diff --git a/backend/app/db/governance_seed.py b/backend/app/db/governance_seed.py index caa6c3a..ae8e267 100644 --- a/backend/app/db/governance_seed.py +++ b/backend/app/db/governance_seed.py @@ -4,6 +4,7 @@ from sqlalchemy import select from sqlalchemy.ext.asyncio import AsyncSession from app.domains.baigong.models import Capability +from app.domains.baigong.service import PLATFORM_SCOPE _BUILTIN_CAPABILITIES = [ # name, 描述, 执行类型, 执行器, 四维风险, 数据范围, 目的地, consent @@ -71,7 +72,7 @@ async def _seed_capabilities(session: AsyncSession) -> None: session.add( Capability( name=name, - owner_scope="local-user", + owner_scope=PLATFORM_SCOPE, description=desc, executor_type=executor_type, executor_ref=ref, @@ -89,3 +90,4 @@ async def _seed_capabilities(session: AsyncSession) -> None: async def ensure_governance_seed(session: AsyncSession) -> None: """启动幂等登记内置能力。""" await _seed_capabilities(session) + await session.commit() diff --git a/backend/app/domains/baigong/service.py b/backend/app/domains/baigong/service.py index 1a4c69c..17feaf4 100644 --- a/backend/app/domains/baigong/service.py +++ b/backend/app/domains/baigong/service.py @@ -26,10 +26,20 @@ from app.models.safety import AuditEvent, PendingConfirmationRecord from app.schemas.auth import CurrentUser +# 内置能力挂平台作用域(全局可见可授契;自定义能力按 owner 隔离) +PLATFORM_SCOPE = "__platform__" + + +def _capability_visible(cap: Capability, owner_scope: str) -> bool: + return cap.owner_scope == owner_scope or ( + cap.owner_scope == PLATFORM_SCOPE and cap.source == "builtin" + ) + + async def _get_capability(capability_id: str, owner_scope: str) -> Capability: async with AsyncSessionLocal() as session: cap = await session.get(Capability, capability_id) - if cap is None or cap.owner_scope != owner_scope: + if cap is None or not _capability_visible(cap, owner_scope): raise AppError("not_found", "能力不存在。", status_code=404) session.expunge(cap) return cap @@ -300,15 +310,24 @@ async def resolve_petition(petition_id: str, approved: bool) -> dict[str, Any]: async def list_capabilities(owner_scope: str) -> list[dict[str, Any]]: async with AsyncSessionLocal() as session: - caps = ( - ( - await session.execute( - select(Capability).where(Capability.owner_scope == owner_scope) + caps = [ + c + for c in ( + ( + await session.execute( + select(Capability).where( + (Capability.owner_scope == owner_scope) + | ( + (Capability.owner_scope == PLATFORM_SCOPE) + & (Capability.source == "builtin") + ) + ) + ) ) + .scalars() + .all() ) - .scalars() - .all() - ) + ] mandates = ( ( await session.execute( diff --git a/backend/app/domains/mirror_tree/service.py b/backend/app/domains/mirror_tree/service.py index 1b94d1a..e02806b 100644 --- a/backend/app/domains/mirror_tree/service.py +++ b/backend/app/domains/mirror_tree/service.py @@ -120,14 +120,15 @@ async def create_tree(*, character_id: str, owner_scope: str, title: str, defaul async def list_trees(owner_scope: str, character_id: str | None = None) -> list[MirrorTree]: async with AsyncSessionLocal() as session: - character_ids = [ - c.id - for c in ( + character_ids = list( + ( await session.execute( select(Character.id).where(Character.owner_scope == owner_scope) ) - ).scalars() - ] + ) + .scalars() + .all() + ) if not character_ids: return [] stmt = select(MirrorTree).where(