refactor(auth): 移除 RO/RW 权限机制并完善配置历史

- 删除 GrantPermissons 与 buildPermissionCode，权限只判断超管、组管理员和应用负责人
- GetHistory 增加权限校验，避免越权读取配置历史
- 配置历史改为分页查询，前端历史弹窗增加分页并处理删除后的页码回退

server/internal/service/auth.go

@@ -45,12 +45,11 @@ func (s *AuthService) Login(userName, password string) (string, *model.LoginUser
 	}
 
 	userInfo := &model.LoginUserInfo{
-		Id:              strconv.Itoa(user.Id),
-		Name:            user.Name,
-		Type:            user.Type,
-		GroupId:         user.GroupId,
-		GrantAppIds:     make([]int, 0),
-		GrantPermissons: make([]string, 0),
+		Id:          strconv.Itoa(user.Id),
+		Name:        user.Name,
+		Type:        user.Type,
+		GroupId:     user.GroupId,
+		GrantAppIds: make([]int, 0),
 	}
 
 	// load permissions
@@ -120,12 +119,11 @@ func (s *AuthService) ValidateToken(tokenString string) (*model.LoginUserInfo, e
 	}
 
 	userInfo := &model.LoginUserInfo{
-		Id:              strconv.Itoa(user.Id),
-		Name:            user.Name,
-		Type:            user.Type,
-		GroupId:         user.GroupId,
-		GrantAppIds:     make([]int, 0),
-		GrantPermissons: make([]string, 0),
+		Id:          strconv.Itoa(user.Id),
+		Name:        user.Name,
+		Type:        user.Type,
+		GroupId:     user.GroupId,
+		GrantAppIds: make([]int, 0),
 	}
 	s.loadPermissions(userInfo, user.Id)
 	return userInfo, nil
@@ -146,10 +144,5 @@ func (s *AuthService) loadPermissions(userInfo *model.LoginUserInfo, userId int)
 	}
 	for _, app := range apps {
 		userInfo.GrantAppIds = append(userInfo.GrantAppIds, app.Id)
-		userInfo.GrantPermissons = append(userInfo.GrantPermissons, buildPermissionCode(app.Id, "RW"))
 	}
 }
-
-func buildPermissionCode(appId int, operate string) string {
-	return strconv.Itoa(appId) + ":" + operate
-}

server/internal/service/permission.go

@@ -18,19 +18,18 @@ func (s *PermissionService) RequireSuperAdmin(userInfo *model.LoginUserInfo) err
 	return nil
 }
 
-func (s *PermissionService) RequirePermission(userInfo *model.LoginUserInfo, groupId *int, appId *int, operate string) error {
+func (s *PermissionService) RequirePermission(userInfo *model.LoginUserInfo, groupId *int, appId *int) error {
 	if userInfo.IsSuperAdmin() {
 		return nil
 	}
-	if groupId != nil && userInfo.GroupId != nil && *groupId == *userInfo.GroupId {
+	if userInfo.IsGroupAdmin() && groupId != nil && userInfo.GroupId != nil && *groupId == *userInfo.GroupId {
 		return nil
 	}
 	if appId == nil || *appId == 0 {
 		return errors.New("你没有全局配置权限")
 	}
-	permCode := buildPermissionCode(*appId, operate)
-	for _, p := range userInfo.GrantPermissons {
-		if p == permCode {
+	for _, id := range userInfo.GrantAppIds {
+		if id == *appId {
 			return nil
 		}
 	}

server/internal/service/permission_test.go

@@ -0,0 +1,93 @@
+package service
+
+import (
+	"testing"
+
+	"kenaito-conf/server/internal/model"
+)
+
+func TestRequirePermission(t *testing.T) {
+	svc := NewPermissionService()
+	groupID := 1
+	otherGroupID := 2
+	appID := 10
+
+	tests := []struct {
+		name    string
+		user    *model.LoginUserInfo
+		groupId *int
+		appId   *int
+		wantErr bool
+	}{
+		{
+			name:    "super admin can access anything",
+			user:    &model.LoginUserInfo{Type: "superAdmin"},
+			groupId: &groupID,
+			appId:   &appID,
+		},
+		{
+			name:    "group admin can access own group",
+			user:    &model.LoginUserInfo{Type: "groupAdmin", GroupId: &groupID},
+			groupId: &groupID,
+			appId:   &appID,
+		},
+		{
+			name:    "group admin cannot access other group",
+			user:    &model.LoginUserInfo{Type: "groupAdmin", GroupId: &groupID},
+			groupId: &otherGroupID,
+			appId:   &appID,
+			wantErr: true,
+		},
+		{
+			name:    "owner can access app",
+			user:    &model.LoginUserInfo{Type: "user", GroupId: &groupID, GrantAppIds: []int{appID}},
+			groupId: &groupID,
+			appId:   &appID,
+		},
+		{
+			name:    "owner can access app across group",
+			user:    &model.LoginUserInfo{Type: "user", GroupId: &otherGroupID, GrantAppIds: []int{appID}},
+			groupId: &groupID,
+			appId:   &appID,
+		},
+		{
+			name:    "normal group member cannot access app without ownership",
+			user:    &model.LoginUserInfo{Type: "user", GroupId: &groupID},
+			groupId: &groupID,
+			appId:   &appID,
+			wantErr: true,
+		},
+		{
+			name:    "normal user cannot access global config",
+			user:    &model.LoginUserInfo{Type: "user", GroupId: &groupID},
+			groupId: &groupID,
+			appId:   nil,
+			wantErr: true,
+		},
+		{
+			name:    "group admin can access own global config",
+			user:    &model.LoginUserInfo{Type: "groupAdmin", GroupId: &groupID},
+			groupId: &groupID,
+			appId:   nil,
+		},
+		{
+			name:    "group admin cannot access other global config",
+			user:    &model.LoginUserInfo{Type: "groupAdmin", GroupId: &groupID},
+			groupId: &otherGroupID,
+			appId:   nil,
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := svc.RequirePermission(tt.user, tt.groupId, tt.appId)
+			if tt.wantErr && err == nil {
+				t.Fatalf("expected an error, got nil")
+			}
+			if !tt.wantErr && err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+		})
+	}
+}