refactor: 权限组从一组一类型改为一组同时包含readonly+write实例

- 新增 instance_group_members 中间表关联权限组和实例
- InstanceGroup 模型移除旧的 instances relationship，改为通过中间表查询
- Instance 模型保留 group_id FK（兼容）但移除 group relationship
- Schema 新增 readonly_instance_ids / write_instance_ids 字段
- InstanceGroupResponse 改为 readonly_instance_count + write_instance_count
- InstanceGroupDetailResponse 返回 readonly_instances + write_instances
- InstanceAssignRequest 新增 access_type 参数
- API create/update 支持同步写入 instance_group_members
- role_permissions 服务更新为使用中间表查询
- 新增迁移 SQL 并应用到 sqlite3.db
- 测试全部通过 (20/20)

backend/app/services/role_permissions.py

@@ -21,7 +21,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.models.user import User
 from app.models.instance import Instance
-from app.models.instance_group import InstanceGroup, user_groups
+from app.models.instance_group import InstanceGroup, user_groups, instance_group_members
 
 logger = logging.getLogger(__name__)
 
@@ -132,7 +132,7 @@ async def get_accessible_instances(
 
     - admin/dba: 返回所有实例
     - auditor: readonly 返回所有，write 返回空
-    - developer: 返回其权限组关联的实例
+    - developer: 返回其权限组关联的实例（通过 instance_group_members）
     """
     role_config = _get_role_config(user.role)
     access_value = role_config.get(access_type)
@@ -144,27 +144,26 @@ async def get_accessible_instances(
     if access_value is None:
         return []
 
-    # "groups" — 查询权限组关联的实例
+    # "groups" — 查询权限组关联的实例 via instance_group_members
     group_ids = await _get_user_group_ids(db, user)
     if not group_ids:
         return []
 
-    # 只返回匹配 access_type 的权限组关联的实例
+    # Query instance_group_members for the matching access_type
     result = await db.execute(
-        select(InstanceGroup).where(InstanceGroup.id.in_(group_ids))
+        select(instance_group_members.c.instance_id)
+        .where(
+            instance_group_members.c.group_id.in_(group_ids),
+            instance_group_members.c.access_type == access_type,
+        )
     )
-    groups = result.scalars().all()
-    matched_instance_ids: set = set()
-    for g in groups:
-        if g.access_type == access_type:
-            for inst in (g.instances or []):
-                matched_instance_ids.add(inst.id)
+    instance_ids = list({row[0] for row in result.all()})
 
-    if not matched_instance_ids:
+    if not instance_ids:
         return []
 
     inst_result = await db.execute(
-        select(Instance).where(Instance.id.in_(matched_instance_ids))
+        select(Instance).where(Instance.id.in_(instance_ids))
     )
     return list(inst_result.scalars().all())
 
@@ -195,12 +194,26 @@ async def _get_user_groups_detail(db: AsyncSession, user: User) -> List[dict]:
 
     details = []
     for g in groups:
-        instance_ids = [inst.id for inst in (g.instances or [])]
+        # Get instance IDs by access_type from instance_group_members
+        ro_result = await db.execute(
+            select(instance_group_members.c.instance_id).where(
+                instance_group_members.c.group_id == g.id,
+                instance_group_members.c.access_type == "readonly",
+            )
+        )
+        wr_result = await db.execute(
+            select(instance_group_members.c.instance_id).where(
+                instance_group_members.c.group_id == g.id,
+                instance_group_members.c.access_type == "write",
+            )
+        )
+        ro_ids = [row[0] for row in ro_result.all()]
+        wr_ids = [row[0] for row in wr_result.all()]
         details.append({
             "group_id": g.id,
             "group_name": g.name,
-            "access_type": g.access_type,
-            "instance_ids": instance_ids,
+            "readonly_instance_ids": ro_ids,
+            "write_instance_ids": wr_ids,
             "allowed_databases": g.get_allowed_databases(),
         })
     return details
@@ -221,28 +234,44 @@ async def _check_group_access(
     if not instance:
         return False
 
+    # Public instance (no group_id) — readonly allowed
     if instance.group_id is None:
         return access_type == "readonly"
 
     group_ids = await _get_user_group_ids(db, user)
-    if instance.group_id not in group_ids:
+
+    # Check if any of the user's groups contain this instance with matching access_type
+    result = await db.execute(
+        select(instance_group_members).where(
+            instance_group_members.c.instance_id == instance_id,
+            instance_group_members.c.group_id.in_(group_ids),
+            instance_group_members.c.access_type == access_type,
+        )
+    )
+    member_row = result.first()
+    if not member_row:
+        # For readonly access, write access_type also grants readonly
+        if access_type == "readonly":
+            wr_result = await db.execute(
+                select(instance_group_members).where(
+                    instance_group_members.c.instance_id == instance_id,
+                    instance_group_members.c.group_id.in_(group_ids),
+                    instance_group_members.c.access_type == "write",
+                )
+            )
+            member_row = wr_result.first()
+
+    if not member_row:
         return False
 
+    # Check allowed_databases from the group
     group_result = await db.execute(
-        select(InstanceGroup).where(InstanceGroup.id == instance.group_id)
+        select(InstanceGroup).where(InstanceGroup.id == member_row.group_id)
     )
     group = group_result.scalar_one_or_none()
     if not group:
         return False
 
-    # readonly 权限组也可以被 write 请求使用（读+写包含只读）
-    if access_type == "write" and group.access_type == "readonly":
-        return False
-
-    # readonly 请求可以用 readonly 或 write 权限组
-    if access_type == "readonly" and group.access_type in ("readonly", "write"):
-        pass  # ok
-
     allowed_dbs = group.get_allowed_databases()
     if not allowed_dbs:
         return True