Allow full management tokens to access token management

apps/aether-gateway/src/control/management_token_permissions.rs

@@ -339,9 +339,12 @@ pub(crate) fn validate_management_token_admin_route_permission(
         .and_then(|value| value.rsplit_once(':').map(|(scope, _)| scope))
         .unwrap_or_default();
     let admin_permission = format!("admin:{scope}:admin");
+    let has_full_assignable_access =
+        management_token_permissions_cover_all_assignable_permissions(token_permissions);
     if token_permissions
         .iter()
         .any(|permission| permission == &required_permission || permission == &admin_permission)
+        || (scope == "management_tokens" && has_full_assignable_access)
     {
         Ok(())
     } else {
@@ -468,6 +471,18 @@ fn is_assignable_management_token_permission(key: &str) -> bool {
         .any(|item| item.key == key)
 }
 
+pub(crate) fn management_token_permissions_cover_all_assignable_permissions(
+    token_permissions: &[String],
+) -> bool {
+    let permission_set = token_permissions
+        .iter()
+        .map(String::as_str)
+        .collect::<BTreeSet<_>>();
+    all_assignable_management_token_permissions()
+        .iter()
+        .all(|permission| permission_set.contains(permission.as_str()))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -581,6 +596,25 @@ mod tests {
         );
     }
 
+    #[test]
+    fn full_assignable_token_permissions_can_cover_management_tokens_scope() {
+        let decision = GatewayControlDecision::synthetic(
+            "/api/admin/management-tokens".to_string(),
+            Some("admin_proxy".to_string()),
+            Some("management_tokens_manage".to_string()),
+            Some("list_tokens".to_string()),
+            Some("admin:management_tokens".to_string()),
+        );
+        let permissions = all_assignable_management_token_permissions();
+
+        assert!(validate_management_token_admin_route_permission(
+            &http::Method::GET,
+            &decision,
+            Some(&permissions),
+        )
+        .is_ok());
+    }
+
     fn extract_admin_route_scopes(source: &'static str) -> BTreeSet<&'static str> {
         let mut scopes = BTreeSet::new();
         let mut remaining = source;

apps/aether-gateway/src/control/mod.rs

@@ -16,6 +16,7 @@ pub(crate) use execute::{allows_control_execute_emergency, maybe_execute_via_con
 pub(crate) use management_token_permissions::{
     all_assignable_management_token_permissions, management_token_permission_catalog_payload,
     management_token_permission_keys_from_value, management_token_permission_mode_and_summary,
+    management_token_permissions_cover_all_assignable_permissions,
     management_token_required_permission, normalize_assignable_management_token_permissions,
     validate_management_token_admin_route_permission,
 };

apps/aether-gateway/src/handlers/admin/system/management_tokens.rs

@@ -1,5 +1,7 @@
 use crate::control::{
-    management_token_permission_catalog_payload, normalize_assignable_management_token_permissions,
+    management_token_permission_catalog_payload,
+    management_token_permissions_cover_all_assignable_permissions,
+    normalize_assignable_management_token_permissions,
 };
 use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
 use crate::handlers::admin::shared::{query_param_optional_bool, query_param_value};
@@ -317,12 +319,20 @@ pub(crate) async fn maybe_build_local_admin_management_tokens_response(
         return Ok(None);
     }
 
-    if decision
+    let is_management_token = decision
         .admin_principal
         .as_ref()
         .and_then(|principal| principal.management_token_id.as_deref())
-        .is_some()
+        .is_some();
-    {
+    let management_token_is_full = decision
+        .admin_principal
+        .as_ref()
+        .and_then(|principal| principal.management_token_permissions.as_deref())
+        .map_or(
+            true,
+            management_token_permissions_cover_all_assignable_permissions,
+        );
+    if is_management_token && !management_token_is_full {
         return Ok(Some(
             (
                 http::StatusCode::FORBIDDEN,

apps/aether-gateway/src/tests/control/admin/health_access.rs

@@ -15,14 +15,15 @@ use http::StatusCode;
 use serde_json::json;
 
 use super::super::{
-    build_router_with_state, issue_test_admin_access_token, sample_endpoint, sample_key,
+    build_router_with_state, hash_management_token, issue_test_admin_access_token, sample_endpoint,
-    sample_ldap_module_config, sample_management_token, sample_oauth_module_provider,
+    sample_key, sample_ldap_module_config, sample_management_token, sample_oauth_module_provider,
     sample_provider, sample_request_candidate, start_server, AppState,
 };
 use crate::constants::{
     GATEWAY_HEADER, TRUSTED_ADMIN_SESSION_ID_HEADER, TRUSTED_ADMIN_USER_ID_HEADER,
     TRUSTED_ADMIN_USER_ROLE_HEADER,
 };
+use crate::control::all_assignable_management_token_permissions;
 use crate::data::GatewayDataState;
 
 const ADMIN_ENDPOINT_HEALTH_DATA_UNAVAILABLE_DETAIL: &str =
@@ -1120,3 +1121,76 @@ async fn gateway_handles_admin_management_tokens_locally_with_trusted_admin_prin
     gateway_handle.abort();
     upstream_handle.abort();
 }
+
+#[tokio::test]
+async fn gateway_allows_full_management_token_to_fetch_permission_catalog() {
+    let upstream_hits = Arc::new(Mutex::new(0usize));
+    let upstream_hits_clone = Arc::clone(&upstream_hits);
+    let upstream = Router::new().route(
+        "/api/admin/management-tokens/permissions/catalog",
+        any(move |_request: Request| {
+            let upstream_hits_inner = Arc::clone(&upstream_hits_clone);
+            async move {
+                *upstream_hits_inner.lock().expect("mutex should lock") += 1;
+                (StatusCode::OK, Body::from("unexpected upstream hit"))
+            }
+        }),
+    );
+
+    let state = AppState::new().expect("gateway should build");
+    let admin_user = state
+        .create_local_auth_user_with_settings(
+            Some("management-full@example.com".to_string()),
+            true,
+            "admin".to_string(),
+            "hash".to_string(),
+            "admin".to_string(),
+            None,
+            None,
+            None,
+            None,
+        )
+        .await
+        .expect("admin user should be created")
+        .expect("admin user should exist");
+    let raw_token = "ae-management-full-access";
+    let mut management_token =
+        sample_management_token("mt-admin-full", &admin_user.id, "management-full", true);
+    management_token.token.allowed_ips = None;
+    management_token.token.permissions = Some(json!(all_assignable_management_token_permissions()));
+    let management_token_repository =
+        Arc::new(InMemoryManagementTokenRepository::seed_with_hashes(
+            vec![management_token],
+            vec![(
+                hash_management_token(raw_token),
+                "mt-admin-full".to_string(),
+            )],
+        ));
+
+    let (upstream_url, upstream_handle) = start_server(upstream).await;
+    let gateway = build_router_with_state(state.with_data_state_for_tests(
+        GatewayDataState::with_management_token_repository_for_tests(management_token_repository),
+    ));
+    let (gateway_url, gateway_handle) = start_server(gateway).await;
+
+    let response = reqwest::Client::new()
+        .get(format!(
+            "{gateway_url}/api/admin/management-tokens/permissions/catalog"
+        ))
+        .header(crate::constants::GATEWAY_HEADER, "rust-phase3b")
+        .bearer_auth(raw_token)
+        .send()
+        .await
+        .expect("request should succeed");
+
+    let status = response.status();
+    let body = response.text().await.expect("body should read");
+    assert_eq!(status, StatusCode::OK, "body={body}");
+    let payload: serde_json::Value = serde_json::from_str(&body).expect("json body should parse");
+    assert!(payload["items"].is_array());
+    assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
+
+    gateway_handle.abort();
+    upstream_handle.abort();
+    drop(upstream_url);
+}

apps/aether-gateway/src/tests/control/admin/oauth.rs

@@ -7439,7 +7439,7 @@ async fn gateway_toggles_admin_management_token_locally_with_trusted_admin_princ
 }
 
 #[tokio::test]
-async fn gateway_rejects_management_token_principal_for_admin_management_token_routes() {
+async fn gateway_rejects_partial_management_token_for_admin_management_token_routes() {
     let upstream_hits = Arc::new(Mutex::new(0usize));
     let upstream_hits_clone = Arc::clone(&upstream_hits);
     let upstream = Router::new().route(
@@ -7453,40 +7453,61 @@ async fn gateway_rejects_management_token_principal_for_admin_management_token_r
         }),
     );
 
-    let repository = Arc::new(InMemoryManagementTokenRepository::seed(vec![
+    let raw_token = "ae-management-partial-access";
-        sample_management_token("mt-admin-1", "user-1", "alice", true),
+    let state = AppState::new().expect("gateway should build");
-    ]));
+    let admin_user = state
+        .create_local_auth_user_with_settings(
+            Some("management-partial@example.com".to_string()),
+            true,
+            "admin".to_string(),
+            "hash".to_string(),
+            "admin".to_string(),
+            None,
+            None,
+            None,
+            None,
+        )
+        .await
+        .expect("admin user should be created")
+        .expect("admin user should exist");
+    let mut management_token = sample_management_token(
+        "mt-admin-partial",
+        &admin_user.id,
+        "management-partial",
+        true,
+    );
+    management_token.token.allowed_ips = None;
+    management_token.token.permissions = Some(json!(["admin:usage:read"]));
+    let repository = Arc::new(InMemoryManagementTokenRepository::seed_with_hashes(
+        vec![management_token],
+        vec![(
+            hash_management_token(raw_token),
+            "mt-admin-partial".to_string(),
+        )],
+    ));
 
     let (upstream_url, upstream_handle) = start_server(upstream).await;
-    let gateway = build_router_with_state(
+    let gateway = build_router_with_state(state.with_data_state_for_tests(
-        AppState::new()
+        GatewayDataState::with_management_token_repository_for_tests(repository),
-            .expect("gateway should build")
+    ));
-            .with_data_state_for_tests(
-                GatewayDataState::with_management_token_repository_for_tests(repository),
-            ),
-    );
     let (gateway_url, gateway_handle) = start_server(gateway).await;
 
     let response = reqwest::Client::new()
         .get(format!("{gateway_url}/api/admin/management-tokens"))
         .header(crate::constants::GATEWAY_HEADER, "rust-phase3b")
-        .header(TRUSTED_ADMIN_USER_ID_HEADER, "admin-user-123")
+        .bearer_auth(raw_token)
-        .header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
-        .header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
-        .header(
-            TRUSTED_ADMIN_MANAGEMENT_TOKEN_ID_HEADER,
-            "mt-admin-principal",
-        )
         .send()
         .await
         .expect("request should succeed");
 
     assert_eq!(response.status(), StatusCode::FORBIDDEN);
     let payload: serde_json::Value = response.json().await.expect("json body should parse");
+    assert_eq!(payload["detail"], "management token permission denied");
     assert_eq!(
-        payload["detail"],
+        payload["required_permission"],
-        "不允许使用 Management Token 管理其他 Token，请使用 Web 界面或 JWT 认证"
+        "admin:management_tokens:read"
     );
+    assert_eq!(payload["route_family"], "management_tokens_manage");
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
 
     gateway_handle.abort();