@stackonward/cli 0.0.1 → 1.0.1

package/dist/resources/templates/go-backend/internal/common/internalapi/route_permission_policies.go

@@ -0,0 +1,660 @@
+package internalapi
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"{{module}}/internal/common/internalservice"
+	iamdomain "{{module}}/internal/integrations/onex/iam"
+)
+
+// RoutePermissionKey 用 HTTP 方法与跨运行时规范路径精确标识内部路由。
+type RoutePermissionKey struct {
+	Method    string
+	RouteName string
+}
+
+// RoutePermissionPolicy 定义内部路由对应的 IAM 动作与资源模板。
+type RoutePermissionPolicy struct {
+	Action          string
+	Resource        string
+	DecisionLogRisk iamdomain.RiskLevel
+}
+
+// RoutePermissionCapability 是内部路由注册表解析出的规范授权能力。
+type RoutePermissionCapability struct {
+	// Method 是规范化后的 HTTP 方法。
+	Method string
+	// RouteName 是不含内部 API 前缀并使用 Gin 参数语法的授权规范路径。
+	RouteName string
+	// Action 是路由策略声明的 IAM 动作。
+	Action string
+	// Resource 是以当前产品解析后的集合级资源。
+	Resource string
+}
+
+// RoutePermissionPolicySet 是内部路由授权策略表。
+type RoutePermissionPolicySet map[RoutePermissionKey]RoutePermissionPolicy
+
+const (
+	wechatMiniProgramResource                = "onex:product:{product_code}:identity:wechat-mini-program/*"
+	authStateResource                        = "onex:product:{product_code}:identity:auth-state/*"
+	guestCapabilityResource                  = "onex:product:{product_code}:identity:guest-capability/*"
+	guestSessionResource                     = "onex:product:{product_code}:identity:guest-session/*"
+	guestAccountResource                     = "onex:product:{product_code}:identity:guest-account/*"
+	quotaResource                            = "onex:product:{product_code}:user_ops:quota/*"
+	creditAccountResource                    = "onex:product:{product_code}:user_ops:credit-account/*"
+	entitlementResource                      = "onex:product:{product_code}:user_ops:entitlement/*"
+	productAccessResource                    = "onex:product:{product_code}:user_ops:entitlement/*"
+	productUserRuntimeProfileResource        = "onex:product:{product_code}:user_ops:identity-view/{userId}"
+	subscriptionResource                     = "onex:product:{product_code}:order:subscription/*"
+	cartResource                             = "onex:product:{product_code}:order:cart/*"
+	checkoutResource                         = "onex:product:{product_code}:order:checkout/*"
+	storePurchaseResource                    = "onex:product:{product_code}:payment:store-purchase/*"
+	runtimeCatalogResource                   = "onex:product:{product_code}:catalog:runtime-catalog/*"
+	promotionResource                        = "onex:product:{product_code}:marketing:promotion/*"
+	promotionRedemptionResource              = "onex:product:{product_code}:marketing:promotion-redemption/*"
+	mediagenResource                         = "onex:product:{product_code}:ai:**"
+	providerCredentialLeaseResource          = "onex:product:{product_code}:ai:provider-credential-lease/*"
+	providerCredentialResource               = "onex:product:{product_code}:ai:provider-credential/*"
+	integrationEventInboundResource          = "onex:product:{product_code}:ops:integration-event-inbound/*"
+	integrationEventRequiredDeliveryResource = "onex:product:{product_code}:ops:integration-event-required-delivery/*"
+	nativeInboxResource                      = "onex:product:{product_code}:communication:native-inbox/*"
+	pushDeviceResource                       = "onex:product:{product_code}:communication:push-device/*"
+	pushPreferenceResource                   = "onex:product:{product_code}:communication:push-preference/*"
+	pushTestSendResource                     = "onex:product:{product_code}:communication:push-test-send/*"
+	notificationDispatchCommandResource      = "onex:product:{product_code}:notification:dispatch-command/*"
+	notificationDispatchCommandInputResource = "onex:product:{product_code}:notification:dispatch-command-input/*"
+	subscriptionProjectionResource           = "onex:product:{product_code}:trade:subscription-projection/*"
+	communicationConsentResource             = "onex:global:-:communication:consent/*"
+	serviceTokenResource                     = "onex:product:{product_code}:iam:service-token/*"
+	serviceEvaluationResource                = "onex:product:{product_code}:iam:decision/*"
+	delegatedEvaluationResource              = "onex:organization:{organization_ref}:iam:decision/*"
+	authorizationBindingResource             = "onex:global:-:iam:binding/{binding_ref}"
+	authorizationPolicyResource              = "onex:global:-:iam:policy/{policy_code}"
+	authorizationPrincipalResource           = "onex:global:-:iam:principal/{principal_ref}"
+	serviceCredentialResource                = "onex:product:{product_code}:iam:service-credential/{credential_public_id}"
+	organizationCollectionResource           = "onex:global:-:organization:organization/*"
+	organizationInstanceResource             = "onex:organization:{organization_ref}:organization:organization/{organization_ref}"
+	productEnrollmentCollectionResource      = "onex:organization:{organization_ref}:organization:product_enrollment/*"
+	productEnrollmentInstanceResource        = "onex:organization:{organization_ref}:organization:product_enrollment/{enrollment_ref}"
+	clientSupportDecisionResource            = "onex:product:{product_code}:registry:client-support-decision/*"
+	featureFlagEvaluationResource            = "onex:product:{product_code}:system:feature-flag-evaluation/*"
+)
+
+// Lookup 按规范化后的 HTTP 方法和跨运行时规范路径查找路由授权策略。
+func (s RoutePermissionPolicySet) Lookup(method, routeName string) (RoutePermissionPolicy, bool) {
+	key, err := CanonicalRoutePermissionKey(method, routeName)
+	if err != nil {
+		return RoutePermissionPolicy{}, false
+	}
+	policy, ok := s[key]
+	return policy, ok
+}
+
+// ResolveCapability 把内部路由策略解析为不依赖业务实例的集合级授权能力。
+//
+// product_code 使用当前请求的权威产品上下文，其余路径参数统一解析为集合通配符，
+// 使服务依赖自查无需构造用户、订单或 allocation 等虚假业务标识。
+func (s RoutePermissionPolicySet) ResolveCapability(
+	method string,
+	routeName string,
+	productCode string,
+) (RoutePermissionCapability, bool, error) {
+	key, keyErr := CanonicalRoutePermissionKey(method, routeName)
+	if keyErr != nil {
+		return RoutePermissionCapability{
+			Method:    normalizeMethod(method),
+			RouteName: strings.TrimSpace(routeName),
+		}, false, nil
+	}
+	policy, ok := s[key]
+	if !ok {
+		return RoutePermissionCapability{
+			Method:    key.Method,
+			RouteName: key.RouteName,
+		}, false, nil
+	}
+	resource, err := resolveCapabilityResource(policy.Resource, productCode)
+	if err != nil {
+		return RoutePermissionCapability{}, true, err
+	}
+	if _, err := iamdomain.ParseResourceARN(resource); err != nil {
+		return RoutePermissionCapability{}, true, fmt.Errorf(
+			"internal route %s %s has invalid resource: %w",
+			key.Method,
+			key.RouteName,
+			err,
+		)
+	}
+	return RoutePermissionCapability{
+		Method:    key.Method,
+		RouteName: key.RouteName,
+		Action:    policy.Action,
+		Resource:  resource,
+	}, true, nil
+}
+
+// InternalRoutePermissionPolicies 返回当前 /internal/v1 路由的完整授权策略表。
+func InternalRoutePermissionPolicies() RoutePermissionPolicySet {
+	return RoutePermissionPolicySet{
+		route(http.MethodPost, "/internal/v1/client-support/resolve"): {
+			Action:   "registry:client-support-decision:read",
+			Resource: clientSupportDecisionResource,
+		},
+		route(http.MethodPost, "/internal/v1/feature-flags/evaluate"): {
+			Action:   "system:feature-flag-evaluation:read",
+			Resource: featureFlagEvaluationResource,
+		},
+		route(http.MethodPost, "/internal/v1/iam/service-tokens"): {
+			Action:          "iam:service-token:create",
+			Resource:        serviceTokenResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+		route(http.MethodPost, "/internal/v1/iam/service-evaluations/batch"): {
+			Action:          "iam:decision:evaluate",
+			Resource:        serviceEvaluationResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+		route(http.MethodPost, "/internal/v1/iam/evaluations/batch"): {
+			Action:          "iam:decision:evaluate",
+			Resource:        delegatedEvaluationResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+		route(http.MethodGet, "/internal/v1/iam/bindings/:binding_ref"): {
+			Action:   "iam:binding:read",
+			Resource: authorizationBindingResource,
+		},
+		route(http.MethodGet, "/internal/v1/iam/policies/:policy_code"): {
+			Action:   "iam:policy:read",
+			Resource: authorizationPolicyResource,
+		},
+		route(http.MethodGet, "/internal/v1/iam/principals/:principal_ref"): {
+			Action:   "iam:principal:read",
+			Resource: authorizationPrincipalResource,
+		},
+		route(http.MethodGet, "/internal/v1/iam/service-credentials/:credential_public_id"): {
+			Action:   "iam:service-credential:read",
+			Resource: serviceCredentialResource,
+		},
+		route(http.MethodGet, "/internal/v1/organizations"): {
+			Action:   "organization:organization:list",
+			Resource: organizationCollectionResource,
+		},
+		route(http.MethodGet, "/internal/v1/organizations/:organization_ref"): {
+			Action:   "organization:organization:read",
+			Resource: organizationInstanceResource,
+		},
+		route(http.MethodPatch, "/internal/v1/organizations/:organization_ref"): {
+			Action:   "organization:organization:update",
+			Resource: organizationInstanceResource,
+		},
+		route(http.MethodPost, "/internal/v1/organizations/:organization_ref/suspensions"): {
+			Action:          "organization:organization:suspend",
+			Resource:        organizationInstanceResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+		route(http.MethodDelete, "/internal/v1/organizations/:organization_ref/suspensions/current"): {
+			Action:   OrganizationTransitionActionResumeOrganization,
+			Resource: organizationInstanceResource,
+		},
+		route(http.MethodGet, "/internal/v1/organizations/:organization_ref/product-enrollments"): {
+			Action:   "organization:product_enrollment:list",
+			Resource: productEnrollmentCollectionResource,
+		},
+		route(http.MethodPost, "/internal/v1/organizations/:organization_ref/product-enrollments"): {
+			Action:   OrganizationTransitionActionEnrollProduct,
+			Resource: productEnrollmentCollectionResource,
+		},
+		route(http.MethodPost, "/internal/v1/organizations/:organization_ref/product-enrollments/:enrollment_ref/suspensions"): {
+			Action:          "organization:product_enrollment:suspend",
+			Resource:        productEnrollmentInstanceResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+		route(http.MethodDelete, "/internal/v1/organizations/:organization_ref/product-enrollments/:enrollment_ref/suspensions/current"): {
+			Action:   OrganizationTransitionActionResumeProductEnrollment,
+			Resource: productEnrollmentInstanceResource,
+		},
+		route(http.MethodDelete, "/internal/v1/organizations/:organization_ref/product-enrollments/:enrollment_ref"): {
+			Action:          "organization:product_enrollment:delete",
+			Resource:        productEnrollmentInstanceResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+		route(http.MethodPost, "/internal/v1/identity/wechat-mini-program/login"): {
+			Action:   "identity:wechat-mini-program:create",
+			Resource: wechatMiniProgramResource,
+		},
+		route(http.MethodPost, "/internal/v1/identity/wechat-mini-program/phone/bind"): {
+			Action:   "identity:wechat-mini-program:update",
+			Resource: wechatMiniProgramResource,
+		},
+		route(http.MethodGet, "/internal/v1/identity/wechat-mini-program/openid"): {
+			Action:   "identity:wechat-mini-program:read",
+			Resource: wechatMiniProgramResource,
+		},
+		route(http.MethodPost, "/internal/v1/identity/auth-state/resolve"): {
+			Action:   "identity:auth-state:read",
+			Resource: authStateResource,
+		},
+		route(http.MethodGet, "/internal/v1/identity/guest-capability-policy"): {
+			Action:   "identity:guest-capability:read",
+			Resource: guestCapabilityResource,
+		},
+		route(http.MethodPost, "/internal/v1/identity/guest-capabilities"): {
+			Action:          "identity:guest-capability:create",
+			Resource:        guestCapabilityResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+		route(http.MethodPost, "/internal/v1/identity/auth/guest"): {
+			Action:          "identity:guest-session:create",
+			Resource:        guestSessionResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+		route(http.MethodPost, "/internal/v1/identity/auth/native-guest"): {
+			Action:          "identity:guest-session:create",
+			Resource:        guestSessionResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+		route(http.MethodPost, "/internal/v1/identity/auth/guest-merges"): {
+			Action:          "identity:guest-account:merge",
+			Resource:        guestAccountResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+
+		route(http.MethodGet, "/internal/v1/quotas/balance"): {
+			Action:   "user_ops:quota:read",
+			Resource: quotaResource,
+		},
+		route(http.MethodPost, "/internal/v1/quotas/batch-grant"): {
+			Action:          "user_ops:quota:grant",
+			Resource:        quotaResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+		route(http.MethodPost, "/internal/v1/quotas/consume"): {
+			Action:   "user_ops:quota:update",
+			Resource: quotaResource,
+		},
+		route(http.MethodPost, "/internal/v1/quotas/release"): {
+			Action:   "user_ops:quota:update",
+			Resource: quotaResource,
+		},
+		route(http.MethodPost, "/internal/v1/quotas/allocations"): {
+			Action:   "user_ops:quota:update",
+			Resource: quotaResource,
+		},
+		route(http.MethodPost, "/internal/v1/quotas/allocations/:allocationNo/activate"): {
+			Action:   "user_ops:quota:update",
+			Resource: quotaResource,
+		},
+		route(http.MethodPost, "/internal/v1/quotas/allocations/:allocationNo/release"): {
+			Action:   "user_ops:quota:update",
+			Resource: quotaResource,
+		},
+		route(http.MethodGet, "/internal/v1/quotas/allocations/:allocationNo"): {
+			Action:   "user_ops:quota:read",
+			Resource: quotaResource,
+		},
+		route(http.MethodGet, "/internal/v1/quotas/capacity"): {
+			Action:   "user_ops:quota:read",
+			Resource: quotaResource,
+		},
+
+		route(http.MethodPost, "/internal/v1/credits/batch-topup"): {
+			Action:          "user_ops:credit-account:grant",
+			Resource:        creditAccountResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+		route(http.MethodPost, "/internal/v1/credits/deduct"): {
+			Action:   "user_ops:credit-account:update",
+			Resource: creditAccountResource,
+		},
+		route(http.MethodPost, "/internal/v1/credits/freeze"): {
+			Action:   "user_ops:credit-account:update",
+			Resource: creditAccountResource,
+		},
+		route(http.MethodPost, "/internal/v1/credits/confirm"): {
+			Action:   "user_ops:credit-account:update",
+			Resource: creditAccountResource,
+		},
+		route(http.MethodPost, "/internal/v1/credits/release"): {
+			Action:   "user_ops:credit-account:update",
+			Resource: creditAccountResource,
+		},
+		route(http.MethodPost, "/internal/v1/credits/refund"): {
+			Action:   "user_ops:credit-account:update",
+			Resource: creditAccountResource,
+		},
+		route(http.MethodPost, "/internal/v1/credits/grant"): {
+			Action:          "user_ops:credit-account:grant",
+			Resource:        creditAccountResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+		route(http.MethodGet, "/internal/v1/credits/balance"): {
+			Action:   "user_ops:credit-account:read",
+			Resource: creditAccountResource,
+		},
+		route(http.MethodGet, "/internal/v1/credits/transactions"): {
+			Action:   "user_ops:credit-account:list",
+			Resource: creditAccountResource,
+		},
+
+		route(http.MethodGet, "/internal/v1/entitlements/check"): {
+			Action:   "user_ops:entitlement:read",
+			Resource: entitlementResource,
+		},
+		route(http.MethodPost, "/internal/v1/entitlements/batch-check"): {
+			Action:   "user_ops:entitlement:read",
+			Resource: entitlementResource,
+		},
+		route(http.MethodGet, "/internal/v1/entitlements/users/:userId"): {
+			Action:   "user_ops:entitlement:read",
+			Resource: entitlementResource,
+		},
+		route(http.MethodGet, "/internal/v1/product-access/users/:userId/policy"): {
+			Action:   "user_ops:entitlement:read",
+			Resource: productAccessResource,
+		},
+		route(http.MethodGet, "/internal/v1/users/:userId/product-user-runtime-profile"): {
+			Action:   "user_ops:identity-view:read",
+			Resource: productUserRuntimeProfileResource,
+		},
+
+		route(http.MethodPost, "/internal/v1/integration-events/inbound"): {
+			Action:          "ops:integration-event-inbound:create",
+			Resource:        integrationEventInboundResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+		route(http.MethodPost, "/internal/v1/integration-events/probe"): {
+			Action:          "ops:integration-event-inbound:create",
+			Resource:        integrationEventInboundResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+		route(http.MethodPost, "/internal/v1/integration-events/required-deliveries"): {
+			Action:          "ops:integration-event-required-delivery:create",
+			Resource:        integrationEventRequiredDeliveryResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+		route(http.MethodPost, "/internal/v1/native-notifications/inbox-queries"): {
+			Action:   "communication:native-inbox:read",
+			Resource: nativeInboxResource,
+		},
+		route(http.MethodPost, "/internal/v1/native-notifications/unread-queries"): {
+			Action:   "communication:native-inbox:read",
+			Resource: nativeInboxResource,
+		},
+		route(http.MethodPost, "/internal/v1/native-notifications/acknowledgements"): {
+			Action:   "communication:native-inbox:update",
+			Resource: nativeInboxResource,
+		},
+		route(http.MethodPost, "/internal/v1/native-notifications/devices"): {
+			Action:   "communication:push-device:create",
+			Resource: pushDeviceResource,
+		},
+		route(http.MethodPost, "/internal/v1/native-notifications/device-revocations"): {
+			Action:   "communication:push-device:update",
+			Resource: pushDeviceResource,
+		},
+		route(http.MethodGet, "/internal/v1/native-notifications/devices"): {
+			Action:   "communication:push-device:list",
+			Resource: pushDeviceResource,
+		},
+		route(http.MethodPost, "/internal/v1/native-notifications/push-preference-queries"): {
+			Action:   "communication:push-preference:read",
+			Resource: pushPreferenceResource,
+		},
+		route(http.MethodPut, "/internal/v1/native-notifications/push-preferences"): {
+			Action:   "communication:push-preference:update",
+			Resource: pushPreferenceResource,
+		},
+		route(http.MethodPost, "/internal/v1/native-notifications/test-push-sends"): {
+			Action:          "communication:push-test-send:create",
+			Resource:        pushTestSendResource,
+			DecisionLogRisk: iamdomain.RiskLevelMedium,
+		},
+		route(http.MethodPost, "/internal/v1/notifications/dispatch-command-inputs"): {
+			Action:          "notification:dispatch-command-input:create",
+			Resource:        notificationDispatchCommandInputResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+		route(http.MethodPost, "/internal/v1/notifications/dispatch-command-status-queries"): {
+			Action:          "notification:dispatch-command:read",
+			Resource:        notificationDispatchCommandResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+		route(http.MethodPost, "/internal/v1/commerce/subscription-projections/resolve"): {
+			Action:   "trade:subscription-projection:read",
+			Resource: subscriptionProjectionResource,
+		},
+		route(http.MethodPost, "/internal/v1/newsletter-consents/grants"): {
+			Action:          "communication:consent:create",
+			Resource:        communicationConsentResource,
+			DecisionLogRisk: iamdomain.RiskLevelMedium,
+		},
+
+		route(http.MethodGet, "/internal/v1/subscriptions/active"): {
+			Action:   "order:subscription:read",
+			Resource: subscriptionResource,
+		},
+		route(http.MethodPost, "/internal/v1/cart/active"): {
+			Action:   "order:cart:create",
+			Resource: cartResource,
+		},
+		route(http.MethodPost, "/internal/v1/cart/:cart_no/items"): {
+			Action:   "order:cart:create",
+			Resource: cartResource,
+		},
+		route(http.MethodPatch, "/internal/v1/cart/:cart_no/items/:cart_item_no"): {
+			Action:   "order:cart:update",
+			Resource: cartResource,
+		},
+		route(http.MethodDelete, "/internal/v1/cart/:cart_no/items/:cart_item_no"): {
+			Action:   "order:cart:update",
+			Resource: cartResource,
+		},
+		route(http.MethodPost, "/internal/v1/cart/:cart_no/clear"): {
+			Action:   "order:cart:update",
+			Resource: cartResource,
+		},
+		route(http.MethodPost, "/internal/v1/checkout/quotes/from-cart"): {
+			Action:   "order:checkout:create",
+			Resource: checkoutResource,
+		},
+		route(http.MethodPost, "/internal/v1/checkout-sessions"): {
+			Action:   "order:checkout:create",
+			Resource: checkoutResource,
+		},
+		route(http.MethodPost, "/internal/v1/checkout-sessions/:session_no/authorizations/reissue"): {
+			Action:   "order:checkout:update",
+			Resource: checkoutResource,
+		},
+		route(http.MethodGet, "/internal/v1/checkout-results/:session_no"): {
+			Action:   "order:checkout:read",
+			Resource: checkoutResource,
+		},
+		route(http.MethodGet, "/internal/v1/checkout/quotes/:quote_no/readiness"): {
+			Action:   "order:checkout:read",
+			Resource: checkoutResource,
+		},
+		route(http.MethodPost, "/internal/v1/checkout/quotes/:quote_no/submit"): {
+			Action:   "order:checkout:update",
+			Resource: checkoutResource,
+		},
+		route(http.MethodGet, "/internal/v1/store-purchases/products"): {
+			Action:   "payment:store-purchase:list",
+			Resource: storePurchaseResource,
+		},
+		route(http.MethodPost, "/internal/v1/store-purchases/verifications"): {
+			Action:          "payment:store-purchase:create",
+			Resource:        storePurchaseResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+		route(http.MethodPost, "/internal/v1/store-purchases/restores"): {
+			Action:          "payment:store-purchase:create",
+			Resource:        storePurchaseResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+		route(http.MethodPost, "/internal/v1/store-purchases/transaction-queries"): {
+			Action:   "payment:store-purchase:read",
+			Resource: storePurchaseResource,
+		},
+		route(http.MethodPost, "/internal/v1/store-purchases/subscription-queries"): {
+			Action:   "payment:store-purchase:read",
+			Resource: storePurchaseResource,
+		},
+		route(http.MethodPost, "/internal/v1/store-purchases/ownership-queries"): {
+			Action:   "payment:store-purchase:read",
+			Resource: storePurchaseResource,
+		},
+		route(http.MethodPost, "/internal/v1/store-purchases/promotional-offer-signatures"): {
+			Action:          "payment:store-purchase:create",
+			Resource:        storePurchaseResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+
+		route(http.MethodGet, "/internal/v1/commerce/runtime/surfaces/:surface_code"): {
+			Action:   "catalog:runtime-catalog:read",
+			Resource: runtimeCatalogResource,
+		},
+		route(http.MethodGet, "/internal/v1/commerce/runtime/products/:merchandise_product_code"): {
+			Action:   "catalog:runtime-catalog:read",
+			Resource: runtimeCatalogResource,
+		},
+		route(http.MethodGet, "/internal/v1/promotion/codes/:code/validate"): {
+			Action:   "marketing:promotion:read",
+			Resource: promotionResource,
+		},
+		route(http.MethodPost, "/internal/v1/promotion/codes/:code/redeem"): {
+			Action:   "marketing:promotion:redeem",
+			Resource: promotionRedemptionResource,
+		},
+
+		route(http.MethodPost, "/internal/v1/mediagen/generations"): {
+			Action:   "ai:generation:create",
+			Resource: mediagenResource,
+		},
+		route(http.MethodPost, "/internal/v1/mediagen/safety-preflights"): {
+			Action:   "ai:generation:create",
+			Resource: mediagenResource,
+		},
+		route(http.MethodGet, "/internal/v1/mediagen/safety-preflights/:id"): {
+			Action:   "ai:generation:read",
+			Resource: mediagenResource,
+		},
+		route(http.MethodPost, "/internal/v1/mediagen/safety-preflights/validate"): {
+			Action:   "ai:generation:update",
+			Resource: mediagenResource,
+		},
+		route(http.MethodPost, "/internal/v1/mediagen/runtime-executions"): {
+			Action:   "ai:generation:update",
+			Resource: mediagenResource,
+		},
+		route(http.MethodGet, "/internal/v1/mediagen/runtime-executions/:id"): {
+			Action:   "ai:generation:read",
+			Resource: mediagenResource,
+		},
+		route(http.MethodPost, "/internal/v1/mediagen/runtime-executions/:id/cancel"): {
+			Action:   "ai:generation:update",
+			Resource: mediagenResource,
+		},
+		route(http.MethodGet, "/internal/v1/mediagen/generations"): {
+			Action:   "ai:generation:list",
+			Resource: mediagenResource,
+		},
+		route(http.MethodGet, "/internal/v1/mediagen/generations/:id"): {
+			Action:   "ai:generation:read",
+			Resource: mediagenResource,
+		},
+		route(http.MethodPost, "/internal/v1/mediagen/provider-credentials/leases"): {
+			Action:          "ai:provider-credential:lease",
+			Resource:        providerCredentialLeaseResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+		route(http.MethodPost, "/internal/v1/mediagen/provider-credentials/:credential_code/complete"): {
+			Action:          "ai:provider-credential:update",
+			Resource:        providerCredentialResource,
+			DecisionLogRisk: iamdomain.RiskLevelHigh,
+		},
+	}
+}
+
+func route(method, routeName string) RoutePermissionKey {
+	key, err := CanonicalRoutePermissionKey(method, routeName)
+	if err != nil {
+		panic(fmt.Sprintf("invalid internal route permission key %s %s: %v", method, routeName, err))
+	}
+	return key
+}
+
+func normalizeMethod(method string) string {
+	return strings.ToUpper(strings.TrimSpace(method))
+}
+
+// CanonicalRoutePermissionKey 把 Gin 或标准路径模板投影为授权注册表唯一键。
+func CanonicalRoutePermissionKey(method, routeName string) (RoutePermissionKey, error) {
+	normalizedMethod := normalizeMethod(method)
+	normalizedRouteName := strings.TrimSpace(routeName)
+	scope, err := internalservice.CanonicalRouteScope(normalizedMethod, normalizedRouteName)
+	if err != nil {
+		return RoutePermissionKey{}, err
+	}
+	separator := strings.IndexByte(scope, ' ')
+	if separator <= 0 || separator == len(scope)-1 {
+		return RoutePermissionKey{}, fmt.Errorf("canonical internal route scope is invalid")
+	}
+	return RoutePermissionKey{
+		Method:    scope[:separator],
+		RouteName: scope[separator+1:],
+	}, nil
+}
+
+func resolveCapabilityResource(template string, productCode string) (string, error) {
+	if !strings.ContainsAny(template, "{}") {
+		return normalizeCapabilityCollectionResource(template), nil
+	}
+	var builder strings.Builder
+	builder.Grow(len(template))
+	rest := template
+	for {
+		open := strings.IndexByte(rest, '{')
+		if open < 0 {
+			if strings.ContainsRune(rest, '}') {
+				return "", fmt.Errorf("resource template contains an unmatched closing brace")
+			}
+			builder.WriteString(rest)
+			break
+		}
+		if strings.ContainsRune(rest[:open], '}') {
+			return "", fmt.Errorf("resource template contains an unmatched closing brace")
+		}
+		closeIndex := strings.IndexByte(rest[open:], '}')
+		if closeIndex < 0 {
+			return "", fmt.Errorf("resource template contains an unmatched opening brace")
+		}
+		closeIndex += open
+		token := strings.TrimSpace(rest[open+1 : closeIndex])
+		if token == "" || strings.ContainsAny(token, "{}") {
+			return "", fmt.Errorf("resource template contains an invalid placeholder")
+		}
+		builder.WriteString(rest[:open])
+		if token == "product_code" {
+			normalizedProductCode := strings.TrimSpace(productCode)
+			if normalizedProductCode == "" {
+				return "", fmt.Errorf("product code is required to resolve the resource template")
+			}
+			builder.WriteString(normalizedProductCode)
+		} else {
+			builder.WriteByte('*')
+		}
+		rest = rest[closeIndex+1:]
+	}
+	resource := builder.String()
+	return normalizeCapabilityCollectionResource(resource), nil
+}
+
+func normalizeCapabilityCollectionResource(resource string) string {
+	if strings.HasSuffix(resource, ":**") {
+		return strings.TrimSuffix(resource, "**") + "*/*"
+	}
+	return resource
+}