feat: better admin permissions (#5755)

* feat: add casbin admin permissions

* feat: improve audit logging to associate logs with actual operators and target users

* feat: enhance admin permissions and UI interactions for sensitive actions

* Refactor authz RBAC and tighten channel permissions

* Split channel authz field policy

* Address channel authz review findings

service/authz/seed.go

@@ -0,0 +1,62 @@
+package authz
+
+import (
+	"fmt"
+
+	"github.com/QuantumNous/new-api/model"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+)
+
+func seedBuiltInRoles(db *gorm.DB) error {
+	for _, spec := range builtInRoles {
+		role := model.AuthzRole{
+			Key:         spec.Key,
+			Name:        spec.Name,
+			Description: spec.Description,
+			BuiltIn:     spec.BuiltIn,
+			Enabled:     true,
+			Sort:        spec.Sort,
+		}
+		if err := db.Clauses(clause.OnConflict{
+			Columns: []clause.Column{{Name: "key"}},
+			DoUpdates: clause.AssignmentColumns([]string{
+				"name",
+				"description",
+				"built_in",
+				"enabled",
+				"sort",
+			}),
+		}).Create(&role).Error; err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func resetBuiltInRolePolicies(db *gorm.DB) error {
+	subjects := make([]string, 0, len(builtInRoles))
+	for _, spec := range builtInRoles {
+		subjects = append(subjects, RoleSubject(spec.Key))
+	}
+	return db.Where("ptype = ? AND v0 IN ?", "p", subjects).Delete(&model.CasbinRule{}).Error
+}
+
+func seedDefaultPolicies() error {
+	e := currentEnforcer()
+	if e == nil {
+		return fmt.Errorf("authz enforcer is not initialized")
+	}
+
+	for _, spec := range builtInRoles {
+		if spec.Superuser {
+			continue
+		}
+		for _, permission := range PermissionsForRole(spec.Key) {
+			if _, err := e.AddPolicy(RoleSubject(spec.Key), permission.Resource, permission.Action, EffectAllow); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}