	+21/-1
active.en.toml `更新英文国际化文件，加入业务写权提示消息`	+1/-0
active.zh.toml `更新中文国际化文件，增加业务写权提示消息`	+1/-0

Additional files

1 files

storage.go	+1/-0

…migration - User model (biz + storage) 新增 BusinessWritePermission bool 字段， GORM tag: column=business_write_permission, default=true, not null - 新增 migrateProjectDirectorToSystemAdmin 迁移函数，将持有项目总监(700001)的用户迁移为系统管理员(700017)，幂等可重入 - AutoMigrate 中调用迁移函数，schema 变更后自动执行 DML - initOpPermission 种子数据移除项目总监(700001)条目 - convertBizUser/convertModelUser 双向映射新增字段 - CreateUserArgs 新增 BusinessWritePermission *bool，newUser 默认 true - initUsers 内置用户显式设置 BusinessWritePermission=true data-upgrade: B-20260508_project_director_to_system_admin Fixes #813

…ation 覆盖 design.md 5.1.4 测试矩阵的 4 个场景： - only_700001: 仅持有项目总监 -> 迁移为系统管理员 - both_700001_700017: 同时持有 -> 仅保留系统管理员 - repeat_migration: 重复执行 -> 无变化无报错 - migrated_user_bwp: 迁移后 BWP 默认 true 测试依赖 test_util.go 提供的 MySQL 测试环境 Fixes #813

…unctions - Add BusinessWritePermission *bool to UpdateUser and AddUser request structs - Add BusinessWritePermission bool to GetUser, ListUser, GetUserOpPermission response structs - Add isBusinessWrite bool param to CanOpGlobal, CanOpProject, IsUserProjectAdmin, GetCanOpDBUsers - When isBusinessWrite=true and user BWP=false, admin/sys admin identity does not grant access - Add userRepo to OpPermissionVerifyUsecase for querying user BWP in permission checks - Implement role switch reset: non-system-admin users always have BWP=true - Service layer passes BWP between API and biz layers - All existing callers pass isBusinessWrite=false to preserve current behavior Refs: dms-ee#813

…ameter

…udbeaver - cloudbeaver.go: CanOpGlobal call changed to isBusinessWrite=true (SQL workbench entry is a business-write operation) - op_permission_verify_test.go: 22 test cases covering CanOpGlobal, IsUserProjectAdmin, and GetCanOpDBUsers with BWP combinations from design.md 5.1.1 test matrix - user_test.go: 5 test cases covering UpdateUser BWP field handling from design.md 5.1.5 test matrix (set false/true, role switch reset, non-admin ignored, global management user)

…i18n messages Filter out system administrators with BusinessWritePermission=false in the DMS NotifyMessage service entry point. This covers notifications sent by SQLE via DMS API (dmsobject.Notify), so SQLE side needs no modification. Also add i18n message for BWP audit record.

Add a new function GetUserOpPermissionWithBWP that returns BusinessWritePermission alongside OpPermissionList and IsAdmin. This allows SQLE to check BWP status when verifying user permissions, enabling server-side enforcement of BWP policy. Issue: #813

…sers When admin/sys has BusinessWritePermission=false, the GetUser API no longer hardcodes IsManager=true for all projects. Instead it checks actual project-level authorization from user_op_permissions, so the frontend useBusinessWritePermission hook can correctly detect that admin is NOT a project manager and properly disable business write buttons. Fixes #813

…ission (#813) The sys user (700201) is used exclusively for internal DMS-to-SQLE communication (e.g., SQL audit during data export workflow creation). It must never be restricted by BWP settings, so always report business_write_permission=true for the sys user regardless of the database value. This fixes the 4011 error when creating data export workflows.

…orInternal (#813) ListMembersForInternal previously passed isBusinessWrite=false to IsUserProjectAdmin, causing built-in admin/sys users to always be marked as project admins regardless of their BWP status. This led to admin appearing in workflow approval candidate sets even when BWP was off and no datasource permissions were assigned. Change isBusinessWrite to true so that admin/sys users with BWP=off must have explicit project-level admin permissions to be included as project admins in the internal member listing.

…ests

github-actions · 2026-05-12T08:32:47Z

PR Reviewer Guide 🔍

(Review updated until commit `91cb204`)

⏱️ Estimated effort to review: 5 🔵🔵🔵🔵🔵
🧪 PR contains tests
🔒 No security concerns identified
⚡ Recommended focus areas for review 默认值矛盾在模型定义中，新添加的业务写权字段的默认值被设置为 false，而需求说明中及部分代码逻辑预期默认值为 true。请核实并统一默认值设定，确保系统管理员在权限判断时符合设计预期。 // 业务写权开关，默认 flase BusinessWritePermission bool `json:"business_write_permission" gorm:"column:business_write_permission;default:false;not null"`

github-actions · 2026-05-12T08:33:22Z

Persistent review updated to latest commit 3c0fbfe

github-actions · 2026-05-12T08:33:22Z

PR Code Suggestions ✨

Latest suggestions up to 406fafa

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	统一默认值设置建议检查数据库模型中 `BusinessWritePermission` 字段的默认值，目前默认值为 false，而业务逻辑以及新用户初始化均设定该值为 true。这种默认值不一致可能导致数据写入时与预期不符，从而引发权限判断错误。 internal/dms/storage/model/model.go [152] -BusinessWritePermission bool `json:"business_write_permission" gorm:"column:business_write_permission;default:false;not null"` +BusinessWritePermission bool `json:"business_write_permission" gorm:"column:business_write_permission;default:true;not null"` Suggestion importance[1-10]: 8 __ Why: The suggestion addresses a critical inconsistency where the `BusinessWritePermission` field default is set to false in the model, while business logic expects it to be true. Changing the default to true ensures that system administrators have the correct permission setting by default.	Medium

Previous suggestions

Suggestions up to commit 3c0fbfe

Category	Suggestion	Impact
Possible issue	调整数据库默认值建议将该字段在数据库模型中的默认值与应用层默认值统一，当前新增业务逻辑默认设定为 true，但数据库字段默认值为 false，这会导致不一致的行为。请将默认值修改为 true，以确保系统管理员业务写权开关的一致性和正确性。 internal/dms/storage/model/model.go [152] -BusinessWritePermission bool `json:"business_write_permission" gorm:"column:business_write_permission;default:false;not null"` +BusinessWritePermission bool `json:"business_write_permission" gorm:"column:business_write_permission;default:true;not null"` Suggestion importance[1-10]: 8 __ Why: The suggestion correctly identifies an inconsistency between the application’s intended default (true) for the business write permission and the model’s default value (false). Updating the default to true will ensure consistency and prevent unexpected behavior.	Medium

Suggestions up to commit 3c0fbfe

Category	Suggestion	Impact
Possible issue	修正数据库默认值建议将 `BusinessWritePermission` 字段的默认值从 false 修改为 true，因为注释中说明默认应该为 true。这可以避免因默认权限错误导致系统管理员的业务写操作权限判断异常，从而引发潜在的安全和逻辑问题。 internal/dms/storage/model/model.go [152] -BusinessWritePermission bool `json:"business_write_permission" gorm:"column:business_write_permission;default:false;not null"` +BusinessWritePermission bool `json:"business_write_permission" gorm:"column:business_write_permission;default:true;not null"` Suggestion importance[1-10]: 8 __ Why: 该建议将 `BusinessWritePermission` 字段的默认值从 false 改为 true，以与注释中默认 true 的描述保持一致，从而避免因默认值错误引起业务写权限判断异常。	Medium

…sion field

github-actions · 2026-05-12T09:26:06Z

Persistent review updated to latest commit 406fafa

…value from 'true' to 'false'

github-actions · 2026-05-12T09:42:11Z

Persistent review updated to latest commit 91cb204

github-actions · 2026-05-12T09:45:45Z

Failed to generate code suggestions for PR

LordofAvernus and others added 11 commits May 12, 2026 05:50

feat(permission): adapt sql_workbench callers for isBusinessWrite par…

20014e2

…ameter

refactor(permission): remove project director migration and related t…

3c0fbfe

…ests

iwanghc force-pushed the dms/feat-813 branch from 5ddcc25 to 3c0fbfe Compare May 12, 2026 08:31

chore(api): update swagger definitions to include BusinessWritePermis…

406fafa

…sion field

iwanghc approved these changes May 12, 2026

View reviewed changes

fix(model): correct comment typo for BusinessWritePermission default …

91cb204

…value from 'true' to 'false'

iwanghc merged commit 335c65b into main May 12, 2026
1 of 2 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(permission): add business write permission (BWP) for system administrators (#813)#613

feat(permission): add business write permission (BWP) for system administrators (#813)#613
iwanghc merged 13 commits into
mainfrom
dms/feat-813

actiontech-bot commented May 12, 2026 •

edited by github-actions Bot

Loading

Uh oh!

github-actions Bot commented May 12, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 12, 2026

Uh oh!

github-actions Bot commented May 12, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 12, 2026

Uh oh!

github-actions Bot commented May 12, 2026

Uh oh!

github-actions Bot commented May 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

actiontech-bot commented May 12, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

Description

Diagram Walkthrough

File Walkthrough

Uh oh!

github-actions Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Reviewer Guide 🔍

(Review updated until commit 91cb204)

Uh oh!

github-actions Bot commented May 12, 2026

Uh oh!

github-actions Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Code Suggestions ✨

Previous suggestions

Uh oh!

github-actions Bot commented May 12, 2026

Uh oh!

github-actions Bot commented May 12, 2026

Uh oh!

github-actions Bot commented May 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

actiontech-bot commented May 12, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented May 12, 2026 •

edited

Loading

(Review updated until commit `91cb204`)

github-actions Bot commented May 12, 2026 •

edited

Loading