feat: sync deployed v1.0.0-rc.38-custom.42

Sync production source including routing, billing, Astra detection and public uptime. Update custom build instructions and license packaging.

service/authz/adapter.go

@@ -1,8 +1,9 @@
 package authz
 
 import (
-	"strings"
+	"fmt"
 
+	"github.com/QuantumNous/new-api/common"
 	"github.com/QuantumNous/new-api/model"
 	casbinmodel "github.com/casbin/casbin/v2/model"
 	"github.com/casbin/casbin/v2/persist"
@@ -24,7 +25,28 @@ func (a *gormAdapter) LoadPolicy(m casbinmodel.Model) error {
 		return err
 	}
 	for _, rule := range rules {
-		if err := persist.LoadPolicyLine(ruleToLine(rule), m); err != nil {
+		if rule.Ptype != "p" {
+			// This model has no role-inheritance or other policy sections.
+			continue
+		}
+		if rule.V0 == "" || rule.V1 == "" || rule.V2 == "" {
+			return fmt.Errorf("authorization policy %d is missing a subject, resource or action", rule.Id)
+		}
+		effect := rule.V3
+		if effect == "" {
+			effect = EffectAllow
+		}
+		if effect != EffectAllow && effect != EffectDeny {
+			return fmt.Errorf("authorization policy %d has an invalid effect", rule.Id)
+		}
+		if rule.V5 != "" || (rule.V4 != "" && rule.V4 != "all") {
+			// The current model cannot enforce legacy own/other scopes. Keep
+			// the stored rule for review and deny this permission in memory.
+			// Skipping a per-user rule would expose the admin role baseline.
+			effect = EffectDeny
+			common.SysLog(fmt.Sprintf("authorization policy %d has an unsupported legacy scope; loaded as deny; review the stored policy before granting access", rule.Id))
+		}
+		if err := persist.LoadPolicyArray([]string{rule.Ptype, rule.V0, rule.V1, rule.V2, effect}, m); err != nil {
 			return err
 		}
 	}
@@ -104,18 +126,3 @@ func newRule(ptype string, policy []string) model.CasbinRule {
 	}
 	return rule
 }
-
-func ruleToLine(rule model.CasbinRule) string {
-	parts := []string{rule.Ptype}
-	values := []string{rule.V0, rule.V1, rule.V2, rule.V3, rule.V4, rule.V5}
-	if rule.Ptype == "p" && rule.V0 != "" && rule.V1 != "" && rule.V2 != "" && rule.V3 == "" {
-		values[3] = EffectAllow
-	}
-	for _, value := range values {
-		if value == "" {
-			continue
-		}
-		parts = append(parts, value)
-	}
-	return strings.Join(parts, ", ")
-}