From cc47447ddd58979f67b1e83b58837f3fd1548234 Mon Sep 17 00:00:00 2001
From: smail <likb_blue@163.com>
Date: Thu, 10 Sep 2026 12:02:52 +0800
Subject: [PATCH] =?UTF-8?q?=E7=BB=9F=E4=B8=80=E5=85=A8=E5=B1=80=E6=8F=92?=
 =?UTF-8?q?=E4=BB=B6=E5=88=97=E8=A1=A8=E8=AE=BF=E9=97=AE=E6=9D=83=E9=99=90?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/controllers/plugin.go          |  2 +-
 backend/controllers/plugin_test.go     |  4 ++--
 backend/services/access/access_test.go |  2 +-
 test/backend/role_scope_test.go        | 13 +++++++++----
 4 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/backend/controllers/plugin.go b/backend/controllers/plugin.go
index 2b2e3b5..64452e8 100644
--- a/backend/controllers/plugin.go
+++ b/backend/controllers/plugin.go
@@ -19,7 +19,7 @@ const (
 )
 
 func GetPluginList(ctx *context.Context, w http.ResponseWriter, req *http.Request) {
-	if !authenticatedPluginUser(ctx) || authorizeCapability(ctx, access.CapabilityPluginRead, "", false) != nil {
+	if !authenticatedPluginUser(ctx) || authorizeCapability(ctx, access.CapabilityPluginReadGlobal, "", false) != nil {
 		response.NewErrorResponse(response.NoAccessPrivileges, "\u65e0\u6743\u8bbf\u95ee", "").FPrint(w)
 		return
 	}
diff --git a/backend/controllers/plugin_test.go b/backend/controllers/plugin_test.go
index 1736859..2839f7e 100644
--- a/backend/controllers/plugin_test.go
+++ b/backend/controllers/plugin_test.go
@@ -115,8 +115,8 @@ func TestPluginConfigurationRejectsNonAdminAccess(t *testing.T) {
 
 	userListRecorder := httptest.NewRecorder()
 	GetPluginList(&context.Context{UserID: 2, Role: access.RoleUser}, userListRecorder, httptest.NewRequest(http.MethodGet, "/api/plugin/list", nil))
-	if !strings.Contains(userListRecorder.Body.String(), "PluginTest") {
-		t.Fatalf("authenticated user cannot read plugin list: body=%s", userListRecorder.Body.String())
+	if !strings.Contains(userListRecorder.Body.String(), "无权访问") {
+		t.Fatalf("ordinary user can read global plugin list: body=%s", userListRecorder.Body.String())
 	}
 
 	pageRecorder := httptest.NewRecorder()
diff --git a/backend/services/access/access_test.go b/backend/services/access/access_test.go
index 1cb3d1b..43da2d8 100644
--- a/backend/services/access/access_test.go
+++ b/backend/services/access/access_test.go
@@ -109,7 +109,7 @@ func TestManagementEndpointCatalog(t *testing.T) {
 		}
 	}
 	endpoint, ok := LookupEndpoint("POST", "/api/plugin/settings/example")
-	if !ok || endpoint.Capability != CapabilityPluginWriteOwn {
+	if !ok || endpoint.Capability != CapabilityPluginReadGlobal {
 		t.Fatal("plugin settings endpoint was not matched")
 	}
 	endpoint, ok = LookupEndpoint("GET", "/api/v1/logs")
diff --git a/test/backend/role_scope_test.go b/test/backend/role_scope_test.go
index 77604bb..5fa9fd4 100644
--- a/test/backend/role_scope_test.go
+++ b/test/backend/role_scope_test.go
@@ -25,6 +25,8 @@ func TestAccountRoleScopeAndOwnProfile(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	engine.SetMaxOpenConns(1)
+	engine.SetMaxIdleConns(1)
 	previous := db.Instance
 	db.Instance = engine
 	t.Cleanup(func() { db.Instance = previous; _ = engine.Close() })
@@ -98,8 +100,11 @@ func TestAccountRoleScopeAndOwnProfile(t *testing.T) {
 	for _, ctx := range []*appcontext.Context{admin, ordinary} {
 		ctx.IsAdmin = true
 		got := call(ctx, GetPluginList, `{}`)
-		if got.ErrorNo != 0 {
-			t.Fatal("已登录角色无法读取可用插件列表")
+		if ctx == ordinary && got.ErrorNo != response.NoAccessPrivileges {
+			t.Fatal("旧管理员标志绕过插件列表授权")
+		}
+		if ctx == admin && got.ErrorNo != 0 {
+			t.Fatal("管理员角色无法读取插件列表")
 		}
 		pageRecorder := httptest.NewRecorder()
 		SettingsHtml(ctx, pageRecorder, httptest.NewRequest(http.MethodGet, "/api/plugin/settings/missing/index.html", nil))
@@ -119,13 +124,13 @@ func TestAccountRoleScopeAndOwnProfile(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	runtime := logstore.Start(store)
-	defer runtime.Stop()
 	for _, user := range users {
 		if err := store.Write(context.Background(), logstore.Entry{Kind: "operation", ActorID: itoa(user.ID), ActorRole: string(user.EffectiveRole()), CreatedAt: time.Now(), Action: "权限验证", Result: "success", Payload: []byte(`{}`)}); err != nil {
 			t.Fatal(err)
 		}
 	}
+	runtime := logstore.Start(store)
+	defer runtime.Stop()
 	for _, item := range []struct {
 		ctx   *appcontext.Context
 		query string