mirror of
https://github.com/jumpserver/jumpserver.git
synced 2025-09-18 00:08:31 +00:00
fix: fix rbac to dev (#7636)
* feat: 添加 RBAC 应用模块 * feat: 添加 RBAC Model、API * feat: 添加 RBAC Model、API 2 * feat: 添加 RBAC Model、API 3 * feat: 添加 RBAC Model、API 4 * feat: RBAC * feat: RBAC * feat: RBAC * feat: RBAC * feat: RBAC * feat: RBAC 整理权限位 * feat: RBAC 整理权限位2 * feat: RBAC 整理权限位2 * feat: RBAC 整理权限位 * feat: RBAC 添加默认角色 * feat: RBAC 添加迁移文件；迁移用户角色->用户角色绑定 * feat: RBAC 添加迁移文件；迁移用户角色->用户角色绑定 * feat: RBAC 修改用户模块API * feat: RBAC 添加组织模块迁移文件 & 修改组织模块API * feat: RBAC 添加组织模块迁移文件 & 修改组织模块API * feat: RBAC 修改用户角色属性的使用 * feat: RBAC No.1 * xxx * perf: 暂存 * perf: ... * perf(rbac): 添加 perms 到 profile serializer 中 * stash * perf: 使用init * perf: 修改migrations * perf: rbac * stash * stash * pref: 修改rbac * stash it * stash: 先去修复其他bug * perf: 修改 role 添加 users * pref: 修改 RBAC Model * feat: 添加权限的 tree api * stash: 暂存一下 * stash: 暂存一下 * perf: 修改 model verbose name * feat: 添加model各种 verbose name * perf: 生成 migrations * perf: 优化权限位 * perf: 添加迁移脚本 * feat: 添加组织角色迁移 * perf: 添加迁移脚本 * stash * perf: 添加migrateion * perf: 暂存一下 * perf: 修改rbac * perf: stash it * fix: 迁移冲突 * fix: 迁移冲突 * perf: 暂存一下 * perf: 修改 rbac 逻辑 * stash: 暂存一下 * perf: 修改内置角色 * perf: 解决 root 组织的问题 * perf: stash it * perf: 优化 rbac * perf: 优化 rolebinding 处理 * perf: 完成用户离开组织的问题 * perf: 暂存一下 * perf: 修改翻译 * perf: 去掉了 IsSuperUser * perf: IsAppUser 去掉完成 * perf: 修改 connection token 的权限 * perf: 去掉导入的问题 * perf: perms define 格式，修改 app 用户 的全新啊 * perf: 修改 permission * perf: 去掉一些 org admin * perf: 去掉部分 org admin * perf: 再去掉点 org admin role * perf: 再去掉部分 org admin * perf: user 角色搜索 * perf: 去掉很多 js * perf: 添加权限位 * perf: 修改权限 * perf: 去掉一个 todo * merge: with dev * fix: 修复冲突 Co-authored-by: Bai <bugatti_it@163.com> Co-authored-by: Michael Bai <baijiangjie@gmail.com> Co-authored-by: ibuler <ibuler@qq.com>
This commit is contained in:
fit2bot
GitHub
4
apps/rbac/models/__init__.py
Normal file
4
apps/rbac/models/__init__.py
Normal file
@@ -0,0 +1,4 @@
|
||||
from .permission import *
|
||||
from .rolebinding import *
|
||||
from .role import *
|
||||
from .menu import *
|
||||
18
apps/rbac/models/menu.py
Normal file
18
apps/rbac/models/menu.py
Normal file
@@ -0,0 +1,18 @@
|
||||
import uuid
|
||||
|
||||
from django.utils.translation import gettext_lazy as _
|
||||
from django.db import models
|
||||
|
||||
|
||||
class MenuPermission(models.Model):
|
||||
""" 附加权限位类，用来定义无资源类的权限，不做实体资源 """
|
||||
id = models.UUIDField(default=uuid.uuid4, primary_key=True)
|
||||
|
||||
class Meta:
|
||||
default_permissions = []
|
||||
verbose_name = _('Menu permission')
|
||||
permissions = [
|
||||
('view_adminview', _('Admin view')),
|
||||
('view_auditview', _('Audit view')),
|
||||
('view_userview', _('User view')),
|
||||
]
|
||||
279
apps/rbac/models/permission.py
Normal file
279
apps/rbac/models/permission.py
Normal file
@@ -0,0 +1,279 @@
|
||||
import uuid
|
||||
from typing import Callable
|
||||
|
||||
from django.db import models
|
||||
from django.db.models import F, Count, Q
|
||||
from django.apps import apps
|
||||
from django.utils.translation import ugettext_lazy as _, ugettext
|
||||
from django.contrib.auth.models import Permission as DjangoPermission
|
||||
from django.contrib.auth.models import ContentType as DjangoContentType
|
||||
|
||||
from common.tree import TreeNode
|
||||
from .. import const
|
||||
|
||||
Scope = const.Scope
|
||||
|
||||
__all__ = ['Permission', 'ContentType']
|
||||
|
||||
|
||||
class ContentType(DjangoContentType):
|
||||
class Meta:
|
||||
proxy = True
|
||||
|
||||
|
||||
class PermissionTreeUtil:
|
||||
get_permissions: Callable
|
||||
|
||||
def __init__(self, permissions, scope, check_disabled=False):
|
||||
self.permissions = self.prefetch_permissions(permissions)
|
||||
self.all_permissions = self.prefetch_permissions(
|
||||
Permission.get_permissions(scope)
|
||||
)
|
||||
self.check_disabled = check_disabled
|
||||
|
||||
@staticmethod
|
||||
def prefetch_permissions(perms):
|
||||
return perms.select_related('content_type') \
|
||||
.annotate(app=F('content_type__app_label')) \
|
||||
.annotate(model=F('content_type__model'))
|
||||
|
||||
def _create_apps_tree_nodes(self):
|
||||
app_counts = self.all_permissions.values('app')\
|
||||
.order_by('app').annotate(count=Count('app'))
|
||||
app_checked_counts = self.permissions.values('app')\
|
||||
.order_by('app').annotate(count=Count('app'))
|
||||
app_checked_counts_mapper = {
|
||||
i['app']: i['count']
|
||||
for i in app_checked_counts
|
||||
}
|
||||
all_apps = apps.get_app_configs()
|
||||
apps_name_mapper = {
|
||||
app.name: app.verbose_name
|
||||
for app in all_apps if hasattr(app, 'verbose_name')
|
||||
}
|
||||
nodes = []
|
||||
|
||||
for i in app_counts:
|
||||
app = i['app']
|
||||
total_counts = i['count']
|
||||
check_counts = app_checked_counts_mapper.get(app, 0)
|
||||
name = apps_name_mapper.get(app, app)
|
||||
full_name = f'{name}({check_counts}/{total_counts})'
|
||||
|
||||
node = TreeNode(**{
|
||||
'id': app,
|
||||
'name': full_name,
|
||||
'title': name,
|
||||
'pId': '$ROOT$',
|
||||
'isParent': True,
|
||||
'open': False,
|
||||
'chkDisabled': self.check_disabled,
|
||||
'checked': total_counts == check_counts,
|
||||
'iconSkin': '',
|
||||
'meta': {
|
||||
'type': 'app',
|
||||
}
|
||||
})
|
||||
nodes.append(node)
|
||||
return nodes
|
||||
|
||||
def _create_models_tree_nodes(self):
|
||||
content_types = ContentType.objects.all()
|
||||
|
||||
model_counts = self.all_permissions \
|
||||
.values('model', 'app', 'content_type') \
|
||||
.order_by('content_type') \
|
||||
.annotate(count=Count('content_type'))
|
||||
model_check_counts = self.permissions \
|
||||
.values('content_type', 'model') \
|
||||
.order_by('content_type') \
|
||||
.annotate(count=Count('content_type'))
|
||||
model_counts_mapper = {
|
||||
i['content_type']: i['count']
|
||||
for i in model_counts
|
||||
}
|
||||
model_check_counts_mapper = {
|
||||
i['content_type']: i['count']
|
||||
for i in model_check_counts
|
||||
}
|
||||
|
||||
nodes = []
|
||||
for ct in content_types:
|
||||
total_counts = model_counts_mapper.get(ct.id, 0)
|
||||
if total_counts == 0:
|
||||
continue
|
||||
check_counts = model_check_counts_mapper.get(ct.id, 0)
|
||||
model_id = f'{ct.app_label}_{ct.model}'
|
||||
name = f'{ct.name}({check_counts}/{total_counts})'
|
||||
node = TreeNode(**{
|
||||
'id': model_id,
|
||||
'name': name,
|
||||
'title': name,
|
||||
'pId': ct.app_label,
|
||||
'chkDisabled': self.check_disabled,
|
||||
'isParent': True,
|
||||
'open': False,
|
||||
'checked': total_counts == check_counts,
|
||||
'meta': {
|
||||
'type': 'model',
|
||||
}
|
||||
})
|
||||
nodes.append(node)
|
||||
return nodes
|
||||
|
||||
@staticmethod
|
||||
def _get_permission_name(p, content_types_name_mapper):
|
||||
code_name = p.codename
|
||||
action_mapper = {
|
||||
'add': ugettext('Create'),
|
||||
'view': ugettext('View'),
|
||||
'change': ugettext('Update'),
|
||||
'delete': ugettext('Delete')
|
||||
}
|
||||
name = ''
|
||||
ct = ''
|
||||
if 'add_' in p.codename:
|
||||
name = action_mapper['add']
|
||||
ct = code_name.replace('add_', '')
|
||||
elif 'view_' in p.codename:
|
||||
name = action_mapper['view']
|
||||
ct = code_name.replace('view_', '')
|
||||
elif 'change_' in p.codename:
|
||||
name = action_mapper['change']
|
||||
ct = code_name.replace('change_', '')
|
||||
elif 'delete' in code_name:
|
||||
name = action_mapper['delete']
|
||||
ct = code_name.replace('delete_', '')
|
||||
|
||||
if ct in content_types_name_mapper:
|
||||
name += content_types_name_mapper[ct]
|
||||
else:
|
||||
name = p.name
|
||||
return name
|
||||
|
||||
def _create_perms_tree_nodes(self):
|
||||
permissions_id = self.permissions.values_list('id', flat=True)
|
||||
nodes = []
|
||||
content_types = ContentType.objects.all()
|
||||
content_types_name_mapper = {ct.model: ct.name for ct in content_types}
|
||||
for p in self.all_permissions:
|
||||
model_id = f'{p.app}_{p.model}'
|
||||
name = self._get_permission_name(p, content_types_name_mapper)
|
||||
|
||||
node = TreeNode(**{
|
||||
'id': p.id,
|
||||
'name': name + '({})'.format(p.app_label_codename),
|
||||
'title': p.name,
|
||||
'pId': model_id,
|
||||
'isParent': False,
|
||||
'chkDisabled': self.check_disabled,
|
||||
'iconSkin': 'file',
|
||||
'checked': p.id in permissions_id,
|
||||
'open': False,
|
||||
'meta': {
|
||||
'type': 'perm',
|
||||
}
|
||||
})
|
||||
nodes.append(node)
|
||||
return nodes
|
||||
|
||||
def _create_root_tree_node(self):
|
||||
total_counts = self.all_permissions.count()
|
||||
check_counts = self.permissions.count()
|
||||
node = TreeNode(**{
|
||||
'id': '$ROOT$',
|
||||
'name': f'所有权限({check_counts}/{total_counts})',
|
||||
'title': '所有权限',
|
||||
'pId': '',
|
||||
'chkDisabled': self.check_disabled,
|
||||
'isParent': True,
|
||||
'checked': total_counts == check_counts,
|
||||
'open': True,
|
||||
'meta': {
|
||||
'type': 'root',
|
||||
}
|
||||
})
|
||||
return node
|
||||
|
||||
def create_tree_nodes(self):
|
||||
nodes = [self._create_root_tree_node()]
|
||||
apps_nodes = self._create_apps_tree_nodes()
|
||||
models_nodes = self._create_models_tree_nodes()
|
||||
perms_nodes = self._create_perms_tree_nodes()
|
||||
|
||||
nodes += apps_nodes + models_nodes + perms_nodes
|
||||
return nodes
|
||||
|
||||
|
||||
class Permission(DjangoPermission):
|
||||
""" 权限类 """
|
||||
class Meta:
|
||||
proxy = True
|
||||
verbose_name = _('Permission')
|
||||
|
||||
@classmethod
|
||||
def to_perms(cls, queryset):
|
||||
perms = queryset.values_list(
|
||||
'content_type__app_label', 'codename'
|
||||
)
|
||||
perms = list(set(["%s.%s" % (ct, codename) for ct, codename in perms]))
|
||||
return sorted(perms)
|
||||
|
||||
@property
|
||||
def app_label_codename(self):
|
||||
return '%s.%s' % (self.content_type.app_label, self.codename)
|
||||
|
||||
@classmethod
|
||||
def get_define_permissions_q(cls, defines):
|
||||
"""
|
||||
:param defines: [(app, model, codename),]
|
||||
:return:
|
||||
"""
|
||||
if not defines:
|
||||
return None
|
||||
q = Q()
|
||||
|
||||
for define in defines:
|
||||
app_label, model, actions, resource, *args = list(define)
|
||||
kwargs = {}
|
||||
if app_label != '*':
|
||||
kwargs['content_type__app_label'] = app_label
|
||||
if model != '*':
|
||||
kwargs['content_type__model'] = model
|
||||
|
||||
actions_list = [a.strip() for a in actions.split(',')]
|
||||
actions_regex = '|'.join(actions_list)
|
||||
if actions == '*' and resource == '*':
|
||||
pass
|
||||
elif actions == '*' and resource != '*':
|
||||
kwargs['codename__iregex'] = r'[a-z]+_{}'.format(resource)
|
||||
elif actions != '*' and resource == '*':
|
||||
kwargs['codename__iregex'] = r'({})_\w+'.format(actions_regex)
|
||||
else:
|
||||
kwargs['codename__iregex'] = r'({})_{}'.format(actions_regex, resource)
|
||||
q |= Q(**kwargs)
|
||||
return q
|
||||
|
||||
@classmethod
|
||||
def clean_permissions(cls, permissions, scope=Scope.system):
|
||||
if scope == Scope.org:
|
||||
excludes = const.org_exclude_permissions
|
||||
else:
|
||||
excludes = const.system_exclude_permissions
|
||||
q = cls.get_define_permissions_q(excludes)
|
||||
if q:
|
||||
permissions = permissions.exclude(q)
|
||||
return permissions
|
||||
|
||||
@staticmethod
|
||||
def create_tree_nodes(permissions, scope, check_disabled=False):
|
||||
util = PermissionTreeUtil(permissions, scope, check_disabled)
|
||||
return util.create_tree_nodes()
|
||||
|
||||
@classmethod
|
||||
def get_permissions(cls, scope):
|
||||
permissions = cls.objects.all()
|
||||
permissions = cls.clean_permissions(permissions, scope=scope)
|
||||
return permissions
|
||||
|
||||
|
||||
135
apps/rbac/models/role.py
Normal file
135
apps/rbac/models/role.py
Normal file
@@ -0,0 +1,135 @@
|
||||
from django.utils.translation import ugettext_lazy as _, gettext
|
||||
from django.db import models
|
||||
|
||||
from common.db.models import JMSModel
|
||||
from common.utils import lazyproperty
|
||||
from .permission import Permission
|
||||
from ..builtin import BuiltinRole
|
||||
from .. import const
|
||||
|
||||
__all__ = ['Role', 'SystemRole', 'OrgRole']
|
||||
|
||||
|
||||
class SystemRoleManager(models.Manager):
|
||||
def get_queryset(self):
|
||||
queryset = super().get_queryset()
|
||||
return queryset.filter(scope=const.Scope.system)
|
||||
|
||||
|
||||
class OrgRoleManager(models.Manager):
|
||||
def get_queryset(self):
|
||||
queryset = super().get_queryset()
|
||||
return queryset.filter(scope=const.Scope.org)
|
||||
|
||||
|
||||
class Role(JMSModel):
|
||||
""" 定义 角色 ｜ 角色-权限 关系 """
|
||||
Scope = const.Scope
|
||||
|
||||
name = models.CharField(max_length=128, verbose_name=_('Name'))
|
||||
scope = models.CharField(
|
||||
max_length=128, choices=Scope.choices, default=Scope.system, verbose_name=_('Scope')
|
||||
)
|
||||
permissions = models.ManyToManyField(
|
||||
'rbac.Permission', related_name='roles', blank=True, verbose_name=_('Permissions')
|
||||
)
|
||||
builtin = models.BooleanField(default=False, verbose_name=_('Built-in'))
|
||||
comment = models.TextField(max_length=128, default='', blank=True, verbose_name=_('Comment'))
|
||||
|
||||
BuiltinRole = BuiltinRole
|
||||
objects = models.Manager()
|
||||
org_roles = OrgRoleManager()
|
||||
system_roles = SystemRoleManager()
|
||||
|
||||
class Meta:
|
||||
unique_together = [('name', 'scope')]
|
||||
verbose_name = _('Role')
|
||||
|
||||
def __str__(self):
|
||||
return '%s(%s)' % (self.name, self.get_scope_display())
|
||||
|
||||
def is_system_admin(self):
|
||||
return self.name == self.BuiltinRole.system_admin.name and self.builtin
|
||||
|
||||
def is_org_admin(self):
|
||||
return self.name == self.BuiltinRole.org_admin.name and self.builtin
|
||||
|
||||
def is_admin(self):
|
||||
yes = self.is_system_admin() or self.is_org_admin()
|
||||
return yes
|
||||
|
||||
@staticmethod
|
||||
def get_scope_roles_perms(roles, scope):
|
||||
has_admin = any([r.is_admin() for r in roles])
|
||||
if has_admin:
|
||||
perms = Permission.objects.all()
|
||||
else:
|
||||
perms = Permission.objects.filter(roles__in=roles).distinct()
|
||||
perms = Permission.clean_permissions(perms, scope=scope)
|
||||
return perms
|
||||
|
||||
@classmethod
|
||||
def get_roles_permissions(cls, roles):
|
||||
org_roles = [role for role in roles if role.scope == cls.Scope.org]
|
||||
org_perms_id = cls.get_scope_roles_perms(org_roles, cls.Scope.org)\
|
||||
.values_list('id', flat=True)
|
||||
|
||||
system_roles = [role for role in roles if role.scope == cls.Scope.system]
|
||||
system_perms_id = cls.get_scope_roles_perms(system_roles, cls.Scope.system)\
|
||||
.values_list('id', flat=True)
|
||||
perms_id = set(org_perms_id) | set(system_perms_id)
|
||||
permissions = Permission.objects.filter(id__in=perms_id)\
|
||||
.prefetch_related('content_type')
|
||||
return permissions
|
||||
|
||||
@classmethod
|
||||
def get_roles_perms(cls, roles):
|
||||
permissions = cls.get_roles_permissions(roles)
|
||||
return Permission.to_perms(permissions)
|
||||
|
||||
def get_permissions(self):
|
||||
if self.is_admin():
|
||||
permissions = Permission.objects.all()
|
||||
else:
|
||||
permissions = self.permissions.all()
|
||||
permissions = Permission.clean_permissions(permissions, self.scope)
|
||||
return permissions
|
||||
|
||||
@lazyproperty
|
||||
def users(self):
|
||||
from .rolebinding import RoleBinding
|
||||
return RoleBinding.get_role_users(self)
|
||||
|
||||
@lazyproperty
|
||||
def users_amount(self):
|
||||
return self.users.count()
|
||||
|
||||
@lazyproperty
|
||||
def permissions_amount(self):
|
||||
return self.permissions.count()
|
||||
|
||||
@classmethod
|
||||
def create_builtin_roles(cls):
|
||||
BuiltinRole.sync_to_db()
|
||||
|
||||
@property
|
||||
def display_name(self):
|
||||
if not self.builtin:
|
||||
return self.name
|
||||
return gettext(self.name)
|
||||
|
||||
|
||||
class SystemRole(Role):
|
||||
objects = SystemRoleManager()
|
||||
|
||||
class Meta:
|
||||
proxy = True
|
||||
verbose_name = _('System role')
|
||||
|
||||
|
||||
class OrgRole(Role):
|
||||
objects = OrgRoleManager()
|
||||
|
||||
class Meta:
|
||||
proxy = True
|
||||
verbose_name = _('Organization role')
|
||||
137
apps/rbac/models/rolebinding.py
Normal file
137
apps/rbac/models/rolebinding.py
Normal file
@@ -0,0 +1,137 @@
|
||||
from django.utils.translation import gettext_lazy as _
|
||||
from django.db import models
|
||||
from django.db.models import Q
|
||||
from rest_framework.serializers import ValidationError
|
||||
|
||||
from common.db.models import JMSModel
|
||||
from common.utils import lazyproperty
|
||||
from orgs.utils import current_org
|
||||
from .role import Role
|
||||
from ..const import Scope
|
||||
|
||||
__all__ = ['RoleBinding', 'SystemRoleBinding', 'OrgRoleBinding']
|
||||
|
||||
|
||||
class RoleBindingManager(models.Manager):
|
||||
def get_queryset(self):
|
||||
queryset = super(RoleBindingManager, self).get_queryset()
|
||||
q = Q(scope=Scope.system)
|
||||
if not current_org.is_root():
|
||||
q |= Q(org_id=current_org.id, scope=Scope.org)
|
||||
queryset = queryset.filter(q)
|
||||
return queryset
|
||||
|
||||
|
||||
class RoleBinding(JMSModel):
|
||||
Scope = Scope
|
||||
""" 定义 用户-角色 关系 """
|
||||
scope = models.CharField(
|
||||
max_length=128, choices=Scope.choices, default=Scope.system,
|
||||
verbose_name=_('Scope')
|
||||
)
|
||||
user = models.ForeignKey(
|
||||
'users.User', related_name='role_bindings', on_delete=models.CASCADE, verbose_name=_('User')
|
||||
)
|
||||
role = models.ForeignKey(
|
||||
Role, related_name='role_bindings', on_delete=models.CASCADE, verbose_name=_('Role')
|
||||
)
|
||||
org = models.ForeignKey(
|
||||
'orgs.Organization', related_name='role_bindings', blank=True, null=True,
|
||||
on_delete=models.CASCADE, verbose_name=_('Organization')
|
||||
)
|
||||
objects = RoleBindingManager()
|
||||
|
||||
class Meta:
|
||||
verbose_name = _('Role binding')
|
||||
unique_together = [
|
||||
('user', 'role', 'org'),
|
||||
]
|
||||
|
||||
def __str__(self):
|
||||
display = '{user} & {role}'.format(user=self.user, role=self.role)
|
||||
if self.org:
|
||||
display += ' | {org}'.format(org=self.org)
|
||||
return display
|
||||
|
||||
def save(self, *args, **kwargs):
|
||||
self.scope = self.role.scope
|
||||
return super().save(*args, **kwargs)
|
||||
|
||||
@classmethod
|
||||
def get_user_perms(cls, user):
|
||||
roles = cls.get_user_roles(user)
|
||||
return Role.get_roles_perms(roles)
|
||||
|
||||
@classmethod
|
||||
def get_role_users(cls, role):
|
||||
from users.models import User
|
||||
bindings = cls.objects.filter(role=role, scope=role.scope)
|
||||
user_ids = bindings.values_list('user', flat=True).distinct()
|
||||
return User.objects.filter(id__in=user_ids)
|
||||
|
||||
@classmethod
|
||||
def get_user_roles(cls, user):
|
||||
bindings = cls.objects.filter(user=user)
|
||||
roles_id = bindings.values_list('role', flat=True).distinct()
|
||||
return Role.objects.filter(id__in=roles_id)
|
||||
|
||||
@lazyproperty
|
||||
def user_display(self):
|
||||
return self.user.name
|
||||
|
||||
@lazyproperty
|
||||
def role_display(self):
|
||||
return self.role.display_name
|
||||
|
||||
|
||||
class OrgRoleBindingManager(models.Manager):
|
||||
def get_queryset(self):
|
||||
queryset = super().get_queryset()
|
||||
if current_org.is_root():
|
||||
return queryset.none()
|
||||
|
||||
queryset = queryset.filter(org=current_org.id)
|
||||
return queryset
|
||||
|
||||
|
||||
class OrgRoleBinding(RoleBinding):
|
||||
objects = OrgRoleBindingManager()
|
||||
|
||||
def save(self, *args, **kwargs):
|
||||
self.org_id = current_org.id
|
||||
self.scope = Scope.org
|
||||
return super().save(*args, **kwargs)
|
||||
|
||||
def delete(self, **kwargs):
|
||||
has_other_role = self.__class__.objects \
|
||||
.filter(user=self.user, scope=self.scope) \
|
||||
.exclude(id=self.id) \
|
||||
.exists()
|
||||
if not has_other_role:
|
||||
error = _('User last role in org, can not be delete, '
|
||||
'you can remove user from org instead')
|
||||
raise ValidationError({'error': error})
|
||||
return super().delete(**kwargs)
|
||||
|
||||
class Meta:
|
||||
proxy = True
|
||||
verbose_name = _('Organization role binding')
|
||||
|
||||
|
||||
class SystemRoleBindingManager(models.Manager):
|
||||
def get_queryset(self):
|
||||
queryset = super().get_queryset().\
|
||||
filter(scope=Scope.org)
|
||||
return queryset
|
||||
|
||||
|
||||
class SystemRoleBinding(RoleBinding):
|
||||
objects = SystemRoleBindingManager()
|
||||
|
||||
class Meta:
|
||||
proxy = True
|
||||
verbose_name = _('System role binding')
|
||||
|
||||
def save(self, *args, **kwargs):
|
||||
self.scope = Scope.system
|
||||
return super().save(*args, **kwargs)
|
||||
Reference in New Issue
Block a user