统一全局插件列表访问权限

backend/controllers/plugin.go

@@ -19,7 +19,7 @@ const (
 )
 
 func GetPluginList(ctx *context.Context, w http.ResponseWriter, req *http.Request) {
-	if !authenticatedPluginUser(ctx) || authorizeCapability(ctx, access.CapabilityPluginRead, "", false) != nil {
+	if !authenticatedPluginUser(ctx) || authorizeCapability(ctx, access.CapabilityPluginReadGlobal, "", false) != nil {
 		response.NewErrorResponse(response.NoAccessPrivileges, "\u65e0\u6743\u8bbf\u95ee", "").FPrint(w)
 		return
 	}

backend/controllers/plugin_test.go

@@ -115,8 +115,8 @@ func TestPluginConfigurationRejectsNonAdminAccess(t *testing.T) {
 
 	userListRecorder := httptest.NewRecorder()
 	GetPluginList(&context.Context{UserID: 2, Role: access.RoleUser}, userListRecorder, httptest.NewRequest(http.MethodGet, "/api/plugin/list", nil))
-	if !strings.Contains(userListRecorder.Body.String(), "PluginTest") {
-		t.Fatalf("authenticated user cannot read plugin list: body=%s", userListRecorder.Body.String())
+	if !strings.Contains(userListRecorder.Body.String(), "无权访问") {
+		t.Fatalf("ordinary user can read global plugin list: body=%s", userListRecorder.Body.String())
 	}
 
 	pageRecorder := httptest.NewRecorder()

backend/services/access/access_test.go

@@ -109,7 +109,7 @@ func TestManagementEndpointCatalog(t *testing.T) {
 		}
 	}
 	endpoint, ok := LookupEndpoint("POST", "/api/plugin/settings/example")
-	if !ok || endpoint.Capability != CapabilityPluginWriteOwn {
+	if !ok || endpoint.Capability != CapabilityPluginReadGlobal {
 		t.Fatal("plugin settings endpoint was not matched")
 	}
 	endpoint, ok = LookupEndpoint("GET", "/api/v1/logs")

test/backend/role_scope_test.go

@@ -25,6 +25,8 @@ func TestAccountRoleScopeAndOwnProfile(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	engine.SetMaxOpenConns(1)
+	engine.SetMaxIdleConns(1)
 	previous := db.Instance
 	db.Instance = engine
 	t.Cleanup(func() { db.Instance = previous; _ = engine.Close() })
@@ -98,8 +100,11 @@ func TestAccountRoleScopeAndOwnProfile(t *testing.T) {
 	for _, ctx := range []*appcontext.Context{admin, ordinary} {
 		ctx.IsAdmin = true
 		got := call(ctx, GetPluginList, `{}`)
-		if got.ErrorNo != 0 {
-			t.Fatal("已登录角色无法读取可用插件列表")
+		if ctx == ordinary && got.ErrorNo != response.NoAccessPrivileges {
+			t.Fatal("旧管理员标志绕过插件列表授权")
+		}
+		if ctx == admin && got.ErrorNo != 0 {
+			t.Fatal("管理员角色无法读取插件列表")
 		}
 		pageRecorder := httptest.NewRecorder()
 		SettingsHtml(ctx, pageRecorder, httptest.NewRequest(http.MethodGet, "/api/plugin/settings/missing/index.html", nil))
@@ -119,13 +124,13 @@ func TestAccountRoleScopeAndOwnProfile(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	runtime := logstore.Start(store)
-	defer runtime.Stop()
 	for _, user := range users {
 		if err := store.Write(context.Background(), logstore.Entry{Kind: "operation", ActorID: itoa(user.ID), ActorRole: string(user.EffectiveRole()), CreatedAt: time.Now(), Action: "权限验证", Result: "success", Payload: []byte(`{}`)}); err != nil {
 			t.Fatal(err)
 		}
 	}
+	runtime := logstore.Start(store)
+	defer runtime.Stop()
 	for _, item := range []struct {
 		ctx   *appcontext.Context
 		query string