Aida 用户身份与权限体系全景

flowchart TB
  subgraph SRC["身份来源 · 3 套身份空间"]
    direction LR
    B["Business 终端用户
Backend Token"]
    I["Internal 后台用户
账号 + 密码"]
    C["Channel / IM 用户
飞书 union_id"]
  end
  B -->|"/api/auth/exchange"| AJ["Aida JWT"]
  I -->|"/api/auth/internal-login"| IJ["Internal JWT"]
  C -->|"webhook 命中 channel_user_binding"| RT["运行时身份"]
  AJ --> TC
  IJ --> TC
  RT --> TC
  TC["TenantContext
tenantId · userId · empId · roles · department · backendToken"]
  TC -->|"AsyncLocalStorage 全链路传播"| CONS["下游消费"]
  CONS --> MY["api-my:投影『当前用户可见面』"]
  CONS --> BK["backendToken:调后端业务工具"]
  TC -.->|"resolveAssignmentSubjectId 单点桥"| U["users 表 (identity_type)"]
  U --> ASG["user_domain_assignments
用户 ↔ 域 ↔ 角色"]
  MY -.->|"读"| ASG
        

flowchart LR
  R["请求带 token"] --> AM["authMiddleware
3 分支识别"]
  AM --> A1["admin static token"]
  AM --> A2["internal JWT"]
  AM --> A3["主 Aida JWT(验签)"]
  A3 --> TP["tokenProvider.resolve
取缓存 backendToken"]
  TP -->|"缓存 miss"| E401["AuthError → 401
需重新 exchange"]
  TP --> DEP["fetchUserDepartment
(5min 缓存)"]
  DEP --> CTX["createTenantContext"]
  CTX --> ALS["withTenantContext
AsyncLocalStorage"]
  ALS --> DS["orchestrator / tool-client / scheduler"]
        

flowchart TD
  S["authMiddleware:取 ctx.roles"] --> D["domainResolverMiddleware
X-Aida-Domain 改写 ctx.roles"]
  D --> SUB["resolveAssignmentSubjectId
运行时 userId → users.id(fail-closed)"]
  SUB -->|"null"| F1["403"]
  SUB --> GA["getActiveAssignment(subjectId, query.domainId)"]
  GA -->|"无 assignment"| F2["403 Domain access denied"]
  GA --> CER["computeEffectiveRoles
assignment.roles 空 → 回退 ctx.roles"]
  CER --> FILT{"逐类资源过滤"}
  FILT --> M1["① 域成员过滤"]
  M1 --> M2["② 租户覆盖(仅 capability)"]
  M2 --> M3["③ 域授权角色门"]
  M3 --> M4["④ 全局默认角色门"]
  M4 --> M5["⑤ 部门门(仅 agent)"]
  M5 --> OUT["返回可见资源"]
        

flowchart LR
  subgraph MAIN["Electron Main(可信)"]
    V["Credential Vault
Backend Token(safeStorage 加密 0600)"]
    EX["exchange → Aida JWT"]
    V --> EX
  end
  subgraph REN["Renderer(不可信)"]
    AJ["Aida JWT(模块级内存)"]
  end
  EX -->|"IPC get-access-token:只下发短时 JWT"| AJ
  AJ -->|"Authorization: Bearer"| API["agent API"]
  V -.->|"绝不进"| X["config / renderer / IPC / 日志"]
        

flowchart TB
  SRV["server agent loop(唯一 loop)"] -->|"SSE delegated tool_call"| REN["renderer(转发)"]
  REN -->|"IPC dispatch-tool-call"| LE["LocalExecutorService(Main)"]
  LE --> G1["trusted root + skill 同意态"]
  LE --> G2["Selected File Grant(opaque fileId)"]
  LE --> G3["Transient Grant(snapshot + 30min TTL + revoke)"]
  LE --> G4["approval-gate(本机确认 + 10min TTL)"]
  LE --> G5["path-policy(容器化 / 拒 symlink 越界)"]
  G1 --> EXn["执行本机 primitive"]
  G2 --> EXn
  G3 --> EXn
  G4 --> EXn
  G5 --> EXn
  EXn --> LED["egress-ledger(脱敏出口审计)"]