mirror of
https://github.com/go-admin-team/go-admin.git
synced 2026-09-21 10:13:01 +00:00
The shipped seed data left data_scope empty for the built-in administrator. That was harmless while an unrecognized scope meant "see everything"; with the previous commits it means the opposite, so a fresh install with data permission enabled would have blinded its own default account on every list endpoint. The admin short-circuit does not help here: role_key == "admin" bypasses Casbin, not the data permission scopes, which never look at role_key. The value is "1" - all data - which is the behaviour the empty string used to produce, so this restores the intent rather than tightening it. A test reads both seed files back so the pair cannot drift apart again. Claude-Session: https://claude.ai/code/session_01HPTAw8b8tAdFNFn8rKdPYx