fix(security): 收紧 MCP 数据权限并移除默认凭据

xiaoqu-agent-service/sql/seed-dev.sql

@@ -1,37 +1,14 @@
 -- =============================================================
 -- dev 种子数据（仅 dev 环境使用！）
--- 用户：46=代理商管理端(isagent=0 总部视角, authority_id=1)
---       1000=斤斤计较(isagent=1 代理商视角, authority_id=108, agent_id=1 有 26 个直属下级)
--- token：
---   HQ      user_id=46   xqak_1d21057ad83203dbeb767eb5069701046b27debdc08a733c
---   AGENT   user_id=1000 xqak_7df02ccee2133dc2cf951db12e3958557bdf2d30a91e7f08
---   NOSCOPE user_id=1000 xqak_5bdc0eac8c1cab535f22dc3e9757f72b3127de43a14997a7  (未授权任何 scope，验证拒绝)
---   SALES   user_id=1727 xqak_cb006faf86c0db6f2f47b3eb8872f8b5d495b0c05a6fb52c  (北京销售1，dept_id=4 命中 authDeptId，
---          post_id=103 不在 authDeptPostId → 销售非负责人；warehouse_agent_auth 代管 agent 19)
--- 依赖：tool 表已由应用启动时 ToolSyncService 同步（sys.ping/agent.count/agent.list.query）
+-- 仅创建作用域并关联工具，不提交固定 token 或 ak。
+-- token 请使用本地随机 ak 的 SHA-256 哈希手工创建，详见 README。
+-- 依赖：tool 表已由应用启动时 ToolSyncService 同步。
 -- =============================================================
 
 USE xiaoqu_agent_svc_d;
 
 START TRANSACTION;
 
--- token（ak 只存 SHA-256 哈希；明文只保留在本文件顶部注释，仅 dev）
-INSERT INTO agent_api_key (user_id, key_prefix, key_hash, memo, status, create_id)
-SELECT 46, 'xqak_1d21', '9068d5a6406afdb853cdc9f5e45e16a5191255e2feb1aba171cd66ea13d5711c', 'dev 测试：总部视角(isagent=0)', 1, 0
-WHERE NOT EXISTS (SELECT 1 FROM agent_api_key WHERE key_hash = '9068d5a6406afdb853cdc9f5e45e16a5191255e2feb1aba171cd66ea13d5711c');
-
-INSERT INTO agent_api_key (user_id, key_prefix, key_hash, memo, status, create_id)
-SELECT 1000, 'xqak_7df0', '00ab77ba18c11c8870500e1c09a9e25747e4cf0d8f1c88ae255a2beca6eef007', 'dev 测试：代理商视角(isagent=1)', 1, 0
-WHERE NOT EXISTS (SELECT 1 FROM agent_api_key WHERE key_hash = '00ab77ba18c11c8870500e1c09a9e25747e4cf0d8f1c88ae255a2beca6eef007');
-
-INSERT INTO agent_api_key (user_id, key_prefix, key_hash, memo, status, create_id)
-SELECT 1000, 'xqak_5bdc', '85733c4eaab02e956bc555e0f25e5043629f9b8f8ad9ca39046735f5e817ca9c', 'dev 测试：无任何 scope 授权', 1, 0
-WHERE NOT EXISTS (SELECT 1 FROM agent_api_key WHERE key_hash = '85733c4eaab02e956bc555e0f25e5043629f9b8f8ad9ca39046735f5e817ca9c');
-
-INSERT INTO agent_api_key (user_id, key_prefix, key_hash, memo, status, create_id)
-SELECT 1727, 'xqak_cb00', '9fd25466ad4913b0c48e60d853b1bb27ba75bec426a117978e8c95687917bada', 'dev 测试：销售非负责人(北京销售1, dept 4/post 103, 代管 agent 19)', 1, 0
-WHERE NOT EXISTS (SELECT 1 FROM agent_api_key WHERE key_hash = '9fd25466ad4913b0c48e60d853b1bb27ba75bec426a117978e8c95687917bada');
-
 -- 作用域：运营
 INSERT INTO agent_scope (name, code, memo, status, create_id)
 SELECT '运营', 'operation', 'dev 种子：运营作用域', 1, 0
@@ -43,18 +20,7 @@ SELECT s.id, t.id, 0 FROM agent_scope s JOIN tool t
 WHERE s.code = 'operation' AND t.name IN ('sys.ping', 'agent.count', 'agent.list.query', 'property.list.query')
   AND NOT EXISTS (SELECT 1 FROM scope_tool st WHERE st.scope_id = s.id AND st.tool_id = t.id);
 
--- token-作用域：HQ / AGENT / SALES 三把 token 授权"运营"；NOSCOPE 不授权
-INSERT INTO token_scope (token_id, scope_id, create_id)
-SELECT k.id, s.id, 0 FROM agent_api_key k JOIN agent_scope s
-WHERE k.key_hash IN ('9068d5a6406afdb853cdc9f5e45e16a5191255e2feb1aba171cd66ea13d5711c',
-                     '00ab77ba18c11c8870500e1c09a9e25747e4cf0d8f1c88ae255a2beca6eef007',
-                     '9fd25466ad4913b0c48e60d853b1bb27ba75bec426a117978e8c95687917bada')
-  AND s.code = 'operation'
-  AND NOT EXISTS (SELECT 1 FROM token_scope ts WHERE ts.token_id = k.id AND ts.scope_id = s.id);
-
 COMMIT;
 
 -- 校验
-SELECT k.id, k.user_id, k.key_prefix, k.memo FROM agent_api_key k ORDER BY k.id;
 SELECT s.id, s.code, t.name FROM agent_scope s JOIN scope_tool st ON s.id = st.scope_id JOIN tool t ON st.tool_id = t.id WHERE s.soft_delete = 0;
-SELECT ts.token_id, ts.scope_id FROM token_scope ts WHERE ts.soft_delete = 0;