重构: ResScope 改成 ResFlags 位标志,行级过滤与字段脱敏拆成独立开关

ResScope(Off/On/All 三选一)改成 ResFlags 位标志:ResRow/ResRowRelations 管行级权限过滤,ResMask/ResMaskRelations 管字段级脱敏,两个维度可以按位独立组合(*Relations 那两位只保留定义,还没接入判断逻辑)。WithRolesScope 改名 WithPermission(req.ResFlags),dataProcessor 里原来单一的 skipPermission 拆成 skipRowFilter/skipFieldMask 分别控制。

resx/resource.go

@@ -325,8 +325,14 @@ func (this *resource) GetDBTable(u req.User, opts ...req.ResOption) (sd *db.Sele
 		sd = op.Tx.From(this.GetTableExpr().As(alias))
 	}
 
-	skipPermission := op.RolesScope != req.ResScopeOn && op.RolesScope != req.ResScopeAll
-	sd.WithHook(&dataProcessor{res: this, u: u, tx: op.Tx, silent: op.Silent, skipPermission: skipPermission})
+	sd.WithHook(&dataProcessor{
+		res:           this,
+		u:             u,
+		tx:            op.Tx,
+		silent:        op.Silent,
+		skipRowFilter: op.Permission&req.ResRow == 0,
+		skipFieldMask: op.Permission&req.ResMask == 0,
+	})
 
 	return sd
 }