feat: add management token permissions

apps/aether-gateway/src/tests/control/admin/oauth.rs

@@ -6767,6 +6767,152 @@ async fn gateway_handles_admin_management_token_detail_locally_with_trusted_admi
     upstream_handle.abort();
 }
 
+#[tokio::test]
+async fn gateway_creates_updates_and_regenerates_admin_management_token_locally_with_permissions() {
+    let upstream_hits = Arc::new(Mutex::new(0usize));
+    let upstream_hits_clone = Arc::clone(&upstream_hits);
+    let upstream = Router::new().fallback(any(move |_request: Request| {
+        let upstream_hits_inner = Arc::clone(&upstream_hits_clone);
+        async move {
+            *upstream_hits_inner.lock().expect("mutex should lock") += 1;
+            (StatusCode::OK, Body::from("unexpected upstream hit"))
+        }
+    }));
+
+    let repository = Arc::new(InMemoryManagementTokenRepository::default());
+    let state = AppState::new().expect("gateway should build");
+    let admin_user = state
+        .create_local_auth_user_with_settings(
+            Some("management-admin@example.com".to_string()),
+            true,
+            "admin".to_string(),
+            "hash".to_string(),
+            "admin".to_string(),
+            None,
+            None,
+            None,
+            None,
+        )
+        .await
+        .expect("admin user should be created")
+        .expect("admin user should exist");
+
+    let (upstream_url, upstream_handle) = start_server(upstream).await;
+    let gateway = build_router_with_state(state.with_data_state_for_tests(
+        GatewayDataState::with_management_token_repository_for_tests(repository.clone()),
+    ));
+    let (gateway_url, gateway_handle) = start_server(gateway).await;
+    let client = reqwest::Client::new();
+
+    let create_response = client
+        .post(format!("{gateway_url}/api/admin/management-tokens"))
+        .header(crate::constants::GATEWAY_HEADER, "rust-phase3b")
+        .header(TRUSTED_ADMIN_USER_ID_HEADER, admin_user.id.as_str())
+        .header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
+        .header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
+        .json(&json!({
+            "name": "admin-token",
+            "description": "admin token",
+            "allowed_ips": ["127.0.0.1"],
+            "permissions": ["admin:usage:read", "admin:pool:write"],
+            "expires_at": "2099-01-01T00:00:00Z",
+        }))
+        .send()
+        .await
+        .expect("request should succeed");
+
+    let create_status = create_response.status();
+    let create_body = create_response.text().await.expect("body should read");
+    assert_eq!(create_status, StatusCode::CREATED, "{create_body}");
+    let create_payload: serde_json::Value =
+        serde_json::from_str(&create_body).expect("json body should parse");
+    let token_id = create_payload["data"]["id"]
+        .as_str()
+        .expect("token id should exist")
+        .to_string();
+    assert_eq!(create_payload["message"], "Management Token 创建成功");
+    assert_eq!(create_payload["data"]["user"]["id"], json!(admin_user.id));
+    assert_eq!(
+        create_payload["data"]["permissions"],
+        json!(["admin:pool:write", "admin:usage:read"])
+    );
+    let created_secret = create_payload["token"].as_str().unwrap_or_default();
+    assert!(created_secret.starts_with("ae-"));
+
+    let update_response = client
+        .put(format!(
+            "{gateway_url}/api/admin/management-tokens/{token_id}"
+        ))
+        .header(crate::constants::GATEWAY_HEADER, "rust-phase3b")
+        .header(TRUSTED_ADMIN_USER_ID_HEADER, admin_user.id.as_str())
+        .header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
+        .header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
+        .json(&json!({
+            "name": "admin-token-updated",
+            "description": null,
+            "allowed_ips": null,
+            "permissions": ["admin:usage:read"],
+            "expires_at": null,
+        }))
+        .send()
+        .await
+        .expect("request should succeed");
+
+    assert_eq!(update_response.status(), StatusCode::OK);
+    let update_payload: serde_json::Value = update_response
+        .json()
+        .await
+        .expect("json body should parse");
+    assert_eq!(update_payload["message"], "更新成功");
+    assert_eq!(update_payload["data"]["name"], "admin-token-updated");
+    assert_eq!(
+        update_payload["data"]["permissions"],
+        json!(["admin:usage:read"])
+    );
+    assert_eq!(
+        update_payload["data"]["allowed_ips"],
+        serde_json::Value::Null
+    );
+
+    let regenerate_response = client
+        .post(format!(
+            "{gateway_url}/api/admin/management-tokens/{token_id}/regenerate"
+        ))
+        .header(crate::constants::GATEWAY_HEADER, "rust-phase3b")
+        .header(TRUSTED_ADMIN_USER_ID_HEADER, admin_user.id.as_str())
+        .header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
+        .header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
+        .send()
+        .await
+        .expect("request should succeed");
+
+    assert_eq!(regenerate_response.status(), StatusCode::OK);
+    let regenerate_payload: serde_json::Value = regenerate_response
+        .json()
+        .await
+        .expect("json body should parse");
+    assert_eq!(regenerate_payload["message"], "Token 已重新生成");
+    assert!(regenerate_payload["token"]
+        .as_str()
+        .unwrap_or_default()
+        .starts_with("ae-"));
+    assert_eq!(
+        repository
+            .get_management_token_with_user(&token_id)
+            .await
+            .expect("lookup should succeed")
+            .expect("token should remain")
+            .token
+            .permissions,
+        Some(json!(["admin:usage:read"]))
+    );
+    assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
+
+    gateway_handle.abort();
+    upstream_handle.abort();
+    drop(upstream_url);
+}
+
 #[tokio::test]
 async fn gateway_deletes_admin_management_token_locally_with_trusted_admin_principal() {
     let upstream_hits = Arc::new(Mutex::new(0usize));

apps/aether-gateway/src/tests/control/admin/proxy_nodes.rs

@@ -763,6 +763,173 @@ async fn gateway_registers_and_unregisters_proxy_nodes_locally_with_management_t
     upstream_handle.abort();
 }
 
+#[tokio::test]
+async fn gateway_allows_management_token_with_proxy_nodes_write_permission() {
+    let raw_token = "ae-proxy-register-write-permission";
+    let proxy_node_repository = Arc::new(InMemoryProxyNodeRepository::default());
+    let state = AppState::new().expect("gateway should build");
+    let admin_user = state
+        .create_local_auth_user_with_settings(
+            Some("proxy-admin-write@example.com".to_string()),
+            true,
+            "admin".to_string(),
+            "hash".to_string(),
+            "admin".to_string(),
+            None,
+            None,
+            None,
+            None,
+        )
+        .await
+        .expect("admin user should be created")
+        .expect("admin user should exist");
+    let mut management_token = sample_management_token(
+        "token-proxy-register-write",
+        &admin_user.id,
+        "proxy-admin-write",
+        true,
+    );
+    management_token.token.allowed_ips = None;
+    management_token.token.permissions = Some(json!(["admin:proxy_nodes:write"]));
+    let management_token_repository =
+        Arc::new(InMemoryManagementTokenRepository::seed_with_hashes(
+            vec![management_token],
+            vec![(
+                hash_management_token(raw_token),
+                "token-proxy-register-write".to_string(),
+            )],
+        ));
+
+    let state = state.with_data_state_for_tests(
+        GatewayDataState::with_management_token_repository_for_tests(management_token_repository)
+            .attach_proxy_node_repository_for_tests(proxy_node_repository),
+    );
+    let gateway = build_router_with_state(state);
+    let (gateway_url, gateway_handle) = start_server(gateway).await;
+
+    let register_response = reqwest::Client::new()
+        .post(format!("{gateway_url}/api/admin/proxy-nodes/register"))
+        .header(GATEWAY_HEADER, "rust-phase3b")
+        .bearer_auth(raw_token)
+        .json(&json!({
+            "name": "proxy-write",
+            "ip": "1.1.1.1",
+            "port": 0,
+            "heartbeat_interval": 30,
+            "tunnel_mode": true
+        }))
+        .send()
+        .await
+        .expect("request should succeed");
+
+    assert_eq!(register_response.status(), StatusCode::OK);
+    let register_payload: serde_json::Value = register_response
+        .json()
+        .await
+        .expect("json body should parse");
+    assert_eq!(register_payload["node"]["name"], "proxy-write");
+    assert_eq!(
+        register_payload["node"]["registered_by"],
+        json!(admin_user.id)
+    );
+
+    gateway_handle.abort();
+}
+
+#[tokio::test]
+async fn gateway_rejects_management_token_without_required_admin_route_permission() {
+    let upstream_hits = Arc::new(Mutex::new(0usize));
+    let upstream_hits_clone = Arc::clone(&upstream_hits);
+    let upstream = Router::new().route(
+        "/api/admin/proxy-nodes/register",
+        any(move |_request: Request| {
+            let upstream_hits_inner = Arc::clone(&upstream_hits_clone);
+            async move {
+                *upstream_hits_inner.lock().expect("mutex should lock") += 1;
+                (StatusCode::OK, Body::from("unexpected upstream hit"))
+            }
+        }),
+    );
+
+    let raw_token = "ae-proxy-register-denied";
+    let proxy_node_repository = Arc::new(InMemoryProxyNodeRepository::default());
+    let state = AppState::new().expect("gateway should build");
+    let admin_user = state
+        .create_local_auth_user_with_settings(
+            Some("proxy-admin-denied@example.com".to_string()),
+            true,
+            "admin".to_string(),
+            "hash".to_string(),
+            "admin".to_string(),
+            None,
+            None,
+            None,
+            None,
+        )
+        .await
+        .expect("admin user should be created")
+        .expect("admin user should exist");
+    let mut management_token = sample_management_token(
+        "token-proxy-register-denied",
+        &admin_user.id,
+        "proxy-admin-denied",
+        true,
+    );
+    management_token.token.allowed_ips = None;
+    management_token.token.permissions = Some(json!(["admin:usage:read"]));
+    let management_token_repository =
+        Arc::new(InMemoryManagementTokenRepository::seed_with_hashes(
+            vec![management_token],
+            vec![(
+                hash_management_token(raw_token),
+                "token-proxy-register-denied".to_string(),
+            )],
+        ));
+
+    let (upstream_url, upstream_handle) = start_server(upstream).await;
+    let state = state.with_data_state_for_tests(
+        GatewayDataState::with_management_token_repository_for_tests(management_token_repository)
+            .attach_proxy_node_repository_for_tests(proxy_node_repository),
+    );
+    let gateway = build_router_with_state(state);
+    let (gateway_url, gateway_handle) = start_server(gateway).await;
+
+    let register_response = reqwest::Client::new()
+        .post(format!("{gateway_url}/api/admin/proxy-nodes/register"))
+        .header(GATEWAY_HEADER, "rust-phase3b")
+        .bearer_auth(raw_token)
+        .json(&json!({
+            "name": "proxy-denied",
+            "ip": "1.1.1.1",
+            "port": 0,
+            "heartbeat_interval": 30,
+            "tunnel_mode": true
+        }))
+        .send()
+        .await
+        .expect("request should succeed");
+
+    assert_eq!(register_response.status(), StatusCode::FORBIDDEN);
+    let denied_payload: serde_json::Value = register_response
+        .json()
+        .await
+        .expect("json body should parse");
+    assert_eq!(
+        denied_payload["detail"],
+        json!("management token permission denied")
+    );
+    assert_eq!(
+        denied_payload["required_permission"],
+        json!("admin:proxy_nodes:write")
+    );
+    assert_eq!(denied_payload["route_family"], json!("proxy_nodes_manage"));
+    assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
+
+    gateway_handle.abort();
+    upstream_handle.abort();
+    drop(upstream_url);
+}
+
 #[tokio::test]
 async fn gateway_registers_proxy_node_with_management_token_when_allowed_ips_is_json_null() {
     let raw_token = "ae_proxy_register_json_null";

apps/aether-gateway/src/tests/frontdoor/public_support.rs

@@ -6858,7 +6858,8 @@ async fn gateway_rejects_users_me_management_token_nested_get_path_as_local_not_
 #[tokio::test]
 async fn gateway_handles_users_me_management_token_writes_locally_without_proxying_upstream() {
     let now = Utc::now();
-    let user = sample_auth_user(now);
+    let mut user = sample_auth_user(now);
+    user.role = "admin".to_string();
     let access_token = build_test_auth_token(
         "access",
         serde_json::Map::from_iter([
@@ -6913,6 +6914,7 @@ async fn gateway_handles_users_me_management_token_writes_locally_without_proxyi
             "name": "writer-token",
             "description": "writer token",
             "allowed_ips": ["127.0.0.1"],
+            "permissions": ["admin:usage:read"],
             "expires_at": (now + chrono::Duration::days(1)).to_rfc3339(),
         }))
         .send()
@@ -6930,6 +6932,10 @@ async fn gateway_handles_users_me_management_token_writes_locally_without_proxyi
         .to_string();
     assert_eq!(create_payload["message"], "Management Token 创建成功");
     assert_eq!(create_payload["data"]["name"], "writer-token");
+    assert_eq!(
+        create_payload["data"]["permissions"],
+        json!(["admin:usage:read"])
+    );
     let created_token = create_payload["token"].as_str().unwrap_or_default();
     let created_token_random = created_token.strip_prefix("ae-").unwrap_or_default();
     assert_eq!(created_token_random.len(), 32);
@@ -6951,6 +6957,7 @@ async fn gateway_handles_users_me_management_token_writes_locally_without_proxyi
             "name": "writer-token-renamed",
             "description": null,
             "allowed_ips": ["10.0.0.1"],
+            "permissions": ["admin:usage:read", "admin:pool:write"],
             "expires_at": (now + chrono::Duration::days(2)).to_rfc3339(),
         }))
         .send()
@@ -6967,6 +6974,10 @@ async fn gateway_handles_users_me_management_token_writes_locally_without_proxyi
         update_payload["data"]["description"],
         serde_json::Value::Null
     );
+    assert_eq!(
+        update_payload["data"]["permissions"],
+        json!(["admin:pool:write", "admin:usage:read"])
+    );
 
     let toggle_response = client
         .patch(format!(
@@ -7055,6 +7066,81 @@ async fn gateway_handles_users_me_management_token_writes_locally_without_proxyi
     upstream_handle.abort();
 }
 
+#[tokio::test]
+async fn gateway_rejects_users_me_management_token_create_for_non_admin_user_without_proxying_upstream(
+) {
+    let now = Utc::now();
+    let user = sample_auth_user(now);
+    let access_token = build_test_auth_token(
+        "access",
+        serde_json::Map::from_iter([
+            ("user_id".to_string(), json!(user.id)),
+            ("role".to_string(), json!(user.role)),
+            (
+                "created_at".to_string(),
+                json!(user.created_at.map(|value| value.to_rfc3339())),
+            ),
+            (
+                "session_id".to_string(),
+                json!("session-users-me-management-token-create-denied"),
+            ),
+        ]),
+        now + chrono::Duration::hours(1),
+    );
+    let repository = Arc::new(InMemoryManagementTokenRepository::default());
+    let user_repository = Arc::new(InMemoryUserReadRepository::seed_auth_users(vec![user]));
+
+    let (gateway_url, upstream_hits, gateway_handle, upstream_handle) =
+        start_auth_gateway_with_builder(|| {
+            let data_state =
+                crate::data::GatewayDataState::with_management_token_repository_for_tests(
+                    repository,
+                )
+                .with_user_reader(user_repository);
+            AppState::new()
+                .expect("gateway should build")
+                .with_data_state_for_tests(data_state)
+                .with_auth_sessions_for_tests([sample_auth_session(
+                    "user-auth-1",
+                    "session-users-me-management-token-create-denied",
+                    "device-users-me-management-token-create-denied",
+                    "refresh-token-users-me-management-token-create-denied",
+                    now,
+                )])
+        })
+        .await;
+
+    let create_response = reqwest::Client::new()
+        .post(format!("{gateway_url}/api/me/management-tokens"))
+        .header("authorization", format!("Bearer {access_token}"))
+        .header(
+            "x-client-device-id",
+            "device-users-me-management-token-create-denied",
+        )
+        .header("user-agent", "AetherTest/1.0")
+        .json(&json!({
+            "name": "ordinary-user-token",
+            "description": "ordinary user token",
+        }))
+        .send()
+        .await
+        .expect("request should succeed");
+
+    assert_eq!(create_response.status(), StatusCode::FORBIDDEN);
+    let create_payload: serde_json::Value = create_response
+        .json()
+        .await
+        .expect("json body should parse");
+    assert_eq!(
+        create_payload["detail"],
+        json!("仅管理员可以创建 Management Token")
+    );
+    assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
+
+    gateway_handle.abort();
+    upstream_handle.abort();
+}
+
 #[tokio::test]
 async fn gateway_returns_service_unavailable_for_users_me_management_token_reads_without_reader() {
     let now = Utc::now();