chore: 初始化仓库基线（AGENTS.md、git 规范、敏感文件排除）

server-go/internal/handler/permission.go

@@ -0,0 +1,64 @@
+package handler
+
+import (
+	"net/http"
+
+	"silk-server-go/internal/middleware"
+	"silk-server-go/internal/model"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+// RegisterPermissionRoutes 注册权限和角色查询路由（需要 user:manage 权限）
+func RegisterPermissionRoutes(rg *gin.RouterGroup, db *gorm.DB) {
+	perm := middleware.RequirePermission(db, "user:manage")
+	rg.GET("/permissions", perm, listPermissions(db))
+	rg.GET("/roles", perm, listRoles(db))
+}
+
+// listPermissions 权限列表
+func listPermissions(db *gorm.DB) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var perms []model.Permission
+		db.Order("code ASC").Find(&perms)
+		c.JSON(http.StatusOK, perms)
+	}
+}
+
+// listRoles 角色列表（含权限码）
+func listRoles(db *gorm.DB) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		type roleInfo struct {
+			Role        string   `json:"role"`
+			Name        string   `json:"name"`
+			Permissions []string `json:"permissions"`
+		}
+
+		// 查询角色-权限映射
+		var rows []struct {
+			Role string `gorm:"column:role"`
+			Code string `gorm:"column:code"`
+		}
+		db.Table("role_permissions").
+			Select("role_permissions.role AS role, permissions.code AS code").
+			Joins("JOIN permissions ON permissions.id = role_permissions.permission_id").
+			Order("role_permissions.role, permissions.code").
+			Scan(&rows)
+
+		rolePermMap := make(map[string][]string)
+		for _, r := range rows {
+			rolePermMap[r.Role] = append(rolePermMap[r.Role], r.Code)
+		}
+
+		result := make([]roleInfo, 0, len(model.AllRoles))
+		for _, role := range model.AllRoles {
+			result = append(result, roleInfo{
+				Role:        role,
+				Name:        model.RoleNames[role],
+				Permissions: rolePermMap[role],
+			})
+		}
+		c.JSON(http.StatusOK, result)
+	}
+}