agentworkshop 0.7.9 → 0.7.11

package/server/api/workshop/daq/[id]/frames.get.ts

@@ -5,12 +5,15 @@
  */
 import { getQuery, getRouterParam } from 'h3'
 import { resolveUser } from '@/server/api/workshop/caller'
+import { requireLineMode } from '@/server/services/workshop/permissions'
 import { defineApiHandler } from '@/server/utils/response'
 import { getDaqController } from '@/server/services/workshop/daq/daq-controller'
 
 export default defineApiHandler(async (event) => {
-  resolveUser(event)
+  const user = resolveUser(event)
   const id = getRouterParam(event, 'id') ?? ''
+  // 产线权限:帧数据需「仅查看」及以上
+  requireLineMode(user, getDaqController().byId(id)?.lineId, 'readonly')
   const q = getQuery(event)
   const num = (k: string): number | undefined => (q[k] != null && !Number.isNaN(Number(q[k])) ? Number(q[k]) : undefined)
   const kind = q.kind === 'vector' || q.kind === 'image' ? q.kind : undefined

package/server/api/workshop/daq/[id]/samples.get.ts

@@ -4,13 +4,16 @@
  */
 import { getQuery, getRouterParam } from 'h3'
 import { resolveUser } from '@/server/api/workshop/caller'
+import { requireLineMode } from '@/server/services/workshop/permissions'
 import { defineApiHandler } from '@/server/utils/response'
 import { getDaqController } from '@/server/services/workshop/daq/daq-controller'
 import { daqRuntimeSettings } from '@/server/services/workshop/settings'
 
 export default defineApiHandler(async (event) => {
-  resolveUser(event)
+  const user = resolveUser(event)
   const id = getRouterParam(event, 'id') ?? ''
+  // 产线权限:历史采样需「仅查看」及以上
+  requireLineMode(user, getDaqController().byId(id)?.lineId, 'readonly')
   const q = getQuery(event)
   const num = (k: string): number | undefined => (q[k] != null && !Number.isNaN(Number(q[k])) ? Number(q[k]) : undefined)
   // 时间间隔参数(bucketMs):缺省与下限来自 daq.query.*(live 配置,热重载)

package/server/api/workshop/daq/[id].patch.ts

@@ -3,6 +3,7 @@
  */
 import { getRouterParam, readBody } from 'h3'
 import { resolveUser } from '@/server/api/workshop/caller'
+import { requireLineMode } from '@/server/services/workshop/permissions'
 import { defineApiHandler } from '@/server/utils/response'
 import { bindDaqHost } from '@/server/services/workshop/daq/host-bindings'
 import { getDaqController, type DaqPatchInput } from '@/server/services/workshop/daq/daq-controller'
@@ -14,6 +15,8 @@ export default defineApiHandler(async (event) => {
   bindDaqHost(broadcastSceneEvent)
   const id = getRouterParam(event, 'id') ?? ''
   const body = await readBody<DaqPatchInput>(event) ?? {}
+  // 产线权限:参数下发=操控能力(readonly/无权用户 403)
+  requireLineMode(user, getDaqController().byId(id)?.lineId, 'operate')
   const node = getDaqController().patch(id, body)
   recordOps({
     actor: user.id,

package/server/api/workshop/daq/alarms/[id]/ack.post.ts

@@ -1,15 +1,20 @@
-/**
- * POST /api/workshop/daq/alarms/:id/ack —— 报警确认(S5 ack 闭环)。
- * body 可空;记录 acked_by/acked_at(裁决人留痕,同 S4 口径)。
- */
-import { getRouterParam } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
-import { getDaqController } from '@/server/services/workshop/daq/daq-controller'
-
-export default defineApiHandler(async (event) => {
-  const user = resolveUser(event)
-  const id = getRouterParam(event, 'id')!
-  const acked = getDaqController().ackAlarm(id, user.id, user.name)
-  return { acked, id }
-})
+/**
+ * POST /api/workshop/daq/alarms/:id/ack —— 报警确认(S5 ack 闭环)。
+ * body 可空;记录 acked_by/acked_at(裁决人留痕,同 S4 口径)。
+ */
+import { getRouterParam } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { requireLineMode } from '@/server/services/workshop/permissions'
+import { defineApiHandler } from '@/server/utils/response'
+import { getDaqController } from '@/server/services/workshop/daq/daq-controller'
+import { getOps } from '@/server/services/workshop/ops/ops'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  const id = getRouterParam(event, 'id')!
+  // 产线权限:告警确认属操控动作(需对该线「可操控」;readonly/无权 403)
+  const alarmNodeId = getOps()?.alarmEvents.nodeIdById(id)
+  requireLineMode(user, alarmNodeId ? getDaqController().byId(alarmNodeId)?.lineId : undefined, 'operate')
+  const acked = getDaqController().ackAlarm(id, user.id, user.name)
+  return { acked, id }
+})

package/server/api/workshop/daq/controller.post.ts

@@ -45,6 +45,8 @@ export default defineApiHandler(async (event) => {
       return { controller }
     }
     case 'config':
+      // 全局采集参数(默认采样/下发间隔)属控制面:admin/editor 才可改
+      requireRole(event, ['admin', 'editor'])
       return { controller: ctrl.configure({ defaultIntervalMs: body.defaultIntervalMs, defaultPublishIntervalMs: body.defaultPublishIntervalMs }) }
     default:
       return { controller: ctrl.controllerState() }

package/server/api/workshop/daq/index.get.ts

@@ -3,8 +3,9 @@
  * 首访触发存量 device-twins(kind=daq)的幂等升格供给,此后渲染完全由本列表驱动。
  */
 import { resolveUser } from '@/server/api/workshop/caller'
+import { filterByLine } from '@/server/services/workshop/permissions'
 import { defineApiHandler } from '@/server/utils/response'
-import { bindDaqHost } from '@/server/services/workshop/daq/host-bindings'
+import { bindDaqHost } from '@/server/services/workshop/daq/host-bindings'
 import { getDaqController } from '@/server/services/workshop/daq/daq-controller'
 import { listDaqTemplates } from '@/server/services/workshop/daq/daq-templates'
 import { tsdbReady } from '@/server/services/workshop/daq/storage'
@@ -13,7 +14,7 @@ import { daqInfraStatus } from '@/server/services/workshop/daq/infra'
 import { broadcastSceneEvent } from '../../../services/workshop/scene-events'
 
 export default defineApiHandler(async (event) => {
-  resolveUser(event)
+  const user = resolveUser(event)
   // ws.ts 出口装配 + 管线上电(幂等;路由模块加载即绑定)
   bindDaqHost(broadcastSceneEvent)
   await Promise.all([tsdbReady, getDaqQueue()])
@@ -22,7 +23,8 @@ export default defineApiHandler(async (event) => {
   const state = ctrl.controllerState()
   return {
     controller: state,
-    nodes: ctrl.listViews(),
+    // 产线级权限:普通用户仅见授权产线的节点(admin/editor 全量)
+    nodes: filterByLine(user, ctrl.listViews(), n => n.lineId),
     meta: {
       ...ctrl.backends(),
       produced: state.produced ?? 0,

package/server/api/workshop/daq/index.post.ts

@@ -5,7 +5,7 @@
  * 创建后广播 daq.node.changed(added),全部已连客户端即时收敛。
  */
 import { readBody } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
+import { requireRole } from '@/server/api/workshop/caller'
 import { defineApiHandler } from '@/server/utils/response'
 import { bindDaqHost } from '@/server/services/workshop/daq/host-bindings'
 import { getDaqController, type DaqCreateInput } from '@/server/services/workshop/daq/daq-controller'
@@ -13,7 +13,7 @@ import { broadcastSceneEvent } from '../../../services/workshop/scene-events'
 import { recordOps } from '../../../services/workshop/ops/ops'
 
 export default defineApiHandler(async (event) => {
-  const user = resolveUser(event)
+  requireRole(event, ['admin', 'editor'])
   bindDaqHost(broadcastSceneEvent)
   const body = await readBody<DaqCreateInput>(event) ?? {}
   const node = getDaqController().create(body)

package/server/api/workshop/dcw/[id]/bind.post.ts

@@ -1,17 +1,20 @@
-/**
- * POST /api/workshop/dcw/:id/bind —— 绑定/解绑设备孪生(body: { deviceId: string | null })。
- */
-import { getRouterParam, readBody } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
-import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
-import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
-
-export default defineApiHandler(async (event) => {
-  resolveUser(event)
-  bindDcwBroadcast(broadcastSceneEvent)
-  const id = getRouterParam(event, 'id') ?? ''
-  const body = await readBody<{ deviceId?: string | null }>(event) ?? {}
-  const node = getDcwController().bind(id, body.deviceId ?? null)
-  return { node: node.toView() }
-})
+/**
+ * POST /api/workshop/dcw/:id/bind —— 绑定/解绑设备孪生(body: { deviceId: string | null })。
+ */
+import { getRouterParam, readBody } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { requireLineMode } from '@/server/services/workshop/permissions'
+import { defineApiHandler } from '@/server/utils/response'
+import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
+import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  bindDcwBroadcast(broadcastSceneEvent)
+  const id = getRouterParam(event, 'id') ?? ''
+  // 产线权限:设备孪生绑定=操控能力
+  requireLineMode(user, getDcwController().byId(id)?.lineId, 'operate')
+  const body = await readBody<{ deviceId?: string | null }>(event) ?? {}
+  const node = getDcwController().bind(id, body.deviceId ?? null)
+  return { node: node.toView() }
+})

package/server/api/workshop/dcw/[id]/test.post.ts

@@ -1,15 +1,18 @@
-/**
- * POST /api/workshop/dcw/:id/test —— 存量节点连接测试。
- */
-import { getRouterParam } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
-import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
-import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
-
-export default defineApiHandler(async (event) => {
-  resolveUser(event)
-  bindDcwBroadcast(broadcastSceneEvent)
-  const id = getRouterParam(event, 'id') ?? ''
-  return { test: await getDcwController().testNode(id) }
-})
+/**
+ * POST /api/workshop/dcw/:id/test —— 存量节点连接测试。
+ */
+import { getRouterParam } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { requireLineMode } from '@/server/services/workshop/permissions'
+import { defineApiHandler } from '@/server/utils/response'
+import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
+import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  bindDcwBroadcast(broadcastSceneEvent)
+  const id = getRouterParam(event, 'id') ?? ''
+  // 产线权限:连接测试触发真实驱动交互,需「可操控」
+  requireLineMode(user, getDcwController().byId(id)?.lineId, 'operate')
+  return { test: await getDcwController().testNode(id) }
+})

package/server/api/workshop/dcw/[id]/write.post.ts

@@ -5,6 +5,7 @@
  */
 import { getRouterParam, readBody } from 'h3'
 import { resolveUser } from '@/server/api/workshop/caller'
+import { requireLineMode } from '@/server/services/workshop/permissions'
 import { defineApiHandler } from '@/server/utils/response'
 import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
 import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
@@ -14,6 +15,8 @@ export default defineApiHandler(async (event) => {
   bindDcwBroadcast(broadcastSceneEvent)
   const id = getRouterParam(event, 'id') ?? ''
   const body = await readBody<{ value?: number }>(event) ?? {}
+  // 产线权限:写控设定值需「可操控」(readonly/无权用户 403)
+  requireLineMode(user, getDcwController().byId(id)?.lineId, 'operate')
   const outcome = await getDcwController().write(id, Number(body.value), null, { source: 'manual', actor: user.id, actorName: user.name })
   return { outcome }
 })

package/server/api/workshop/dcw/index.get.ts

@@ -2,24 +2,37 @@
  * GET /api/workshop/dcw —— 写控制节点列表 + 网关状态 + 模板/配方/批次/写历史(登录用户)。
  */
 import { resolveUser } from '@/server/api/workshop/caller'
+import { filterByLine, isPrivilegedRole, visibleLineIds } from '@/server/services/workshop/permissions'
 import { defineApiHandler } from '@/server/utils/response'
 import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
 import { listDcwTemplates } from '@/server/services/workshop/dcw/dcw-templates'
 import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
 
 export default defineApiHandler(async (event) => {
-  resolveUser(event)
+  const user = resolveUser(event)
   bindDcwBroadcast(broadcastSceneEvent)
   const ctrl = getDcwController()
+  // 产线级权限:普通用户仅见授权产线及其下属数据(admin/editor 全量)。
+  // recipes/products/runs 携带 lineId;history 按 nodeId→节点产线联结;
+  // 全局网关统计仅特权角色可见(计数不含产线维度但属运营面)。
+  const visible = visibleLineIds(user)
+  const privileged = isPrivilegedRole(user)
+  const inLine = (lineId: string | null | undefined): boolean =>
+    lineId != null && lineId !== '' && visible != null && visible.has(lineId)
+  const nodeLine = (nodeId: string): string | undefined => ctrl.byId(nodeId)?.lineId
   return {
-    controller: ctrl.controllerState(),
-    nodes: ctrl.listViews(),
+    controller: privileged
+      ? ctrl.controllerState()
+      : { running: ctrl.controllerState().running === true },
+    nodes: filterByLine(user, ctrl.listViews(), n => n.lineId),
     templates: listDcwTemplates(),
-    recipes: ctrl.listRecipes(),
-    runs: ctrl.listRuns(),
-    history: ctrl.listHistory(60),
-    products: ctrl.listProducts(),
-    lines: ctrl.listLines(),
-    lineStates: ctrl.allLineStates(),
+    recipes: visible ? ctrl.listRecipes().filter(r => inLine(r.lineId)) : ctrl.listRecipes(),
+    runs: visible ? ctrl.listRuns().filter(r => inLine(r.lineId)) : ctrl.listRuns(),
+    history: visible
+      ? ctrl.listHistory(400).filter(h => inLine(nodeLine(h.nodeId))).slice(0, 60)
+      : ctrl.listHistory(60),
+    products: visible ? ctrl.listProducts().filter(p => inLine(p.lineId)) : ctrl.listProducts(),
+    lines: visible ? ctrl.listLines().filter(l => visible.has(l.id)) : ctrl.listLines(),
+    lineStates: visible ? ctrl.allLineStates().filter(s => visible.has(s.lineId)) : ctrl.allLineStates(),
   }
 })

package/server/api/workshop/dcw/line/query.get.ts

@@ -1,31 +1,38 @@
-/**
- * GET /api/workshop/dcw/line/query —— 产线数据查询(产品/配方/工艺参数/时间/间隔)。
- * qs: productId, recipeId, paramKey, from(epoch ms), to, bucketMs, limit
- */
-import { getQuery } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
-import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
-import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
-
-export default defineApiHandler(async (event) => {
-  resolveUser(event)
-  bindDcwBroadcast(broadcastSceneEvent)
-  const q = getQuery(event)
-  const num = (v: unknown): number | undefined => {
-    const n = Number(v)
-    return v != null && v !== '' && Number.isFinite(n) ? n : undefined
-  }
-  const result = await getDcwController().lineQuery({
-    lineId: q.lineId ? String(q.lineId) : undefined,
-    productId: q.productId ? String(q.productId) : undefined,
-    recipeId: q.recipeId ? String(q.recipeId) : undefined,
-    paramKey: q.paramKey ? String(q.paramKey) : undefined,
-    nodeId: q.nodeId ? String(q.nodeId) : undefined,
-    fromMs: num(q.from),
-    toMs: num(q.to),
-    bucketMs: num(q.bucketMs),
-    limit: num(q.limit),
-  })
-  return result
-})
+/**
+ * GET /api/workshop/dcw/line/query —— 产线数据查询(产品/配方/工艺参数/时间/间隔)。
+ * qs: productId, recipeId, paramKey, from(epoch ms), to, bucketMs, limit
+ */
+import { getQuery } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { AppError } from '@/server/utils/errors'
+import { visibleLineIds } from '@/server/services/workshop/permissions'
+import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
+import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  bindDcwBroadcast(broadcastSceneEvent)
+  const q = getQuery(event)
+  // 产线权限:产线查询仅限可见产线(admin/editor 不限)
+  const visible = visibleLineIds(user)
+  if (visible && (!q.lineId || !visible.has(String(q.lineId)))) {
+    throw new AppError(403, 'LINE_FORBIDDEN', '无该产线权限:查询目标产线不在授权范围内')
+  }
+  const num = (v: unknown): number | undefined => {
+    const n = Number(v)
+    return v != null && v !== '' && Number.isFinite(n) ? n : undefined
+  }
+  const result = await getDcwController().lineQuery({
+    lineId: q.lineId ? String(q.lineId) : undefined,
+    productId: q.productId ? String(q.productId) : undefined,
+    recipeId: q.recipeId ? String(q.recipeId) : undefined,
+    paramKey: q.paramKey ? String(q.paramKey) : undefined,
+    nodeId: q.nodeId ? String(q.nodeId) : undefined,
+    fromMs: num(q.from),
+    toMs: num(q.to),
+    bucketMs: num(q.bucketMs),
+    limit: num(q.limit),
+  })
+  return result
+})

package/server/api/workshop/dcw/lines/[id]/start.post.ts

@@ -4,6 +4,7 @@
  */
 import { getRouterParam, readBody } from 'h3'
 import { resolveUser } from '@/server/api/workshop/caller'
+import { requireLineMode } from '@/server/services/workshop/permissions'
 import { defineApiHandler } from '@/server/utils/response'
 import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
 import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
@@ -15,6 +16,8 @@ export default defineApiHandler(async (event) => {
   const user = resolveUser(event)
   bindDcwBroadcast(broadcastSceneEvent)
   const id = getRouterParam(event, 'id')!
+  // 产线权限:开跑会向真实 PLC 下发全部配方参数,需「可操控」
+  requireLineMode(user, id, 'operate')
   const body = await readBody<{ recipeId?: string }>(event) ?? {}
   const run = await getDcwController().lineStart(id, String(body.recipeId ?? ''))
   const active = getActiveLineRun(id)

package/server/api/workshop/dcw/lines/[id]/stop.post.ts

@@ -4,6 +4,7 @@
  */
 import { getRouterParam } from 'h3'
 import { resolveUser } from '@/server/api/workshop/caller'
+import { requireLineMode } from '@/server/services/workshop/permissions'
 import { defineApiHandler } from '@/server/utils/response'
 import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
 import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
@@ -15,6 +16,8 @@ export default defineApiHandler(async (event) => {
   const user = resolveUser(event)
   bindDcwBroadcast(broadcastSceneEvent)
   const id = getRouterParam(event, 'id')!
+  // 产线权限:停线属操控能力
+  requireLineMode(user, id, 'operate')
   const active = getActiveLineRun(id)
   const run = getDcwController().lineStop(id)
   recordOps({

package/server/api/workshop/dcw/lines/index.get.ts

@@ -2,13 +2,19 @@
  * GET /api/workshop/dcw/lines —— 产线列表 + 各产线运行状态。
  */
 import { resolveUser } from '@/server/api/workshop/caller'
+import { visibleLineIds } from '@/server/services/workshop/permissions'
 import { defineApiHandler } from '@/server/utils/response'
 import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
 import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
 
 export default defineApiHandler(async (event) => {
-  resolveUser(event)
+  const user = resolveUser(event)
   bindDcwBroadcast(broadcastSceneEvent)
   const ctrl = getDcwController()
-  return { lines: ctrl.listLines(), states: ctrl.allLineStates() }
+  // 产线级权限:普通用户仅见授权产线(admin/editor 全量)
+  const visible = visibleLineIds(user)
+  return {
+    lines: visible ? ctrl.listLines().filter(l => visible.has(l.id)) : ctrl.listLines(),
+    states: visible ? ctrl.allLineStates().filter(s => visible.has(s.lineId)) : ctrl.allLineStates(),
+  }
 })

package/server/api/workshop/dcw/lines/index.post.ts

@@ -3,7 +3,7 @@
  * 缺省光晕色按创建序取色板(1号蓝 2号黄…);可显式指定 color。
  */
 import { readBody } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
+import { requireRole } from '@/server/api/workshop/caller'
 import { defineApiHandler } from '@/server/utils/response'
 import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
 import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
@@ -11,7 +11,7 @@ import { recordOps } from '@/server/services/workshop/ops/ops'
 import type { LineInput } from '#shared/dcw-protocol'
 
 export default defineApiHandler(async (event) => {
-  const user = resolveUser(event)
+  requireRole(event, ['admin', 'editor'])
   bindDcwBroadcast(broadcastSceneEvent)
   const body = await readBody<LineInput>(event) ?? { name: '' }
   const line = getDcwController().createLine(body)

package/server/api/workshop/dcw/products/index.post.ts

@@ -1,16 +1,16 @@
-/**
- * POST /api/workshop/dcw/products —— 创建产品(body: { name, description? })。
- */
-import { readBody } from 'h3'
-import type { ProductInput } from '#shared/dcw-protocol'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
-import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
-import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
-
-export default defineApiHandler(async (event) => {
-  resolveUser(event)
-  bindDcwBroadcast(broadcastSceneEvent)
-  const body = await readBody<ProductInput>(event) ?? { name: '' }
-  return { product: getDcwController().createProduct(body) }
-})
+/**
+ * POST /api/workshop/dcw/products —— 创建产品(body: { name, description? })。
+ */
+import { readBody } from 'h3'
+import type { ProductInput } from '#shared/dcw-protocol'
+import { requireRole } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
+import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
+
+export default defineApiHandler(async (event) => {
+  requireRole(event, ['admin', 'editor'])
+  bindDcwBroadcast(broadcastSceneEvent)
+  const body = await readBody<ProductInput>(event) ?? { name: '' }
+  return { product: getDcwController().createProduct(body) }
+})

package/server/api/workshop/dcw/runs/[id]/data.get.ts

@@ -1,15 +1,20 @@
-/**
- * GET /api/workshop/dcw/runs/:id/data —— 批次数据视图(数采汇总 + 写历史,窗口隔离)。
- */
-import { getRouterParam } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
-import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
-import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
-
-export default defineApiHandler(async (event) => {
-  resolveUser(event)
-  bindDcwBroadcast(broadcastSceneEvent)
-  const id = getRouterParam(event, 'id') ?? ''
-  return await getDcwController().runData(id)
-})
+/**
+ * GET /api/workshop/dcw/runs/:id/data —— 批次数据视图(数采汇总 + 写历史,窗口隔离)。
+ */
+import { getRouterParam } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { requireLineMode } from '@/server/services/workshop/permissions'
+import { defineApiHandler } from '@/server/utils/response'
+import { getDcwRecipeRepo } from '@/server/services/workshop/dcw/dcw-recipe.repo'
+import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
+import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  bindDcwBroadcast(broadcastSceneEvent)
+  const id = getRouterParam(event, 'id') ?? ''
+  // 产线权限:批次数据需对所属产线「仅查看」及以上
+  const run = getDcwRecipeRepo().runById(id)
+  requireLineMode(user, run?.lineId, 'readonly')
+  return await getDcwController().runData(id)
+})

package/server/api/workshop/dcw/runs/index.get.ts

@@ -1,11 +1,13 @@
-/**
- * GET /api/workshop/dcw/runs —— 生产批次列表。
- */
-import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
-import { getDcwRecipeRepo } from '@/server/services/workshop/dcw/dcw-recipe.repo'
-
-export default defineApiHandler(async (event) => {
-  resolveUser(event)
-  return { runs: getDcwRecipeRepo().listRuns() }
-})
+/**
+ * GET /api/workshop/dcw/runs —— 生产批次列表。
+ */
+import { resolveUser } from '@/server/api/workshop/caller'
+import { filterByLine } from '@/server/services/workshop/permissions'
+import { defineApiHandler } from '@/server/utils/response'
+import { getDcwRecipeRepo } from '@/server/services/workshop/dcw/dcw-recipe.repo'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  // 产线权限:批次列表按产线过滤
+  return { runs: filterByLine(user, getDcwRecipeRepo().listRuns(), r => r.lineId) }
+})

package/server/api/workshop/permissions/index.get.ts

@@ -0,0 +1,30 @@
+/**
+ * GET /api/workshop/permissions —— 产线授权管理面(admin 专用)。
+ * 返回全量产线 + 全部用户(基本信息 + 各自 channels + 当前产线授权)。
+ * 单查询批量取 grants(不逐用户 N+1);requireAdmin 已含鉴权,不重复 resolve。
+ */
+import { requireAdmin } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { userRepository } from '@/server/repositories/user.repository'
+import { getWorkshopManager } from '@/server/plugins/workshop'
+import { getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
+
+export default defineApiHandler(async (event) => {
+  requireAdmin(event)
+  const lines = getDcwController().listLines()
+  const manager = getWorkshopManager()
+  const users = userRepository.listAll()
+  const grantsByUser = new Map<string, Array<{ lineId: string, mode: string, grantedBy: string | null, grantedAt: string }>>()
+  for (const g of userRepository.allGrants()) {
+    const list = grantsByUser.get(g.userId) ?? []
+    list.push({ lineId: g.lineId, mode: g.mode, grantedBy: g.grantedBy, grantedAt: g.grantedAt })
+    grantsByUser.set(g.userId, list)
+  }
+  // channel 列表按 owner 归并(每用户一次轻量查询;channel 行自带 ownerUserId)
+  const out = users.map(u => ({
+    ...u,
+    channels: manager.listChannelsForUser(u.id).map(c => ({ id: c.channelId, name: c.name, createdAt: c.createdAt })),
+    grants: grantsByUser.get(u.id) ?? [],
+  }))
+  return { lines, users: out }
+})

package/server/api/workshop/permissions/index.put.ts

@@ -0,0 +1,29 @@
+/**
+ * PUT /api/workshop/permissions —— 批量设置某用户的产线授权(admin 专用)。
+ * body: { userId, grants: [{ lineId, mode: 'readonly' | 'operate' | null }] }(null = 撤销)
+ * 写后广播 permissions.changed(scene-events)与 permissions:changed(插件钩子)。
+ */
+import { readBody } from 'h3'
+import { resolveUser, requireAdmin } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { userRepository } from '@/server/repositories/user.repository'
+import { AppError, ErrorCodes } from '@/server/utils/errors'
+import { notifyGrantsChanged } from '@/server/services/workshop/permissions'
+
+export default defineApiHandler(async (event) => {
+  const admin = resolveUser(event)
+  requireAdmin(event)
+  const body = await readBody<{ userId?: string, grants?: Array<{ lineId?: string, mode?: string | null }> }>(event) ?? {}
+  const userId = String(body.userId ?? '')
+  if (!userId || !userRepository.findById(userId)) {
+    throw new AppError(404, ErrorCodes.NOT_FOUND, `用户不存在: ${userId || '?'}`)
+  }
+  const grants = Array.isArray(body.grants) ? body.grants : []
+  for (const g of grants) {
+    const lineId = String(g?.lineId ?? '')
+    if (!lineId) continue
+    userRepository.setGrant(userId, lineId, (g?.mode ?? null) as string | null, admin.id)
+  }
+  notifyGrantsChanged(userId)
+  return { userId, grants: userRepository.listGrants(userId) }
+})