修改用户设置的新增用户的权限点击操作

backend/app/modules/data_convert/router.py

@@ -9,7 +9,7 @@ from fastapi import APIRouter, Body, Depends, File, UploadFile
 from fastapi.responses import FileResponse
 
 from app.api.v1.endpoints.platform import ok, fail
-from app.core.auth import get_current_user
+from app.core.auth import get_current_user, is_admin
 from app.db.platform_store import get_platform_store, new_id
 
 
@@ -63,14 +63,28 @@ def list_tasks(
 ) -> dict[str, Any]:
     store = get_platform_store()
     with store.connect() as conn:
-        rows = conn.execute(
-            "SELECT * FROM data_convert_tasks WHERE deleted_at IS NULL "
-            "ORDER BY create_time DESC LIMIT %s OFFSET %s",
-            (page_size, (page - 1) * page_size),
-        ).fetchall()
-        total = conn.execute(
-            "SELECT COUNT(*) FROM data_convert_tasks WHERE deleted_at IS NULL"
-        ).fetchone()[0]
+        if is_admin(current_user):
+            # 管理员可见全部
+            rows = conn.execute(
+                "SELECT * FROM data_convert_tasks WHERE deleted_at IS NULL "
+                "ORDER BY create_time DESC LIMIT %s OFFSET %s",
+                (page_size, (page - 1) * page_size),
+            ).fetchall()
+            total = conn.execute(
+                "SELECT COUNT(*) FROM data_convert_tasks WHERE deleted_at IS NULL"
+            ).fetchone()[0]
+        else:
+            # 普通用户只能看到自己创建的
+            user_id = current_user.get("id")
+            rows = conn.execute(
+                "SELECT * FROM data_convert_tasks WHERE deleted_at IS NULL AND created_by=%s "
+                "ORDER BY create_time DESC LIMIT %s OFFSET %s",
+                (user_id, page_size, (page - 1) * page_size),
+            ).fetchall()
+            total = conn.execute(
+                "SELECT COUNT(*) FROM data_convert_tasks WHERE deleted_at IS NULL AND created_by=%s",
+                (user_id,)
+            ).fetchone()[0]
     return ok({"items": [dict(r) for r in rows], "total": total})
 
 
@@ -85,12 +99,13 @@ def create_task(
     task_id = new_id("dct")
     output_filename = _safe_output_filename(payload.get("output_filename"))
     description = str(payload.get("description") or "").strip()
+    user_id = current_user.get("id")
     store = get_platform_store()
     with store.connect() as conn:
         conn.execute(
-            "INSERT INTO data_convert_tasks (id, name, description, output_filename) "
-            "VALUES (%s, %s, %s, %s)",
-            (task_id, name, description, output_filename),
+            "INSERT INTO data_convert_tasks (id, name, description, output_filename, created_by) "
+            "VALUES (%s, %s, %s, %s, %s)",
+            (task_id, name, description, output_filename, user_id),
         )
     # 创建目录
     _input_dir(task_id).mkdir(parents=True, exist_ok=True)

backend/app/modules/resource/router.py

@@ -6,6 +6,7 @@ from typing import Any
 from app.api.v1.endpoints.platform import ok, fail
 from app.db.platform_store import get_platform_store
 from app.core.auth import get_current_user, has_resource_access, is_admin
+from app.core.audit import audit_log, AuditActions
 
 router = APIRouter(prefix="/resources", tags=["resource"])
 
@@ -25,6 +26,11 @@ def get_acl(resource_type: str, resource_id: str, current_user: dict = Depends(g
 
 
 @router.put("/{resource_type}/{resource_id}/acl")
+@audit_log(
+    action=AuditActions.GRANT_ACL,
+    target_type="",
+    detail_template="设置资源授权: {resource_type}/{resource_id}",
+)
 def set_acl(
     resource_type: str,
     resource_id: str,