fix: 撤销工单支持approved状态 + DDL跳过EXPLAIN预检 + 审批菜单仅admin/dba + 审批状态流转修复 + 权限组实例绑定修复

backend/internal/handler/ticket.go

@@ -427,12 +427,13 @@ func ApproveTicket(c *gin.Context) {
 	if input.Action == "reject" {
 		newStatus = "rejected"
 	} else if input.Action == "approve" {
-		// Check if there are more pending approvals
-		var pendingCount int64
-		model.DB.Model(&model.TicketApproval{}).Where("ticket_id = ? AND action IS NULL", id).Count(&pendingCount)
-		if pendingCount > 0 {
+		// Check if there are more pending AUDIT approvals (exclude execute type)
+		var pendingAuditCount int64
+		model.DB.Model(&model.TicketApproval{}).Where("ticket_id = ? AND action IS NULL AND step_type != 'execute'", id).Count(&pendingAuditCount)
+		if pendingAuditCount > 0 {
 			newStatus = "reviewing"
 		}
+		// If all audit steps done → "approved" (ready for execution)
 	}
 	
 	ticket.Status = &newStatus
@@ -603,25 +604,36 @@ func ExecuteTicket(c *gin.Context) {
 			execTimeout := getSettingInt("executor_timeout", 300)
 			ctx, cancel := context.WithTimeout(context.Background(), time.Duration(execTimeout)*time.Second)
 			defer cancel()
-			// Dry-run: EXPLAIN pre-check
+			// Dry-run: EXPLAIN pre-check (skip DDL statements)
 			if getSetting("executor_dry_run", "true") == "true" {
+				ddlPrefixes := []string{"CREATE", "ALTER", "DROP", "TRUNCATE", "RENAME"}
 				statements := splitSQL(ticket.SQLContent)
 				for _, stmt := range statements {
 					stmt = strings.TrimSpace(stmt)
-					if stmt == "" || strings.HasPrefix(strings.ToUpper(stmt), "EXPLAIN") {
+					if stmt == "" {
+						continue
+					}
+					upperStmt := strings.ToUpper(stmt)
+					if strings.HasPrefix(upperStmt, "EXPLAIN") {
+						continue
+					}
+					// Skip DDL — EXPLAIN does not work on DDL statements
+					isDDL := false
+					for _, prefix := range ddlPrefixes {
+						if strings.HasPrefix(upperStmt, prefix) {
+							isDDL = true
+							break
+						}
+					}
+					if isDDL {
 						continue
 					}
-					var explainRows []string
 					rows, err := db.QueryContext(ctx, "EXPLAIN "+stmt)
 					if err != nil {
 						execErr = fmt.Sprintf("预检查失败(EXPLAIN): %v", err)
 						break
 					}
-					for rows.Next() {
-						rows.Close()
-						break
-					}
-					_ = explainRows
+					rows.Close()
 				}
 				if execErr != "" {
 					failStatus := "failed"
@@ -753,8 +765,8 @@ func CancelTicket(c *gin.Context) {
 		}
 	}
 	
-	if ticket.Status != nil && (*ticket.Status != "pending" && *ticket.Status != "reviewing") {
-		c.JSON(http.StatusBadRequest, gin.H{"detail": "Can only cancel pending or reviewing tickets"})
+	if ticket.Status != nil && (*ticket.Status != "pending" && *ticket.Status != "reviewing" && *ticket.Status != "approved") {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "只能撤销待审核、审核中或已通过（待执行）的工单"})
 		return
 	}