chore: update sureness yml (#3870)

home/docs/help/security_model.md

@@ -16,6 +16,8 @@ Apache HertzBeat™ uses [Sureness](https://github.com/dromara/sureness) to supp
 
 Use the `sureness.yml` provided by Sureness to configure user accounts, roles, API resources, etc. It is strongly recommended that the initial user modify the account password. For details, refer to [Account Permission Management](../start/account-modify)
 
+Please note that the role permission function is being improved, please do not use roles to control user permissions, all users have management permissions.
+
 ## Monitoring Template Security
 
 Apache HertzBeat™ provides a monitoring template feature that allows users to define monitoring rules by configuring custom monitoring templates and custom scripts.

home/i18n/zh-cn/docusaurus-plugin-content-docs/current/help/security_model.md

@@ -16,6 +16,8 @@ Apache HertzBeat™ 使用 [Sureness](https://github.com/dromara/sureness) 来
 
 使用 Sureness 提供的 `sureness.yml` 来配置用户账户，角色，API资源等，强烈建议初始用户修改账户密码，具体参考 [账户权限管理](../start/account-modify)
 
+请注意角色权限功能正在完善中，请勿使用角色来控制用户权限，所有用户均拥有管理权限。
+
 ## 监控模板安全
 
 Apache HertzBeat™ 提供了监控模板功能，用户可以通过配置自定义监控模板和自定义脚本来定义监控规则。

script/docker-compose/hertzbeat-mysql-iotdb/conf/sureness.yml

@@ -66,12 +66,18 @@ resourceRole:
   - /api/bulletin/**===post===[admin,user]
   - /api/bulletin/**===put===[admin,user]
   - /api/bulletin/**===delete===[admin]
+  - /api/sse/**===get===[admin,user]
+  - /api/sse/**===post===[admin,user]
+  - /api/chat/**===get===[admin,user]
+  - /api/chat/**===post===[admin,user]
+  - /api/logs/ingest/**===post===[admin,user]
 
 # config the resource restful api that need bypass auth protection
 # rule: api===method 
 # eg: /api/v1/source3===get means /api/v1/source3===get can be access by anyone, no need auth.
 excludedResource:
   - /api/alert/sse/**===*
+  - /api/logs/sse/**===*
   - /api/account/auth/**===*
   - /api/i18n/**===get
   - /api/apps/hierarchy===get
@@ -88,6 +94,7 @@ excludedResource:
   - /setting/**===get
   - /passport/**===get
   - /status/**===get
+  - /log/**===get
   - /**/*.html===get
   - /**/*.js===get
   - /**/*.css===get

script/docker-compose/hertzbeat-mysql-tdengine/conf/sureness.yml

@@ -66,12 +66,18 @@ resourceRole:
   - /api/bulletin/**===post===[admin,user]
   - /api/bulletin/**===put===[admin,user]
   - /api/bulletin/**===delete===[admin]
+  - /api/sse/**===get===[admin,user]
+  - /api/sse/**===post===[admin,user]
+  - /api/chat/**===get===[admin,user]
+  - /api/chat/**===post===[admin,user]
+  - /api/logs/ingest/**===post===[admin,user]
 
 # config the resource restful api that need bypass auth protection
 # rule: api===method 
 # eg: /api/v1/source3===get means /api/v1/source3===get can be access by anyone, no need auth.
 excludedResource:
   - /api/alert/sse/**===*
+  - /api/logs/sse/**===*
   - /api/account/auth/**===*
   - /api/i18n/**===get
   - /api/apps/hierarchy===get
@@ -88,6 +94,7 @@ excludedResource:
   - /setting/**===get
   - /passport/**===get
   - /status/**===get
+  - /log/**===get
   - /**/*.html===get
   - /**/*.js===get
   - /**/*.css===get

script/docker-compose/hertzbeat-mysql-victoria-metrics/conf/sureness.yml

@@ -66,12 +66,18 @@ resourceRole:
   - /api/bulletin/**===post===[admin,user]
   - /api/bulletin/**===put===[admin,user]
   - /api/bulletin/**===delete===[admin]
+  - /api/sse/**===get===[admin,user]
+  - /api/sse/**===post===[admin,user]
+  - /api/chat/**===get===[admin,user]
+  - /api/chat/**===post===[admin,user]
+  - /api/logs/ingest/**===post===[admin,user]
 
 # config the resource restful api that need bypass auth protection
 # rule: api===method 
 # eg: /api/v1/source3===get means /api/v1/source3===get can be access by anyone, no need auth.
 excludedResource:
   - /api/alert/sse/**===*
+  - /api/logs/sse/**===*
   - /api/account/auth/**===*
   - /api/i18n/**===get
   - /api/apps/hierarchy===get
@@ -88,6 +94,7 @@ excludedResource:
   - /setting/**===get
   - /passport/**===get
   - /status/**===get
+  - /log/**===get
   - /**/*.html===get
   - /**/*.js===get
   - /**/*.css===get

script/docker-compose/hertzbeat-postgresql-greptimedb/conf/sureness.yml

@@ -73,7 +73,7 @@ resourceRole:
   - /api/logs/ingest/**===post===[admin,user]
 
 # config the resource restful api that need bypass auth protection
-# rule: api===method
+# rule: api===method 
 # eg: /api/v1/source3===get means /api/v1/source3===get can be access by anyone, no need auth.
 excludedResource:
   - /api/alert/sse/**===*

script/docker-compose/hertzbeat-postgresql-victoria-metrics/conf/sureness.yml

@@ -66,12 +66,18 @@ resourceRole:
   - /api/bulletin/**===post===[admin,user]
   - /api/bulletin/**===put===[admin,user]
   - /api/bulletin/**===delete===[admin]
+  - /api/sse/**===get===[admin,user]
+  - /api/sse/**===post===[admin,user]
+  - /api/chat/**===get===[admin,user]
+  - /api/chat/**===post===[admin,user]
+  - /api/logs/ingest/**===post===[admin,user]
 
 # config the resource restful api that need bypass auth protection
 # rule: api===method 
 # eg: /api/v1/source3===get means /api/v1/source3===get can be access by anyone, no need auth.
 excludedResource:
   - /api/alert/sse/**===*
+  - /api/logs/sse/**===*
   - /api/account/auth/**===*
   - /api/i18n/**===get
   - /api/apps/hierarchy===get
@@ -88,6 +94,7 @@ excludedResource:
   - /setting/**===get
   - /passport/**===get
   - /status/**===get
+  - /log/**===get
   - /**/*.html===get
   - /**/*.js===get
   - /**/*.css===get

script/sureness.yml

@@ -66,12 +66,18 @@ resourceRole:
   - /api/bulletin/**===post===[admin,user]
   - /api/bulletin/**===put===[admin,user]
   - /api/bulletin/**===delete===[admin]
+  - /api/sse/**===get===[admin,user]
+  - /api/sse/**===post===[admin,user]
+  - /api/chat/**===get===[admin,user]
+  - /api/chat/**===post===[admin,user]
+  - /api/logs/ingest/**===post===[admin,user]
 
 # config the resource restful api that need bypass auth protection
 # rule: api===method 
 # eg: /api/v1/source3===get means /api/v1/source3===get can be access by anyone, no need auth.
 excludedResource:
   - /api/alert/sse/**===*
+  - /api/logs/sse/**===*
   - /api/account/auth/**===*
   - /api/i18n/**===get
   - /api/apps/hierarchy===get
@@ -88,6 +94,7 @@ excludedResource:
   - /setting/**===get
   - /passport/**===get
   - /status/**===get
+  - /log/**===get
   - /**/*.html===get
   - /**/*.js===get
   - /**/*.css===get