chore: 统一本地服务器与远程仓库源码

- 合并 main 与 master 历史并以服务器结构为基线
- 保留迁移、数据保留、AWS 账单与部署安全能力
- 建立 SDD 规格和 CI 验证闭环

backend/middleware/pipeline_access.go

@@ -3,6 +3,7 @@ package middleware
 import (
 	"net/http"
 	"regexp"
+	"strconv"
 
 	"ezops/model"
 
@@ -28,67 +29,75 @@ func PipelineAccess(db *gorm.DB) gin.HandlerFunc {
 			return
 		}
 
-		// 注入 context，后续 handlers 统一从这里读
-		c.Set("pipelineID", pipeline.ID)
-		c.Set("pipelineCode", code)
-
-		// 2) 管理员直接放行（跳过权限检查）
-		if isAdmin, _ := c.Get("isAdmin"); isAdmin == true {
+		if authorizePipelineAccess(c, db, &pipeline) {
 			c.Next()
-			return
 		}
-
-		username, _ := c.Get("username")
-		usernameStr, _ := username.(string)
-		if usernameStr == "" {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"code": 401, "message": "未认证"})
-			return
-		}
-
-		pipelineID := pipeline.ID
-
-		// 3) 检查是否直接是流水线成员
-		var directCount int64
-		db.Model(&model.DeployPipelineMember{}).
-			Where("pipeline_id = ? AND username = ?", pipelineID, usernameStr).
-			Count(&directCount)
-		if directCount > 0 {
-			c.Next()
-			return
-		}
-
-		// 4) 检查是否属于授权给该流水线的用户组
-		var groupCount int64
-		db.Table("deploy_pipeline_members").
-			Joins("JOIN deploy_user_group_members ON deploy_user_group_members.group_id = deploy_pipeline_members.group_id").
-			Where("deploy_pipeline_members.pipeline_id = ? AND deploy_user_group_members.username = ?", pipelineID, usernameStr).
-			Count(&groupCount)
-		if groupCount > 0 {
-			c.Next()
-			return
-		}
-
-		// 5) Jenkins-style Item Role — regex pattern matching on pipeline code
-		var itemRoles []model.ItemRole
-		db.Table("iam_item_roles").
-			Joins("JOIN iam_user_item_roles ON iam_user_item_roles.item_role_id = iam_item_roles.id").
-			Where("iam_item_roles.status = 1 AND iam_user_item_roles.user_id = ?",
-				func() uint { uid, _ := c.Get("userID"); return uid.(uint) }()).
-			Find(&itemRoles)
-		for _, ir := range itemRoles {
-			if pipelineMatchesItemRole(pipeline, ir.Pattern) {
-				c.Next()
-				return
-			}
-		}
-
-		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
-			"code":    403,
-			"message": "无权访问此流水线，请联系流水线 Owner 添加你为成员",
-		})
 	}
 }
 
+// PipelineRunAccess 通过运行记录反查流水线并校验访问权限，防止按 runId 越权读取日志或工作区。 // Logan.Li
+func PipelineRunAccess(db *gorm.DB) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		runID, err := strconv.ParseUint(c.Param("runId"), 10, 32)
+		if err != nil {
+			c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"code": 400, "message": "无效的运行记录 ID"})
+			return
+		}
+
+		var run model.PipelineRun
+		if err := db.Select("id", "pipeline_id").Take(&run, uint(runID)).Error; err != nil {
+			c.AbortWithStatusJSON(http.StatusNotFound, gin.H{"code": 404, "message": "流水线运行记录不存在"})
+			return
+		}
+		var pipeline model.Pipeline
+		if err := db.Take(&pipeline, run.PipelineID).Error; err != nil {
+			c.AbortWithStatusJSON(http.StatusNotFound, gin.H{"code": 404, "message": "关联流水线不存在"})
+			return
+		}
+		if authorizePipelineAccess(c, db, &pipeline) {
+			c.Next()
+		}
+	}
+}
+
+// authorizePipelineAccess 集中复用流水线成员、用户组与 Item Role 授权规则。 // Logan.Li
+func authorizePipelineAccess(c *gin.Context, db *gorm.DB, pipeline *model.Pipeline) bool {
+	c.Set("pipelineID", pipeline.ID)
+	c.Set("pipelineCode", pipeline.Code)
+	if isAdmin, _ := c.Get("isAdmin"); isAdmin == true {
+		return true
+	}
+	username, _ := c.Get("username")
+	usernameStr, _ := username.(string)
+	userID, _ := c.Get("userID")
+	userIDUint, ok := userID.(uint)
+	if usernameStr == "" || !ok {
+		c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"code": 401, "message": "未认证"})
+		return false
+	}
+
+	var directCount int64
+	db.Model(&model.DeployPipelineMember{}).Where("pipeline_id = ? AND username = ?", pipeline.ID, usernameStr).Count(&directCount)
+	if directCount > 0 {
+		return true
+	}
+	var groupCount int64
+	db.Table("deploy_pipeline_members").Joins("JOIN deploy_user_group_members ON deploy_user_group_members.group_id = deploy_pipeline_members.group_id").Where("deploy_pipeline_members.pipeline_id = ? AND deploy_user_group_members.username = ?", pipeline.ID, usernameStr).Count(&groupCount)
+	if groupCount > 0 {
+		return true
+	}
+
+	var itemRoles []model.ItemRole
+	db.Table("iam_item_roles").Joins("JOIN iam_user_item_roles ON iam_user_item_roles.item_role_id = iam_item_roles.id").Where("iam_item_roles.status = 1 AND iam_user_item_roles.user_id = ?", userIDUint).Find(&itemRoles)
+	for _, ir := range itemRoles {
+		if pipelineMatchesItemRole(*pipeline, ir.Pattern) {
+			return true
+		}
+	}
+	c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"code": 403, "message": "无权访问此流水线，请联系流水线 Owner 添加你为成员"})
+	return false
+}
+
 // GetAccessiblePipelineIDs 获取当前用户有权访问的流水线 ID 列表
 // 包括：直接成员 + 用户组 + Item Role (regex)
 func GetAccessiblePipelineIDs(db *gorm.DB, username string, userID uint) ([]uint, bool) {