AskaEth
deb0a3cb97
执行方案 DevDocs/audit/_plan.md 阶段 0 · G0-C：该文件是全仓第二大超限文件（666 行）， 且后续多条裁决要改它（工具策略落盘、主人档案 GET/PUT、admin API 补推送结果、模型配置 自动化）⇒ 先拆。 - admin.go(169)：共享地基 —— backthinkListLimit 常量、全部 DTO 类型、 collectSessions/collectMemories 收集器、iotDeviceSummary - admin_query.go(467)：只读 GET 聚合（personas/sessions/memories/plugins/channels/iot/ llm/automations/users/backthink/rag 的列表与查询 handler + 渠道账号脱敏等私有辅助） - admin_mutate.go(41)：写操作（adminSetPolicy，带审计的 owner 写） 纯搬移机械证明：拆前与拆后（非空、非 package、非 import 块行）排序后 **md5 相同** （605=605 行）；顶层声明集合 43 条守恒；唯一新增 = 两个新文件的 package 行与 import 块。 未触碰 admin_write_*.go / admin_channels_*.go 及任何 _test.go。 验证：go build/vet 绿；internal/services/gateway 测试绿（含 -run Admin 定向）； linux/amd64 + darwin/arm64 交叉编译绿；三文件 169/467/41 行均 ≤500；gofmt -l 无输出。
42 lines
1.5 KiB
Go
42 lines
1.5 KiB
Go
package gateway
|
|
|
|
import (
|
|
"encoding/json"
|
|
"errors"
|
|
"net/http"
|
|
|
|
capreg "git.yeij.top/AskaEth/Cyrene_v2/internal/capability/registry"
|
|
apperr "git.yeij.top/AskaEth/Cyrene_v2/internal/errors"
|
|
)
|
|
|
|
// adminSetPolicy 更新插入某个能力的可达性标记。它是
|
|
// 带审计的管理写示例（仅 owner，由路由注册强制）。
|
|
func (s *Server) adminSetPolicy(w http.ResponseWriter, r *http.Request) {
|
|
var req policyRequest
|
|
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "invalid request body"))
|
|
return
|
|
}
|
|
if req.Name == "" {
|
|
writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "name is required"))
|
|
return
|
|
}
|
|
if s.caps == nil {
|
|
s.auditClaims(r, "policy.set", "error")
|
|
writeError(w, apperr.Wrap(apperr.ErrInternal, "policy_unavailable", "capability service is not configured"))
|
|
return
|
|
}
|
|
err := s.caps.SetPolicy(req.Name, capreg.ToolPolicy{AllowInGroup: req.AllowInGroup, AllowInStranger: req.AllowInStranger})
|
|
if err != nil {
|
|
s.auditClaims(r, "policy.set", "error")
|
|
if errors.Is(err, capreg.ErrNotFound) {
|
|
writeError(w, apperr.Wrap(apperr.ErrNotFound, "not_found", "capability %q not found", req.Name))
|
|
return
|
|
}
|
|
writeError(w, apperr.Wrap(apperr.ErrInternal, "policy_failed", "failed to set policy"))
|
|
return
|
|
}
|
|
s.auditClaims(r, "policy.set", "ok")
|
|
writeJSON(w, http.StatusOK, map[string]any{"name": req.Name, "allowInGroup": req.AllowInGroup, "allowInStranger": req.AllowInStranger})
|
|
}
|