feat(avatar): align authorization page with design

digital-avatar-app/backend/routers/authorizations.py

@@ -11,6 +11,9 @@ router = APIRouter(tags=["授权"])
 TARGET_TYPES = {"user", "organization", "application"}
 PERMISSION_ORDER = ("friend", "chat", "publish", "browse", "interact", "takeover")
 ALLOWED_PERMISSIONS = set(PERMISSION_ORDER)
+AVATAR_PERMISSION_ORDER = PERMISSION_ORDER[:-1]
+AVATAR_PERMISSION_KEY = "authorizationPermissions"
+DEFAULT_AVATAR_PERMISSIONS = ["friend", "chat"]
 LEGACY_PERMISSION_MAP = {
     "read": "browse",
     "reply": "chat",
@@ -53,6 +56,44 @@ def _normalize_permissions(value) -> list[str]:
     return sorted(normalized, key=PERMISSION_ORDER.index)
 
 
+def _normalize_avatar_permissions(value) -> list[str]:
+    if not isinstance(value, list):
+        raise ValueError("权限格式不正确")
+
+    normalized = []
+    for raw in value:
+        permission = LEGACY_PERMISSION_MAP.get(str(raw).strip(), str(raw).strip())
+        if permission not in AVATAR_PERMISSION_ORDER:
+            raise ValueError(f"不支持的权限：{raw}")
+        if permission not in normalized:
+            normalized.append(permission)
+    return sorted(normalized, key=AVATAR_PERMISSION_ORDER.index)
+
+
+def _stored_avatar_permissions(avatar) -> list[str]:
+    config = avatar.config or {}
+    if AVATAR_PERMISSION_KEY not in config:
+        return list(DEFAULT_AVATAR_PERMISSIONS)
+
+    stored = config.get(AVATAR_PERMISSION_KEY)
+    if not isinstance(stored, list):
+        return list(DEFAULT_AVATAR_PERMISSIONS)
+
+    permissions = []
+    for raw in stored:
+        permission = LEGACY_PERMISSION_MAP.get(str(raw).strip(), str(raw).strip())
+        if permission in AVATAR_PERMISSION_ORDER and permission not in permissions:
+            permissions.append(permission)
+    return sorted(permissions, key=AVATAR_PERMISSION_ORDER.index)
+
+
+def _permission_settings_payload(avatar) -> dict:
+    return {
+        "avatarId": avatar.id,
+        "permissions": _stored_avatar_permissions(avatar),
+    }
+
+
 def _require_authorization(db: Session, avatar_id: str, authorization_id: str) -> Authorization:
     authorization = (
         db.query(Authorization)
@@ -85,6 +126,40 @@ def _duplicate_target(
     return query.first()
 
 
+@router.get("/avatar/{avatar_id}/permission-settings")
+def get_permission_settings(
+    avatar_id: str,
+    authorization: str = Header(None),
+    db: Session = Depends(get_db),
+):
+    avatar = _require_owned_avatar(db, avatar_id, authorization)
+    return ok(_permission_settings_payload(avatar))
+
+
+@router.put("/avatar/{avatar_id}/permission-settings")
+def update_permission_settings(
+    avatar_id: str,
+    payload: dict = Body(...),
+    authorization: str = Header(None),
+    db: Session = Depends(get_db),
+):
+    avatar = _require_owned_avatar(db, avatar_id, authorization)
+    if "permissions" not in payload:
+        return fail("缺少 permissions", 400)
+    try:
+        permissions = _normalize_avatar_permissions(payload["permissions"])
+    except ValueError as exc:
+        return fail(str(exc), 400)
+
+    avatar.config = {
+        **(avatar.config or {}),
+        AVATAR_PERMISSION_KEY: permissions,
+    }
+    db.commit()
+    db.refresh(avatar)
+    return ok(_permission_settings_payload(avatar), "授权设置已保存")
+
+
 @router.get("/avatar/{avatar_id}/authorizations")
 def list_auth(
     avatar_id: str,