对接

internal/data/system/surface_upgrade.go

@@ -206,6 +206,36 @@ func InheritAPIPolicy(db *gorm.DB, sourcePath, sourceMethod, targetPath, targetM
 	})
 }
 
+// GrantAuthorityAPIs idempotently grants an explicit API set to one authority.
+// Keeping this helper in data/system preserves ownership of the Casbin storage
+// shape while allowing module migrations to add narrowly scoped client routes.
+func GrantAuthorityAPIs(db *gorm.DB, authorityID uint, apis []platformmodule.API) error {
+	if db == nil || authorityID == 0 || len(apis) == 0 || !db.Migrator().HasTable(&casbinRulePO{}) {
+		return nil
+	}
+	return db.Transaction(func(tx *gorm.DB) error {
+		for _, api := range apis {
+			method := strings.ToUpper(strings.TrimSpace(api.Method))
+			path := strings.TrimSpace(api.Path)
+			if method == "" || path == "" {
+				continue
+			}
+			exists, err := policyExists(tx, authorityID, path, method)
+			if err != nil {
+				return err
+			}
+			if exists {
+				continue
+			}
+			rule := newPolicyRule(authorityID, path, method)
+			if err := tx.Create(&rule).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+}
+
 // GrantMenuAPIs makes a visible administration menu usable by granting only
 // its explicitly supplied API set to authorities that already own the menu.
 func GrantMenuAPIs(db *gorm.DB, menuName string, apis []platformmodule.API) error {