0.11.7: 代码审查查缺补漏(安全/并发/前端三轮审查修复)

安全:
- 渠道 webhook 入站强制令牌鉴权(恒定时间比较+统一文案),企微签名官方算法;
- 报表/概览/systemInfo 端点按 usage:read/audit:read/system:manage 授权;
- sso_error 固定错误码;个人渠道令牌仅请求头;工具出站 Dialer.Control 消除
  DNS rebinding TOCTOU;新增 channel:read/manage 权限;限流倍数上限 10。

并发/一致性:
- 任务上报单条条件 UPDATE 防重放双提交;认领回收过期 claimed 任务;
- 审批改先开通后落记录(幂等,无嵌套事务);聊天消息单事务落库;
- 会话列表校验 AuthVersion;吊销先 Del 后 SRem;删工具保护调用历史;
- rejected 冷却 24h;限流被拒补偿;maintenance 清理限流窗口。

前端/菜单:
- 修复 gatewayChildren late-append 导致 reports/tenants/channels 菜单不可见;
- 聊天改名 PUT 对齐;渠道编辑清空凭据防串写+启用开关;
- 聊天响应防串扰;报表本地时区日期。

internal/operations/admin_http.go

@@ -43,8 +43,20 @@ func (h *AdminHTTPHandler) account(w http.ResponseWriter, r *http.Request) (iden
 	return account, true
 }
 
+func (h *AdminHTTPHandler) requirePermission(w http.ResponseWriter, r *http.Request, permission string) (identity.Account, bool) {
+	account, ok := h.account(w, r)
+	if !ok {
+		return account, false
+	}
+	if !identity.HasPermission(account, permission) {
+		apiresponse.Error(w, http.StatusForbidden, "缺少权限")
+		return identity.Account{}, false
+	}
+	return account, true
+}
+
 func (h *AdminHTTPHandler) systemInfo(w http.ResponseWriter, r *http.Request) {
-	if _, ok := h.account(w, r); !ok {
+	if _, ok := h.requirePermission(w, r, identity.PermissionSystemManage); !ok {
 		return
 	}
 	var providers, models, keys int64
@@ -56,7 +68,7 @@ func (h *AdminHTTPHandler) systemInfo(w http.ResponseWriter, r *http.Request) {
 }
 
 func (h *AdminHTTPHandler) overview(w http.ResponseWriter, r *http.Request) {
-	if _, ok := h.account(w, r); !ok {
+	if _, ok := h.requirePermission(w, r, identity.PermissionUsageRead); !ok {
 		return
 	}
 	var requests, failures, promptTokens, completionTokens, cost int64
@@ -80,7 +92,7 @@ func (h *AdminHTTPHandler) reloadSnapshots(w http.ResponseWriter, r *http.Reques
 	}
 	if h.reload != nil {
 		if err := h.reload(r.Context()); err != nil {
-			apiresponse.Error(w, http.StatusServiceUnavailable, "运行时快照刷新不完整: "+err.Error())
+			apiresponse.Error(w, http.StatusServiceUnavailable, "运行时快照刷新不完整，请查看服务端日志")
 			return
 		}
 	}
@@ -89,7 +101,7 @@ func (h *AdminHTTPHandler) reloadSnapshots(w http.ResponseWriter, r *http.Reques
 
 // tenantsOverview 以部门为租户维度,汇总各租户的账号/Key/用量与配额。
 func (h *AdminHTTPHandler) tenantsOverview(w http.ResponseWriter, r *http.Request) {
-	if _, ok := h.account(w, r); !ok {
+	if _, ok := h.requirePermission(w, r, identity.PermissionUsageRead); !ok {
 		return
 	}
 	rows, err := h.pool.Query(r.Context(), `SELECT d.id::text,d.name,d.max_api_keys,d.max_monthly_tokens,
@@ -151,7 +163,7 @@ func (h *AdminHTTPHandler) reportRange(r *http.Request) (from, to time.Time) {
 
 // reportTools 工具维度统计:调用数/成功率/平均延迟。
 func (h *AdminHTTPHandler) reportTools(w http.ResponseWriter, r *http.Request) {
-	if _, ok := h.account(w, r); !ok {
+	if _, ok := h.requirePermission(w, r, identity.PermissionUsageRead); !ok {
 		return
 	}
 	from, to := h.reportRange(r)
@@ -182,7 +194,7 @@ func (h *AdminHTTPHandler) reportTools(w http.ResponseWriter, r *http.Request) {
 
 // reportApprovals 审批维度统计:模型/资源/工具申请的发起与审批结果。
 func (h *AdminHTTPHandler) reportApprovals(w http.ResponseWriter, r *http.Request) {
-	if _, ok := h.account(w, r); !ok {
+	if _, ok := h.requirePermission(w, r, identity.PermissionUsageRead); !ok {
 		return
 	}
 	from, to := h.reportRange(r)
@@ -209,7 +221,7 @@ func (h *AdminHTTPHandler) reportApprovals(w http.ResponseWriter, r *http.Reques
 
 // reportSecurity 安全维度统计:登录成功/失败、锁定与来源 IP 分布。
 func (h *AdminHTTPHandler) reportSecurity(w http.ResponseWriter, r *http.Request) {
-	if _, ok := h.account(w, r); !ok {
+	if _, ok := h.requirePermission(w, r, identity.PermissionAuditRead); !ok {
 		return
 	}
 	from, to := h.reportRange(r)