fix: fix rbac to dev (#7636)

* feat: 添加 RBAC 应用模块 * feat: 添加 RBAC Model、API * feat: 添加 RBAC Model、API 2 * feat: 添加 RBAC Model、API 3 * feat: 添加 RBAC Model、API 4 * feat: RBAC * feat: RBAC * feat: RBAC * feat: RBAC * feat: RBAC * feat: RBAC 整理权限位 * feat: RBAC 整理权限位2 * feat: RBAC 整理权限位2 * feat: RBAC 整理权限位 * feat: RBAC 添加默认角色 * feat: RBAC 添加迁移文件；迁移用户角色->用户角色绑定 * feat: RBAC 添加迁移文件；迁移用户角色->用户角色绑定 * feat: RBAC 修改用户模块API * feat: RBAC 添加组织模块迁移文件 & 修改组织模块API * feat: RBAC 添加组织模块迁移文件 & 修改组织模块API * feat: RBAC 修改用户角色属性的使用 * feat: RBAC No.1 * xxx * perf: 暂存 * perf: ... * perf(rbac): 添加 perms 到 profile serializer 中 * stash * perf: 使用init * perf: 修改migrations * perf: rbac * stash * stash * pref: 修改rbac * stash it * stash: 先去修复其他bug * perf: 修改 role 添加 users * pref: 修改 RBAC Model * feat: 添加权限的 tree api * stash: 暂存一下 * stash: 暂存一下 * perf: 修改 model verbose name * feat: 添加model各种 verbose name * perf: 生成 migrations * perf: 优化权限位 * perf: 添加迁移脚本 * feat: 添加组织角色迁移 * perf: 添加迁移脚本 * stash * perf: 添加migrateion * perf: 暂存一下 * perf: 修改rbac * perf: stash it * fix: 迁移冲突 * fix: 迁移冲突 * perf: 暂存一下 * perf: 修改 rbac 逻辑 * stash: 暂存一下 * perf: 修改内置角色 * perf: 解决 root 组织的问题 * perf: stash it * perf: 优化 rbac * perf: 优化 rolebinding 处理 * perf: 完成用户离开组织的问题 * perf: 暂存一下 * perf: 修改翻译 * perf: 去掉了 IsSuperUser * perf: IsAppUser 去掉完成 * perf: 修改 connection token 的权限 * perf: 去掉导入的问题 * perf: perms define 格式，修改 app 用户的全新啊 * perf: 修改 permission * perf: 去掉一些 org admin * perf: 去掉部分 org admin * perf: 再去掉点 org admin role * perf: 再去掉部分 org admin * perf: user 角色搜索 * perf: 去掉很多 js * perf: 添加权限位 * perf: 修改权限 * perf: 去掉一个 todo * merge: with dev * fix: 修复冲突 Co-authored-by: Bai <bugatti_it@163.com> Co-authored-by: Michael Bai <baijiangjie@gmail.com> Co-authored-by: ibuler <ibuler@qq.com>
2025-09-11 04:09:45 +00:00 · 2022-02-17 20:13:31 +08:00
parent b088362ae3
commit e259d2a9e9
263 changed files with 3049 additions and 62465 deletions
--- a/apps/rbac/api/role.py
+++ b/apps/rbac/api/role.py
@@ -0,0 +1,77 @@
+from django.db.models import Count
+from django.utils.translation import ugettext as _
+from rest_framework.exceptions import PermissionDenied
+from rest_framework.decorators import action
+
+from common.drf.api import JMSModelViewSet
+from ..serializers import RoleSerializer, RoleUserSerializer
+from ..models import Role, SystemRole, OrgRole
+from .permission import PermissionViewSet
+
+__all__ = [
+    'RoleViewSet', 'RolePermissionsViewSet',
+    'SystemRoleViewSet', 'OrgRoleViewSet'
+]
+
+
+class RoleViewSet(JMSModelViewSet):
+    queryset = Role.objects.all()
+    serializer_classes = {
+        'default': RoleSerializer,
+        'users': RoleUserSerializer,
+    }
+    filterset_fields = ['name', 'scope', 'builtin']
+    search_fields = filterset_fields
+    rbac_perms = {
+        'users': 'rbac.view_rolebinding'
+    }
+
+    def perform_destroy(self, instance):
+        if instance.builtin:
+            error = _("Internal role, can't be destroy")
+            raise PermissionDenied(error)
+        return super().perform_destroy(instance)
+
+    def perform_update(self, serializer):
+        instance = serializer.instance
+        if instance.builtin:
+            error = _("Internal role, can't be update")
+            raise PermissionDenied(error)
+        return super().perform_update(serializer)
+
+    def get_queryset(self):
+        queryset = super().get_queryset()\
+            .annotate(permissions_amount=Count('permissions'))
+        return queryset
+
+    @action(methods=['GET'], detail=True)
+    def users(self, *args, **kwargs):
+        role = self.get_object()
+        queryset = role.users
+        return self.get_paginated_response_with_query_set(queryset)
+
+
+class SystemRoleViewSet(RoleViewSet):
+    queryset = SystemRole.objects.all()
+
+
+class OrgRoleViewSet(RoleViewSet):
+    queryset = OrgRole.objects.all()
+
+
+# Sub view set
+class RolePermissionsViewSet(PermissionViewSet):
+    rbac_perms = (
+        ('get_tree', 'role.view_role'),
+    )
+    http_method_names = ['get', 'option']
+    check_disabled = False
+
+    def get_queryset(self):
+        role_id = self.kwargs.get('role_pk')
+        role = Role.objects.get(id=role_id)
+        self.scope = role.scope
+        self.check_disabled = role.builtin
+        queryset = role.get_permissions()\
+            .prefetch_related('content_type')
+        return queryset