update

README.md

@@ -113,6 +113,25 @@ ConnectHub 是一个轻量级企业集成中间件：统一管理多系统集成
   - Worker 执行前自动解密，仅在内存中传给 Job
   - key 自动生成到 `FERNET_KEY_PATH`（默认 `/data/fernet.key`），volume 挂载后可持久化
 
+#### 账户、权限与 LDAP
+
+- 本地原始 `admin` 由 `BOOTSTRAP_ADMIN_*` 配置自动创建，是 LDAP 不可用时的兜底管理员。
+- 后台菜单由 SQLAdmin ModelView 生成，并通过权限码控制可见性：
+  - `table:{table}:read`：是否显示菜单和详情页
+  - `table:{table}:write`：是否允许新增、编辑、删除
+  - `button:{code}`：是否允许执行按钮动作
+- 启动时会自动创建两个标准角色：
+  - `system_admin`：系统管理员角色，拥有任务、账户、LDAP、权限和审计管理能力。
+  - `readonly_viewer`：只读查看者角色，仅可查看任务和任务日志。
+- LDAP 连接信息优先在后台 `LDAP配置` 菜单中维护。首次启动会参考 `.env` 中的 LDAP 变量创建默认配置，之后运行时以数据库配置为准。
+- `LDAP配置` 中的服务账号密码不会回显，留空保存表示不修改，填写新密码会使用 Fernet 加密落库。
+- 将 AD 安全组映射为系统角色的流程：
+  1. 使用本地 `admin` 登录后台。
+  2. 进入 `LDAP配置`，填写 LDAP 地址、服务账号、Base DN、用户过滤器和组过滤器，并点击 `测试连接`。
+  3. 让目标 AD 用户登录一次，或在 `LDAP组` 中执行同步，使系统记录对应安全组。
+  4. 在 `LDAP组映射` 中把管理员安全组映射到 `system_admin`，把只读安全组映射到 `readonly_viewer`。
+  5. 映射后 LDAP 用户再次登录会刷新角色；未命中任何映射角色的 LDAP 用户不能进入系统。
+
 #### PluginManager（动态加载）
 
 - 位置：`app/plugins/manager.py`

app/admin/templates/ldap_config_edit.html

@@ -0,0 +1,43 @@
+{% extends "sqladmin/edit.html" %}
+
+{% block content %}
+  {{ super() }}
+
+  <div class="card mt-3">
+    <div class="card-body">
+      <div class="row mb-3">
+        <label class="form-label col-sm-2 col-form-label">服务账号密码</label>
+        <div class="col-sm-10">
+          <input id="connecthub-bind-password" class="form-control" type="password" autocomplete="new-password" placeholder="留空表示不修改；填写后将加密保存。">
+          <div class="form-text">
+            出于安全考虑，编辑页不回显历史密码。留空表示不修改；填写新密码将覆盖旧密码并加密落库。
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+{% endblock %}
+
+{% block tail %}
+  {{ super() }}
+  <script>
+    (function () {
+      // SQLAdmin 默认 edit 页面会渲染一个 form；这里将密码输入注入为隐藏字段，以便提交到后端。
+      const form = document.querySelector("form");
+      const password = document.getElementById("connecthub-bind-password");
+      if (!form || !password) return;
+
+      let hidden = form.querySelector('input[name="bind_password"]');
+      if (!hidden) {
+        hidden = document.createElement("input");
+        hidden.type = "hidden";
+        hidden.name = "bind_password";
+        form.appendChild(hidden);
+      }
+
+      form.addEventListener("submit", function () {
+        hidden.value = password.value || "";
+      });
+    })();
+  </script>
+{% endblock %}

app/admin/views.py

@@ -17,15 +17,18 @@ from app.db import crud
 from app.db.engine import get_session
 from app.db.models import JobStatus
 from app.db.models import Job, JobLog
-from app.db.models import AuditLog, LdapGroup, LdapGroupRole, Permission, Role, User
+from app.db.models import AuditLog, LdapConfig, LdapGroup, LdapGroupRole, Permission, Role, User
 from app.plugins.manager import load_job_class
 from app.security.fernet import encrypt_json
 from app.tasks.execute import execute_job
 from app.admin.secure import SecureModelView
 from app.security.permissions import button_permission_code
 from app.security.audit import log_event
+from app.security.ldap_client import LdapClient
+from app.security.ldap_config import encrypt_bind_password, mask_sensitive_result, to_runtime_config
 from app.security.ldap_sync import sync_all_ldap_users
 from app.security.auth import hash_password
+from app.security.session import get_current_user
 
 
 def _maybe_json(value: Any) -> Any:
@@ -533,6 +536,144 @@ class PermissionAdmin(SecureModelView, model=Permission):
             session.close()
 
 
+class LdapConfigAdmin(SecureModelView, model=LdapConfig):
+    name = "LDAP配置"
+    name_plural = "LDAP配置"
+    icon = "fa fa-sliders"
+    can_create = False
+    can_delete = False
+    edit_template = "ldap_config_edit.html"
+
+    column_list = [LdapConfig.enabled, LdapConfig.uri, LdapConfig.bind_dn, LdapConfig.base_dn, LdapConfig.last_test_at]
+    column_details_list = [
+        LdapConfig.enabled,
+        LdapConfig.uri,
+        LdapConfig.bind_dn,
+        LdapConfig.bind_password_encrypted,
+        LdapConfig.base_dn,
+        LdapConfig.user_filter,
+        LdapConfig.group_filter,
+        LdapConfig.use_starttls,
+        LdapConfig.verify_tls,
+        LdapConfig.last_test_at,
+        LdapConfig.last_test_result,
+        LdapConfig.updated_by_user_id,
+        LdapConfig.created_at,
+        LdapConfig.updated_at,
+    ]
+    form_excluded_columns = [
+        LdapConfig.name,
+        LdapConfig.bind_password_encrypted,
+        LdapConfig.last_test_at,
+        LdapConfig.last_test_result,
+        LdapConfig.updated_by_user_id,
+        LdapConfig.created_at,
+        LdapConfig.updated_at,
+    ]
+    column_labels = {
+        "name": "配置名称",
+        "enabled": "启用LDAP登录",
+        "uri": "LDAP地址",
+        "bind_dn": "服务账号DN",
+        "bind_password_encrypted": "服务账号密码",
+        "base_dn": "Base DN",
+        "user_filter": "用户过滤器",
+        "group_filter": "组过滤器",
+        "use_starttls": "启用StartTLS",
+        "verify_tls": "校验证书",
+        "last_test_at": "上次测试时间",
+        "last_test_result": "上次测试结果",
+        "updated_by_user_id": "更新人ID",
+        "created_at": "创建时间",
+        "updated_at": "更新时间",
+    }
+    column_formatters = {
+        LdapConfig.last_test_at: lambda m, a: _fmt_dt_seconds(m.last_test_at),
+    }
+    column_formatters_detail = {
+        LdapConfig.bind_password_encrypted: lambda m, a: "******" if m.bind_password_encrypted else "",
+        LdapConfig.last_test_at: lambda m, a: _fmt_dt_seconds(m.last_test_at),
+        LdapConfig.last_test_result: lambda m, a: Markup(
+            "<pre style='white-space:pre-wrap'>"
+            + json.dumps(m.last_test_result or {}, ensure_ascii=False, indent=2, sort_keys=True)
+            + "</pre>"
+        ),
+        LdapConfig.created_at: lambda m, a: _fmt_dt_seconds(m.created_at),
+        LdapConfig.updated_at: lambda m, a: _fmt_dt_seconds(m.updated_at),
+    }
+
+    @action(
+        name="test_connection",
+        label="测试连接",
+        confirmation_message="确认使用当前保存的 LDAP 配置测试连接？",
+        add_in_list=True,
+        add_in_detail=True,
+    )
+    async def test_connection(self, request: Request):  # type: ignore[override]
+        if not self.has_action_permission(request, "test_connection"):
+            return RedirectResponse(request.url_for("admin:list", identity=self.identity), status_code=303)
+
+        pks = [pk for pk in request.query_params.get("pks", "").split(",") if pk]
+        pk = int(pks[0]) if pks else None
+        session = get_session()
+        try:
+            config = session.get(LdapConfig, pk) if pk is not None else session.query(LdapConfig).first()
+            if not config:
+                return RedirectResponse(request.url_for("admin:list", identity=self.identity), status_code=303)
+            result = LdapClient(to_runtime_config(config)).test_connection()
+            config.last_test_at = datetime.utcnow()
+            config.last_test_result = mask_sensitive_result(result)
+            session.add(config)
+            session.commit()
+            log_event(
+                session,
+                action="ldap.test",
+                target=f"ldap_config:{config.id}",
+                detail=config.last_test_result,
+                request=request,
+            )
+            return RedirectResponse(request.url_for("admin:details", identity=self.identity, pk=str(config.id)), status_code=303)
+        finally:
+            session.close()
+
+    def get_action_permission_code(self, action_name: str) -> str | None:
+        if action_name == "test_connection":
+            return button_permission_code("ldap:test")
+        return None
+
+    async def on_model_change(self, data: dict, model: LdapConfig, is_created: bool, request) -> None:  # type: ignore[override]
+        if not data.get("name"):
+            data["name"] = "default"
+            model.name = "default"
+
+        try:
+            form = await request.form()
+            raw_password = str(form.get("bind_password") or "").strip()
+        except Exception:
+            raw_password = ""
+        if raw_password:
+            encrypted = encrypt_bind_password(raw_password)
+            data["bind_password_encrypted"] = encrypted
+            model.bind_password_encrypted = encrypted
+
+        user = get_current_user(request)
+        if user:
+            data["updated_by_user_id"] = user.id
+            model.updated_by_user_id = user.id
+
+        session = get_session()
+        try:
+            log_event(
+                session,
+                action="ldap.config.change",
+                target=f"ldap_config:{model.name or 'default'}",
+                detail={"created": is_created},
+                request=request,
+            )
+        finally:
+            session.close()
+
+
 class LdapGroupAdmin(SecureModelView, model=LdapGroup):
     name = "LDAP组"
     name_plural = "LDAP组"
@@ -572,6 +713,12 @@ class LdapGroupRoleAdmin(SecureModelView, model=LdapGroupRole):
     name = "LDAP组映射"
     name_plural = "LDAP组映射"
     icon = "fa fa-random"
+    column_list = [LdapGroupRole.id, LdapGroupRole.ldap_group, LdapGroupRole.role]
+    form_columns = [LdapGroupRole.ldap_group, LdapGroupRole.role]
+    column_labels = {
+        "ldap_group": "LDAP组",
+        "role": "系统角色",
+    }
 
     async def on_model_change(self, data: dict, model: LdapGroupRole, is_created: bool, request) -> None:  # type: ignore[override]
         session = get_session()

app/db/models.py

@@ -107,6 +107,9 @@ class Role(Base):
     users: Mapped[list[User]] = relationship(secondary=user_roles, back_populates="roles")
     permissions: Mapped[list["Permission"]] = relationship(secondary=role_permissions, back_populates="roles")
 
+    def __repr__(self) -> str:
+        return self.name
+
 
 class Permission(Base):
     __tablename__ = "permissions"
@@ -125,6 +128,9 @@ class LdapGroup(Base):
     dn: Mapped[str] = mapped_column(String, unique=True, index=True, nullable=False)
     name: Mapped[str] = mapped_column(String, index=True, nullable=False)
 
+    def __repr__(self) -> str:
+        return self.name or self.dn
+
 
 class LdapGroupRole(Base):
     __tablename__ = "ldap_group_roles"
@@ -133,6 +139,32 @@ class LdapGroupRole(Base):
     ldap_group_id: Mapped[int] = mapped_column(ForeignKey("ldap_groups.id"), nullable=False)
     role_id: Mapped[int] = mapped_column(ForeignKey("roles.id"), nullable=False)
 
+    ldap_group: Mapped[LdapGroup] = relationship()
+    role: Mapped[Role] = relationship()
+
+
+class LdapConfig(Base):
+    __tablename__ = "ldap_configs"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    name: Mapped[str] = mapped_column(String, unique=True, index=True, default="default", nullable=False)
+    enabled: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
+    uri: Mapped[str] = mapped_column(String, default="", nullable=False)
+    bind_dn: Mapped[str] = mapped_column(String, default="", nullable=False)
+    bind_password_encrypted: Mapped[str] = mapped_column(Text, default="", nullable=False)
+    base_dn: Mapped[str] = mapped_column(String, default="", nullable=False)
+    user_filter: Mapped[str] = mapped_column(String, default="(uid={username})", nullable=False)
+    group_filter: Mapped[str] = mapped_column(String, default="(member={user_dn})", nullable=False)
+    use_starttls: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
+    verify_tls: Mapped[bool] = mapped_column(Boolean, default=True, nullable=False)
+    last_test_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+    last_test_result: Mapped[dict[str, Any]] = mapped_column(JSON, default=dict, nullable=False)
+    updated_by_user_id: Mapped[int | None] = mapped_column(ForeignKey("users.id"), nullable=True)
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False
+    )
+
 
 class AuditLog(Base):
     __tablename__ = "audit_logs"

app/main.py

@@ -11,6 +11,7 @@ from app.admin.views import (
     AuditLogAdmin,
     JobAdmin,
     JobLogAdmin,
+    LdapConfigAdmin,
     LdapGroupAdmin,
     LdapGroupRoleAdmin,
     PermissionAdmin,
@@ -25,6 +26,8 @@ from app.security.bootstrap import bootstrap_admin
 from app.security.session import get_current_user
 from app.security.fernet import get_or_create_fernet_key
 from app.api.auth_routes import router as auth_router
+from app.security.ldap_config import ensure_default_ldap_config
+from app.security.rbac_seed import seed_standard_rbac
 
 
 def _init_db() -> None:
@@ -40,6 +43,8 @@ def _ensure_runtime() -> None:
     get_or_create_fernet_key(settings.fernet_key_path)
     _init_db()
     bootstrap_admin()
+    ensure_default_ldap_config()
+    seed_standard_rbac()
 
 
 def create_app() -> FastAPI:
@@ -57,6 +62,7 @@ def create_app() -> FastAPI:
     admin.add_view(UserAdmin)
     admin.add_view(RoleAdmin)
     admin.add_view(PermissionAdmin)
+    admin.add_view(LdapConfigAdmin)
     admin.add_view(LdapGroupAdmin)
     admin.add_view(LdapGroupRoleAdmin)
     admin.add_view(AuditLogAdmin)

app/security/auth.py

@@ -51,7 +51,23 @@ def authenticate_local(username: str, password: str, request=None) -> int | None
 
 def authenticate_ldap(username: str, password: str, request=None) -> int | None:
     client = LdapClient()
-    result = client.authenticate(username, password)
+    if not client.is_enabled():
+        return None
+    try:
+        result = client.authenticate(username, password)
+    except Exception as exc:
+        db = get_session()
+        try:
+            log_event(
+                db,
+                action="login.failed",
+                target=username,
+                detail={"reason": "ldap_error", "message": str(exc)},
+                request=request,
+            )
+        finally:
+            db.close()
+        return None
     if not result:
         db = get_session()
         try:
@@ -72,7 +88,19 @@ def authenticate_ldap(username: str, password: str, request=None) -> int | None:
         user.is_ldap = True
         user.is_active = True
         user.last_login_at = datetime.utcnow()
-        sync_user_ldap_roles(session=db, user=user, username=username, user_dn=user_dn)
+        roles = sync_user_ldap_roles(session=db, user=user, username=username, user_dn=user_dn)
+        if not roles:
+            db.add(user)
+            db.commit()
+            log_event(
+                db,
+                action="login.failed",
+                target=username,
+                detail={"reason": "ldap.no_mapped_role", "user_dn": user_dn},
+                request=request,
+                actor=user,
+            )
+            return None
         db.add(user)
         db.commit()
         log_event(db, action="login.success", target=username, detail={"provider": "ldap"}, request=request, actor=user)

app/security/ldap_client.py

@@ -5,34 +5,53 @@ from typing import Any
 
 from ldap3 import ALL, Connection, Server, Tls
 
-from app.core.config import settings
+from app.security.ldap_config import RuntimeLdapConfig, get_runtime_ldap_config
 
 
 class LdapClient:
-    def __init__(self) -> None:
+    def __init__(self, config: RuntimeLdapConfig | None = None) -> None:
+        self.config = config if config is not None else get_runtime_ldap_config()
+        self._server: Server | None = None
+        if not self.config:
+            return
         tls = None
-        if settings.ldap_uri.startswith("ldaps://") or settings.ldap_use_starttls:
+        if self.config.uri.startswith("ldaps://") or self.config.use_starttls:
-            tls = Tls(validate=ssl.CERT_REQUIRED if settings.ldap_verify_tls else ssl.CERT_NONE)
+            tls = Tls(validate=ssl.CERT_REQUIRED if self.config.verify_tls else ssl.CERT_NONE)
-        self._server = Server(settings.ldap_uri, use_ssl=settings.ldap_uri.startswith("ldaps://"), get_info=ALL, tls=tls)
+        self._server = Server(self.config.uri, use_ssl=self.config.uri.startswith("ldaps://"), get_info=ALL, tls=tls)
+
+    def is_enabled(self) -> bool:
+        return bool(self.config and self.config.enabled and self.config.uri and self.config.base_dn)
+
+    def _format_filter(self, template: str, **values: str) -> str:
+        # 兼容 AD 配置中常见的 sAMAccountName 占位写法。
+        if "username" in values:
+            values.setdefault("sAMAccountName", values["username"])
+        return template.format(**values)
 
     def _connect(self, *, bind_dn: str | None = None, password: str | None = None) -> Connection:
+        if not self._server:
+            raise RuntimeError("LDAP is not configured")
         conn = Connection(self._server, user=bind_dn, password=password, auto_bind=False)
         conn.open()
-        if settings.ldap_use_starttls and self._server.ssl is False:
+        if self.config and self.config.use_starttls and self._server.ssl is False:
-            conn.start_tls()
+            if not conn.start_tls():
-        conn.bind()
+                raise RuntimeError(f"LDAP StartTLS failed: {conn.result}")
+        if not conn.bind():
+            raise RuntimeError(f"LDAP bind failed: {conn.result}")
         return conn
 
     def _service_conn(self) -> Connection:
-        return self._connect(bind_dn=settings.ldap_bind_dn, password=settings.ldap_bind_password)
+        if not self.config:
+            raise RuntimeError("LDAP is not configured")
+        return self._connect(bind_dn=self.config.bind_dn, password=self.config.bind_password)
 
     def find_user_dn(self, username: str) -> str | None:
-        if not settings.ldap_base_dn:
+        if not self.is_enabled() or not self.config:
             return None
         conn = self._service_conn()
         try:
-            search_filter = settings.ldap_user_filter.format(username=username)
+            search_filter = self._format_filter(self.config.user_filter, username=username)
-            conn.search(settings.ldap_base_dn, search_filter, attributes=["dn"])
+            conn.search(self.config.base_dn, search_filter, attributes=["dn"])
             if not conn.entries:
                 return None
             return conn.entries[0].entry_dn
@@ -51,12 +70,12 @@ class LdapClient:
             return None
 
     def get_user_groups(self, *, user_dn: str, username: str) -> list[dict[str, str]]:
-        if not settings.ldap_base_dn:
+        if not self.is_enabled() or not self.config:
             return []
         conn = self._service_conn()
         try:
-            search_filter = settings.ldap_group_filter.format(user_dn=user_dn, username=username)
+            search_filter = self._format_filter(self.config.group_filter, user_dn=user_dn, username=username)
-            conn.search(settings.ldap_base_dn, search_filter, attributes=["cn"])
+            conn.search(self.config.base_dn, search_filter, attributes=["cn"])
             results: list[dict[str, str]] = []
             for entry in conn.entries:
                 dn = entry.entry_dn
@@ -69,3 +88,21 @@ class LdapClient:
             return results
         finally:
             conn.unbind()
+
+    def test_connection(self) -> dict[str, Any]:
+        if not self.is_enabled() or not self.config:
+            return {"ok": False, "message": "LDAP 未启用或配置不完整"}
+        conn = None
+        try:
+            conn = self._service_conn()
+            conn.search(self.config.base_dn, "(objectClass=*)", attributes=["dn"], size_limit=1)
+            return {
+                "ok": True,
+                "message": "LDAP 服务账号连接成功",
+                "entries_found": len(conn.entries),
+            }
+        except Exception as exc:
+            return {"ok": False, "message": str(exc)}
+        finally:
+            if conn is not None:
+                conn.unbind()

app/security/ldap_config.py

@@ -0,0 +1,104 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any
+
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from app.core.config import settings
+from app.db.engine import get_session
+from app.db.models import LdapConfig
+from app.security.fernet import decrypt_json, encrypt_json
+
+
+LDAP_CONFIG_NAME = "default"
+
+
+@dataclass(frozen=True)
+class RuntimeLdapConfig:
+    enabled: bool
+    uri: str
+    bind_dn: str
+    bind_password: str
+    base_dn: str
+    user_filter: str
+    group_filter: str
+    use_starttls: bool
+    verify_tls: bool
+
+
+def encrypt_bind_password(password: str) -> str:
+    if not password:
+        return ""
+    return encrypt_json({"password": password})
+
+
+def decrypt_bind_password(token: str) -> str:
+    if not token:
+        return ""
+    try:
+        data = decrypt_json(token)
+    except Exception:
+        return ""
+    value = data.get("password")
+    return str(value) if value is not None else ""
+
+
+def get_default_ldap_config(session: Session) -> LdapConfig | None:
+    return session.scalar(select(LdapConfig).where(LdapConfig.name == LDAP_CONFIG_NAME))
+
+
+def ensure_default_ldap_config() -> None:
+    db = get_session()
+    try:
+        if get_default_ldap_config(db):
+            return
+        config = LdapConfig(
+            name=LDAP_CONFIG_NAME,
+            enabled=bool(settings.ldap_base_dn),
+            uri=settings.ldap_uri,
+            bind_dn=settings.ldap_bind_dn,
+            bind_password_encrypted=encrypt_bind_password(settings.ldap_bind_password),
+            base_dn=settings.ldap_base_dn,
+            user_filter=settings.ldap_user_filter,
+            group_filter=settings.ldap_group_filter,
+            use_starttls=settings.ldap_use_starttls,
+            verify_tls=settings.ldap_verify_tls,
+            last_test_result={},
+        )
+        db.add(config)
+        db.commit()
+    finally:
+        db.close()
+
+
+def to_runtime_config(config: LdapConfig | None) -> RuntimeLdapConfig | None:
+    if not config or not config.enabled:
+        return None
+    return RuntimeLdapConfig(
+        enabled=bool(config.enabled),
+        uri=config.uri,
+        bind_dn=config.bind_dn,
+        bind_password=decrypt_bind_password(config.bind_password_encrypted),
+        base_dn=config.base_dn,
+        user_filter=config.user_filter,
+        group_filter=config.group_filter,
+        use_starttls=bool(config.use_starttls),
+        verify_tls=bool(config.verify_tls),
+    )
+
+
+def get_runtime_ldap_config() -> RuntimeLdapConfig | None:
+    db = get_session()
+    try:
+        return to_runtime_config(get_default_ldap_config(db))
+    finally:
+        db.close()
+
+
+def mask_sensitive_result(result: dict[str, Any]) -> dict[str, Any]:
+    cleaned = dict(result)
+    cleaned.pop("password", None)
+    cleaned.pop("bind_password", None)
+    return cleaned

app/security/ldap_sync.py

@@ -27,14 +27,14 @@ def _ensure_groups(session, groups: list[dict[str, str]]) -> list[LdapGroup]:
     return results
 
 
-def sync_user_ldap_roles(*, session, user: User, username: str, user_dn: str) -> None:
+def sync_user_ldap_roles(*, session, user: User, username: str, user_dn: str) -> list[Role]:
     client = LdapClient()
     groups = client.get_user_groups(user_dn=user_dn, username=username)
     group_objs = _ensure_groups(session, groups)
     if not group_objs:
         user.roles = []
         session.add(user)
-        return
+        return []
 
     group_ids = [g.id for g in group_objs]
     role_ids = list(
@@ -43,10 +43,11 @@ def sync_user_ldap_roles(*, session, user: User, username: str, user_dn: str) ->
     if not role_ids:
         user.roles = []
         session.add(user)
-        return
+        return []
     roles = list(session.scalars(select(Role).where(Role.id.in_(role_ids))))
     user.roles = roles
     session.add(user)
+    return roles
 
 
 def sync_all_ldap_users() -> int:

app/security/rbac_seed.py

@@ -0,0 +1,126 @@
+from __future__ import annotations
+
+from sqlalchemy import select
+
+from app.db.engine import get_session
+from app.db.models import Permission, Role
+
+
+SYSTEM_ADMIN_ROLE = "system_admin"
+READONLY_VIEWER_ROLE = "readonly_viewer"
+
+ADMIN_PERMISSION_CODES = {
+    "table:jobs:read",
+    "table:jobs:write",
+    "table:job_logs:read",
+    "table:job_logs:write",
+    "table:users:read",
+    "table:users:write",
+    "table:roles:read",
+    "table:roles:write",
+    "table:permissions:read",
+    "table:permissions:write",
+    "table:ldap_configs:read",
+    "table:ldap_configs:write",
+    "table:ldap_groups:read",
+    "table:ldap_groups:write",
+    "table:ldap_group_roles:read",
+    "table:ldap_group_roles:write",
+    "table:audit_logs:read",
+    "button:job:run",
+    "button:job:run_now",
+    "button:job:view_logs",
+    "button:job:disable",
+    "button:job:clear_logs",
+    "button:job:delete_with_logs",
+    "button:joblog:retry",
+    "button:ldap:sync",
+    "button:ldap:test",
+}
+
+READONLY_PERMISSION_CODES = {
+    "table:jobs:read",
+    "table:job_logs:read",
+}
+
+PERMISSION_DESCRIPTIONS = {
+    "table:jobs:read": "查看任务菜单和任务详情",
+    "table:jobs:write": "创建、编辑、删除任务",
+    "table:job_logs:read": "查看任务日志菜单和日志详情",
+    "table:job_logs:write": "管理任务日志",
+    "table:users:read": "查看用户菜单和用户详情",
+    "table:users:write": "管理用户",
+    "table:roles:read": "查看角色菜单和角色详情",
+    "table:roles:write": "管理角色",
+    "table:permissions:read": "查看权限菜单和权限详情",
+    "table:permissions:write": "管理权限",
+    "table:ldap_configs:read": "查看 LDAP 配置",
+    "table:ldap_configs:write": "管理 LDAP 配置",
+    "table:ldap_groups:read": "查看 LDAP 组",
+    "table:ldap_groups:write": "管理 LDAP 组",
+    "table:ldap_group_roles:read": "查看 LDAP 组角色映射",
+    "table:ldap_group_roles:write": "管理 LDAP 组角色映射",
+    "table:audit_logs:read": "查看审计日志",
+    "button:job:run": "从任务列表立即运行任务",
+    "button:job:run_now": "通过 SQLAdmin 动作立即运行任务",
+    "button:job:view_logs": "从任务查看关联日志",
+    "button:job:disable": "停用任务",
+    "button:job:clear_logs": "清理任务日志",
+    "button:job:delete_with_logs": "删除任务及日志",
+    "button:joblog:retry": "重试任务日志",
+    "button:ldap:sync": "同步 LDAP 用户角色",
+    "button:ldap:test": "测试 LDAP 连接",
+}
+
+
+def _ensure_permissions(session, codes: set[str]) -> dict[str, Permission]:
+    existing = {p.code: p for p in session.scalars(select(Permission).where(Permission.code.in_(codes)))}
+    for code in sorted(codes):
+        perm = existing.get(code)
+        if not perm:
+            perm = Permission(code=code, description=PERMISSION_DESCRIPTIONS.get(code, ""))
+            session.add(perm)
+            session.flush()
+            existing[code] = perm
+        elif not perm.description and code in PERMISSION_DESCRIPTIONS:
+            perm.description = PERMISSION_DESCRIPTIONS[code]
+            session.add(perm)
+    return existing
+
+
+def _ensure_role(session, *, name: str, description: str, permission_codes: set[str]) -> Role:
+    role = session.scalar(select(Role).where(Role.name == name))
+    if not role:
+        role = Role(name=name, description=description)
+        session.add(role)
+        session.flush()
+    elif not role.description:
+        role.description = description
+        session.add(role)
+
+    perms = _ensure_permissions(session, permission_codes)
+    current_codes = {p.code for p in role.permissions}
+    for code in sorted(permission_codes - current_codes):
+        role.permissions.append(perms[code])
+    session.add(role)
+    return role
+
+
+def seed_standard_rbac() -> None:
+    db = get_session()
+    try:
+        _ensure_role(
+            db,
+            name=SYSTEM_ADMIN_ROLE,
+            description="系统管理员：通过角色获得完整后台管理权限",
+            permission_codes=ADMIN_PERMISSION_CODES,
+        )
+        _ensure_role(
+            db,
+            name=READONLY_VIEWER_ROLE,
+            description="只读查看者：仅可查看任务和任务日志",
+            permission_codes=READONLY_PERMISSION_CODES,
+        )
+        db.commit()
+    finally:
+        db.close()

env.example

@@ -18,11 +18,11 @@ BOOTSTRAP_ADMIN_GENERATE=1
 BOOTSTRAP_ADMIN_PASS_PATH=/data/admin.pass
 
 # LDAP
-LDAP_URI=ldaps://SHDC01.senasic.cn:636
+LDAP_URI=ldap://localhost:389
-LDAP_BIND_DN=dcadmin@senasic.cn
+LDAP_BIND_DN=
-LDAP_BIND_PASSWORD=Jj_Window$
+LDAP_BIND_PASSWORD=
-LDAP_BASE_DN=ou=People,dc=senasic,dc=com
+LDAP_BASE_DN=
-LDAP_USER_FILTER=(uid={sAMAccountName})
+LDAP_USER_FILTER=(sAMAccountName={username})
 LDAP_GROUP_FILTER=(member={user_dn})
 LDAP_USE_STARTTLS=0
 LDAP_VERIFY_TLS=0