feat: add Casbin admin permissions

[Calcium-Ion]

⚠️ 提交说明 / PR Notice

Important

• 请提供人工撰写的简洁摘要，避免直接粘贴未经整理的 AI 输出。

📝 变更描述 / Description

新增基于 Casbin 的后台 Admin 细分权限能力，首期接入渠道管理权限。

• 新增 casbin_rule policy 存储和 authz_roles 角色元数据初始化，启动时写入内置 Root/Admin 权限基线。
• 新增通用 authz.Permission catalog、权限判断、能力矩阵和用户级 allow/deny override。
• 渠道路由接入 RequirePermission，并对渠道 key、base URL、Header/Param Override、OpenAI Organization 等敏感字段执行字段级权限校验。
• 用户 API 返回并保存通用 Admin 权限矩阵，Root 可对单个 Admin 增加或取消权限。
• 默认前端根据权限矩阵控制渠道新增、复制、敏感编辑、Fetch Models 等入口展示，并补齐多语言文案。

🚀 变更类型 / Type of change

• 🐛 Bug 修复 (Bug fix) - 请关联对应 Issue，避免将设计取舍、理解偏差或预期不一致直接归类为 bug
• ✨ 新功能 (New feature) - 重大特性建议先通过 Issue 沟通
• ⚡ 性能优化 / 重构 (Refactor)
• 📝 文档更新 (Documentation)

🔗 关联任务 / Related Issue

• 无

✅ 提交前检查项 / Checklist

• 人工确认: 我已亲自整理并撰写此描述，没有直接粘贴未经处理的 AI 输出。
• 非重复提交: 我已搜索现有的 Issues 与 PRs，确认不是重复提交。
• Bug fix 说明: 若此 PR 标记为 Bug fix，我已提交或关联对应 Issue，且不会将设计取舍、预期不一致或理解偏差直接归类为 bug。
• 变更理解: 我已理解这些更改的工作原理及可能影响。
• 范围聚焦: 本 PR 未包含任何与当前任务无关的代码改动。
• 本地验证: 已在本地运行并通过测试或手动验证，维护者可以据此复核结果。
• 安全合规: 代码中无敏感凭据，且符合项目代码规范。

📸 运行证明 / Proof of Work

已在本地运行并通过：

• go test ./...
• bun run i18n:sync
• bun run typecheck
• bun run build

Summary by CodeRabbit

• New Features

  • Added granular admin permissions for channel management, including sensitive-write controls.
  • Added permission-aware channel status updates (single and batch), plus an admin permission catalog endpoint.

• Bug Fixes

  • Sensitive channel edits and destructive multi-key actions now require proper authorization.
  • User admin permissions stay consistent when roles/permissions are updated.

• UI Updates

  • Channel, multi-key, and bulk actions are now disabled when permission is missing, with clearer “no permission” messaging.
  • Eligible admins can view and edit per-user admin permissions.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

The PR adds a Casbin-backed authorization system, a permission-catalog endpoint, per-user admin permission persistence, channel sensitive-write checks and status routes, and frontend editors/UI gating for channel and user permissions. Locale files add matching permission and channel management text.

Changes

Authorization and permission gating

Layer / File(s)	Summary
Permission vocabulary service/authz/permission.go, service/authz/registry.go, service/authz/role.go, service/authz/resources_channel.go, service/authz/assignment.go	Defines shared permission primitives, the registry, built-in roles, and channel resource metadata.
Authz engine and bootstrap go.mod, model/authz_role.go, model/casbin_rule.go, model/main.go, service/authz/adapter.go, service/authz/enforcer.go, service/authz/seed.go, service/authz/override.go, service/authz/resolver.go, service/authz/authz_test.go, controller/authz.go, router/authz-router.go, main.go	Adds Casbin-backed persistence, policy seeding, authz initialization, the permission catalog endpoint, and its router wiring.
User authz state model/user.go, controller/user.go, controller/audit.go, model/log.go	Adds admin permission data to user responses and updates transactional user mutation and audit flows.
Channel authz and routing middleware/auth.go, controller/channel.go, controller/channel_authz.go, controller/channel_authz_test.go, router/api-router.go, router/channel-router.go, router/channel_router_test.go	Adds sensitive-write checks for channel edits and multi-key actions, channel status handlers, and permission-aware channel routing tests.
Channel UI gating web/default/src/features/channels/..., web/default/src/i18n/locales/*.json	Updates channel APIs, status/delete flows, mutation form filtering, and channel permission copy across the locale files.
Admin permission editing web/default/src/lib/admin-permissions.ts, web/default/src/stores/auth-store.ts, web/default/src/features/users/..., web/default/src/i18n/locales/*.json	Adds the permission catalog model, user permission matrix editing, and admin-permission copy across the locale files.

Estimated review effort

🎯 5 (Critical) | ⏱️ ~120 minutes

Possibly related PRs

• QuantumNous/new-api#1341: Also changes controller/channel.go around channel update validation and processing.
• QuantumNous/new-api#1498: Also touches ManageMultiKeys channel behavior and delete-related actions.
• QuantumNous/new-api#1954: Also affects channel key route security and secure verification flow.

Suggested labels
enhancement

Suggested reviewers

• seefs001

A bunny hopped through perms all day,
With Casbin gates to mark the way.
🐇 Keys, channels, and roles now sing,
While admin carrots do their thing.
Hop hop — the audit logs stay neat.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 26.47% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the PR’s main change: adding Casbin-based admin permissions.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/better-admin

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 8

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@controller/channel.go`:
- Around line 1081-1083: The key-change sensitivity check in the channel update
logic is too permissive because it only flags changes when channel.Key is
non-empty, allowing explicit clearing via key being empty or null to slip
through. Update the comparison in the channel update/sensitivity path so that
whenever requestData contains key, it is treated as sensitive if the submitted
value differs from origin.Key, including transitions to empty or nil. Use the
existing channel.Key, origin.Key, and requestData["key"] check to locate and
adjust the condition.

In `@controller/user.go`:
- Around line 646-649: The user update and authorization update are not atomic,
so a failure in updateAdminPermissionsForUser or authz.ClearUserAuthorization
can leave the User record changed while casbin_rule is stale. Refactor the
affected handlers around updatedUser, updateAdminPermissionsForUser, and
authz.ClearUserAuthorization to perform the user write and authz write in one
transactional flow with rollback/compensation on failure, and make sure the
demote path still invalidates cache only after both steps succeed. Apply the
same atomicity fix in the other update paths noted by the review as well.

In `@model/casbin_rule.go`:
- Around line 5-11: The Casbin rule schema in the model struct needs a
uniqueness constraint on the policy columns so concurrent AddPolicy calls cannot
create duplicate rows. Update the gorm tags on CasbinRule fields (Ptype, V0
through V5) to define a unique composite index over the full policy key, and
keep the existing adapter logic in service/authz/adapter.go aligned with that
database-level enforcement.

In `@model/main.go`:
- Around line 354-355: The concurrent migration path in migrateDBFast is now
including CasbinRule and AuthzRole, which can trigger SQLite locking during
startup. Keep these authz tables out of the parallel AutoMigrate set and ensure
SQLite uses the serial migration path instead, while still running the authz
setup afterward. Update the migration selection logic around migrateDBFast and
the authz initialization flow so all supported dialects remain compatible.

In `@router/channel-router.go`:
- Around line 23-29: The channel key endpoint is still wired to RootAuth()
instead of the new channel secret-view authorization. Update the route in
channelRoute.POST("/:id/key") to use the ChannelSecretView permission check from
the channel permission matrix, keeping the existing
rate-limit/cache/verification middleware intact, and ensure
controller.GetChannelKey is only reached when secret-view access is granted.

In `@service/authz/authz_test.go`:
- Around line 16-18: The in-memory SQLite test fixture created in authz_test.go
can become flaky because gorm.Open with sqlite.Open(":memory:") may use multiple
connections. Update the test setup around gorm.Open and AutoMigrate so the
underlying DB is restricted to a single connection for the lifetime of the
fixture, using the existing db handle returned in the test. This should be
applied where the test initializes the database before running Authz-related
assertions.

In `@service/authz/authz.go`:
- Around line 315-331: The built-in role seeding logic in the role upsert path
is doing a read-then-create/update flow with a raw Where on the key column,
which is not dialect-safe and can race during concurrent startup. Replace this
block with a single upsert in the seeding routine that targets the role key
uniquely and updates the existing fields atomically, using the shared
reserved-word-safe column constant instead of a raw key literal. Keep the change
within the authz seeding code around the AuthzRole handling so it works across
SQLite, MySQL, and PostgreSQL without aborting when another instance seeds the
same role first.

In `@web/default/src/lib/admin-permissions.ts`:
- Around line 11-17: The `secret_view` admin permission is being dropped during
normalization because `normalizeAdminPermissions` rebuilds permissions from
`ADMIN_PERMISSION_CATALOG` but `ADMIN_PERMISSION_ACTIONS.SECRET_VIEW` is not
included there. Update the `ADMIN_PERMISSION_CATALOG` entry in
`admin-permissions.ts` so the `resource.actions` array includes `SECRET_VIEW`,
ensuring `users-mutate-drawer.tsx` and `user-form.ts` preserve it when calling
`normalizeAdminPermissions` and `authz.SetUserPermissions`.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 584c6dd7-8a3a-428c-a7df-312a2628fad2

📥 Commits

Reviewing files that changed from the base of the PR and between 7939674 and a23080c.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (28)

• controller/channel.go
• controller/channel_authz_test.go
• controller/user.go
• go.mod
• main.go
• middleware/auth.go
• model/authz_role.go
• model/casbin_rule.go
• model/main.go
• model/user.go
• router/api-router.go
• router/channel-router.go
• service/authz/adapter.go
• service/authz/authz.go
• service/authz/authz_test.go
• web/default/src/features/channels/components/channels-primary-buttons.tsx
• web/default/src/features/channels/components/data-table-row-actions.tsx
• web/default/src/features/users/components/users-mutate-drawer.tsx
• web/default/src/features/users/lib/user-form.ts
• web/default/src/features/users/types.ts
• web/default/src/i18n/locales/en.json
• web/default/src/i18n/locales/fr.json
• web/default/src/i18n/locales/ja.json
• web/default/src/i18n/locales/ru.json
• web/default/src/i18n/locales/vi.json
• web/default/src/i18n/locales/zh.json
• web/default/src/lib/admin-permissions.ts
• web/default/src/stores/auth-store.ts

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (3)

web/default/src/i18n/locales/ja.json (1)

3640-3640: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Minor terminology inconsistency: "チャンネル" vs "チャネル".

These two new strings use "チャンネル", while the rest of the channel-related strings in this file (e.g. Line 713 "チャネル管理", Line 3894 "機密チャネル設定") use "チャネル". Align for consistency.

Also applies to: 4732-4732

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/default/src/i18n/locales/ja.json` at line 3640, The Japanese locale has
inconsistent terminology for channel-related strings by using “チャンネル” instead of
the established “チャネル” used elsewhere in this file. Update the affected
translation entries, including the string in the reserved-view message and the
other noted entry, so they consistently use “チャネル” to match the existing locale
wording.

Source: Learnings

web/default/src/features/channels/components/drawers/channel-mutate-drawer.tsx (1)

324-330: 🔒 Security & Privacy | 🔵 Trivial

Reveal-key gating uses role, not the SECRET_VIEW permission.

The canRevealChannelKey check relies on a hard-coded SUPER_ADMIN role requirement, bypassing the SECRET_VIEW permission explicitly defined for "Viewing complete channel secrets." This prevents administrators with the specific SECRET_VIEW grant from revealing keys, creating an inconsistency with the permission model.

Replace the role check with hasPermission to respect the defined permission grant:

Current vs. Proposed Change

  const canEditSensitive = hasPermission(
    currentUser,
    ADMIN_PERMISSION_RESOURCES.CHANNEL,
    ADMIN_PERMISSION_ACTIONS.SENSITIVE_WRITE
  )
- const canRevealChannelKey = currentUser?.role === ROLE.SUPER_ADMIN
+ const canRevealChannelKey = hasPermission(
+   currentUser,
+   ADMIN_PERMISSION_RESOURCES.CHANNEL,
+   ADMIN_PERMISSION_ACTIONS.SECRET_VIEW
+ )

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@web/default/src/features/channels/components/drawers/channel-mutate-drawer.tsx`
around lines 324 - 330, The reveal-key access check is using a hard-coded role
instead of the existing permission model. Update the canRevealChannelKey logic
in channel-mutate-drawer.tsx to use hasPermission with
ADMIN_PERMISSION_RESOURCES.CHANNEL and ADMIN_PERMISSION_ACTIONS.SECRET_VIEW,
matching the pattern already used by canEditSensitive, and remove the direct
SUPER_ADMIN role comparison.

web/default/src/features/channels/hooks/use-channel-mutate-form.ts (1)

44-54: 🗄️ Data Integrity & Integration | 🔵 Trivial

SENSITIVE_UPDATE_FIELDS diverges from the UI's SENSITIVE_FORM_FIELDS, though backend enforcement is narrow.

Verification confirms the backend (controller/channel.go) only enforces ChannelSensitiveWrite permission for changes to type, base_url, key, openai_organization, setting, param_override, and header_override. Fields like proxy, system_prompt, and force_format (marked sensitive in the drawer) are not checked by the backend, so their presence in the payload does not currently cause save rejections for locked users.

However, the frontend maintains two separate lists: the hook's strip list matches the backend's strict definition, while the drawer treats ~33 fields as sensitive. This drift creates ambiguity: the UI may prevent edits or flag changes for fields the backend considers safe, and future backend updates syncing with the UI's broader list could cause unexpected rejections if the strip list isn't updated.

Recommendation:

• Centralize the definition of sensitive fields. Ensure SENSITIVE_FORM_FIELDS in the drawer and SENSITIVE_UPDATE_FIELDS in the hook derive from a single source of truth to prevent drift.
• If the UI intentionally treats fields like proxy as sensitive (for behavioral locking), explicitly include them in SENSITIVE_UPDATE_FIELDS to strip them for locked users, ensuring the UI protection logic matches the data sent to the API.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/default/src/features/channels/hooks/use-channel-mutate-form.ts` around
lines 44 - 54, The sensitive-field rules are split between the channel mutate
hook and the drawer, causing drift between what the UI blocks and what gets sent
to the API. Update the `SENSITIVE_UPDATE_FIELDS` in `use-channel-mutate-form` to
derive from the same source as `SENSITIVE_FORM_FIELDS` (or otherwise share a
single constants list) so both the form UI and payload-stripping logic stay
aligned. If fields like `proxy`, `system_prompt`, or `force_format` are meant to
be locked, ensure they are included in the shared definition and therefore
handled consistently by `use-channel-mutate-form` and the drawer.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@service/authz/authz.go`:
- Around line 273-280: The authz enforcer access is racy because ReloadPolicy
can call LoadPolicy while Can/GetFilteredPolicy run outside the lock, causing
concurrent map access. Fix this by making the enforcer thread-safe at creation
time with casbin.NewSyncedEnforcer, or by holding enforcerMu.RLock() for the
full duration of enforcement in Can and any policy reads. Keep the change
centered around currentEnforcer, Can, and ReloadPolicy so all enforcer
operations are protected consistently.

---

Nitpick comments:
In
`@web/default/src/features/channels/components/drawers/channel-mutate-drawer.tsx`:
- Around line 324-330: The reveal-key access check is using a hard-coded role
instead of the existing permission model. Update the canRevealChannelKey logic
in channel-mutate-drawer.tsx to use hasPermission with
ADMIN_PERMISSION_RESOURCES.CHANNEL and ADMIN_PERMISSION_ACTIONS.SECRET_VIEW,
matching the pattern already used by canEditSensitive, and remove the direct
SUPER_ADMIN role comparison.

In `@web/default/src/features/channels/hooks/use-channel-mutate-form.ts`:
- Around line 44-54: The sensitive-field rules are split between the channel
mutate hook and the drawer, causing drift between what the UI blocks and what
gets sent to the API. Update the `SENSITIVE_UPDATE_FIELDS` in
`use-channel-mutate-form` to derive from the same source as
`SENSITIVE_FORM_FIELDS` (or otherwise share a single constants list) so both the
form UI and payload-stripping logic stay aligned. If fields like `proxy`,
`system_prompt`, or `force_format` are meant to be locked, ensure they are
included in the shared definition and therefore handled consistently by
`use-channel-mutate-form` and the drawer.

In `@web/default/src/i18n/locales/ja.json`:
- Line 3640: The Japanese locale has inconsistent terminology for
channel-related strings by using “チャンネル” instead of the established “チャネル” used
elsewhere in this file. Update the affected translation entries, including the
string in the reserved-view message and the other noted entry, so they
consistently use “チャネル” to match the existing locale wording.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4c76bc3c-f887-4ef0-9ba5-af41bbc9daf4

📥 Commits

Reviewing files that changed from the base of the PR and between 2f5565e and a6de6c7.

📒 Files selected for processing (21)

• controller/user.go
• model/casbin_rule.go
• model/main.go
• model/user.go
• router/channel-router.go
• service/authz/adapter.go
• service/authz/authz.go
• service/authz/authz_test.go
• web/default/src/features/channels/components/channels-primary-buttons.tsx
• web/default/src/features/channels/components/data-table-row-actions.tsx
• web/default/src/features/channels/components/dialogs/multi-key-manage-dialog.tsx
• web/default/src/features/channels/components/dialogs/multi-key-table-row-actions.tsx
• web/default/src/features/channels/components/drawers/channel-mutate-drawer.tsx
• web/default/src/features/channels/hooks/use-channel-mutate-form.ts
• web/default/src/i18n/locales/en.json
• web/default/src/i18n/locales/fr.json
• web/default/src/i18n/locales/ja.json
• web/default/src/i18n/locales/ru.json
• web/default/src/i18n/locales/vi.json
• web/default/src/i18n/locales/zh.json
• web/default/src/lib/admin-permissions.ts

💤 Files with no reviewable changes (1)

• model/main.go

✅ Files skipped from review due to trivial changes (3)

• web/default/src/i18n/locales/ru.json
• web/default/src/i18n/locales/fr.json
• web/default/src/i18n/locales/zh.json

🚧 Files skipped from review as they are similar to previous changes (6)

• model/casbin_rule.go
• router/channel-router.go
• web/default/src/features/channels/components/channels-primary-buttons.tsx
• web/default/src/lib/admin-permissions.ts
• web/default/src/features/channels/components/data-table-row-actions.tsx
• service/authz/adapter.go

[coderabbitai]

Actionable comments posted: 5

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

web/default/src/features/channels/components/data-table-bulk-actions.tsx (1)

180-199: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Disabled delete trigger hides the permission explanation.

Line 184 disables the button, so the tooltip text added at Lines 195-199 is unlikely to be reachable by mouse or keyboard users. That makes the new “No permission to perform this action” feedback effectively invisible. Keep the trigger focusable (for example, wrap the disabled control) or surface the reason inline. As per coding guidelines, use keyboard-accessible controls and appropriate ARIA/interaction behavior.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/default/src/features/channels/components/data-table-bulk-actions.tsx`
around lines 180 - 199, The delete action in data-table-bulk-actions is fully
disabled when canEditSensitive is false, which prevents the TooltipTrigger
content from being reached and hides the permission message. Update the delete
control so it remains keyboard/mouse accessible while conveying the disabled
state, such as by using a focusable wrapper around the disabled button or by
surfacing the “No permission to perform this action” text inline. Make sure the
interaction in the delete trigger and TooltipContent path still uses accessible
behavior and ARIA semantics for users without edit permission.

Source: Coding guidelines

🧹 Nitpick comments (1)

service/authz/registry.go (1)

27-34: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Deep-copy DefaultRoles in the catalog copy.

Catalog() copies the actions slice, but each ActionDefinition.DefaultRoles slice still shares backing storage with the registry. A caller mutating the returned catalog can accidentally change role defaults used by the authz package.

♻️ Proposed fix

 func Catalog() []ResourceDefinition {
 	result := make([]ResourceDefinition, 0, len(registry))
 	for _, resource := range registry {
+		actions := make([]ActionDefinition, 0, len(resource.Actions))
+		for _, action := range resource.Actions {
+			action.DefaultRoles = append([]string(nil), action.DefaultRoles...)
+			actions = append(actions, action)
+		}
 		result = append(result, ResourceDefinition{
 			Resource: resource.Resource,
 			LabelKey: resource.LabelKey,
-			Actions:  append([]ActionDefinition(nil), resource.Actions...),
+			Actions:  actions,
 		})
 	}
 	return result
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@service/authz/registry.go` around lines 27 - 34, Catalog() only deep-copies
Actions, but ActionDefinition.DefaultRoles is still shared with the registry and
can be mutated by callers. Update the Catalog function to also copy each
action’s DefaultRoles slice when building the returned ResourceDefinition list,
using the ActionDefinition and ResourceDefinition symbols to locate the copy
logic.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@controller/channel_authz.go`:
- Around line 90-97: The non-sensitive edit classification in UpdateChannel is
too permissive because server-managed/accounting fields like balance,
used_quota, and the timestamp/health fields can still slip through when they
appear in the request body. Update the sensitive-write handling in
channel_authz.go so that these fields are rejected outright in UpdateChannel, or
ensure they are treated as sensitive before the classified-field skip list is
applied. Use the existing UpdateChannel flow and the field allow/deny logic
around the classified-field checks to locate the fix.

In `@controller/channel.go`:
- Around line 1093-1095: Update the request parsing in UpdateChannelStatus and
BatchUpdateChannelStatus to use the shared JSON wrapper instead of
c.ShouldBindJSON. Read the body with c.GetRawData() and deserialize via
common.Unmarshal or common.DecodeJson, then validate the resulting
ChannelStatusRequest as before. Keep the change localized to the request
handling around ChannelStatusRequest so both endpoints follow the common/json.go
guideline consistently.

In `@service/authz/enforcer.go`:
- Around line 14-16: The shared authz enforcer is currently a raw
casbin.Enforcer, so concurrent policy reads and writes in currentEnforcer,
GetFilteredPolicy, AddPolicy, RemoveFilteredPolicy, and LoadPolicy can race.
Update the shared instance in enforcer.go to use casbin.SyncedEnforcer, or
consistently guard every access with enforcerMu, and propagate the resulting
type/signature changes through the helper methods that return or accept the
enforcer.

In `@service/authz/resolver.go`:
- Around line 13-20: The permission check in the resolver currently allows
superuser roles to short-circuit before validation, so unknown permissions can
incorrectly pass. Update the logic in the permission guard that uses roles,
isSuperuserRole, and isKnownPermission so permission validity is checked first
and any unknown catalog entry returns false before considering superuser access.

In `@web/default/src/features/users/lib/user-form.ts`:
- Around line 83-91: The admin permission payload in transformFormDataToPayload
is still being set when the only available catalog is EMPTY_PERMISSION_CATALOG,
which causes an empty admin_permissions override to be serialized. Update the
guard around the admin_permissions assignment so it only runs when there is a
usable catalog (not the empty sentinel) and the target role is admin, using
ADMIN_ROLE_KEY from `@/lib/admin-permissions` to validate the baseline/resources
before calling normalizeAdminPermissions. This keeps UsersMutateDrawer from
persisting admin_permissions: {} during loading or failure states and preserves
existing permissions when the catalog is not ready.

---

Outside diff comments:
In `@web/default/src/features/channels/components/data-table-bulk-actions.tsx`:
- Around line 180-199: The delete action in data-table-bulk-actions is fully
disabled when canEditSensitive is false, which prevents the TooltipTrigger
content from being reached and hides the permission message. Update the delete
control so it remains keyboard/mouse accessible while conveying the disabled
state, such as by using a focusable wrapper around the disabled button or by
surfacing the “No permission to perform this action” text inline. Make sure the
interaction in the delete trigger and TooltipContent path still uses accessible
behavior and ARIA semantics for users without edit permission.

---

Nitpick comments:
In `@service/authz/registry.go`:
- Around line 27-34: Catalog() only deep-copies Actions, but
ActionDefinition.DefaultRoles is still shared with the registry and can be
mutated by callers. Update the Catalog function to also copy each action’s
DefaultRoles slice when building the returned ResourceDefinition list, using the
ActionDefinition and ResourceDefinition symbols to locate the copy logic.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4d90e377-c8a0-4a91-b523-823d3d92db0d

📥 Commits

Reviewing files that changed from the base of the PR and between a6de6c7 and a23b7e4.

📒 Files selected for processing (36)

• controller/authz.go
• controller/channel.go
• controller/channel_authz.go
• controller/channel_authz_test.go
• main.go
• router/api-router.go
• router/authz-router.go
• router/channel-router.go
• router/channel_router_test.go
• service/authz/assignment.go
• service/authz/authz_test.go
• service/authz/enforcer.go
• service/authz/override.go
• service/authz/permission.go
• service/authz/registry.go
• service/authz/resolver.go
• service/authz/resources_channel.go
• service/authz/role.go
• service/authz/seed.go
• web/default/src/features/channels/api.ts
• web/default/src/features/channels/components/channels-primary-buttons.tsx
• web/default/src/features/channels/components/data-table-bulk-actions.tsx
• web/default/src/features/channels/components/data-table-row-actions.tsx
• web/default/src/features/channels/components/drawers/channel-mutate-drawer.tsx
• web/default/src/features/channels/lib/channel-actions.ts
• web/default/src/features/channels/lib/channel-form.ts
• web/default/src/features/users/api.ts
• web/default/src/features/users/components/users-mutate-drawer.tsx
• web/default/src/features/users/lib/user-form.ts
• web/default/src/i18n/locales/en.json
• web/default/src/i18n/locales/fr.json
• web/default/src/i18n/locales/ja.json
• web/default/src/i18n/locales/ru.json
• web/default/src/i18n/locales/vi.json
• web/default/src/i18n/locales/zh.json
• web/default/src/lib/admin-permissions.ts

💤 Files with no reviewable changes (1)

• web/default/src/features/channels/lib/channel-form.ts

✅ Files skipped from review due to trivial changes (2)

• web/default/src/i18n/locales/vi.json
• web/default/src/i18n/locales/ja.json

🚧 Files skipped from review as they are similar to previous changes (9)

• router/api-router.go
• router/channel-router.go
• web/default/src/features/channels/components/channels-primary-buttons.tsx
• web/default/src/features/users/components/users-mutate-drawer.tsx
• service/authz/authz_test.go
• web/default/src/i18n/locales/fr.json
• web/default/src/features/channels/components/drawers/channel-mutate-drawer.tsx
• web/default/src/i18n/locales/zh.json
• web/default/src/i18n/locales/ru.json

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Fail closed for unknown permissions before the superuser allow path.

A typo or unregistered permission currently returns true for root users because the superuser check runs before isKnownPermission. Validate the permission first so all callers fail closed on unknown catalog entries.

🛡️ Proposed fix

 	if len(roles) == 0 {
 		return false
 	}
+	if !isKnownPermission(permission) {
+		return false
+	}
 	for _, role := range roles {
 		if isSuperuserRole(role) {
 			return true
 		}
 	}
-	if !isKnownPermission(permission) {
-		return false
-	}

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	for _, role := range roles {
	if isSuperuserRole(role) {
	return true
	}
	}
	if !isKnownPermission(permission) {
	return false
	}
	for _, role := range roles {
	if isSuperuserRole(role) {
	return true
	}
	}
	if !isKnownPermission(permission) {
	return false
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@service/authz/resolver.go` around lines 13 - 20, The permission check in the
resolver currently allows superuser roles to short-circuit before validation, so
unknown permissions can incorrectly pass. Update the logic in the permission
guard that uses roles, isSuperuserRole, and isKnownPermission so permission
validity is checked first and any unknown catalog entry returns false before
considering superuser access.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

controller/channel_authz.go (1)

9-10: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Treat explicit key clearing as a sensitive change.

With channel.Key != "", a request containing "key": "" against a channel with an existing key falls through as non-sensitive because key is then skipped by channelSensitiveFields. Since channel keys are part of the sensitive-write surface, explicit clearing should still require ChannelSensitiveWrite.

Suggested fix

-	if _, ok := requestData["key"]; ok && channel.Key != "" && channel.Key != origin.Key {
+	if _, ok := requestData["key"]; ok && channel.Key != origin.Key {
 		return true
 	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@controller/channel_authz.go` around lines 9 - 10, The sensitivity check in
`channelHasSensitiveWrite` currently skips explicit key clearing because it only
treats `requestData["key"]` as sensitive when `channel.Key` is non-empty and
different from `origin.Key`. Update this logic so any request that includes the
key field, including `"key": ""`, is treated as a sensitive write when the
channel currently has a key. Keep the fix localized to
`channelHasSensitiveWrite` and `channelSensitiveFields` so
`ChannelSensitiveWrite` is required for explicit key removal.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@controller/channel_authz.go`:
- Around line 9-10: The sensitivity check in `channelHasSensitiveWrite`
currently skips explicit key clearing because it only treats
`requestData["key"]` as sensitive when `channel.Key` is non-empty and different
from `origin.Key`. Update this logic so any request that includes the key field,
including `"key": ""`, is treated as a sensitive write when the channel
currently has a key. Keep the fix localized to `channelHasSensitiveWrite` and
`channelSensitiveFields` so `ChannelSensitiveWrite` is required for explicit key
removal.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6c38a8d5-0d8e-4498-b6c8-4aefd2988215

📥 Commits

Reviewing files that changed from the base of the PR and between a23b7e4 and 4689230.

📒 Files selected for processing (7)

• controller/channel.go
• controller/channel_authz.go
• controller/channel_authz_test.go
• service/authz/enforcer.go
• service/authz/override.go
• service/authz/resolver.go
• web/default/src/features/channels/components/data-table-bulk-actions.tsx

🚧 Files skipped from review as they are similar to previous changes (5)

• web/default/src/features/channels/components/data-table-bulk-actions.tsx
• service/authz/resolver.go
• service/authz/enforcer.go
• service/authz/override.go
• controller/channel.go