mirror of
https://github.com/go-admin-team/go-admin.git
synced 2026-09-21 18:20:50 +00:00
Nothing checked what went into sys_role.data_scope, so creating a role without a dataScope stored an empty string - the value that used to be indistinguishable from "see everything". All three DTOs that write the column are validated, not just the insert path: they target the same column, and guarding one entrance while leaving two open would not be a guard. Claude-Session: https://claude.ai/code/session_01HPTAw8b8tAdFNFn8rKdPYx