fix: fix rbac to dev (#7636)

* feat: 添加 RBAC 应用模块

* feat: 添加 RBAC Model、API

* feat: 添加 RBAC Model、API 2

* feat: 添加 RBAC Model、API 3

* feat: 添加 RBAC Model、API 4

* feat: RBAC

* feat: RBAC

* feat: RBAC

* feat: RBAC

* feat: RBAC

* feat: RBAC 整理权限位

* feat: RBAC 整理权限位2

* feat: RBAC 整理权限位2

* feat: RBAC 整理权限位

* feat: RBAC 添加默认角色

* feat: RBAC 添加迁移文件；迁移用户角色->用户角色绑定

* feat: RBAC 添加迁移文件；迁移用户角色->用户角色绑定

* feat: RBAC 修改用户模块API

* feat: RBAC 添加组织模块迁移文件 & 修改组织模块API

* feat: RBAC 添加组织模块迁移文件 & 修改组织模块API

* feat: RBAC 修改用户角色属性的使用

* feat: RBAC No.1

* xxx

* perf: 暂存

* perf: ...

* perf(rbac): 添加 perms 到 profile serializer 中

* stash

* perf: 使用init

* perf: 修改migrations

* perf: rbac

* stash

* stash

* pref: 修改rbac

* stash it

* stash: 先去修复其他bug

* perf: 修改 role 添加 users

* pref: 修改 RBAC Model

* feat: 添加权限的 tree api

* stash: 暂存一下

* stash: 暂存一下

* perf: 修改 model verbose name

* feat: 添加model各种 verbose name

* perf: 生成 migrations

* perf: 优化权限位

* perf: 添加迁移脚本

* feat: 添加组织角色迁移

* perf: 添加迁移脚本

* stash

* perf: 添加migrateion

* perf: 暂存一下

* perf: 修改rbac

* perf: stash it

* fix: 迁移冲突

* fix: 迁移冲突

* perf: 暂存一下

* perf: 修改 rbac 逻辑

* stash: 暂存一下

* perf: 修改内置角色

* perf: 解决 root 组织的问题

* perf: stash it

* perf: 优化 rbac

* perf: 优化 rolebinding 处理

* perf: 完成用户离开组织的问题

* perf: 暂存一下

* perf: 修改翻译

* perf: 去掉了 IsSuperUser

* perf: IsAppUser 去掉完成

* perf: 修改 connection token 的权限

* perf: 去掉导入的问题

* perf: perms define 格式，修改 app 用户 的全新啊

* perf: 修改 permission

* perf: 去掉一些 org admin

* perf: 去掉部分 org admin

* perf: 再去掉点 org admin role

* perf: 再去掉部分 org admin

* perf: user 角色搜索

* perf: 去掉很多 js

* perf: 添加权限位

* perf: 修改权限

* perf: 去掉一个 todo

* merge: with dev

* fix: 修复冲突

Co-authored-by: Bai <bugatti_it@163.com>
Co-authored-by: Michael Bai <baijiangjie@gmail.com>
Co-authored-by: ibuler <ibuler@qq.com>

apps/rbac/api/__init__.py

@@ -0,0 +1,4 @@
+from .permission import *
+from .role import *
+from .rolebinding import *
+

apps/rbac/api/permission.py

@@ -0,0 +1,54 @@
+from rest_framework.response import Response
+from rest_framework.decorators import action
+from django.shortcuts import get_object_or_404
+
+from common.tree import TreeNodeSerializer
+from common.drf.api import JMSModelViewSet
+from ..models import Permission, Role
+from ..serializers import PermissionSerializer
+
+__all__ = ['PermissionViewSet']
+
+
+class PermissionViewSet(JMSModelViewSet):
+    filterset_fields = ['codename']
+    serializer_classes = {
+        'get_tree': TreeNodeSerializer,
+        'default': PermissionSerializer
+    }
+    scope = 'org'
+    check_disabled = False
+    http_method_names = ['get', 'option', 'head']
+
+    @action(methods=['GET'], detail=False, url_path='tree')
+    def get_tree(self, request, *args, **kwargs):
+        queryset = self.filter_queryset(self.get_queryset()).distinct()
+        tree_nodes = Permission.create_tree_nodes(
+            queryset, scope=self.scope, check_disabled=self.check_disabled
+        )
+        serializer = self.get_serializer(tree_nodes, many=True)
+        return Response(serializer.data)
+
+    def get_queryset(self):
+        self.scope = self.request.query_params.get('scope') or 'org'
+        role_id = self.request.query_params.get('role')
+
+        if role_id:
+            role = get_object_or_404(Role, pk=role_id)
+            self.scope = role.scope
+            queryset = role.get_permissions()
+        else:
+            queryset = Permission.get_permissions(self.scope)
+        queryset = queryset.prefetch_related('content_type')
+        return queryset
+
+
+# class UserPermsApi(ListAPIView):
+#     serializer_class = UserPermsSerializer
+#     permission_classes = (IsValidUser,)
+#
+#     def list(self, request, *args, **kwargs):
+#         perms = RoleBinding.get_user_perms(request.user)
+#         serializer = super().get_serializer(data={'perms': perms})
+#         return Res
+

apps/rbac/api/role.py

@@ -0,0 +1,77 @@
+from django.db.models import Count
+from django.utils.translation import ugettext as _
+from rest_framework.exceptions import PermissionDenied
+from rest_framework.decorators import action
+
+from common.drf.api import JMSModelViewSet
+from ..serializers import RoleSerializer, RoleUserSerializer
+from ..models import Role, SystemRole, OrgRole
+from .permission import PermissionViewSet
+
+__all__ = [
+    'RoleViewSet', 'RolePermissionsViewSet',
+    'SystemRoleViewSet', 'OrgRoleViewSet'
+]
+
+
+class RoleViewSet(JMSModelViewSet):
+    queryset = Role.objects.all()
+    serializer_classes = {
+        'default': RoleSerializer,
+        'users': RoleUserSerializer,
+    }
+    filterset_fields = ['name', 'scope', 'builtin']
+    search_fields = filterset_fields
+    rbac_perms = {
+        'users': 'rbac.view_rolebinding'
+    }
+
+    def perform_destroy(self, instance):
+        if instance.builtin:
+            error = _("Internal role, can't be destroy")
+            raise PermissionDenied(error)
+        return super().perform_destroy(instance)
+
+    def perform_update(self, serializer):
+        instance = serializer.instance
+        if instance.builtin:
+            error = _("Internal role, can't be update")
+            raise PermissionDenied(error)
+        return super().perform_update(serializer)
+
+    def get_queryset(self):
+        queryset = super().get_queryset()\
+            .annotate(permissions_amount=Count('permissions'))
+        return queryset
+
+    @action(methods=['GET'], detail=True)
+    def users(self, *args, **kwargs):
+        role = self.get_object()
+        queryset = role.users
+        return self.get_paginated_response_with_query_set(queryset)
+
+
+class SystemRoleViewSet(RoleViewSet):
+    queryset = SystemRole.objects.all()
+
+
+class OrgRoleViewSet(RoleViewSet):
+    queryset = OrgRole.objects.all()
+
+
+# Sub view set
+class RolePermissionsViewSet(PermissionViewSet):
+    rbac_perms = (
+        ('get_tree', 'role.view_role'),
+    )
+    http_method_names = ['get', 'option']
+    check_disabled = False
+
+    def get_queryset(self):
+        role_id = self.kwargs.get('role_pk')
+        role = Role.objects.get(id=role_id)
+        self.scope = role.scope
+        self.check_disabled = role.builtin
+        queryset = role.get_permissions()\
+            .prefetch_related('content_type')
+        return queryset

apps/rbac/api/rolebinding.py

@@ -0,0 +1,52 @@
+
+from django.db.models import F, Value
+from django.db.models.functions import Concat
+
+from orgs.mixins.api import OrgBulkModelViewSet
+from orgs.utils import current_org
+from .. import serializers
+from ..models import RoleBinding, SystemRoleBinding, OrgRoleBinding
+
+__all__ = ['RoleBindingViewSet', 'SystemRoleBindingViewSet', 'OrgRoleBindingViewSet']
+
+
+class RoleBindingViewSet(OrgBulkModelViewSet):
+    model = RoleBinding
+    serializer_class = serializers.RoleBindingSerializer
+    filterset_fields = [
+        'scope', 'user', 'role', 'org',
+        'user__name', 'user__username', 'role__name'
+    ]
+    search_fields = [
+        'user__name', 'user__username', 'role__name'
+    ]
+
+    def get_queryset(self):
+        queryset = super().get_queryset()\
+            .prefetch_related('user', 'role') \
+            .annotate(
+                user_display=Concat(
+                    F('user__name'), Value('('),
+                    F('user__username'), Value(')')
+                ),
+                role_display=F('role__name')
+            )
+        return queryset
+
+
+class SystemRoleBindingViewSet(RoleBindingViewSet):
+    model = SystemRoleBinding
+    serializer_class = serializers.SystemRoleBindingSerializer
+
+
+class OrgRoleBindingViewSet(RoleBindingViewSet):
+    model = OrgRoleBinding
+    serializer_class = serializers.OrgRoleBindingSerializer
+
+    def perform_bulk_create(self, serializer):
+        validated_data = serializer.validated_data
+        bindings = [
+            OrgRoleBinding(role=d['role'], user=d['user'], org_id=current_org.id, scope='org')
+            for d in validated_data
+        ]
+        OrgRoleBinding.objects.bulk_create(bindings, ignore_conflicts=True)