wangxuming/LWLT-AIBOT
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: integrate account authorization model

Browse Source
This commit is contained in:
inman
2026-09-01 19:18:41 +08:00
parent 191c1a1aad
commit ffda0d5f3f
6 changed files with 108 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
.project-docs/10-decisions/AUTH-001-fixed-scope-account-authorization.md Normal file
View File

@@ -0,0 +1,46 @@
# AUTH-001: Fixed-scope account authorization
## Status
Accepted
## Date
2026-09-01
## Context
The platform already required login but treated the fixed deployment scope as a shared administrator workspace. It needed administrator-maintained accounts, per-user task isolation, a team-lead oversight role, creator/original-input audit, and explicit task-type eligibility without introducing tenant or organization administration.
## Decision
- Keep one internal `organization_id` deployment scope and do not expose organization selection or tenant administration.
- Use three roles: `admin`, `team_lead`, and `user`.
- Administrators manage account lifecycle, passwords, sessions, global settings/audit, AgentBus/system tasks, and all manual tasks. They always hold all 18 registered manual business routes.
- Team leads and ordinary users use normal business APIs only for their own manual tasks. New non-administrator accounts start with no task-type grants and may invoke only routes explicitly granted by an administrator.
- Re-read route authorization before intake and relevant task state transitions. Known denied routes and unknown/non-unique routes fail closed before parsing, plugin dispatch, or ERP execution.
- Give team leads a dedicated read-only operations dashboard over all manual account tasks. It exposes who acted, the business instruction, and the readable business result, but not parser/executor payloads or mutation authority.
- Preserve creator and input-turn attribution with encrypted input at rest. Routine removal is archive/restore; irreversible purge is not exposed.
- Keep AgentBus authorization as a separate administrator-controlled channel boundary.
## Rationale
This model fits a single-organization deployment while enforcing least privilege, owner isolation, business-facing oversight, and auditable denial without weakening the existing ERP confirmation and write-safety gates.
## Consequences
- Migrations 015–017 must be applied before the updated control plane starts.
- Existing accounts migrate as administrators; newly created team leads and users require explicit task grants.
- Permission revocation can block an existing task at confirmation or browser claim even when an administrator attempts the transition.
- Cross-user operational visibility is intentionally separated from normal task mutation and technical debugging surfaces.
## Supersedes
- The implicit administrator-only, organization-shared account behavior of the earlier control-plane baseline.
## Related
- `control-plane/migrations/015_account_roles_and_task_audit.sql`
- `control-plane/migrations/016_team_lead_operations_dashboard.sql`
- `control-plane/migrations/017_user_business_route_authorizations.sql`
- `.project-docs/30-worklog/tasks/20260901-account-system-impl-d4e7a2.md`

1
.project-docs/10-decisions/decision-index.md
View File

@@ -10,6 +10,7 @@
| RELEASE-001 | Current artifacts, filenames, versions, and SHA-256 values are defined only by `dist/release-manifest.json`. | Active | 2026-08-28 | Release and delivery | [Release manifest](../../dist/release-manifest.json) |
| SAFETY-001 | Real ERP access/write, task mutation, extension reload, service restart, deployment, and external delivery require explicit task-scoped authorization. | Active | 2026-08-28 | Operations and maintenance | [Governance](../../AGENTS.md) |
| NETWORK-001 | In the trusted internal deployment, AgentBus roster attachment URLs may resolve to internal/private addresses; HTTPS, credential rejection, DNS pinning, redirect validation, bounds, and digest checks remain. | Active | 2026-08-31 | AgentBus attachment ingress | [Reply contract](../../agent设计规范/agentbus-reply-contract.md) |
| AUTH-001 | The fixed deployment scope uses administrator-managed `admin`, `team_lead`, and `user` accounts, owner-isolated normal tasks, a read-only leadership dashboard, and explicit non-admin task-route allowlists. | Active | 2026-09-01 | Authentication, authorization, audit, and operations oversight | [ADR](AUTH-001-fixed-scope-account-authorization.md) |
## Superseded Decisions

6
.project-docs/20-architecture/data-flow.md
View File

@@ -5,6 +5,7 @@
| Flow | Source | Destination | Notes |
|---|---|---|---|
| Business directive | Manual workbench or AgentBus | Route orchestrator | Source changes input/reply adaptation, not parser or confirmation policy |
| Manual account authorization | Signed-in account plus resolved business route | Intake and task-transition gates | Administrators hold all routes; team leads/users require explicit grants and unresolved routes fail closed |
| Parsing | Route orchestrator | AI Skill or deterministic Program parser | AI/Shadow/Auto/Program mode is frozen per task |
| Operation | Parser | Control-plane task and confirmation | Must validate against the same final contract |
| ERP execution | Confirmed task | Chrome extension and logged-in ERP page | Requires unique object, page identity, ownership, and write preflight |
@@ -13,12 +14,13 @@
| WeChat roster attachment | Strict transport envelope plus one structured `payload.attachments[]` entry | Existing `awaiting_attachment` task | Explicit conversation ID wins; otherwise strict `Conversation:` supplies the fallback. Placeholder text alone never creates a task. |
| Internal attachment download | Credential-free HTTPS URL | Bounded in-memory workbook bytes | Internal/private DNS answers are allowed; the selected address is pinned, every redirect is revalidated, and URL/host/IP/bytes are omitted from logs. |
| Operational diagnostics | Service, request, task, parser, AgentBus, attachment, database, and cleanup stages | Structured stdout/stderr and bounded Docker logs | Correlation identifiers, codes, outcomes, and durations only; no secrets or business payloads. |
| Operations oversight | Manual task creator, encrypted instruction history, and readable outcome | Team-lead/administrator dashboard projection | Read-only who/instruction/result view; no parser/executor payloads or task mutation authority |
| Confirmation export | ERP source file | Archived source plus mobile delivery artifact | Visitor XLS becomes real XLSX; other types prefer PDF |
| Release | Editable source | `dist/release-manifest.json` and versioned artifacts | Manifest owns current hashes and filenames |
## State Ownership
- PostgreSQL owns durable control-plane task, session, confirmation, channel, audit, and outcome state.
- PostgreSQL owns durable control-plane account, role, task-route grant, task, session, confirmation, channel, audit, archive, and outcome state.
- Production attachment bytes use the configured OSS provider; normalized sensitive fields remain encrypted.
- Chrome extension local state is bounded execution/reconciliation support, not canonical business history.
- `.project-docs/30-worklog/tasks/` owns task-local project memory; canonical project state is an integrated projection.
@@ -32,4 +34,4 @@
## Last Updated
2026-08-31
2026-09-01

10
.project-docs/20-architecture/system-overview.md
View File

@@ -2,7 +2,7 @@
## Current Architecture
Manual or AgentBus input is routed through task-scoped AI/Shadow/Auto/Program orchestration into one validated operation contract. The control plane owns task/session/confirmation/audit state, and the Chrome extension resolves the unique ERP object, enforces page and write gates, performs native actions, and returns action-specific evidence.
Authenticated manual or AgentBus input is routed through task-scoped AI/Shadow/Auto/Program orchestration into one validated operation contract. The control plane owns account, task, session, task-type authorization, confirmation, audit, and archive state, and the Chrome extension resolves the unique ERP object, enforces page and write gates, performs native actions, and returns action-specific evidence.
## Main Components
@@ -20,7 +20,10 @@ Manual or AgentBus input is routed through task-scoped AI/Shadow/Auto/Program or
## Important Boundaries
- AI/Program parsing and ERP resolution/execution share the final operation contract but do not share authority.
- Platform envelope fields such as task ID, session, parser decision, confirmation, transport, and audit never enter the business operation.
- Platform envelope fields such as task ID, account identity, authorization revision, session, parser decision, confirmation, transport, and audit never enter the business operation.
- The product is one fixed internal organization scope with three roles. Administrators manage accounts and all 18 manual routes; team leads and users are owner-scoped for normal tasks and require explicit per-route grants. Team leads additionally receive a dedicated read-only, manual-task-only operations dashboard.
- Authorization is enforced in server and service paths, not by navigation visibility. A denied or unresolved non-admin business route stops before parsing, plugin dispatch, and ERP execution; creator authorization is rechecked at confirmation and browser claim.
- Creator and manual input-turn attribution remain durable while business input stays encrypted at rest. Routine removal is reversible archive/restore; physical purge is not an operator capability.
- Unknown, ambiguous, unverified, or post-write-uncertain states fail closed; automatic retries must not create duplicate writes.
- PostgreSQL is the sole required durable database/state middleware, and the production artifact provider is OSS. Redis, message queues, MongoDB, and search services are not runtime dependencies.
- Migrations must complete before the application starts. The current ACK topology starts with one application replica because AgentBus listeners and SSE emission are process-local; horizontal scale requires explicit coordination first.
@@ -36,7 +39,8 @@ Manual or AgentBus input is routed through task-scoped AI/Shadow/Auto/Program or
- RELEASE-001
- SAFETY-001
- NETWORK-001
- AUTH-001
## Last Updated
2026-08-31
2026-09-01

44
.project-docs/30-worklog/tasks/20260901-integrate-account-system-7b2f4d.md Normal file
View File

@@ -0,0 +1,44 @@
# Task: Integrate account system and restart panel
## Identity
- Task ID: 20260901-integrate-account-system-7b2f4d
- Mode: Integration
- Branch: codex/20260901-integrate-account-system-5e8c1a-integrate-account-system-5e8c1a
- Worktree: /Users/inmanx/Documents/lwltAPI-integrate-account-system-5e8c1a
- Base commit: 191c1a1aad6f4bb1651143df3e0c1dc98dcd09e0
- Owner: codex
- Status: Planning
## Scope
- Integrate completed account-system source commit `375fda1` (cherry-picked as `191c1a1`) into the default branch without including unrelated ready-for-integration feature tasks.
- Promote the accepted fixed-scope account, role, dashboard, audit, archive, and task-route authorization model into canonical project memory.
- Run the full repository verification set against the integrated tree.
- Fast-forward local `main`, apply migrations 015–017 to the configured standard control-plane database, and restart only the authorized `127.0.0.1:8786` panel service.
- Verify health, schema readiness, existing administrator login, account management, task-type catalog, and leadership dashboard routing without performing ERP writes or external delivery.
## Intent And Constraints
- Preserve the existing dirty-state history: the prior main-sync task record was committed under its original owner before main was released and updated.
- Keep the roster-workbook feature and every other unrelated peer task outside this integration.
- Do not read or print `.env` or secrets. Reuse the existing supervisor and configured environment for migration/restart.
- Existing accounts migrate as administrators; do not create, reset, disable, or alter real account credentials during deployment verification.
- Do not access ERP, trigger business execution, reload the Chrome extension, or send external messages.
- The user explicitly authorized integration, database migration, and restart in this turn.
## Outcome
- Not completed.
## Verification
- Not run.
## Follow-ups
- None recorded.
## Promotion Candidates
- None recorded.

7
.project-docs/40-domain/business-rules.md
View File

@@ -4,6 +4,11 @@
- `agent设计规范/business-adaptation-registry.md` is the cross-session business entry; each business maps user input, Skill/action, ERP flow, contracts, implementation, fixtures, and verification status.
- Manual and AgentBus tasks share the same 18 machine routes, task-scoped parser mode snapshot, and organization automation rules.
- The platform exposes one fixed deployment scope, not an organization-management product. Accounts use `admin`, `team_lead`, and `user` roles.
- Administrators always hold all 18 manual business routes. Team leads and ordinary users start with no task grants, require explicit administrator allowlists, and may use normal task APIs only for their own manual tasks.
- A known ungranted route or a non-unique/unresolved route for a non-administrator fails before parsing, plugin dispatch, or ERP execution. Authorization is rechecked for supplemental input, attachments, confirmation, automatic confirmation, and browser claim.
- Team leads may read all manual account work only through the operations dashboard's who/instruction/result projection; this does not grant cross-user task mutation, artifacts, SSE, technical payloads, global settings, audit administration, or AgentBus access.
- Creator and input-turn attribution are durable, business inputs remain encrypted at rest, denial audit excludes plaintext, and routine task removal uses archive/restore rather than physical purge.
- The two passenger-list import routes are Program-only and wait for exactly one `.xls` or `.xlsx` attachment before deterministic normalization.
- A WeChat attachment card is transport placeholder text, not file content. Only a structured `payload.attachments[]` entry can resume a roster task; missing metadata fails before ingestion and leaves the original task in `awaiting_attachment` instead of creating a new task.
- The trusted internal deployment accepts credential-free HTTPS roster attachment URLs whose host is internal, private/reserved IPv4/IPv6, or localhost. DNS pinning, redirect revalidation, download timeout, byte limits, declared-size checks, and optional SHA-256 verification remain mandatory.
@@ -22,4 +27,4 @@
## Last Reviewed
2026-08-31
2026-09-01