feat(workbench): add dynamic task approval lifecycle

app/infra/integrations/operational_data.py

@@ -19,6 +19,7 @@ class TaskDataSettings(BaseSettings):
     server_url: str = "http://127.0.0.1:8000"
     peripheral_url: str = ""
     timeout_seconds: float = Field(default=15, ge=1, le=60)
+    delegation_bearer: str = ""
     model_config = SettingsConfigDict(
         env_prefix="OPERATIONAL_DATA_", extra="ignore",
         env_file=Path(__file__).resolve().parents[3] / ".env",
@@ -81,13 +82,20 @@ def _select_demo_observations(
 
 async def read_task_data(
     *, context: ProjectContext, query: TaskDataQuery, credential: str | None,
+    delegated: bool = False,
     settings: TaskDataSettings | None = None,
     transport: httpx.AsyncBaseTransport | None = None,
 ) -> TaskDataSnapshot:
     config = settings or TaskDataSettings()
     permission = SCADA_VIEW if query.source.startswith("scada_") else SIMULATION_VIEW
-    if permission not in permissions_for_context(context):
+    if permission not in permissions_for_context(context) and not delegated:
         raise TaskDataError(403, "当前身份没有该数据源的读取权限")
+    if delegated:
+        credential = config.delegation_bearer
+        if not credential:
+            raise TaskDataError(503, "任务授权已批准，但数据源委托身份尚未配置")
+        if not credential.lower().startswith("bearer "):
+            credential = f"Bearer {credential}"
     if not credential or not credential.lower().startswith("bearer "):
         raise TaskDataError(401, "数据查询需要当前产品身份")
     peripheral = query.source.startswith("peripheral_")