M5-security.yaml
1.72 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
# M5 权限脱敏安全模型 (v2.1：新增 order_audit 权限，绑定 SCENE_AUDIT_ORDER)
# 区分模板编辑管理员权限、页面访问权限、敏感字段掩码渲染规则；前端渲染引擎自动读取执行。
securityModel:
globalConfig:
authMode: oauth2_jwt
auditEnable: true
principals:
- principalId: normal_user
desc: C端普通消费者
- principalId: backend_admin
desc: 后台运营管理员
functionPermissions:
- permId: customer_create
bindScene: SCENE_CREATE_CUSTOMER
allowPrincipals: [backend_admin]
- permId: order_create
bindScene: SCENE_CREATE_ORDER
allowPrincipals: [normal_user, backend_admin]
- permId: order_modify_addr
bindScene: SCENE_MODIFY_ORDER_ADDR
allowPrincipals: [normal_user, backend_admin]
- permId: order_cancel
bindScene: SCENE_CANCEL_ORDER
allowPrincipals: [normal_user, backend_admin]
- permId: order_audit
bindScene: SCENE_AUDIT_ORDER
allowPrincipals: [normal_user, backend_admin]
- permId: customer_modify
bindScene: SCENE_MODIFY_CUSTOMER
allowPrincipals: [backend_admin]
- permId: product_create
bindScene: SCENE_CREATE_PRODUCT
allowPrincipals: [backend_admin]
- permId: product_modify_price
bindScene: SCENE_MODIFY_PRODUCT_PRICE
allowPrincipals: [backend_admin]
- permId: employee_create
bindScene: SCENE_CREATE_EMPLOYEE
allowPrincipals: [backend_admin]
- permId: employee_modify
bindScene: SCENE_MODIFY_EMPLOYEE
allowPrincipals: [backend_admin]
maskRules:
contactPhone: "{first3}****{last4}"
receiverPhone: "{first3}****{last4}"
encryptRules:
storageEncrypt: [contactPhone, receiverPhone]