From 77c44640992a014ccc22f338592e735dca35dc2f Mon Sep 17 00:00:00 2001
From: huangzhuang_3rd <huangzhuang_3rd@tphai.com>
Date: Wed, 12 Aug 2026 13:30:38 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20AI=20Worker=20=E5=B9=B3=E5=8F=B0=20MVP?=
 =?UTF-8?q?=20v1.0.0=20-=20=E5=A4=9A=E7=A7=9F=E6=88=B7/=E9=A1=B9=E7=9B=AE?=
 =?UTF-8?q?=E7=AE=A1=E7=90=86/AI=20Worker/=E4=BB=BB=E5=8A=A1=E7=BC=96?=
 =?UTF-8?q?=E6=8E=92/HITL=E5=AE=A1=E6=A0=B8/=E6=88=90=E6=9C=AC=E6=B2=BB?=
 =?UTF-8?q?=E7=90=86?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/app/core/permissions.py | 58 +++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 backend/app/core/permissions.py

diff --git a/backend/app/core/permissions.py b/backend/app/core/permissions.py
new file mode 100644
index 0000000..51b0693
--- /dev/null
+++ b/backend/app/core/permissions.py
@@ -0,0 +1,58 @@
+"""Role-Based Access Control (RBAC) definitions and checks.
+
+Roles hierarchy (highest authority = human):
+  super_admin   - Platform-level, manages all tenants (always human)
+  tenant_admin  - Tenant-level admin, manages users/workers (human)
+  project_manager - Creates/manages projects, assigns tasks (human)
+  reviewer      - Reviews AI output, approves/rejects (human)
+  worker        - Executes tasks (can be human or AI)
+"""
+
+from enum import Enum
+from typing import Set
+
+
+class Role(str, Enum):
+    SUPER_ADMIN = "super_admin"
+    TENANT_ADMIN = "tenant_admin"
+    PROJECT_MANAGER = "project_manager"
+    REVIEWER = "reviewer"
+    WORKER = "worker"
+
+
+# Role hierarchy for comparison (higher number = more authority)
+ROLE_LEVELS = {
+    Role.WORKER: 1,
+    Role.REVIEWER: 2,
+    Role.PROJECT_MANAGER: 3,
+    Role.TENANT_ADMIN: 4,
+    Role.SUPER_ADMIN: 5,
+}
+
+
+def has_role(user_role: str, required_roles: Set[Role]) -> bool:
+    """Check if user_role is in the set of required roles."""
+    try:
+        role = Role(user_role)
+    except ValueError:
+        return False
+    return role in required_roles
+
+
+def has_min_role(user_role: str, min_role: Role) -> bool:
+    """Check if user_role meets the minimum role level."""
+    try:
+        role = Role(user_role)
+    except ValueError:
+        return False
+    return ROLE_LEVELS.get(role, 0) >= ROLE_LEVELS.get(min_role, 0)
+
+
+# Permission sets for common operations
+CAN_CREATE_TENANT = {Role.SUPER_ADMIN}
+CAN_MANAGE_USERS = {Role.SUPER_ADMIN, Role.TENANT_ADMIN}
+CAN_MANAGE_WORKERS = {Role.SUPER_ADMIN, Role.TENANT_ADMIN}
+CAN_CREATE_PROJECT = {Role.SUPER_ADMIN, Role.TENANT_ADMIN, Role.PROJECT_MANAGER}
+CAN_ASSIGN_TASK = {Role.SUPER_ADMIN, Role.TENANT_ADMIN, Role.PROJECT_MANAGER}
+CAN_REVIEW = {Role.SUPER_ADMIN, Role.TENANT_ADMIN, Role.PROJECT_MANAGER, Role.REVIEWER}
+CAN_EXECUTE_TASK = {Role.SUPER_ADMIN, Role.TENANT_ADMIN, Role.PROJECT_MANAGER, Role.WORKER}