feat(v2.7): 收口治理权限适配器

apps/server/src/modules/governance/dto/governance-dictionary.dto.ts

@@ -23,17 +23,32 @@ export class GovernanceDictionaryDto {
   @IsOptional()
   @IsString()
   scope?: string;
+
+  @IsOptional()
+  @IsArray()
+  @IsString({ each: true })
+  permissions?: string[];
 }
 
 export class RemoveGovernanceDictionaryDto {
   @IsString()
   actorId!: string;
+
+  @IsOptional()
+  @IsArray()
+  @IsString({ each: true })
+  permissions?: string[];
 }
 
 export class ImportGovernanceDictionariesDto {
   @IsString()
   actorId!: string;
 
+  @IsOptional()
+  @IsArray()
+  @IsString({ each: true })
+  permissions?: string[];
+
   @IsArray()
   @ValidateNested({ each: true })
   @Type(() => GovernanceDictionaryDto)

apps/server/src/modules/governance/governance.controller.ts

@@ -31,7 +31,7 @@ export class GovernanceController {
     @Param('id') id: string,
     @Body() dto: RemoveGovernanceDictionaryDto,
   ) {
-    return this.governanceService.remove({ actorId: dto.actorId, kind, id });
+    return this.governanceService.remove({ actorId: dto.actorId, permissions: dto.permissions, kind, id });
   }
 
   @Get('export')
@@ -41,6 +41,6 @@ export class GovernanceController {
 
   @Post('import')
   importAll(@Body() dto: ImportGovernanceDictionariesDto) {
-    return this.governanceService.importAll(dto.actorId, dto.items);
+    return this.governanceService.importAll(dto.actorId, dto.items, dto.permissions);
   }
 }

apps/server/src/modules/governance/governance.service.spec.ts

@@ -1,5 +1,6 @@
 import { BadRequestException } from '@nestjs/common';
 import { AuditService } from '../../common/audit/audit.service';
+import { RbacService } from '../../common/rbac/rbac.service';
 import { GovernanceService } from './governance.service';
 
 describe('GovernanceService', () => {
@@ -21,20 +22,43 @@ describe('GovernanceService', () => {
       },
     };
     const audit = { record: jest.fn() } as unknown as AuditService;
-    return { prisma, audit, service: new GovernanceService(prisma as any, audit) };
+    const rbac = {
+      assertGlobalPermission: jest.fn().mockResolvedValue({ actorId: 'm-admin', via: 'system' }),
+    } as unknown as RbacService;
+    return { prisma, audit, rbac, service: new GovernanceService(prisma as any, audit, rbac) };
   };
 
+  it('requires governance manage permission through the RBAC adapter', async () => {
+    const { prisma, rbac, service } = makeService();
+    (rbac.assertGlobalPermission as jest.Mock).mockRejectedValue(new Error('forbidden'));
+
+    await expect(service.create({
+      actorId: 'm-dev',
+      permissions: ['project:view'],
+      kind: 'requirement_type',
+      name: '新功能',
+    })).rejects.toThrow('forbidden');
+
+    expect(prisma.governanceDictionary.create).not.toHaveBeenCalled();
+  });
+
   it('blocks hard deletion of a task category that is used by dev tasks or test cases', async () => {
-    const { prisma, service } = makeService();
+    const { prisma, rbac, service } = makeService();
     prisma.devTask.count.mockResolvedValue(1);
     prisma.testCase.count.mockResolvedValue(0);
 
     await expect(service.remove({
       actorId: 'm-admin',
+      permissions: ['governance:manage'],
       kind: 'task_category',
       id: 'cat-1',
     })).rejects.toBeInstanceOf(BadRequestException);
 
+    expect(rbac.assertGlobalPermission).toHaveBeenCalledWith({
+      actorId: 'm-admin',
+      permissions: ['governance:manage'],
+      requiredPermissions: ['governance:manage'],
+    });
     expect(prisma.taskCategory.delete).not.toHaveBeenCalled();
   });
 
@@ -42,7 +66,7 @@ describe('GovernanceService', () => {
     const { prisma, audit, service } = makeService();
     prisma.governanceDictionary.update.mockResolvedValue({ id: 'dict-1', kind: 'requirement_type', deletedAt: new Date('2026-07-08T00:00:00.000Z') });
 
-    await service.remove({ actorId: 'm-admin', kind: 'requirement_type', id: 'dict-1' });
+    await service.remove({ actorId: 'm-admin', permissions: ['governance:manage'], kind: 'requirement_type', id: 'dict-1' });
 
     expect(prisma.governanceDictionary.update).toHaveBeenCalledWith({
       where: { id: 'dict-1' },

apps/server/src/modules/governance/governance.service.ts

@@ -1,5 +1,6 @@
 import { BadRequestException, Injectable } from '@nestjs/common';
 import { AuditService } from '../../common/audit/audit.service';
+import { RbacService } from '../../common/rbac/rbac.service';
 import { PrismaService } from '../../prisma/prisma.service';
 
 export const GOVERNANCE_DICTIONARY_KINDS = ['task_category', 'requirement_type', 'requirement_platform', 'requirement_source'] as const;
@@ -14,12 +15,14 @@ export interface GovernanceDictionaryInput {
   group?: string | null;
   scope?: string;
   value?: unknown;
+  permissions?: string[];
 }
 
 export interface GovernanceRemoveInput {
   actorId: string;
   kind: GovernanceDictionaryKind;
   id: string;
+  permissions?: string[];
 }
 
 @Injectable()
@@ -27,6 +30,7 @@ export class GovernanceService {
   constructor(
     private readonly prisma: PrismaService,
     private readonly auditService: AuditService,
+    private readonly rbacService: RbacService,
   ) {}
 
   list(kind: GovernanceDictionaryKind) {
@@ -43,6 +47,7 @@ export class GovernanceService {
   async create(input: GovernanceDictionaryInput) {
     assertDictionaryKind(input.kind);
     const actorId = requireText(input.actorId, 'actorId');
+    await this.assertManagePermission(actorId, input.permissions);
     const created = input.kind === 'task_category'
       ? await this.prisma.taskCategory.create({
         data: {
@@ -75,6 +80,7 @@ export class GovernanceService {
   async update(input: GovernanceDictionaryInput & { id: string }) {
     assertDictionaryKind(input.kind);
     const actorId = requireText(input.actorId, 'actorId');
+    await this.assertManagePermission(actorId, input.permissions);
     const id = requireText(input.id, 'id');
     const updated = input.kind === 'task_category'
       ? await this.prisma.taskCategory.update({
@@ -108,6 +114,7 @@ export class GovernanceService {
   async remove(input: GovernanceRemoveInput) {
     assertDictionaryKind(input.kind);
     const actorId = requireText(input.actorId, 'actorId');
+    await this.assertManagePermission(actorId, input.permissions);
     const id = requireText(input.id, 'id');
     if (input.kind === 'task_category') {
       const [devTaskCount, testCaseCount] = await Promise.all([
@@ -150,12 +157,13 @@ export class GovernanceService {
     return { taskCategories, dictionaries };
   }
 
-  async importAll(actorId: string, items: GovernanceDictionaryInput[]) {
+  async importAll(actorId: string, items: GovernanceDictionaryInput[], permissions: string[] = []) {
+    await this.assertManagePermission(actorId, permissions);
     const results = [];
     for (const item of items) {
       assertDictionaryKind(item.kind);
       if (item.kind === 'task_category') {
-        results.push(await this.create({ ...item, actorId }));
+        results.push(await this.create({ ...item, actorId, permissions }));
       } else {
         const saved = await this.prisma.governanceDictionary.upsert({
           where: {
@@ -196,6 +204,14 @@ export class GovernanceService {
   private resourceType(kind: GovernanceDictionaryKind) {
     return kind === 'task_category' ? 'task_category' : 'governance_dictionary';
   }
+
+  private assertManagePermission(actorId: string, permissions: string[] = []) {
+    return this.rbacService.assertGlobalPermission({
+      actorId,
+      permissions,
+      requiredPermissions: ['governance:manage'],
+    });
+  }
 }
 
 function assertDictionaryKind(kind: string): asserts kind is GovernanceDictionaryKind {

apps/server/src/modules/management/management.module.ts

@@ -1,8 +1,10 @@
 import { Module } from '@nestjs/common';
+import { CommonDomainModule } from '../../common/common-domain.module';
 import { ManagementController } from './management.controller';
 import { ManagementService } from './management.service';
 
 @Module({
+  imports: [CommonDomainModule],
   controllers: [ManagementController],
   providers: [ManagementService],
 })

apps/server/src/modules/management/management.service.spec.ts

@@ -12,14 +12,24 @@ describe('ManagementService', () => {
       bug: { findMany: jest.fn() },
       xiaobaoRiskSummary: { findMany: jest.fn() },
     };
-    return { prisma, service: new ManagementService(prisma as any) };
+    const rbac = {
+      assertGlobalPermission: jest.fn().mockResolvedValue({ actorId: 'm-manager', via: 'permission' }),
+    };
+    return { prisma, rbac, service: new ManagementService(prisma as any, rbac as any) };
   };
 
+  it('requires management view permission through the RBAC adapter', async () => {
+    const { rbac, service } = makeService();
+    rbac.assertGlobalPermission.mockRejectedValue(new Error('forbidden'));
+
+    await expect(service.getOverview({ actorId: 'm-dev', permissions: [] })).rejects.toThrow('forbidden');
+  });
+
   it('returns an empty dashboard when actor has no managed projects', async () => {
-    const { prisma, service } = makeService();
+    const { prisma, rbac, service } = makeService();
     prisma.projectMember.findMany.mockResolvedValue([]);
 
-    await expect(service.getOverview({ actorId: 'm-dev', permissions: [] })).resolves.toEqual({
+    await expect(service.getOverview({ actorId: 'm-dev', permissions: ['management:view'] })).resolves.toEqual({
       activeVersionCount: 0,
       overdueItemCount: 0,
       blockedItemCount: 0,
@@ -30,6 +40,11 @@ describe('ManagementService', () => {
       blockedItems: [],
       highRiskVersions: [],
     });
+    expect(rbac.assertGlobalPermission).toHaveBeenCalledWith({
+      actorId: 'm-dev',
+      permissions: ['management:view'],
+      requiredPermissions: ['management:view'],
+    });
     expect(prisma.appData.findMany).not.toHaveBeenCalled();
   });
 

apps/server/src/modules/management/management.service.ts

@@ -1,4 +1,5 @@
 import { BadRequestException, Injectable } from '@nestjs/common';
+import { RbacService } from '../../common/rbac/rbac.service';
 import { PrismaService } from '../../prisma/prisma.service';
 
 export interface ManagementOverviewQuery {
@@ -22,13 +23,21 @@ type WorkItem = {
 
 @Injectable()
 export class ManagementService {
-  constructor(private readonly prisma: PrismaService) {}
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly rbacService: RbacService,
+  ) {}
 
   async getOverview(query: ManagementOverviewQuery) {
     const actorId = query.actorId?.trim();
     if (!actorId) throw new BadRequestException('actorId is required');
+    const permission = await this.rbacService.assertGlobalPermission({
+      actorId,
+      permissions: query.permissions ?? [],
+      requiredPermissions: ['management:view'],
+    });
     const now = query.now ?? new Date();
-    const allProjects = query.permissions?.includes('*') === true;
+    const allProjects = permission.via === 'system';
     const projectIds = allProjects ? undefined : await this.getManagedProjectIds(actorId);
     if (!allProjects && projectIds?.length === 0) return emptyOverview();