feat(sso): strip owner prefix in roleKey; expose /sso/casdoor/config; casdoor env passthrough

- RoleResolver.roleKey 取组名最后一段再匹配前缀，兼容 Casdoor user.groups 的 owner/name 全 ID
- 前端 nginx 增加精确 location /sso/casdoor/config 转发网关
- docker-compose 网关服务透传 DEEPDATA_CASDOOR_* 环境变量（Spring relaxed binding）

backend/api-gateway/src/main/java/com/deepdata/gateway/common/config/RoleResolver.java

@@ -79,12 +79,19 @@ public class RoleResolver {
     /**
      * 组名 → 角色键：命中前缀返回后缀小写（如 deepdata-admin → admin），否则 null。
      * 前缀为空时按整名小写匹配（兼容 group-prefix 留空的自定义组名）。
+     *
+     * <p>Casdoor 的 user.groups 存的是 {@code owner/name} 全 ID（如 {@code built-in/deepdata-admin}），
+     * 开启 useGroupPathInToken 时更可能是多级组路径；统一取最后一段作为组名再匹配。
      */
     private String roleKey(String group, String prefix) {
         if (group == null || group.isBlank()) {
             return null;
         }
         String g = group.trim();
+        int slash = g.lastIndexOf('/');
+        if (slash >= 0) {
+            g = g.substring(slash + 1);
+        }
         if (prefix.isEmpty()) {
             return g.toLowerCase(Locale.ROOT);
         }

deployment/docker/deepdata/docker-compose.yml

@@ -71,6 +71,15 @@ services:
       - JWT_SECRET=${JWT_SECRET:-}
       - DB_PASSWORD=${DB_PASSWORD:?DB_PASSWORD is required. Set in .env file}
       - deepdata.jwt.enable=${DEEPDATA_JWT_ENABLE:-false}
+      # ---- Casdoor SSO（M1/M2）：空值保持 Spring 默认；生产经 .env 注入 ----
+      - DEEPDATA_CASDOOR_ENABLED=${DEEPDATA_CASDOOR_ENABLED:-false}
+      - DEEPDATA_CASDOOR_ISSUER=${DEEPDATA_CASDOOR_ISSUER:-}
+      - DEEPDATA_CASDOOR_AUTHORIZEURI=${DEEPDATA_CASDOOR_AUTHORIZE_URI:-}
+      - DEEPDATA_CASDOOR_TOKENURI=${DEEPDATA_CASDOOR_TOKEN_URI:-}
+      - DEEPDATA_CASDOOR_JWKSURI=${DEEPDATA_CASDOOR_JWKS_URI:-}
+      - DEEPDATA_CASDOOR_CLIENTID=${DEEPDATA_CASDOOR_CLIENT_ID:-}
+      - DEEPDATA_CASDOOR_CLIENTSECRET=${DEEPDATA_CASDOOR_CLIENT_SECRET:-}
+      - DEEPDATA_CASDOOR_REDIRECTURI=${DEEPDATA_CASDOOR_REDIRECT_URI:-}
       - LOG_ROTATION_MAX_SIZE=${LOG_ROTATION_MAX_SIZE:-100MB}
       - LOG_ROTATION_BACKUP_COUNT=${LOG_ROTATION_BACKUP_COUNT:-30}
     volumes:

scripts/images/frontend/routes.inc

@@ -29,6 +29,14 @@ location /deepflow-backend {
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 }
 
+# Casdoor SSO 前端配置端点（无 /api 前缀，供登录弹窗探测 SSO 是否启用）
+location = /sso/casdoor/config {
+    proxy_pass http://deepdata-gateway:8080/sso/casdoor/config;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+}
+
 location @static_fallback {
     root   /opt/frontend/statics;
     try_files $uri $uri/ /index.html;