From 04850b942cc6c91a5af1420b9d6c1233eecfe934 Mon Sep 17 00:00:00 2001 From: oliver Date: Sun, 20 Sep 2026 15:14:08 +0800 Subject: [PATCH] Expose biz-monitor:read on API key scope UI and include it in create defaults. Co-authored-by: Cursor --- web/src/i18n/en.ts | 3 ++- web/src/i18n/zh.ts | 3 ++- web/src/pages/ApiTokensPage.tsx | 10 +++++++++- 3 files changed, 13 insertions(+), 3 deletions(-) diff --git a/web/src/i18n/en.ts b/web/src/i18n/en.ts index dc785ac..b967fed 100644 --- a/web/src/i18n/en.ts +++ b/web/src/i18n/en.ts @@ -1313,7 +1313,7 @@ const en = { colIp: "IP", apiKeysTitle: "API Key management", apiKeysHelp: - "The web UI uses login sessions, not API keys — keys are for MCP/scripts. Defaults on create: alarms:read + ne:read + ne:write + ne:exec; refine later with Edit scopes (takes effect immediately, no need to regenerate). Secret is shown once. Admins may issue for other users; scopes cannot exceed the owner's. Unused scopes are reserved for future MCP tools. System-wide cap: {{max}} non-revoked keys (revoke to free a slot).", + "The web UI uses login sessions, not API keys — keys are for MCP/scripts and netxops. Defaults on create: alarms:read + ne:read + ne:write + ne:exec + biz-monitor:read; refine later with Edit scopes (takes effect immediately, no need to regenerate). Secret is shown once. Admins may issue for other users; scopes cannot exceed the owner's. Unused scopes are reserved. System-wide cap: {{max}} non-revoked keys (revoke to free a slot).", tokenQuota: "Active {{active}} / {{max}}", tokenLimitReached: "API key limit reached ({{max}}). Revoke unused keys first.", tokenName: "Name", @@ -1350,6 +1350,7 @@ const en = { scopeNeRead: "ne:read — NE / topology read (MCP)", scopeNeWrite: "ne:write — NE / topology write / draw (MCP)", scopeNeExec: "ne:exec — Managed NE CLI (netx MCP)", + scopeBizMonitorRead: "biz-monitor:read — Biz monitor / cutover read (netxops)", scopeSql: "sql:query — UME SQL (netx MCP)", scopeWebcrt: "webcrt:session — WebCRT (reserved MCP)", scopeAdminUsers: "admin:users — User admin (reserved MCP)", diff --git a/web/src/i18n/zh.ts b/web/src/i18n/zh.ts index b339929..5e76664 100644 --- a/web/src/i18n/zh.ts +++ b/web/src/i18n/zh.ts @@ -1303,7 +1303,7 @@ const zh = { colIp: "IP", apiKeysTitle: "API Key 管理", apiKeysHelp: - "网页登录不用 API Key，Key 给 MCP/脚本用。生成时默认 alarms:read + ne:read + ne:write + ne:exec，之后用「改权限」增减（保存即生效，不必重生明文）。明文仅创建时显示一次。管理员可代其他用户签发，权限不能超过所属用户已有能力；未接 MCP 的项为预留。全站未吊销 Key 上限 {{max}} 把（吊销后可再建）。", + "网页登录不用 API Key，Key 给 MCP/脚本与 netxops 用。生成时默认 alarms:read + ne:read + ne:write + ne:exec + biz-monitor:read，之后用「改权限」增减（保存即生效，不必重生明文）。明文仅创建时显示一次。管理员可代其他用户签发，权限不能超过所属用户已有能力；未接的项为预留。全站未吊销 Key 上限 {{max}} 把（吊销后可再建）。", tokenQuota: "未吊销 {{active}} / {{max}}", tokenLimitReached: "已达 API Key 上限（{{max}}），请先吊销不用的 Key", tokenName: "名称", @@ -1340,6 +1340,7 @@ const zh = { scopeNeRead: "ne:read — 网元/拓扑只读（MCP）", scopeNeWrite: "ne:write — 网元/拓扑写入、画图（MCP）", scopeNeExec: "ne:exec — 托管网元 CLI（netx MCP）", + scopeBizMonitorRead: "biz-monitor:read — 业务监控/割接只读（netxops）", scopeSql: "sql:query — UME SQL（netx MCP）", scopeWebcrt: "webcrt:session — WebCRT（预留 MCP）", scopeAdminUsers: "admin:users — 用户管理（预留 MCP）", diff --git a/web/src/pages/ApiTokensPage.tsx b/web/src/pages/ApiTokensPage.tsx index 20be6e9..24159b7 100644 --- a/web/src/pages/ApiTokensPage.tsx +++ b/web/src/pages/ApiTokensPage.tsx @@ -36,6 +36,7 @@ const ALL_SCOPE_KEYS = [ "ne:read", "ne:write", "ne:exec", + "biz-monitor:read", "sql:query", "webcrt:session", "admin:users", @@ -43,13 +44,20 @@ const ALL_SCOPE_KEYS = [ ] as const; /** Applied on create; refine later via「改权限」. */ -const CREATE_DEFAULT_SCOPES = ["alarms:read", "ne:read", "ne:exec", "ne:write"] as const; +const CREATE_DEFAULT_SCOPES = [ + "alarms:read", + "ne:read", + "ne:exec", + "ne:write", + "biz-monitor:read", +] as const; const SCOPE_LABEL_KEYS: Record<(typeof ALL_SCOPE_KEYS)[number], string> = { "alarms:read": "auth.scopeAlarmsRead", "ne:read": "auth.scopeNeRead", "ne:write": "auth.scopeNeWrite", "ne:exec": "auth.scopeNeExec", + "biz-monitor:read": "auth.scopeBizMonitorRead", "sql:query": "auth.scopeSql", "webcrt:session": "auth.scopeWebcrt", "admin:users": "auth.scopeAdminUsers",