sync: 同步 sql-platform-pro 最新代码 — 权限体系安全修复 v0.8.1

- P0: 实例访问控制全线接入权限组 (829测试)
- P1: permissions字段激活 + 操作级权限检查 (843测试)
- 前端: 删除数据权限页面, 权限组合并为唯一入口
- 新增: CodeMirror编辑器 + 查询模板 + 慢查询分析
- 新增: MongoDB管理页面 + Dashboard增强
- 修复: Pydantic V2迁移 + 前端TS错误修复

backend/app/api/v1/endpoints/instance_detail.py

@@ -8,6 +8,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.database import get_db
 from app.core.security import require_role
+from app.core.permissions import check_instance_access
 from app.models.user import User
 from app.models.instance import Instance
 from app.core.crypto import decrypt_password
@@ -70,6 +71,8 @@ async def list_databases(
     current_user: User = Depends(require_role("admin", "dba")),
 ):
     instance = await _get_decrypted_instance(db, instance_id)
+    # P0: 权限检查
+    await check_instance_access(current_user, instance, db)
     if instance.db_type != "mysql":
         raise HTTPException(status_code=400, detail="仅支持MySQL实例")
     try:
@@ -93,6 +96,8 @@ async def list_tables(
     current_user: User = Depends(require_role("admin", "dba")),
 ):
     instance = await _get_decrypted_instance(db, instance_id)
+    # P0: 权限检查
+    await check_instance_access(current_user, instance, db)
     if instance.db_type != "mysql":
         raise HTTPException(status_code=400, detail="仅支持MySQL实例")
     try:
@@ -126,6 +131,8 @@ async def table_detail(
     current_user: User = Depends(require_role("admin", "dba")),
 ):
     instance = await _get_decrypted_instance(db, instance_id)
+    # P0: 权限检查
+    await check_instance_access(current_user, instance, db)
     if instance.db_type != "mysql":
         raise HTTPException(status_code=400, detail="仅支持MySQL实例")
     try:
@@ -169,6 +176,8 @@ async def list_users(
     current_user: User = Depends(require_role("admin", "dba")),
 ):
     instance = await _get_decrypted_instance(db, instance_id)
+    # P0: 权限检查
+    await check_instance_access(current_user, instance, db)
     if instance.db_type != "mysql":
         raise HTTPException(status_code=400, detail="仅支持MySQL实例")
     try:
@@ -190,6 +199,8 @@ async def show_grants(
     current_user: User = Depends(require_role("admin", "dba")),
 ):
     instance = await _get_decrypted_instance(db, instance_id)
+    # P0: 权限检查
+    await check_instance_access(current_user, instance, db)
     if instance.db_type != "mysql":
         raise HTTPException(status_code=400, detail="仅支持MySQL实例")
     try:
@@ -216,6 +227,8 @@ async def slow_queries(
     current_user: User = Depends(require_role("admin", "dba")),
 ):
     instance = await _get_decrypted_instance(db, instance_id)
+    # P0: 权限检查
+    await check_instance_access(current_user, instance, db)
     if instance.db_type != "mysql":
         raise HTTPException(status_code=400, detail="仅支持MySQL实例")
     try:
@@ -249,6 +262,8 @@ async def show_processlist(
     current_user: User = Depends(require_role("admin", "dba")),
 ):
     instance = await _get_decrypted_instance(db, instance_id)
+    # P0: 权限检查
+    await check_instance_access(current_user, instance, db)
     if instance.db_type != "mysql":
         raise HTTPException(status_code=400, detail="仅支持MySQL实例")
     try:
@@ -268,6 +283,8 @@ async def kill_process(
     current_user: User = Depends(require_role("admin", "dba")),
 ):
     instance = await _get_decrypted_instance(db, instance_id)
+    # P0: 权限检查
+    await check_instance_access(current_user, instance, db)
     if instance.db_type != "mysql":
         raise HTTPException(status_code=400, detail="仅支持MySQL实例")
     try:
@@ -286,6 +303,8 @@ async def show_status(
     current_user: User = Depends(require_role("admin", "dba")),
 ):
     instance = await _get_decrypted_instance(db, instance_id)
+    # P0: 权限检查
+    await check_instance_access(current_user, instance, db)
     if instance.db_type != "mysql":
         raise HTTPException(status_code=400, detail="仅支持MySQL实例")
     try:
@@ -322,6 +341,8 @@ async def show_variables(
     current_user: User = Depends(require_role("admin", "dba")),
 ):
     instance = await _get_decrypted_instance(db, instance_id)
+    # P0: 权限检查
+    await check_instance_access(current_user, instance, db)
     if instance.db_type != "mysql":
         raise HTTPException(status_code=400, detail="仅支持MySQL实例")
     try: