sync: 同步 sql-platform-pro 最新代码 — 权限体系安全修复 v0.8.1

- P0: 实例访问控制全线接入权限组 (829测试)
- P1: permissions字段激活 + 操作级权限检查 (843测试)
- 前端: 删除数据权限页面, 权限组合并为唯一入口
- 新增: CodeMirror编辑器 + 查询模板 + 慢查询分析
- 新增: MongoDB管理页面 + Dashboard增强
- 修复: Pydantic V2迁移 + 前端TS错误修复

backend/app/api/v1/endpoints/instance.py

@@ -7,8 +7,10 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.database import get_db
 from app.core.security import get_current_user, require_role
+from app.core.permissions import check_instance_access, get_user_accessible_group_ids
 from app.models.user import User
 from app.models.instance import Instance
+from app.models.instance_group import user_groups
 from app.schemas.instance import InstanceCreate, InstanceUpdate, InstanceResponse, ConnectionTestResult
 from app.services.instance_service import InstanceService
 from app.core.crypto import encrypt_password, decrypt_password
@@ -52,6 +54,21 @@ async def list_instances(
         stmt = stmt.where(Instance.db_type == db_type)
     if env:
         stmt = stmt.where(Instance.env == env)
+    
+    # P0: 权限组过滤 — 非 admin 只能看到自己权限组内的 + 公开实例
+    if current_user.role != "admin":
+        result = await db.execute(
+            select(user_groups.c.group_id).where(user_groups.c.user_id == current_user.id)
+        )
+        user_group_ids = [row[0] for row in result.all()]
+        if user_group_ids:
+            stmt = stmt.where(
+                (Instance.group_id.in_(user_group_ids)) | (Instance.group_id.is_(None))
+            )
+        else:
+            # 没有任何权限组，只能看公开实例
+            stmt = stmt.where(Instance.group_id.is_(None))
+    
     result = await db.execute(stmt)
     instances = result.scalars().all()
     return [_serialize_json_fields(i) for i in instances]
@@ -114,6 +131,8 @@ async def get_instance(
     instance = result.scalar_one_or_none()
     if not instance:
         raise HTTPException(status_code=404, detail="数据源不存在")
+    # P0: 检查访问权限
+    await check_instance_access(current_user, instance, db)
     return _serialize_json_fields(instance)
 
 
@@ -194,6 +213,9 @@ async def list_databases(
     if not instance:
         raise HTTPException(status_code=404, detail="数据源不存在")
 
+    # P0: 检查访问权限
+    await check_instance_access(current_user, instance, db)
+
     return await InstanceService.list_databases(instance)
 
 
@@ -209,4 +231,7 @@ async def list_tables(
     if not instance:
         raise HTTPException(status_code=404, detail="数据源不存在")
 
+    # P0: 检查访问权限
+    await check_instance_access(current_user, instance, db)
+
     return await InstanceService.list_tables(instance, database)