feat: 工单权限过滤+仪表盘优化+LDAP登录+审批流程+待处理工单

后端:
- ticket_statistics/list_tickets 按用户身份过滤(admin全部, dba/auditor审批相关, developer自己的)
- 新增 /dashboard/my-tickets 接口(按角色返回待处理工单)
- auth.py 本地优先+LDAP fallback 登录认证
- ldap_config.py LDAPS 证书验证修复
- instance_detail.py developer/auditor 权限修复

前端:
- Dashboard 仪表盘: 3核心大数字指标+公告+我的待处理工单
- 删除 ECharts 趋势图(无真实数据)
- TicketDetailPage 审批流程时间线展示
- TicketsPage 工单统计按用户过滤+关联列(我提交的/待我审批)
- types 新增 TicketApproval 等类型定义

backend/app/api/v1/endpoints/auth.py

@@ -4,38 +4,127 @@ from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.database import get_db
-from app.core.security import verify_password, create_access_token, get_current_user
+from app.core.security import verify_password, hash_password, create_access_token, get_current_user
 from app.models.user import User
 from app.schemas.auth import LoginRequest, TokenResponse, UserBrief
 
 router = APIRouter(prefix="/auth", tags=["认证"])
 
 
+async def _try_ldap_auth(username: str, password: str):
+    """尝试 LDAP 认证，成功返回用户信息 dict，失败返回 None"""
+    from app.core.database import async_session
+    from app.models.ldap_config import LdapConfig
+    from app.core.crypto import decrypt_password
+    import json
+
+    async with async_session() as db:
+        result = await db.execute(select(LdapConfig).limit(1))
+        ldap = result.scalar_one_or_none()
+        if not ldap or not ldap.ldap_host:
+            return None
+
+    try:
+        import ldap as _ldap
+        protocol = "ldaps" if ldap.use_ldaps else "ldap"
+        uri = f"{protocol}://{ldap.ldap_host}:{ldap.ldap_port}"
+        conn = _ldap.initialize(uri)
+        conn.protocol_version = 3
+        if ldap.use_ldaps:
+            conn.set_option(_ldap.OPT_X_TLS_REQUIRE_CERT, _ldap.OPT_X_TLS_NEVER)
+        conn.set_option(_ldap.OPT_NETWORK_TIMEOUT, 10)
+
+        # Admin bind to search user
+        conn.simple_bind_s(ldap.admin_dn, decrypt_password(ldap.admin_password))
+
+        # Search with uid filter
+        base_filter = ldap.search_filter or "(objectClass=inetOrgPerson)"
+        if "%s" in base_filter:
+            user_filter = base_filter.replace("%s", username)
+        else:
+            user_filter = f"(&{base_filter}(uid={username}))"
+
+        results = conn.search_s(
+            ldap.base_dn, _ldap.SCOPE_SUBTREE, user_filter,
+            ["uid", "cn", "mail", "telephoneNumber"],
+        )
+        if not results or not results[0][0]:
+            conn.unbind_s()
+            return None
+
+        user_dn, user_attrs = results[0]
+
+        # Verify password by binding as user
+        try:
+            conn.simple_bind_s(user_dn, password)
+        except Exception:
+            conn.unbind_s()
+            return None
+
+        # Extract info
+        def _attr(key):
+            vals = user_attrs.get(key, [])
+            return vals[0].decode("utf-8", errors="ignore") if vals else ""
+
+        user_mapping = json.loads(ldap.user_mapping) if ldap.user_mapping else {}
+        info = {
+            "username": _attr(user_mapping.get("username", "uid")) or username,
+            "display_name": _attr(user_mapping.get("display_name", "cn")) or username,
+            "email": _attr(user_mapping.get("email", "mail")) or None,
+        }
+        conn.unbind_s()
+        return info
+    except Exception:
+        return None
+
+
 @router.post("/login", response_model=TokenResponse)
 async def login(req: LoginRequest, request: Request, db: AsyncSession = Depends(get_db)):
     result = await db.execute(select(User).where(User.username == req.username))
     user = result.scalar_one_or_none()
 
-    if not user or not verify_password(req.password, user.hashed_password):
-        # 记录登录失败
-        from app.services.audit_logger import log_operation
-        await log_operation(db, action="login_failed", username=req.username,
-                            detail=f"登录失败: 用户名或密码错误", request=request)
-        await db.commit()
-        raise HTTPException(status_code=401, detail="用户名或密码错误")
+    auth_source = "local"
+
+    if user:
+        # 本地用户存在，用本地密码验证
+        if not verify_password(req.password, user.hashed_password):
+            # 本地密码不对，记录失败
+            from app.services.audit_logger import log_operation
+            await log_operation(db, action="login_failed", username=req.username,
+                                detail="登录失败: 用户名或密码错误", request=request)
+            await db.commit()
+            raise HTTPException(status_code=401, detail="用户名或密码错误")
+    else:
+        # 本地没有该用户，尝试 LDAP 认证
+        ldap_info = await _try_ldap_auth(req.username, req.password)
+        if not ldap_info:
+            from app.services.audit_logger import log_operation
+            await log_operation(db, action="login_failed", username=req.username,
+                                detail="登录失败: 本地和LDAP均未通过", request=request)
+            await db.commit()
+            raise HTTPException(status_code=401, detail="用户名或密码错误")
+
+        # LDAP 认证成功，自动创建本地用户
+        user = User(
+            username=ldap_info["username"],
+            display_name=ldap_info["display_name"],
+            email=ldap_info.get("email"),
+            hashed_password=hash_password(req.password),
+            role="developer",
+            is_active=True,
+        )
+        db.add(user)
+        await db.flush()
+        auth_source = "ldap"
 
     if not user.is_active:
         raise HTTPException(status_code=403, detail="用户已禁用")
 
-    if user.role == "guest":
-        raise HTTPException(status_code=403, detail="访客账户已禁用，请联系管理员")
-
     user.last_login = datetime.now(timezone.utc)
 
-    # 记录登录成功
     from app.services.audit_logger import log_operation
     await log_operation(db, action="login", user_id=user.id, username=user.username,
-                        detail=f"登录成功", request=request)
+                        detail=f"登录成功 ({auth_source})", request=request)
     await db.commit()
 
     token = create_access_token(data={"sub": str(user.id), "role": user.role})

backend/app/api/v1/endpoints/dashboard.py

@@ -131,3 +131,94 @@ async def get_trend(
         items.append(TrendPoint(date=label, **d))
 
     return TrendData(items=items)
+
+
+@router.get("/my-tickets")
+async def my_pending_tickets(
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
+    """返回当前用户关联的待处理工单:
+    - admin: 所有 pending/reviewing/executing
+    - dba: 自己需要审批的 + 自己提交的
+    - developer/auditor: 自己提交的
+    """
+    from app.models.workflow import TicketApproval, WorkflowStep
+    from sqlalchemy import or_
+    import json as _json
+
+    user_id = current_user.id
+    role = current_user.role
+
+    if role == "admin":
+        # admin 看所有待处理
+        rows = (await db.execute(
+            select(Ticket).where(
+                Ticket.status.in_(["pending", "reviewing", "executing"])
+            ).order_by(Ticket.create_time.desc()).limit(10)
+        )).scalars().all()
+    else:
+        # 非admin: 找"和我有关"的工单
+        # 1) 我提交的
+        my_submitted = set((await db.execute(
+            select(Ticket.id).where(
+                Ticket.status.in_(["pending", "reviewing", "executing"]),
+                Ticket.applicant_id == user_id,
+            )
+        )).scalars().all())
+
+        # 2) ticket_approvals 中 action=pending 且 approver_id = me
+        my_approvals = set((await db.execute(
+            select(TicketApproval.ticket_id).where(
+                TicketApproval.action == "pending",
+                TicketApproval.approver_id == user_id,
+            )
+        )).scalars().all())
+
+        # 3) 通过角色匹配: approver_role == my role
+        my_role_approvals = set((await db.execute(
+            select(TicketApproval.ticket_id).where(
+                TicketApproval.action == "pending",
+                TicketApproval.approver_role == role,
+            )
+        )).scalars().all())
+
+        all_ids = my_submitted | my_approvals | my_role_approvals
+        if not all_ids:
+            return []
+        rows = (await db.execute(
+            select(Ticket).where(Ticket.id.in_(all_ids)).order_by(Ticket.create_time.desc()).limit(10)
+        )).scalars().all()
+
+    # 用户名映射
+    all_users = (await db.execute(select(User))).scalars().all()
+    user_map = {u.id: u.username for u in all_users}
+
+    result = []
+    for t in rows:
+        pending_approvals = (await db.execute(
+            select(TicketApproval).where(
+                TicketApproval.ticket_id == t.id,
+                TicketApproval.action == "pending",
+            )
+        )).scalars().all()
+
+        pending_info = []
+        for pa in pending_approvals:
+            approver_name = user_map.get(pa.approver_id, "")
+            label = pa.step_name or ""
+            if approver_name:
+                pending_info.append(f"{label}: {approver_name}" if label else approver_name)
+
+        is_mine = t.applicant_id == user_id
+        result.append({
+            "id": t.id,
+            "title": t.title or "",
+            "status": t.status,
+            "db_type": t.db_type or "",
+            "applicant": user_map.get(t.applicant_id, ""),
+            "create_time": t.create_time.strftime("%m-%d %H:%M") if t.create_time else "",
+            "pending_info": ", ".join(filter(None, pending_info)),
+            "relation": "我提交的" if is_mine else "待我审批",
+        })
+    return result

backend/app/api/v1/endpoints/instance_detail.py

@@ -68,7 +68,7 @@ async def _mysql_execute(instance: Instance, sql: str, database: Optional[str] =
 async def list_databases(
     instance_id: int,
     db: AsyncSession = Depends(get_db),
-    current_user: User = Depends(require_role("admin", "dba")),
+    current_user: User = Depends(require_role("admin", "dba", "developer", "auditor")),
 ):
     instance = await _get_decrypted_instance(db, instance_id)
     # P0: 权限检查
@@ -93,7 +93,7 @@ async def list_tables(
     instance_id: int,
     database: str = Query(..., description="数据库名"),
     db: AsyncSession = Depends(get_db),
-    current_user: User = Depends(require_role("admin", "dba")),
+    current_user: User = Depends(require_role("admin", "dba", "developer", "auditor")),
 ):
     instance = await _get_decrypted_instance(db, instance_id)
     # P0: 权限检查
@@ -160,7 +160,7 @@ async def table_detail(
     database: str = Query(..., description="数据库名"),
     table: str = Query(..., description="表名"),
     db: AsyncSession = Depends(get_db),
-    current_user: User = Depends(require_role("admin", "dba")),
+    current_user: User = Depends(require_role("admin", "dba", "developer", "auditor")),
 ):
     instance = await _get_decrypted_instance(db, instance_id)
     # P0: 权限检查

backend/app/api/v1/endpoints/ldap_config.py

@@ -120,9 +120,13 @@ async def test_ldap_connection(
         conn.set_option(_ldap.OPT_NETWORK_TIMEOUT, 10)
         conn.simple_bind_s(ldap.admin_dn, decrypt_password(ldap.admin_password))
 
-        # Search user
-        search_filter = ldap.search_filter or "(uid=%s)"
-        user_filter = search_filter.replace("%s", data.test_user)
+        # Search user — always filter by uid to avoid matching wrong user
+        base_filter = ldap.search_filter or "(objectClass=inetOrgPerson)"
+        if "%s" in base_filter:
+            user_filter = base_filter.replace("%s", data.test_user)
+        else:
+            # search_filter has no placeholder, append uid condition
+            user_filter = f"(&{base_filter}(uid={data.test_user}))"
         results = conn.search_s(
             ldap.base_dn,
             _ldap.SCOPE_SUBTREE,

backend/app/api/v1/endpoints/ticket.py

@@ -299,24 +299,60 @@ async def _enrich_ticket(ticket: Ticket, db: AsyncSession) -> Dict[str, Any]:
 
     # Resolve current approver (审批/执行阶段的当前待审核人)
     data["current_approver_name"] = None
-    if ticket.status in ("reviewing", "approved", "executing"):
-        pending_approval = await db.execute(
+    data["pending_steps"] = []
+    if ticket.status in ("pending", "reviewing", "approved", "executing"):
+        pending_result = await db.execute(
             select(TicketApproval)
             .where(
                 TicketApproval.ticket_id == ticket.id,
                 TicketApproval.action == "pending",
             )
             .order_by(TicketApproval.step_number)
-            .limit(1)
         )
-        pending = pending_approval.scalar_one_or_none()
-        if pending:
-            if pending.approver_id:
-                r = await db.execute(select(User).where(User.id == pending.approver_id))
-                approver_user = r.scalar_one_or_none()
-                data["current_approver_name"] = approver_user.display_name if approver_user else None
-            elif pending.approver_role:
-                data["current_approver_name"] = pending.approver_role
+        pending_list = pending_result.scalars().all()
+
+        pending_names_all = []
+        for pa in pending_list:
+            step_info = {
+                "step_number": pa.step_number,
+                "step_name": pa.step_name,
+                "step_type": pa.step_type,
+                "approver_names": [],
+            }
+            # Try ticket_approval.approver_id first
+            if pa.approver_id:
+                r = await db.execute(select(User).where(User.id == pa.approver_id))
+                u = r.scalar_one_or_none()
+                if u:
+                    step_info["approver_names"].append(u.display_name or u.username)
+            # Fallback: resolve from workflow_steps.approver_ids
+            if not step_info["approver_names"] and ticket.workflow_id:
+                ws_result = await db.execute(
+                    select(WorkflowStep).where(
+                        WorkflowStep.workflow_id == ticket.workflow_id,
+                        WorkflowStep.step_number == pa.step_number,
+                    )
+                )
+                ws = ws_result.scalar_one_or_none()
+                if ws and ws.approver_ids:
+                    try:
+                        import json as _json
+                        ids = _json.loads(ws.approver_ids) if isinstance(ws.approver_ids, str) else ws.approver_ids
+                        for uid in (ids or []):
+                            r = await db.execute(select(User).where(User.id == uid))
+                            u = r.scalar_one_or_none()
+                            if u:
+                                step_info["approver_names"].append(u.display_name or u.username)
+                    except (json.JSONDecodeError, TypeError):
+                        pass
+
+            if step_info["approver_names"]:
+                pending_names_all.extend(step_info["approver_names"])
+            data["pending_steps"].append(step_info)
+
+        # Backward compat: single string
+        if pending_names_all:
+            data["current_approver_name"] = ", ".join(dict.fromkeys(pending_names_all))
 
     return data
 
@@ -411,16 +447,37 @@ async def list_tickets(
     db: AsyncSession = Depends(get_db),
     current_user: User = Depends(get_current_user),
 ):
-    """获取工单列表。
-
-    - admin/dba 可查看所有工单
-    - developer 只能查看自己的工单
-    """
+    """获取工单列表（按用户身份过滤）。"""
     stmt = select(Ticket)
 
-    # 权限过滤: developer 只能看到自己的工单
-    if current_user.role == "developer":
+    # 权限过滤
+    if current_user.role == "admin":
+        pass  # admin 看全部
+    elif current_user.role == "developer":
         stmt = stmt.where(Ticket.applicant_id == current_user.id)
+    else:
+        # dba/auditor: 自己提交的 + 自己需要审批的
+        from app.models.workflow import TicketApproval as _TA
+        _my_sub = set((await db.execute(
+            select(Ticket.id).where(Ticket.applicant_id == current_user.id)
+        )).scalars().all())
+        _my_appr = set((await db.execute(
+            select(_TA.ticket_id).where(
+                _TA.action == "pending",
+                _TA.approver_id == current_user.id,
+            )
+        )).scalars().all())
+        _my_role = set((await db.execute(
+            select(_TA.ticket_id).where(
+                _TA.action == "pending",
+                _TA.approver_role == current_user.role,
+            )
+        )).scalars().all())
+        _all_ids = _my_sub | _my_appr | _my_role
+        if _all_ids:
+            stmt = stmt.where(Ticket.id.in_(_all_ids))
+        else:
+            stmt = stmt.where(Ticket.applicant_id == current_user.id)
 
     # 状态过滤
     if status:
@@ -678,8 +735,38 @@ async def ticket_statistics(
     db: AsyncSession = Depends(get_db),
     current_user: User = Depends(get_current_user),
 ):
-    """获取工单统计信息。"""
-    stmt = select(Ticket.status, func.count(Ticket.id)).group_by(Ticket.status)
+    """获取工单统计信息（按用户身份过滤）。"""
+    # 构建用户可见工单的基础查询
+    base_stmt = select(Ticket)
+    if current_user.role == "developer":
+        # developer 只看自己提交的
+        base_stmt = base_stmt.where(Ticket.applicant_id == current_user.id)
+    elif current_user.role not in ("admin",):
+        # dba/auditor: 看自己提交的 + 自己需要审批的
+        from app.models.workflow import TicketApproval
+        my_approvals = set((await db.execute(
+            select(TicketApproval.ticket_id).where(
+                TicketApproval.action == "pending",
+                TicketApproval.approver_id == current_user.id,
+            )
+        )).scalars().all())
+        my_role_approvals = set((await db.execute(
+            select(TicketApproval.ticket_id).where(
+                TicketApproval.action == "pending",
+                TicketApproval.approver_role == current_user.role,
+            )
+        )).scalars().all())
+        my_submitted = set((await db.execute(
+            select(Ticket.id).where(Ticket.applicant_id == current_user.id)
+        )).scalars().all())
+        all_ids = my_submitted | my_approvals | my_role_approvals
+        if all_ids:
+            base_stmt = base_stmt.where(Ticket.id.in_(all_ids))
+        else:
+            base_stmt = base_stmt.where(Ticket.applicant_id == current_user.id)
+
+    sub = base_stmt.subquery()
+    stmt = select(sub.c.status, func.count(sub.c.id)).group_by(sub.c.status)
     result = await db.execute(stmt)
     stats = {row[0]: row[1] for row in result.all()}
 
@@ -773,20 +860,31 @@ async def get_ticket_approvals(
     )
     approvals = approvals_result.scalars().all()
 
-    return [
-        {
+    # Enrich with approver display names
+    result = []
+    for a in approvals:
+        approver_name = None
+        if a.approver_id:
+            u = await db.execute(select(User).where(User.id == a.approver_id))
+            approver_name = u.scalar_one_or_none()
+            approver_name = approver_name.display_name if approver_name else None
+
+        result.append({
             "id": a.id,
             "step_number": a.step_number,
             "step_name": a.step_name,
+            "step_type": a.step_type,
             "approver_role": a.approver_role,
             "action": a.action,
             "approver_id": a.approver_id,
+            "approver_name": approver_name,
             "comment": a.comment,
             "created_at": a.created_at.isoformat() if a.created_at else None,
             "updated_at": a.updated_at.isoformat() if a.updated_at else None,
-        }
-        for a in approvals
-    ]
+            "completed_at": a.completed_at.isoformat() if a.completed_at else None,
+        })
+
+    return result
 
 
 @router.post("/{ticket_id}/review")