mirror of
https://github.com/jumpserver/jumpserver.git
synced 2025-09-03 08:25:04 +00:00
fix: fix rbac to dev (#7636)
* feat: 添加 RBAC 应用模块 * feat: 添加 RBAC Model、API * feat: 添加 RBAC Model、API 2 * feat: 添加 RBAC Model、API 3 * feat: 添加 RBAC Model、API 4 * feat: RBAC * feat: RBAC * feat: RBAC * feat: RBAC * feat: RBAC * feat: RBAC 整理权限位 * feat: RBAC 整理权限位2 * feat: RBAC 整理权限位2 * feat: RBAC 整理权限位 * feat: RBAC 添加默认角色 * feat: RBAC 添加迁移文件；迁移用户角色->用户角色绑定 * feat: RBAC 添加迁移文件；迁移用户角色->用户角色绑定 * feat: RBAC 修改用户模块API * feat: RBAC 添加组织模块迁移文件 & 修改组织模块API * feat: RBAC 添加组织模块迁移文件 & 修改组织模块API * feat: RBAC 修改用户角色属性的使用 * feat: RBAC No.1 * xxx * perf: 暂存 * perf: ... * perf(rbac): 添加 perms 到 profile serializer 中 * stash * perf: 使用init * perf: 修改migrations * perf: rbac * stash * stash * pref: 修改rbac * stash it * stash: 先去修复其他bug * perf: 修改 role 添加 users * pref: 修改 RBAC Model * feat: 添加权限的 tree api * stash: 暂存一下 * stash: 暂存一下 * perf: 修改 model verbose name * feat: 添加model各种 verbose name * perf: 生成 migrations * perf: 优化权限位 * perf: 添加迁移脚本 * feat: 添加组织角色迁移 * perf: 添加迁移脚本 * stash * perf: 添加migrateion * perf: 暂存一下 * perf: 修改rbac * perf: stash it * fix: 迁移冲突 * fix: 迁移冲突 * perf: 暂存一下 * perf: 修改 rbac 逻辑 * stash: 暂存一下 * perf: 修改内置角色 * perf: 解决 root 组织的问题 * perf: stash it * perf: 优化 rbac * perf: 优化 rolebinding 处理 * perf: 完成用户离开组织的问题 * perf: 暂存一下 * perf: 修改翻译 * perf: 去掉了 IsSuperUser * perf: IsAppUser 去掉完成 * perf: 修改 connection token 的权限 * perf: 去掉导入的问题 * perf: perms define 格式，修改 app 用户 的全新啊 * perf: 修改 permission * perf: 去掉一些 org admin * perf: 去掉部分 org admin * perf: 再去掉点 org admin role * perf: 再去掉部分 org admin * perf: user 角色搜索 * perf: 去掉很多 js * perf: 添加权限位 * perf: 修改权限 * perf: 去掉一个 todo * merge: with dev * fix: 修复冲突 Co-authored-by: Bai <bugatti_it@163.com> Co-authored-by: Michael Bai <baijiangjie@gmail.com> Co-authored-by: ibuler <ibuler@qq.com>
This commit is contained in:
fit2bot
GitHub
@@ -5,9 +5,6 @@ from rest_framework import permissions
|
||||
from django.conf import settings
|
||||
from common.exceptions import MFAVerifyRequired
|
||||
|
||||
from orgs.utils import current_org
|
||||
from common.utils import is_uuid
|
||||
|
||||
|
||||
class IsValidUser(permissions.IsAuthenticated, permissions.BasePermission):
|
||||
"""Allows access to valid user, is active and not expired"""
|
||||
@@ -17,80 +14,12 @@ class IsValidUser(permissions.IsAuthenticated, permissions.BasePermission):
|
||||
and request.user.is_valid
|
||||
|
||||
|
||||
class IsAppUser(IsValidUser):
|
||||
"""Allows access only to app user """
|
||||
|
||||
class OnlySuperUser(IsValidUser):
|
||||
def has_permission(self, request, view):
|
||||
return super(IsAppUser, self).has_permission(request, view) \
|
||||
and request.user.is_app
|
||||
|
||||
|
||||
class IsSuperUser(IsValidUser):
|
||||
def has_permission(self, request, view):
|
||||
return super(IsSuperUser, self).has_permission(request, view) \
|
||||
return super().has_permission(request, view) \
|
||||
and request.user.is_superuser
|
||||
|
||||
|
||||
class IsSuperUserOrAppUser(IsSuperUser):
|
||||
def has_permission(self, request, view):
|
||||
if request.user.is_anonymous:
|
||||
return False
|
||||
return super(IsSuperUserOrAppUser, self).has_permission(request, view) \
|
||||
or request.user.is_app
|
||||
|
||||
|
||||
class IsSuperAuditor(IsValidUser):
|
||||
def has_permission(self, request, view):
|
||||
return super(IsSuperAuditor, self).has_permission(request, view) \
|
||||
and request.user.is_super_auditor
|
||||
|
||||
|
||||
class IsOrgAuditor(IsValidUser):
|
||||
def has_permission(self, request, view):
|
||||
if not current_org:
|
||||
return False
|
||||
return super(IsOrgAuditor, self).has_permission(request, view) \
|
||||
and current_org.can_audit_by(request.user)
|
||||
|
||||
|
||||
class IsOrgAdmin(IsValidUser):
|
||||
"""Allows access only to superuser"""
|
||||
|
||||
def has_permission(self, request, view):
|
||||
if not current_org:
|
||||
return False
|
||||
return super(IsOrgAdmin, self).has_permission(request, view) \
|
||||
and current_org.can_admin_by(request.user)
|
||||
|
||||
|
||||
class IsOrgAdminOrAppUser(IsValidUser):
|
||||
"""Allows access between superuser and app user"""
|
||||
|
||||
def has_permission(self, request, view):
|
||||
if not current_org:
|
||||
return False
|
||||
if request.user.is_anonymous:
|
||||
return False
|
||||
return super(IsOrgAdminOrAppUser, self).has_permission(request, view) \
|
||||
and (current_org.can_admin_by(request.user) or request.user.is_app)
|
||||
|
||||
|
||||
class IsOrgAdminOrAppUserOrUserReadonly(IsOrgAdminOrAppUser):
|
||||
def has_permission(self, request, view):
|
||||
if IsValidUser.has_permission(self, request, view) \
|
||||
and request.method in permissions.SAFE_METHODS:
|
||||
return True
|
||||
else:
|
||||
return IsOrgAdminOrAppUser.has_permission(self, request, view)
|
||||
|
||||
|
||||
class IsCurrentUserOrReadOnly(permissions.BasePermission):
|
||||
def has_object_permission(self, request, view, obj):
|
||||
if request.method in permissions.SAFE_METHODS:
|
||||
return True
|
||||
return obj == request.user
|
||||
|
||||
|
||||
class WithBootstrapToken(permissions.BasePermission):
|
||||
def has_permission(self, request, view):
|
||||
authorization = request.META.get('HTTP_AUTHORIZATION', '')
|
||||
@@ -100,21 +29,6 @@ class WithBootstrapToken(permissions.BasePermission):
|
||||
return settings.BOOTSTRAP_TOKEN == request_bootstrap_token
|
||||
|
||||
|
||||
class UserCanAnyPermCurrentOrg(permissions.BasePermission):
|
||||
def has_permission(self, request, view):
|
||||
return current_org.can_any_by(request.user)
|
||||
|
||||
|
||||
class UserCanUpdatePassword(permissions.BasePermission):
|
||||
def has_permission(self, request, view):
|
||||
return request.user.can_update_password()
|
||||
|
||||
|
||||
class UserCanUpdateSSHKey(permissions.BasePermission):
|
||||
def has_permission(self, request, view):
|
||||
return request.user.can_update_ssh_key()
|
||||
|
||||
|
||||
class NeedMFAVerify(permissions.BasePermission):
|
||||
def has_permission(self, request, view):
|
||||
if not settings.SECURITY_VIEW_AUTH_NEED_MFA:
|
||||
@@ -126,80 +40,7 @@ class NeedMFAVerify(permissions.BasePermission):
|
||||
raise MFAVerifyRequired()
|
||||
|
||||
|
||||
class CanUpdateDeleteUser(permissions.BasePermission):
|
||||
|
||||
@staticmethod
|
||||
def has_delete_object_permission(request, view, obj):
|
||||
if request.user.is_anonymous:
|
||||
return False
|
||||
if not request.user.can_admin_current_org:
|
||||
return False
|
||||
# 超级管理员 / 组织管理员
|
||||
if str(request.user.id) == str(obj.id):
|
||||
return False
|
||||
# 超级管理员
|
||||
if request.user.is_superuser:
|
||||
if obj.is_superuser and obj.username in ['admin']:
|
||||
return False
|
||||
return True
|
||||
# 组织管理员
|
||||
if obj.is_superuser:
|
||||
return False
|
||||
if obj.is_super_auditor:
|
||||
return False
|
||||
if obj.can_admin_current_org:
|
||||
return False
|
||||
return True
|
||||
|
||||
@staticmethod
|
||||
def has_update_object_permission(request, view, obj):
|
||||
if request.user.is_anonymous:
|
||||
return False
|
||||
if not request.user.can_admin_current_org:
|
||||
return False
|
||||
# 超级管理员 / 组织管理员
|
||||
if str(request.user.id) == str(obj.id):
|
||||
return True
|
||||
# 超级管理员
|
||||
if request.user.is_superuser:
|
||||
return True
|
||||
# 组织管理员
|
||||
if obj.is_superuser:
|
||||
return False
|
||||
if obj.is_super_auditor:
|
||||
return False
|
||||
return True
|
||||
|
||||
def has_object_permission(self, request, view, obj):
|
||||
if request.user.is_anonymous:
|
||||
return False
|
||||
if not request.user.can_admin_current_org:
|
||||
return False
|
||||
if request.method in ['DELETE']:
|
||||
return self.has_delete_object_permission(request, view, obj)
|
||||
if request.method in ['PUT', 'PATCH']:
|
||||
return self.has_update_object_permission(request, view, obj)
|
||||
return True
|
||||
|
||||
|
||||
class IsObjectOwner(IsValidUser):
|
||||
def has_object_permission(self, request, view, obj):
|
||||
return (super().has_object_permission(request, view, obj) and
|
||||
request.user == getattr(obj, 'user', None))
|
||||
|
||||
|
||||
class HasQueryParamsUserAndIsCurrentOrgMember(permissions.BasePermission):
|
||||
def has_permission(self, request, view):
|
||||
query_user_id = request.query_params.get('user')
|
||||
if not query_user_id or not is_uuid(query_user_id):
|
||||
return False
|
||||
query_user = current_org.get_members().filter(id=query_user_id).first()
|
||||
return bool(query_user)
|
||||
|
||||
|
||||
class OnlySuperUserCanList(IsValidUser):
|
||||
def has_permission(self, request, view):
|
||||
user = request.user
|
||||
if view.action == 'list' and not user.is_superuser:
|
||||
return False
|
||||
return True
|
||||
|
||||
Reference in New Issue
Block a user