perf: add AssetTreeAPI rbac_perms

apps/assets/api/tree/base.py

@@ -8,7 +8,6 @@ from users.models import User
 from common.utils import lazyproperty, timeit
 from common.exceptions import APIException
 from orgs.utils import current_org
-from orgs.models import Organization
 from rbac.permissions import RBACPermission
 from assets.tree.asset_tree import AssetTree
 from assets.models import Node
@@ -21,11 +20,9 @@ __all__ = ['AbstractAssetTreeAPI']
 
 class AbstractAssetTreeAPI(SerializeToTreeNodeMixin, generics.ListAPIView):
 
+    # TODO: 子类必须定义 rbac_perms 属性限制权限
     permission_classes = (RBACPermission,)
 
-    # TODO: 再确认一下 API 所需的权限位
-    perm_model = Node
-
     # query parameters keys
     query_search_key = 'search'
     query_search_key_value_sep = ':'

apps/assets/api/tree/tree.py

@@ -5,6 +5,7 @@ from rest_framework.generics import get_object_or_404
 from rest_framework.response import Response
 
 from assets.locks import NodeAddChildrenLock
+from assets.models import Platform
 from common.exceptions import JMSException
 from common.tree import TreeNodeSerializer
 from common.utils import get_logger
@@ -83,6 +84,12 @@ class NodeChildrenApi(generics.ListCreateAPIView):
 
 class AssetTreeAPI(AbstractAssetTreeAPI):
 
+    rbac_perms = {
+        'list': 'assets.view_asset',
+        'GET': 'assets.view_asset',
+        'OPTIONS': 'assets.view_asset',
+    }
+
     def initial(self, request, *args, **kwargs):
         super().initial(request, *args, **kwargs)
         self.initial_org_root_node_if_need()