feat: add user and role management pages with API integration

- Implemented user management functionality in UsersPage including user creation, editing, deletion, and role assignment.
- Added role management functionality in RolesPage with role creation, editing, deletion, and path rule management.
- Created users API for handling user-related operations.
- Created roles API for handling role-related operations.
- Integrated permissions handling in both user and role management.
- Enhanced UI with Ant Design components for better user experience.

setup/foxel_cli.py

@@ -15,6 +15,8 @@ if str(PROJECT_ROOT) not in sys.path:
 
 from domain.config import VERSION
 from domain.auth import get_password_hash
+from domain.permission.types import PERMISSION_DEFINITIONS
+from domain.role.types import SystemRoles
 
 
 def _project_root() -> Path:
@@ -127,6 +129,129 @@ def _cmd_reset_password(args: argparse.Namespace) -> int:
     return 0
 
 
+def _cmd_init_rbac(args: argparse.Namespace) -> int:
+    db_path = Path(args.db).expanduser() if args.db else _default_db_path()
+
+    role_definitions = [
+        {
+            "name": SystemRoles.ADMIN,
+            "description": "管理员角色，拥有所有系统和适配器权限",
+        },
+        {
+            "name": SystemRoles.USER,
+            "description": "普通用户角色，需要管理员配置路径权限",
+        },
+        {
+            "name": SystemRoles.VIEWER,
+            "description": "只读用户角色，仅可查看文件",
+        },
+    ]
+
+    conn = sqlite3.connect(str(db_path))
+    try:
+        conn.execute("PRAGMA foreign_keys = ON")
+        cursor = conn.cursor()
+
+        try:
+            cursor.execute("SELECT 1 FROM permissions LIMIT 1")
+            cursor.execute("SELECT 1 FROM roles LIMIT 1")
+            cursor.execute("SELECT 1 FROM role_permissions LIMIT 1")
+            cursor.execute("SELECT 1 FROM path_rules LIMIT 1")
+        except sqlite3.OperationalError as exc:
+            print(f"数据库未初始化（缺少表）。请先启动一次服务生成表。{exc}", file=sys.stderr)
+            return 1
+
+        # upsert permissions
+        for perm in PERMISSION_DEFINITIONS:
+            cursor.execute(
+                """
+                INSERT INTO permissions (code, name, category, description)
+                VALUES (?, ?, ?, ?)
+                ON CONFLICT(code) DO UPDATE SET
+                  name = excluded.name,
+                  category = excluded.category,
+                  description = excluded.description
+                """,
+                (
+                    perm["code"],
+                    perm["name"],
+                    perm["category"],
+                    perm.get("description"),
+                ),
+            )
+
+        # upsert roles
+        for role in role_definitions:
+            cursor.execute(
+                """
+                INSERT INTO roles (name, description, is_system)
+                VALUES (?, ?, 1)
+                ON CONFLICT(name) DO UPDATE SET
+                  description = excluded.description,
+                  is_system = 1
+                """,
+                (role["name"], role["description"]),
+            )
+
+        # grant all permissions to Admin role
+        cursor.execute("SELECT id FROM roles WHERE name = ?", (SystemRoles.ADMIN,))
+        admin_row = cursor.fetchone()
+        if not admin_row:
+            print("初始化失败：未找到 Admin 角色", file=sys.stderr)
+            return 1
+        admin_role_id = int(admin_row[0])
+
+        cursor.execute("DELETE FROM role_permissions WHERE role_id = ?", (admin_role_id,))
+        cursor.execute("SELECT id FROM permissions")
+        permission_ids = [int(row[0]) for row in cursor.fetchall()]
+        cursor.executemany(
+            "INSERT INTO role_permissions (role_id, permission_id) VALUES (?, ?)",
+            [(admin_role_id, pid) for pid in permission_ids],
+        )
+
+        # ensure Admin has full access path rule
+        cursor.execute(
+            "SELECT id FROM path_rules WHERE role_id = ? AND path_pattern = ? LIMIT 1",
+            (admin_role_id, "/**"),
+        )
+        existing_rule = cursor.fetchone()
+        if existing_rule:
+            cursor.execute(
+                """
+                UPDATE path_rules
+                SET is_regex = 0,
+                    can_read = 1,
+                    can_write = 1,
+                    can_delete = 1,
+                    can_share = 1,
+                    priority = 100
+                WHERE id = ?
+                """,
+                (int(existing_rule[0]),),
+            )
+        else:
+            cursor.execute(
+                """
+                INSERT INTO path_rules (
+                  role_id, path_pattern, is_regex,
+                  can_read, can_write, can_delete, can_share,
+                  priority
+                )
+                VALUES (?, ?, 0, 1, 1, 1, 1, 100)
+                """,
+                (admin_role_id, "/**"),
+            )
+
+        conn.commit()
+    finally:
+        conn.close()
+
+    print(f"已初始化权限: {len(PERMISSION_DEFINITIONS)} 条", file=sys.stderr)
+    print("已补齐内置角色: Admin / User / Viewer", file=sys.stderr)
+    print("已为 Admin 角色授予全部权限并设置 /** 全路径规则", file=sys.stderr)
+    return 0
+
+
 def _build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(prog="foxel")
     subparsers = parser.add_subparsers(dest="command", required=True)
@@ -139,6 +264,10 @@ def _build_parser() -> argparse.ArgumentParser:
     reset_password.add_argument("--db", help="sqlite db 路径（默认 data/db/db.sqlite3）")
     reset_password.set_defaults(func=_cmd_reset_password)
 
+    init_rbac = subparsers.add_parser("init-rbac", help="初始化权限与内置角色")
+    init_rbac.add_argument("--db", help="sqlite db 路径（默认 data/db/db.sqlite3）")
+    init_rbac.set_defaults(func=_cmd_init_rbac)
+
     return parser