更新

backend/models/db_migrate.py

@@ -196,6 +196,54 @@ def migrate_rules_table(conn) -> None:
         )
 
 
+def migrate_roles_table(conn) -> None:
+    """Ensure roles table exists (create_all usually handles this; keep as safety net)."""
+    try:
+        insp = inspect(conn)
+        if insp.has_table("roles"):
+            return
+    except Exception:
+        return
+    dialect = _dialect(conn)
+    if dialect == "postgresql":
+        conn.execute(
+            text(
+                """
+                CREATE TABLE roles (
+                    id SERIAL PRIMARY KEY,
+                    code VARCHAR(50) NOT NULL UNIQUE,
+                    label VARCHAR(100) NOT NULL,
+                    description VARCHAR(255),
+                    is_system BOOLEAN DEFAULT FALSE,
+                    is_admin BOOLEAN DEFAULT FALSE,
+                    permissions TEXT NOT NULL DEFAULT '[]',
+                    created_at TIMESTAMP,
+                    updated_at TIMESTAMP
+                )
+                """
+            )
+        )
+    else:
+        conn.execute(
+            text(
+                """
+                CREATE TABLE IF NOT EXISTS roles (
+                    id INTEGER PRIMARY KEY AUTOINCREMENT,
+                    code VARCHAR(50) NOT NULL UNIQUE,
+                    label VARCHAR(100) NOT NULL,
+                    description VARCHAR(255),
+                    is_system BOOLEAN DEFAULT 0,
+                    is_admin BOOLEAN DEFAULT 0,
+                    permissions TEXT NOT NULL DEFAULT '[]',
+                    created_at DATETIME,
+                    updated_at DATETIME
+                )
+                """
+            )
+        )
+    add_index_if_missing(conn, "roles", "ix_roles_code", ("code",))
+
+
 def migrate_users_table(conn) -> None:
     add_column_if_missing(
         conn,

backend/models/models.py

@@ -5,6 +5,28 @@ from .database import Base
 from utils.log_limits import bound_error_log_content, bound_message_log_content
 
 
+class Role(Base):
+    """Assignable role with a fixed permission-code list.
+
+    ``users.role`` stores ``Role.code``.  Built-in roles are seeded on startup;
+    custom roles are owned by admins via the users.manage permission.
+    """
+
+    __tablename__ = "roles"
+
+    id = Column(Integer, primary_key=True, index=True)
+    code = Column(String(50), unique=True, index=True, nullable=False)
+    label = Column(String(100), nullable=False)
+    description = Column(String(255), nullable=True)
+    is_system = Column(Boolean, default=False)
+    # Global data scope + unlimited account quota.  Only the built-in admin
+    # role may be true; custom roles are always own-scoped.
+    is_admin = Column(Boolean, default=False)
+    permissions = Column(Text, nullable=False, default="[]")  # JSON string list
+    created_at = Column(DateTime, default=datetime.utcnow)
+    updated_at = Column(DateTime, default=datetime.utcnow, onupdate=datetime.utcnow)
+
+
 class User(Base):
     __tablename__ = "users"
 
@@ -13,7 +35,7 @@ class User(Base):
     email = Column(String(255), unique=True, index=True, nullable=True)
     password_hash = Column(String(255), nullable=False)
     display_name = Column(String(100), nullable=True)
-    role = Column(String(20), default="operator", index=True)  # admin, operator, viewer
+    role = Column(String(50), default="operator", index=True)  # roles.code
     is_active = Column(Boolean, default=True)
     email_verified = Column(Boolean, default=False)
     email_verified_at = Column(DateTime, nullable=True)