admin

package
v0.5.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 15, 2026 License: Apache-2.0 Imports: 82 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func BuildAccessTokenClaims added in v0.4.2 

func BuildAccessTokenClaims(input AccessTokenInput) (*auth.AccessTokenClaims, error)

BuildAccessTokenClaims constructs claims without querying a database, selecting a key, signing, or generating implicit identifiers.

func GetPageSize 

func GetPageSize(ctx context.Context, pageSize int32) int32

GetPageSize 实现分页参数获取

func GetPageSizeByStructure 

func GetPageSizeByStructure(ctx context.Context, pageSize int32, structure adminv1.Structure) int32

GetPageSizeByStructure 根据 Structure 返回分页参数

func GetUserID 

func GetUserID(ctx context.Context) (int64, error)

GetUserID 获取用户 ID

func I18NName 

func I18NName(name string) string

I18NName 用于获取 i18n name

func MetadataJSON 

func MetadataJSON(metadata map[string]string) string

func MetadataParse 

func MetadataParse(rawBody string) map[string]string

Types

type AccessTokenInput added in v0.4.2 

type AccessTokenInput struct {
	Subject           string
	PreferredUsername string
	Email             string
	EmailVerified     bool
	Roles             []string
	Groups            []string
	Tenant            string
	ClientID          string
	Scope             string
	TTL               time.Duration
	IssuedAt          time.Time
	JWTID             string
}

AccessTokenInput contains only data needed to build a JWT Access Token. Database access, key selection, time and identifier generation stay outside BuildAccessTokenClaims so the constructor remains deterministic.

type AccessTokenIssuanceContext added in v0.4.2 

type AccessTokenIssuanceContext struct {
	ClientID string
	Scope    string
	// Tenant/Roles/Groups 为令牌声明的最终值：留空（""/nil）则对应声明不写入令牌
	// （json omitempty）。issuer 不再隐式回退，调用方须显式填入期望值——登录路径填
	// 静态用户自身配置，CreateAuthToken 按授权决策填入（留空即省略）。
	Tenant string
	Roles  []string
	Groups []string
	// PreferredUsername/Email 为令牌身份展示字段的覆盖值：非空则覆盖静态用户/DB profile
	// 自身值（仅 superadmin 可设置）。留空时，OmitIdentityFields=true（superadmin 签发）
	// 则不写入令牌（不回退自身）；OmitIdentityFields=false（登录/MFA/非 superadmin）则
	// 回退到静态用户/DB profile 自身值。subject 由签发路径决定（委托签发时为目标 user_id）。
	PreferredUsername string
	Email             string
	// EmailVerified 仅在 Email 非空时写入令牌（superadmin 可选）；其余签发路径取静态
	// 用户/DB profile 自身值或固定 false。
	EmailVerified bool
	// OmitIdentityFields 为 true 时，PreferredUsername/Email 留空即不写入令牌（不回退
	// 到调用方自身值）；仅 CreateAuthToken superadmin 路径置 true，其余签发路径保持 false。
	OmitIdentityFields bool
	TTL                time.Duration
}

AccessTokenIssuanceContext survives an MFA challenge. It intentionally does not contain tokens, credentials, signing keys, or authorization snapshots.

type KnownAdminAPI 

type KnownAdminAPI struct {
	// contains filtered or unexported fields
}

KnownAdminAPI xx

func New 

func New(opts ...Options) *KnownAdminAPI

New xx

func (*KnownAdminAPI) ChangeCurrentUserPassword added in v0.4.3 

func (a *KnownAdminAPI) ChangeCurrentUserPassword(ctx context.Context, req *adminv1.ChangeCurrentUserPasswordRequest) (*emptypb.Empty, error)

ChangeCurrentUserPassword updates an existing active LOCAL identity only.

func (*KnownAdminAPI) ConfirmAuthMFASetup 

func (a *KnownAdminAPI) ConfirmAuthMFASetup(ctx context.Context, req *adminv1.ConfirmAuthMFASetupRequest) (*adminv1.AuthToken, error)

ConfirmAuthMFASetup 登录态首次配置 MFA（确认）

func (*KnownAdminAPI) ConfirmCurrentUserMFA added in v0.4.3 

func (a *KnownAdminAPI) ConfirmCurrentUserMFA(ctx context.Context, req *adminv1.ConfirmCurrentUserMFARequest) (*adminv1.ConfirmCurrentUserMFAResponse, error)

ConfirmCurrentUserMFA confirms MFA setup for the authenticated subject.

func (*KnownAdminAPI) CreateAuthLogin 

func (a *KnownAdminAPI) CreateAuthLogin(ctx context.Context, req *adminv1.CreateAuthLoginRequest) (*adminv1.AuthToken, error)

CreateAuthLogin 创建登录认证

func (*KnownAdminAPI) CreateAuthProvider 

func (a *KnownAdminAPI) CreateAuthProvider(ctx context.Context, req *adminv1.CreateAuthProviderRequest) (*adminv1.AuthProvider, error)

CreateAuthProvider 创建认证提供方

func (*KnownAdminAPI) CreateAuthToken 

func (a *KnownAdminAPI) CreateAuthToken(ctx context.Context, req *adminv1.CreateAuthTokenRequest) (*adminv1.AuthToken, error)

CreateAuthToken 创建认证令牌

func (*KnownAdminAPI) CreateCredential 

func (a *KnownAdminAPI) CreateCredential(ctx context.Context, req *adminv1.CreateCredentialRequest) (*adminv1.Credential, error)

CreateCredential 创建凭证

func (*KnownAdminAPI) CreateDatabaseInitialize 

func (a *KnownAdminAPI) CreateDatabaseInitialize(ctx context.Context, req *adminv1.CreateDatabaseInitializeRequest) (*emptypb.Empty, error)

CreateDatabaseInitialize 幂等补全内置种子数据：已存在则跳过，缺失则创建。

func (*KnownAdminAPI) CreateDepartment 

func (a *KnownAdminAPI) CreateDepartment(ctx context.Context, req *adminv1.CreateDepartmentRequest) (*adminv1.Department, error)

CreateDepartment 创建部门 请求字段与 proto Department 定义对齐，支持：parent_id, code, display_name, type, status, sort_order, description, cost_center_code, budget_item_code, max_members, external_id, metadata；created_by/updated_by 从上下文获取

func (*KnownAdminAPI) CreateDepartmentMembers 

func (a *KnownAdminAPI) CreateDepartmentMembers(ctx context.Context, req *adminv1.CreateDepartmentMembersRequest) (*adminv1.CreateDepartmentMembersResponse, error)

CreateDepartmentMembers 创建部门成员（与 proto Membership 定义对齐）

func (*KnownAdminAPI) CreateGlobalSetting added in v0.4.4 

func (a *KnownAdminAPI) CreateGlobalSetting(ctx context.Context, req *adminv1.CreateGlobalSettingRequest) (*adminv1.GlobalSetting, error)

func (*KnownAdminAPI) CreateGroup 

func (a *KnownAdminAPI) CreateGroup(ctx context.Context, req *adminv1.CreateGroupRequest) (*adminv1.Group, error)

CreateGroup 创建用户组

func (*KnownAdminAPI) CreateGroupMembers 

func (a *KnownAdminAPI) CreateGroupMembers(ctx context.Context, req *adminv1.CreateGroupMembersRequest) (*adminv1.CreateGroupMembersResponse, error)

CreateGroupMembers 创建群组成员

func (*KnownAdminAPI) CreateMenu 

func (a *KnownAdminAPI) CreateMenu(ctx context.Context, req *adminv1.CreateMenuRequest) (*adminv1.Menu, error)

func (*KnownAdminAPI) CreateOAuth2Client 

func (a *KnownAdminAPI) CreateOAuth2Client(ctx context.Context, req *adminv1.CreateOAuth2ClientRequest) (*adminv1.CreateOAuth2ClientResponse, error)

CreateOAuth2Client 创建 OAuth2 客户端

func (*KnownAdminAPI) CreatePolicy 

func (a *KnownAdminAPI) CreatePolicy(ctx context.Context, req *adminv1.CreatePolicyRequest) (*adminv1.Policy, error)

CreatePolicy 创建策略

func (*KnownAdminAPI) CreateRole 

func (a *KnownAdminAPI) CreateRole(ctx context.Context, req *adminv1.CreateRoleRequest) (*adminv1.Role, error)

CreateRole 创建角色

func (*KnownAdminAPI) CreateRoleMembers 

func (a *KnownAdminAPI) CreateRoleMembers(ctx context.Context, req *adminv1.CreateRoleMembersRequest) (*adminv1.CreateRoleMembersResponse, error)

CreateRoleMembers 批量添加角色主体绑定。

func (*KnownAdminAPI) CreateRoleMenus 

func (a *KnownAdminAPI) CreateRoleMenus(ctx context.Context, req *adminv1.CreateRoleMenusRequest) (*adminv1.CreateRoleMenusResponse, error)

CreateRoleMenus 批量创建角色菜单关联

func (*KnownAdminAPI) CreateRolePolicies 

func (a *KnownAdminAPI) CreateRolePolicies(ctx context.Context, req *adminv1.CreateRolePoliciesRequest) (*adminv1.CreateRolePoliciesResponse, error)

func (*KnownAdminAPI) CreateUser 

func (a *KnownAdminAPI) CreateUser(ctx context.Context, req *adminv1.CreateUserRequest) (*adminv1.User, error)

CreateUser 创建用户

func (*KnownAdminAPI) DeleteAuthProvider 

func (a *KnownAdminAPI) DeleteAuthProvider(ctx context.Context, req *adminv1.DeleteAuthProviderRequest) (*emptypb.Empty, error)

DeleteAuthProvider 删除认证提供方

func (*KnownAdminAPI) DeleteCredential added in v0.4.1 

func (a *KnownAdminAPI) DeleteCredential(ctx context.Context, req *adminv1.DeleteCredentialRequest) (*emptypb.Empty, error)

DeleteCredential 删除凭证（软删除） 受保护（protected=true）的凭证不可删除

func (*KnownAdminAPI) DeleteDepartment 

func (a *KnownAdminAPI) DeleteDepartment(ctx context.Context, req *adminv1.DeleteDepartmentRequest) (*adminv1.Department, error)

DeleteDepartment moves a leaf department to the recycle bin. Authorization is enforced by IAM/OPA before this handler is called.

func (*KnownAdminAPI) DeleteDepartmentMember 

func (a *KnownAdminAPI) DeleteDepartmentMember(ctx context.Context, req *adminv1.DeleteDepartmentMemberRequest) (*emptypb.Empty, error)

DeleteDepartmentMember 删除部门成员

func (*KnownAdminAPI) DeleteGlobalSetting added in v0.4.4 

func (a *KnownAdminAPI) DeleteGlobalSetting(ctx context.Context, req *adminv1.DeleteGlobalSettingRequest) (*emptypb.Empty, error)

func (*KnownAdminAPI) DeleteGroup 

func (a *KnownAdminAPI) DeleteGroup(ctx context.Context, req *adminv1.DeleteGroupRequest) (*adminv1.Group, error)

DeleteGroup moves a group to the recycle bin. Authorization is enforced by the IAM/OPA interceptor before this handler is called.

func (*KnownAdminAPI) DeleteGroupMember 

func (a *KnownAdminAPI) DeleteGroupMember(ctx context.Context, req *adminv1.DeleteGroupMemberRequest) (*emptypb.Empty, error)

DeleteGroupMember 删除群组成员

func (*KnownAdminAPI) DeleteMenu 

func (a *KnownAdminAPI) DeleteMenu(ctx context.Context, req *adminv1.DeleteMenuRequest) (*emptypb.Empty, error)

func (*KnownAdminAPI) DeleteOAuth2Client 

func (a *KnownAdminAPI) DeleteOAuth2Client(ctx context.Context, req *adminv1.DeleteOAuth2ClientRequest) (*emptypb.Empty, error)

DeleteOAuth2Client 删除 OAuth2 客户端（软删除）

func (*KnownAdminAPI) DeletePolicy 

func (a *KnownAdminAPI) DeletePolicy(ctx context.Context, req *adminv1.DeletePolicyRequest) (*emptypb.Empty, error)

DeletePolicy 删除策略

func (*KnownAdminAPI) DeleteRole 

func (a *KnownAdminAPI) DeleteRole(ctx context.Context, req *adminv1.DeleteRoleRequest) (*emptypb.Empty, error)

DeleteRole 删除角色

func (*KnownAdminAPI) DeleteRoleMember 

func (a *KnownAdminAPI) DeleteRoleMember(ctx context.Context, req *adminv1.DeleteRoleMemberRequest) (*emptypb.Empty, error)

DeleteRoleMember 移除角色下的主体绑定。

func (*KnownAdminAPI) DeleteRoleMenu 

func (a *KnownAdminAPI) DeleteRoleMenu(ctx context.Context, req *adminv1.DeleteRoleMenuRequest) (*emptypb.Empty, error)

DeleteRoleMenu 删除角色下的菜单关联

func (*KnownAdminAPI) DeleteRolePolicy 

func (a *KnownAdminAPI) DeleteRolePolicy(ctx context.Context, req *adminv1.DeleteRolePolicyRequest) (*emptypb.Empty, error)

func (*KnownAdminAPI) DeleteUser added in v0.4.4 

func (a *KnownAdminAPI) DeleteUser(ctx context.Context, req *adminv1.DeleteUserRequest) (*adminv1.User, error)

DeleteUser moves a user to the recycle bin. Authorization is enforced by the IAM/OPA interceptor before this handler is called.

func (*KnownAdminAPI) DeleteUserMFA added in v0.4.4 

func (a *KnownAdminAPI) DeleteUserMFA(ctx context.Context, req *adminv1.DeleteUserMFARequest) (*emptypb.Empty, error)

DeleteUserMFA removes every MFA enrollment associated with a managed user. Authorization for this administrative operation is enforced by the policy layer before the RPC handler is invoked.

func (*KnownAdminAPI) DisableCurrentUserMFA added in v0.4.3 

func (a *KnownAdminAPI) DisableCurrentUserMFA(ctx context.Context, req *adminv1.DisableCurrentUserMFARequest) (*emptypb.Empty, error)

DisableCurrentUserMFA disables MFA for the authenticated subject.

func (*KnownAdminAPI) ExpungeDepartment added in v0.4.4 

func (a *KnownAdminAPI) ExpungeDepartment(ctx context.Context, req *adminv1.ExpungeDepartmentRequest) (*emptypb.Empty, error)

ExpungeDepartment permanently removes a soft-deleted department and its core polymorphic bindings. Department groups are intentionally a blocking weak reference so an undelete never points at an already-purged department.

func (*KnownAdminAPI) ExpungeGroup added in v0.4.4 

func (a *KnownAdminAPI) ExpungeGroup(ctx context.Context, req *adminv1.ExpungeGroupRequest) (*emptypb.Empty, error)

ExpungeGroup irreversibly removes a soft-deleted group and the core rows that reference it. Authorization is enforced by the IAM/OPA interceptor.

func (*KnownAdminAPI) ExpungeUser added in v0.4.4 

func (a *KnownAdminAPI) ExpungeUser(ctx context.Context, req *adminv1.ExpungeUserRequest) (*emptypb.Empty, error)

ExpungeUser irreversibly removes a soft-deleted user and the core rows that reference it. Authorization is enforced by the IAM/OPA interceptor.

func (*KnownAdminAPI) GetAuthCallback 

func (a *KnownAdminAPI) GetAuthCallback(ctx context.Context, req *adminv1.GetAuthCallbackRequest) (*adminv1.GetAuthCallbackResponse, error)

GetAuthCallback 处理 OAuth2.0 的回调

func (*KnownAdminAPI) GetAuthProvider 

func (a *KnownAdminAPI) GetAuthProvider(ctx context.Context, req *adminv1.GetAuthProviderRequest) (*adminv1.AuthProvider, error)

GetAuthProvider 获取认证提供方

func (*KnownAdminAPI) GetCredential added in v0.4.1 

func (a *KnownAdminAPI) GetCredential(ctx context.Context, req *adminv1.GetCredentialRequest) (*adminv1.Credential, error)

GetCredential 获取凭证详情

func (*KnownAdminAPI) GetCurrentUser added in v0.4.3 

func (a *KnownAdminAPI) GetCurrentUser(ctx context.Context, _ *adminv1.GetCurrentUserRequest) (*adminv1.CurrentUserProfile, error)

GetCurrentUser returns the self-service profile for the effective authenticated subject. The request intentionally cannot select a user.

func (*KnownAdminAPI) GetGlobalSettings 

func (a *KnownAdminAPI) GetGlobalSettings(ctx context.Context, req *adminv1.GetGlobalSettingsRequest) (*adminv1.GlobalSettingCategory, error)

func (*KnownAdminAPI) GetGroup 

func (a *KnownAdminAPI) GetGroup(ctx context.Context, req *adminv1.GetGroupRequest) (*adminv1.Group, error)

GetGroup 获取群组详情

func (*KnownAdminAPI) GetLionClient 

func (a *KnownAdminAPI) GetLionClient() (*lion.Client, error)

func (*KnownAdminAPI) GetLocalConfigs 

func (a *KnownAdminAPI) GetLocalConfigs(ctx context.Context, req *adminv1.GetLocalConfigsRequest) (*adminv1.LocalConfigs, error)

func (*KnownAdminAPI) GetMicroserviceGatewayServiceConfig added in v0.4.1 

func (a *KnownAdminAPI) GetMicroserviceGatewayServiceConfig() (*serviceconfig.Service, error)

GetMicroserviceGatewayServiceConfig 公开的 gateway 配置访问器，委托给私有方法。 该方法在内部错误（如配置未加载）时返回 (nil, error)，由调用方按需处理。

func (*KnownAdminAPI) GetMicroserviceGatewaySwagger added in v0.4.1 

func (a *KnownAdminAPI) GetMicroserviceGatewaySwagger() (*openapiconfig.OpenAPIConfig, error)

GetMicroserviceGatewaySwagger 公开的 swagger 配置访问器，委托给私有方法。 该方法在内部错误（如配置未加载）时返回 (nil, error)，由调用方按需处理。

func (*KnownAdminAPI) GetMicroserviceGatewaySwaggerJSON added in v0.4.1 

func (a *KnownAdminAPI) GetMicroserviceGatewaySwaggerJSON() (fs.FS, string)

GetMicroserviceGatewaySwaggerJSON 返回微服务网关资产 FS 与 swagger 资产基名， 供 AutoBridge 侧 loadSwaggerDoc 加载 openapi/<name>.swagger.json（Phase 6）。 未调用 SetMicroserviceGatewayYAML 时 assets 为 nil，调用方应降级为仅 path 参数。

func (*KnownAdminAPI) GetOAuth2Client 

func (a *KnownAdminAPI) GetOAuth2Client(ctx context.Context, req *adminv1.GetOAuth2ClientRequest) (*adminv1.OAuth2Client, error)

GetOAuth2Client 获取 OAuth2 客户端详情

func (*KnownAdminAPI) GetOAuth2Discovery 

func (a *KnownAdminAPI) GetOAuth2Discovery(ctx context.Context, req *emptypb.Empty) (*adminv1.OAuth2Discovery, error)

GetOAuth2Discovery 获取内置 OpenID 配置

func (*KnownAdminAPI) GetOAuth2JSONWebKeys 

func (a *KnownAdminAPI) GetOAuth2JSONWebKeys(ctx context.Context, req *emptypb.Empty) (*adminv1.OAuth2JSONWebKeys, error)

GetOAuth2JSONWebKeys 获取内置 OpenID 公钥

func (*KnownAdminAPI) GetOAuth2Userinfo 

func (a *KnownAdminAPI) GetOAuth2Userinfo(ctx context.Context, req *emptypb.Empty) (*adminv1.OAuth2Userinfo, error)

GetOAuth2Userinfo 获取内置 OpenID 用户信息 对应 OIDC userinfo endpoint，返回 OIDC Standard Claims 规范定义的用户信息 https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse

func (*KnownAdminAPI) GetPolicy 

func (a *KnownAdminAPI) GetPolicy(ctx context.Context, req *adminv1.GetPolicyRequest) (*adminv1.Policy, error)

GetPolicy 获取策略详情

func (*KnownAdminAPI) GetRole 

func (a *KnownAdminAPI) GetRole(ctx context.Context, req *adminv1.GetRoleRequest) (*adminv1.Role, error)

GetRole 获取角色详情

func (*KnownAdminAPI) GetUser 

func (a *KnownAdminAPI) GetUser(ctx context.Context, req *adminv1.GetUserRequest) (*adminv1.User, error)

GetUser 获取用户详情

func (*KnownAdminAPI) ListAuthProviders 

func (a *KnownAdminAPI) ListAuthProviders(ctx context.Context, req *adminv1.ListAuthProvidersRequest) (*adminv1.ListAuthProvidersResponse, error)

ListAuthProviders 获取认证提供列表

func (*KnownAdminAPI) ListCredentials added in v0.4.1 

func (a *KnownAdminAPI) ListCredentials(ctx context.Context, req *adminv1.ListCredentialsRequest) (*adminv1.ListCredentialsResponse, error)

ListCredentials 查询凭证列表

func (*KnownAdminAPI) ListDepartmentMembers 

func (a *KnownAdminAPI) ListDepartmentMembers(ctx context.Context, req *adminv1.ListDepartmentMembersRequest) (*adminv1.ListDepartmentMembersResponse, error)

ListDepartmentMembers 获取部门成员（与 proto Membership 定义对齐）

func (*KnownAdminAPI) ListDepartments 

func (a *KnownAdminAPI) ListDepartments(ctx context.Context, req *adminv1.ListDepartmentsRequest) (*adminv1.ListDepartmentsResponse, error)

ListDepartments 列出部门

func (*KnownAdminAPI) ListGlobalSettings 

func (a *KnownAdminAPI) ListGlobalSettings(ctx context.Context, req *adminv1.ListGlobalSettingsRequest) (*adminv1.ListGlobalSettingsResponse, error)

func (*KnownAdminAPI) ListGroupMembers 

func (a *KnownAdminAPI) ListGroupMembers(ctx context.Context, req *adminv1.ListGroupMembersRequest) (*adminv1.ListGroupMembersResponse, error)

ListGroupMembers 获取群组成员列表 根据群组类型从不同数据源获取成员：

  • DEPARTMENT: 从 user_departments 表查询关联部门的成员
  • ROLE: 从 user_roles 表查询关联角色的成员
  • DYNAMIC: 根据 dynamic_config.user_filter 从 users 表查询
  • SYSTEM: 同 DYNAMIC，根据 system_config.user_filter 查询（系统内置，不可创建/修改/删除）
  • 其他类型: 从 user_groups 表查询

func (*KnownAdminAPI) ListGroups 

func (a *KnownAdminAPI) ListGroups(ctx context.Context, req *adminv1.ListGroupsRequest) (*adminv1.ListGroupsResponse, error)

ListGroups 列出用户组

func (*KnownAdminAPI) ListLocalConfigs 

func (a *KnownAdminAPI) ListLocalConfigs(ctx context.Context, req *adminv1.ListLocalConfigsRequest) (*adminv1.ListLocalConfigsResponse, error)

func (*KnownAdminAPI) ListLoginOptions 

func (a *KnownAdminAPI) ListLoginOptions(ctx context.Context, req *adminv1.ListLoginOptionsRequest) (*adminv1.ListLoginOptionsResponse, error)

ListLoginOptions 获取登录页可用的认证提供方列表（无需认证） 仅返回登录页渲染所需的最小字段集，不包含任何敏感配置信息

func (*KnownAdminAPI) ListMenus 

func (a *KnownAdminAPI) ListMenus(ctx context.Context, req *adminv1.ListMenusRequest) (*adminv1.ListMenusResponse, error)

func (*KnownAdminAPI) ListOAuth2Clients 

func (a *KnownAdminAPI) ListOAuth2Clients(ctx context.Context, req *adminv1.ListOAuth2ClientsRequest) (*adminv1.ListOAuth2ClientsResponse, error)

ListOAuth2Clients 查询 OAuth2 客户端列表

func (*KnownAdminAPI) ListPolicies 

func (a *KnownAdminAPI) ListPolicies(ctx context.Context, req *adminv1.ListPoliciesRequest) (*adminv1.ListPoliciesResponse, error)

ListPolicies 获取策略列表

func (*KnownAdminAPI) ListRoleMembers 

func (a *KnownAdminAPI) ListRoleMembers(ctx context.Context, req *adminv1.ListRoleMembersRequest) (*adminv1.ListRoleMembersResponse, error)

ListRoleMembers 获取角色主体绑定列表，并在 full 视图下展开为用户 membership。

func (*KnownAdminAPI) ListRoleMenus 

func (a *KnownAdminAPI) ListRoleMenus(ctx context.Context, req *adminv1.ListRoleMenusRequest) (*adminv1.ListRoleMenusResponse, error)

ListRoleMenus 获取角色菜单列表

func (*KnownAdminAPI) ListRolePolicies 

func (a *KnownAdminAPI) ListRolePolicies(ctx context.Context, req *adminv1.ListRolePoliciesRequest) (*adminv1.ListRolePoliciesResponse, error)

func (*KnownAdminAPI) ListRoles 

func (a *KnownAdminAPI) ListRoles(ctx context.Context, req *adminv1.ListRolesRequest) (*adminv1.ListRolesResponse, error)

ListRoles 获取角色列表，默认返回树状结构 仅返回当前用户拥有的角色及其所有子角色

func (*KnownAdminAPI) ListServiceActions 

func (a *KnownAdminAPI) ListServiceActions(ctx context.Context, req *adminv1.ListServiceActionsRequest) (*adminv1.ListServiceActionsResponse, error)

func (*KnownAdminAPI) ListServices 

func (a *KnownAdminAPI) ListServices(ctx context.Context, req *adminv1.ListServicesRequest) (*adminv1.ListServicesResponse, error)

func (*KnownAdminAPI) ListUserAuthBindings added in v0.4.4 

func (a *KnownAdminAPI) ListUserAuthBindings(ctx context.Context, req *adminv1.ListUserAuthBindingsRequest) (*adminv1.ListUserAuthBindingsResponse, error)

ListUserAuthBindings returns the read-only authentication identity summary for one managed user. Method-level IAM/OPA authorization runs before this handler; this method intentionally contains no parallel role or permission checks.

func (*KnownAdminAPI) ListUsers 

func (a *KnownAdminAPI) ListUsers(ctx context.Context, req *adminv1.ListUsersRequest) (*adminv1.ListUsersResponse, error)

ListUsers 获取用户列表

func (*KnownAdminAPI) RevealCredentialSecret added in v0.4.1 

func (a *KnownAdminAPI) RevealCredentialSecret(ctx context.Context, req *adminv1.RevealCredentialSecretRequest) (*adminv1.RevealCredentialSecretResponse, error)

RevealCredentialSecret 揭示凭证密钥 通过当前用户密码二次验证后，解密并返回凭证的敏感字段。 安全约束： - 从 context 获取当前用户名，与 password_hash 一起验证身份 - 支持静态用户和数据库注册用户两种验证方式 - 验证失败返回 Unauthenticated - 按凭证类型仅解密并返回该类型实际拥有的字段 - 操作记录审计日志

func (*KnownAdminAPI) SetMicroserviceGatewayYAML 

func (a *KnownAdminAPI) SetMicroserviceGatewayYAML(assets fs.FS) error

SetMicroserviceGatewayYAML 设置微服务网关的 YAML 配置，并在注入时立即完成解析

func (*KnownAdminAPI) SetupCurrentUserMFA added in v0.4.3 

func (a *KnownAdminAPI) SetupCurrentUserMFA(ctx context.Context, _ *adminv1.SetupCurrentUserMFARequest) (*adminv1.SetupCurrentUserMFAResponse, error)

SetupCurrentUserMFA initializes MFA for the authenticated subject.

func (*KnownAdminAPI) StartAuthMFASetup 

func (a *KnownAdminAPI) StartAuthMFASetup(ctx context.Context, req *adminv1.StartAuthMFASetupRequest) (*adminv1.StartAuthMFASetupResponse, error)

StartAuthMFASetup 登录态首次配置 MFA（开始）

func (*KnownAdminAPI) UndeleteDepartment added in v0.4.4 

func (a *KnownAdminAPI) UndeleteDepartment(ctx context.Context, req *adminv1.UndeleteDepartmentRequest) (*adminv1.Department, error)

UndeleteDepartment restores a department in INACTIVE state. An explicit UpdateDepartment call is required before it can become effective again.

func (*KnownAdminAPI) UndeleteGroup added in v0.4.4 

func (a *KnownAdminAPI) UndeleteGroup(ctx context.Context, req *adminv1.UndeleteGroupRequest) (*adminv1.Group, error)

UndeleteGroup restores a group from the recycle bin. Restored groups remain disabled and require an explicit UpdateGroup operation to become active.

func (*KnownAdminAPI) UndeleteUser added in v0.4.4 

func (a *KnownAdminAPI) UndeleteUser(ctx context.Context, req *adminv1.UndeleteUserRequest) (*adminv1.User, error)

UndeleteUser restores a user from the recycle bin. Restored users remain disabled and require an explicit UpdateUser operation to become active.

func (*KnownAdminAPI) UpdateAuthProvider 

func (a *KnownAdminAPI) UpdateAuthProvider(ctx context.Context, req *adminv1.UpdateAuthProviderRequest) (*adminv1.AuthProvider, error)

UpdateAuthProvider 更新认证提供方

func (*KnownAdminAPI) UpdateCredential added in v0.4.1 

func (a *KnownAdminAPI) UpdateCredential(ctx context.Context, req *adminv1.UpdateCredentialRequest) (*adminv1.Credential, error)

UpdateCredential 更新凭证 仅允许更新 status / display_name / description / expires_at / metadata 受保护（protected=true）的凭证仅允许更新 display_name / description / status

func (*KnownAdminAPI) UpdateCurrentUser added in v0.4.3 

func (a *KnownAdminAPI) UpdateCurrentUser(ctx context.Context, req *adminv1.UpdateCurrentUserRequest) (*adminv1.CurrentUserProfile, error)

UpdateCurrentUser changes only the authenticated subject's editable profile.

func (*KnownAdminAPI) UpdateDepartment 

func (a *KnownAdminAPI) UpdateDepartment(ctx context.Context, req *adminv1.UpdateDepartmentRequest) (*adminv1.Department, error)

UpdateDepartment 更新部门

func (*KnownAdminAPI) UpdateDepartmentMembers 

func (a *KnownAdminAPI) UpdateDepartmentMembers(ctx context.Context, req *adminv1.UpdateDepartmentMembersRequest) (*adminv1.UpdateDepartmentMembersResponse, error)

UpdateDepartmentMembers 更新部门成员（按 department_id + user_id 定位，与 proto Membership 对齐）

func (*KnownAdminAPI) UpdateGlobalSettings 

func (a *KnownAdminAPI) UpdateGlobalSettings(ctx context.Context, req *adminv1.UpdateGlobalSettingsRequest) (*adminv1.UpdateGlobalSettingsResponse, error)

func (*KnownAdminAPI) UpdateGroup 

func (a *KnownAdminAPI) UpdateGroup(ctx context.Context, req *adminv1.UpdateGroupRequest) (*adminv1.Group, error)

UpdateGroup 更新用户组；code、type 以及来源绑定创建后不可修改。

func (*KnownAdminAPI) UpdateGroupMember 

func (a *KnownAdminAPI) UpdateGroupMember(ctx context.Context, req *adminv1.UpdateGroupMemberRequest) (*adminv1.Membership, error)

UpdateGroupMember 更新群组成员

func (*KnownAdminAPI) UpdateMenu 

func (a *KnownAdminAPI) UpdateMenu(ctx context.Context, req *adminv1.UpdateMenuRequest) (*adminv1.Menu, error)

func (*KnownAdminAPI) UpdateOAuth2Client 

func (a *KnownAdminAPI) UpdateOAuth2Client(ctx context.Context, req *adminv1.UpdateOAuth2ClientRequest) (*adminv1.OAuth2Client, error)

UpdateOAuth2Client 更新 OAuth2 客户端

func (*KnownAdminAPI) UpdatePolicy 

func (a *KnownAdminAPI) UpdatePolicy(ctx context.Context, req *adminv1.UpdatePolicyRequest) (*adminv1.Policy, error)

UpdatePolicy 更新策略

func (*KnownAdminAPI) UpdateRole 

func (a *KnownAdminAPI) UpdateRole(ctx context.Context, req *adminv1.UpdateRoleRequest) (*adminv1.Role, error)

UpdateRole 更新角色

func (*KnownAdminAPI) UpdateRoleMembers 

func (a *KnownAdminAPI) UpdateRoleMembers(ctx context.Context, req *adminv1.UpdateRoleMembersRequest) (*adminv1.UpdateRoleMembersResponse, error)

UpdateRoleMembers 批量更新角色下主体绑定（PATCH .../roles/{parent}/members）。

func (*KnownAdminAPI) UpdateRoleMenus 

func (a *KnownAdminAPI) UpdateRoleMenus(ctx context.Context, req *adminv1.UpdateRoleMenusRequest) (*adminv1.UpdateRoleMenusResponse, error)

UpdateRoleMenus 批量更新角色菜单关联

func (*KnownAdminAPI) UpdateRolePolicies 

func (a *KnownAdminAPI) UpdateRolePolicies(ctx context.Context, req *adminv1.UpdateRolePoliciesRequest) (*adminv1.UpdateRolePoliciesResponse, error)

func (*KnownAdminAPI) UpdateUser 

func (a *KnownAdminAPI) UpdateUser(ctx context.Context, req *adminv1.UpdateUserRequest) (*adminv1.User, error)

UpdateUser 更新用户信息

func (*KnownAdminAPI) UpdateUserPassword 

func (a *KnownAdminAPI) UpdateUserPassword(ctx context.Context, req *adminv1.UpdateUserPasswordRequest) (*adminv1.UpdateUserPasswordResponse, error)

UpdateUserPassword 修改用户密码

func (*KnownAdminAPI) UpsertAuthProviders 

func (a *KnownAdminAPI) UpsertAuthProviders(ctx context.Context, req *adminv1.UpsertAuthProvidersRequest) (*adminv1.UpsertAuthProvidersResponse, error)

UpsertAuthProviders 更新认证提供方列表

func (*KnownAdminAPI) VerifyAuthMFA 

func (a *KnownAdminAPI) VerifyAuthMFA(ctx context.Context, req *adminv1.VerifyAuthMFARequest) (*adminv1.AuthToken, error)

VerifyAuthMFA 登录时的 MFA 二步验证

type LocalConfigSnapshot 

type LocalConfigSnapshot struct {
	Services    *adminv1.ServicesConfig
	Discover    *adminv1.DiscoverConfig
	Security    *adminv1.SecurityConfig
	Database    *adminv1.DatabaseConfig
	Cachebox    *adminv1.CacheboxConfig
	Debugger    *adminv1.DebuggerConfig
	Objstore    *adminv1.ObjstoreConfig
	Frontend    *adminv1.FrontendConfig
	Observables *adminv1.ObservablesConfig
	Cloudevents *adminv1.CloudEventsConfig
	Automations *adminv1.AutomationsConfig
	AIConnector *adminv1.AIConnectorConfig
	Independent *structpb.Struct
}

LocalConfigSnapshot keeps admin runtime config sections for local-config APIs.

type Options 

type Options func(c *config)

Options xx

func WithAESKey 

func WithAESKey(key []byte) Options

WithAESKey 设置 AES 加密的密钥

func WithLionClient 

func WithLionClient(client *lion.Client) Options

WithLionClient 内置管理模块的 ent client 数据库 lion 数据结构

func WithLocalConfigSnapshot 

func WithLocalConfigSnapshot(snapshot *LocalConfigSnapshot) Options

WithLocalConfigSnapshot 设置运行时本地配置快照

func WithLogger 

func WithLogger(logger *slog.Logger) Options

WithLogger 返回一个 Options，用于设置 KnownAdminAPI 的日志记录器。

func WithOIDCProvider 

func WithOIDCProvider(issuer, clientID, clientSecret string) Options

WithOIDCProvider 设置 oidc 认证的基础信息

func WithStaticUsers 

func WithStaticUsers(users *StaticUsers) Options

WithStaticUsers 设置本地配置的静态用户

type StaticUser 

type StaticUser struct {
	UserID       int64    `json:"user_id"`
	Username     string   `json:"username"`
	PasswordHash string   `json:"password_hash"`
	Email        string   `json:"email"`
	Groups       []string `json:"groups"`
	Roles        []string `json:"roles,omitempty"`
	Tenant       string   `json:"tenant"`
}

StaticUser 本地配置的静态用户

func (StaticUser) GetAccessToken 

func (s StaticUser) GetAccessToken(expiresIn int32, clientID string) (string, error)

GetAccessToken 获取或生成 jwt token。第二个参数是标准 client_id； 历史调用方可保持原调用形态，但新 token 不再写入 appid claim。

type StaticUsers 

type StaticUsers []*StaticUser

func (*StaticUsers) Append 

func (s *StaticUsers) Append(user *StaticUser)

Append 添加本地静态用户

func (*StaticUsers) Find added in v0.4.3 

func (s *StaticUsers) Find(username string) (*StaticUser, bool)

Find 按 username 反查静态用户（不校验口令）。 供已认证调用方重签自身令牌时定位静态用户及其 HS256 签名密钥。

func (*StaticUsers) FindByUserID added in v0.4.3 

func (s *StaticUsers) FindByUserID(userID int64) (*StaticUser, bool)

FindByUserID 按 user_id 查找静态用户（兼容 UserID==0 时用 username 折算 user_id）。 供 CreateAuthToken 委托签发按目标 user_id 定位静态用户及其 HS256 签名密钥。

func (*StaticUsers) Len 

func (s *StaticUsers) Len() int

Len 返回用户数量

func (*StaticUsers) Valid 

func (s *StaticUsers) Valid(username, passwordHash string) (*StaticUser, bool)

Valid 验证 LOCAL 登录载荷（CreateAuthLoginRequest.password_hash）是否与静态用户匹配。 存储为 sha256 十六进制时做字符串相等比较；存储为 bcrypt 时（以 “$2” 开头）用 BcryptCompare，与库表 LOCAL 用户约定一致。

Source Files

View all Source files

Directories

Path Synopsis
internal
gentimezonealiases command

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.