fix: 修复管理端 Basic 认证接口初始化缺陷并补集成测试

- 修复 PermissionCheckByBasicAttribute 构造函数参数与 TypeFilter 用法不匹配导致所有 AdmBasicAuthentication 接口 500 的问题

- 收敛系统角色与权限初始化到唯一幂等入口 EnsureSystemRolePermissions，重复执行不再产生重复的角色-权限绑定

- 调整启动顺序：先初始化权限体系(Function/角色/绑定)再初始化 superadmin user，并从 InitSa 移除冗余的 EnsureSystemRoles(Freesql+Mongodb)

- 重命名 TryInitSuperAdminRole 为 TryInitSystemRolesAndPermissions 以反映真实职责

- 新增 ApiSite 集成测试覆盖全部 AdmBasicAuthentication 接口、错误凭证 403 及初始化幂等性

Author: agile.zhou

src/AgileConfig.Server.Apisite/Filters/PermissionCheckByBasicAttribute.cs

@@ -19,7 +19,6 @@ public PermissionCheckByBasicAttribute(
         IConfigService configService,
         IAdmBasicAuthService basicAuthService,
         IUserService userService,
-        string actionName,
         string functionKey) : base(permissionService, configService, functionKey)
     {
         _userService = userService;

src/AgileConfig.Server.Apisite/InitService.cs

@@ -43,10 +43,10 @@ public async Task StartAsync(CancellationToken cancellationToken)
         if (Appsettings.IsAdminConsoleMode)
         {
             _systemInitializationService.TryInitJwtSecret(); // Initialize the JWT secret.
+            await _systemInitializationService
+                .TryInitSystemRolesAndPermissions(); // Initialize system roles, functions and permission bindings.
             _systemInitializationService.TryInitSaPassword(); // init super admin password
             _systemInitializationService.TryInitDefaultApp();
-            await _systemInitializationService
-                .TryInitSuperAdminRole(); // Initialize SuperAdministrator role and functions
             _ = _remoteServerNodeProxy.TestEchoAsync(); // Start node connectivity checks.
             _ = _serviceHealthCheckService.StartCheckAsync(); // Start service health monitoring.
             _eventRegister.Register(); // Register event bus callbacks.

src/AgileConfig.Server.Data.Abstraction/ISysInitRepository.cs

@@ -32,4 +32,10 @@ public interface ISysInitRepository
     bool HasSa();
 
     bool InitDefaultApp(string appName);
+
+    /// <summary>
+    ///     Ensure the built-in system roles and their function permission bindings exist and stay in sync.
+    ///     Idempotent: safe to call on every startup without creating duplicate bindings.
+    /// </summary>
+    void EnsureSystemRolePermissions();
 }

src/AgileConfig.Server.Data.Repository.Freesql/SysInitRepository.cs

@@ -45,8 +45,6 @@ public bool InitSa(string password)
 
         var sql = freeSqlFactory.Create();
 
-        EnsureSystemRoles(sql);
-
         var user = new User();
         user.Id = SystemSettings.SuperAdminId;
         user.Password = password;
@@ -103,6 +101,12 @@ public bool InitDefaultApp(string appName)
         return true;
     }
 
+    public void EnsureSystemRolePermissions()
+    {
+        var sql = freeSqlFactory.Create();
+        EnsureSystemRoles(sql);
+    }
+
     private static void EnsureSystemRoles(IFreeSql sql)
     {
         // Super Admin gets all permissions

src/AgileConfig.Server.Data.Repository.Mongodb/SysInitRepository.cs

@@ -48,8 +48,6 @@ public bool InitSa(string password)
         var newSalt = Guid.NewGuid().ToString("N");
         password = Encrypt.Md5(password + newSalt);
 
-        EnsureSystemRoles();
-
         var user = new User();
         user.Id = SystemSettings.SuperAdminId;
         user.Password = password;
@@ -112,6 +110,11 @@ public bool InitDefaultApp(string appName)
         return true;
     }
 
+    public void EnsureSystemRolePermissions()
+    {
+        EnsureSystemRoles();
+    }
+
     private void EnsureSystemRoles()
     {
         EnsureRole(SystemRoleConstants.SuperAdminId, "Super Administrator");

src/AgileConfig.Server.IService/ISystemInitializationService.cs

@@ -14,5 +14,5 @@ public interface ISystemInitializationService
 
     bool TryInitDefaultEnvironment();
 
-    Task<bool> TryInitSuperAdminRole();
+    Task<bool> TryInitSystemRolesAndPermissions();
 }

src/AgileConfig.Server.Service/SystemInitializationService.cs

@@ -14,9 +14,7 @@ public class SystemInitializationService(
     ISysInitRepository sysInitRepository,
     IConfiguration configuration,
     ILogger<SystemInitializationService> logger,
-    IRoleDefinitionRepository roleDefinitionRepository,
-    IFunctionRepository functionRepository,
-    IRoleFunctionRepository roleFunctionRepository) : ISystemInitializationService
+    IFunctionRepository functionRepository) : ISystemInitializationService
 {
     /// <summary>
     ///     Initialize the JWT secret if it is not configured via file or environment variables.
@@ -130,59 +128,25 @@ public bool TryInitDefaultApp(string appName = "")
         return true;
     }
 
-    public async Task<bool> TryInitSuperAdminRole()
+    public async Task<bool> TryInitSystemRolesAndPermissions()
     {
         try
         {
-            // Check if SuperAdministrator role already exists
-            var superAdminRole = await roleDefinitionRepository.GetAsync(SystemRoleConstants.SuperAdminId);
-            if (superAdminRole != null)
-            {
-                logger.LogInformation("SuperAdministrator role already exists.");
-                return true;
-            }
-
-            // Create SuperAdministrator role
-            superAdminRole = new Role
-            {
-                Id = SystemRoleConstants.SuperAdminId,
-                Name = "SuperAdministrator",
-                Description = "System super administrator with all permissions",
-                IsSystem = true,
-                CreateTime = DateTime.Now
-            };
-
-            await roleDefinitionRepository.InsertAsync(superAdminRole);
-            logger.LogInformation("SuperAdministrator role created successfully.");
-
-            // Get all existing functions
+            // Ensure the built-in permission (function) catalog exists first, because the
+            // system role-function bindings are matched against these function codes.
             var allFunctions = await functionRepository.AllAsync();
+            if (allFunctions.Count == 0) await InitializeFunctions();
 
-            // If no functions exist yet, create them from the Functions class constants
-            if (allFunctions.Count == 0) allFunctions = await InitializeFunctions();
-
-// Bind all functions to SuperAdministrator role
-            var roleFunctions = new List<RoleFunction>();
-            foreach (var function in allFunctions)
-                roleFunctions.Add(new RoleFunction
-                {
-                    Id = Guid.NewGuid().ToString("N"),
-                    RoleId = SystemRoleConstants.SuperAdminId,
-                    FunctionId = function.Id,
-                    CreateTime = DateTime.Now
-                });
-
-            if (roleFunctions.Count > 0)
-            {
-                await roleFunctionRepository.InsertAsync(roleFunctions);
-                logger.LogInformation("Bound {count} functions to SuperAdministrator role.", roleFunctions.Count);
-            }
+            // Delegate system role creation and role-function binding to the single
+            // idempotent implementation in the repository layer. It only adds missing
+            // bindings and removes stale ones, so it is safe to run on every startup.
+            sysInitRepository.EnsureSystemRolePermissions();
 
             return true;
         }
         catch (Exception e)
         {
-            logger.LogError(e, "Failed to initialize SuperAdministrator role.");
+            logger.LogError(e, "Failed to initialize system roles and permissions.");
             return false;
         }
     }