fix: fix rbac to dev (#7636)

* feat: 添加 RBAC 应用模块 * feat: 添加 RBAC Model、API * feat: 添加 RBAC Model、API 2 * feat: 添加 RBAC Model、API 3 * feat: 添加 RBAC Model、API 4 * feat: RBAC * feat: RBAC * feat: RBAC * feat: RBAC * feat: RBAC * feat: RBAC 整理权限位 * feat: RBAC 整理权限位2 * feat: RBAC 整理权限位2 * feat: RBAC 整理权限位 * feat: RBAC 添加默认角色 * feat: RBAC 添加迁移文件；迁移用户角色->用户角色绑定 * feat: RBAC 添加迁移文件；迁移用户角色->用户角色绑定 * feat: RBAC 修改用户模块API * feat: RBAC 添加组织模块迁移文件 & 修改组织模块API * feat: RBAC 添加组织模块迁移文件 & 修改组织模块API * feat: RBAC 修改用户角色属性的使用 * feat: RBAC No.1 * xxx * perf: 暂存 * perf: ... * perf(rbac): 添加 perms 到 profile serializer 中 * stash * perf: 使用init * perf: 修改migrations * perf: rbac * stash * stash * pref: 修改rbac * stash it * stash: 先去修复其他bug * perf: 修改 role 添加 users * pref: 修改 RBAC Model * feat: 添加权限的 tree api * stash: 暂存一下 * stash: 暂存一下 * perf: 修改 model verbose name * feat: 添加model各种 verbose name * perf: 生成 migrations * perf: 优化权限位 * perf: 添加迁移脚本 * feat: 添加组织角色迁移 * perf: 添加迁移脚本 * stash * perf: 添加migrateion * perf: 暂存一下 * perf: 修改rbac * perf: stash it * fix: 迁移冲突 * fix: 迁移冲突 * perf: 暂存一下 * perf: 修改 rbac 逻辑 * stash: 暂存一下 * perf: 修改内置角色 * perf: 解决 root 组织的问题 * perf: stash it * perf: 优化 rbac * perf: 优化 rolebinding 处理 * perf: 完成用户离开组织的问题 * perf: 暂存一下 * perf: 修改翻译 * perf: 去掉了 IsSuperUser * perf: IsAppUser 去掉完成 * perf: 修改 connection token 的权限 * perf: 去掉导入的问题 * perf: perms define 格式，修改 app 用户的全新啊 * perf: 修改 permission * perf: 去掉一些 org admin * perf: 去掉部分 org admin * perf: 再去掉点 org admin role * perf: 再去掉部分 org admin * perf: user 角色搜索 * perf: 去掉很多 js * perf: 添加权限位 * perf: 修改权限 * perf: 去掉一个 todo * merge: with dev * fix: 修复冲突 Co-authored-by: Bai <bugatti_it@163.com> Co-authored-by: Michael Bai <baijiangjie@gmail.com> Co-authored-by: ibuler <ibuler@qq.com>
2025-09-11 04:09:45 +00:00 · 2022-02-17 20:13:31 +08:00
parent b088362ae3
commit e259d2a9e9
263 changed files with 3049 additions and 62465 deletions
--- a/apps/rbac/const.py
+++ b/apps/rbac/const.py
@@ -0,0 +1,76 @@
+from django.db import models
+from django.utils.translation import ugettext_lazy as _
+
+
+class Scope(models.TextChoices):
+    system = 'system', _('System')
+    org = 'org', _('Organization')
+
+
+exclude_permissions = (
+    # ('App', 'Model', 'Action', 'Resource') Model 和 Resource 可能不同
+    # users.add_user
+    ('auth', '*', '*', '*'),
+    ('authentication', 'loginconfirmsetting', '*', '*'),
+    ('captcha', '*', '*', '*'),
+    ('contenttypes', '*', '*', '*'),
+    ('django_cas_ng', '*', '*', '*'),
+    ('django_celery_beat', '*', '*', '*'),
+    ('jms_oidc_rp', '*', '*', '*'),
+    ('admin', '*', '*', '*'),
+    ('sessions', '*', '*', '*'),
+    ('notifications', '*', '*', '*'),
+
+    ('applications', 'historicalaccount', '*', '*'),
+    ('applications', 'databaseapp', '*', '*'),
+    ('applications', 'k8sapp', '*', '*'),
+    ('applications', 'remoteapp', '*', '*'),
+    ('assets', 'adminuser', '*', '*'),
+    ('assets', 'assetgroup', '*', '*'),
+    ('assets', 'cluster', '*', '*'),
+    ('assets', 'favoriteasset', '*', '*'),
+    ('assets', 'historicalauthbook', '*', '*'),
+    ('assets', 'assetuser', '*', '*'),
+    ('authentication', 'privatetoken', '*', '*'),
+    ('perms', 'databaseapppermission', '*', '*'),
+    ('perms', 'k8sapppermission', '*', '*'),
+    ('perms', 'remoteapppermission', '*', '*'),
+    ('perms', 'userassetgrantedtreenoderelation', '*', '*'),
+    ('perms', 'usergrantedmappingnode', '*', '*'),
+    ('perms', 'permnode', '*', '*'),
+    ('perms', 'rebuildusertreetask', '*', '*'),
+    ('rbac', 'contenttype', '*', '*'),
+    ('rbac', 'permission', 'add,delete,change', 'permission'),
+    ('ops', 'adhoc', '*', '*'),
+    ('ops', 'adhocexecution', '*', '*'),
+    ('ops', 'celerytask', '*', '*'),
+    ('ops', 'task', 'add,change', 'task'),
+    ('orgs', 'organizationmember', '*', '*'),
+    ('settings', 'setting', 'add,delete', 'setting'),
+    ('audits', 'operatelog', 'add,delete,change', 'operatelog'),
+    ('audits', 'passwordchangelog', 'add,change,delete', 'passwordchangelog'),
+    ('audits', 'userloginlog', 'change,delete,change', 'userloginlog'),
+    ('audits', 'ftplog', 'change,delete', 'ftplog'),
+    ('terminal', 'session', 'delete', 'session'),
+    ('tickets', '*', '*', '*'),
+    ('users', 'userpasswordhistory', '*', '*'),
+    ('xpack', 'interface', 'add,delete', 'interface'),
+)
+
+
+only_system_permissions = (
+    ('users', 'user', 'delete', 'user'),
+    ('rbac', 'role', 'delete,add,change', 'role'),
+    ('rbac', 'systemrole', '*', '*'),
+    ('rbac', 'rolebinding', '*', '*'),
+    ('rbac', 'systemrolebinding', '*', '*'),
+    ('orgs', 'organization', '*', '*'),
+    ('xpack', 'license', '*', '*'),
+    ('settings', 'setting', '*', '*'),
+)
+
+only_org_permissions = (
+)
+
+system_exclude_permissions = list(exclude_permissions) + list(only_org_permissions)
+org_exclude_permissions = list(exclude_permissions) + list(only_system_permissions)