Background
StreamPark currently ships a configurable RBAC model based on roles, role-menu bindings, team membership, and a custom @Permission aspect for resource-level checks. This adds significant operational and maintenance overhead for most deployments, where only a small set of fixed capabilities is needed.
Proposal
Simplify authorization to two built-in user types stored on t_user.user_type:
- Admin — full access (
*)
- Editor — fixed permission set for job and development resources (app/sql/project/resource/etc.)
Scope
- Remove role/member/team management APIs, entities, mappers, and UI pages
- Derive Shiro roles and permissions directly from
UserTypeEnum
- Remove the legacy
@Permission annotation and PermissionAspect
- Keep API authorization via Shiro
@RequiresPermissions
- Add MySQL/PostgreSQL
3.0.0 upgrade scripts to migrate legacy team-admin membership and drop obsolete RBAC tables
- Update frontend permission checks and remove obsolete E2E cases
Motivation
- Reduce complexity for operators and contributors
- Make authorization behavior predictable and easier to test
- Align with StreamPark 3.0 simplification goals
Notes
Team identifiers remain in the data model for existing resources, but team/member/role administration is removed from the console.
Background
StreamPark currently ships a configurable RBAC model based on roles, role-menu bindings, team membership, and a custom
@Permissionaspect for resource-level checks. This adds significant operational and maintenance overhead for most deployments, where only a small set of fixed capabilities is needed.Proposal
Simplify authorization to two built-in user types stored on
t_user.user_type:*)Scope
UserTypeEnum@Permissionannotation andPermissionAspect@RequiresPermissions3.0.0upgrade scripts to migrate legacy team-admin membership and drop obsolete RBAC tablesMotivation
Notes
Team identifiers remain in the data model for existing resources, but team/member/role administration is removed from the console.