fix: fix rbac to dev (#7636)

* feat: 添加 RBAC 应用模块 * feat: 添加 RBAC Model、API * feat: 添加 RBAC Model、API 2 * feat: 添加 RBAC Model、API 3 * feat: 添加 RBAC Model、API 4 * feat: RBAC * feat: RBAC * feat: RBAC * feat: RBAC * feat: RBAC * feat: RBAC 整理权限位 * feat: RBAC 整理权限位2 * feat: RBAC 整理权限位2 * feat: RBAC 整理权限位 * feat: RBAC 添加默认角色 * feat: RBAC 添加迁移文件；迁移用户角色->用户角色绑定 * feat: RBAC 添加迁移文件；迁移用户角色->用户角色绑定 * feat: RBAC 修改用户模块API * feat: RBAC 添加组织模块迁移文件 & 修改组织模块API * feat: RBAC 添加组织模块迁移文件 & 修改组织模块API * feat: RBAC 修改用户角色属性的使用 * feat: RBAC No.1 * xxx * perf: 暂存 * perf: ... * perf(rbac): 添加 perms 到 profile serializer 中 * stash * perf: 使用init * perf: 修改migrations * perf: rbac * stash * stash * pref: 修改rbac * stash it * stash: 先去修复其他bug * perf: 修改 role 添加 users * pref: 修改 RBAC Model * feat: 添加权限的 tree api * stash: 暂存一下 * stash: 暂存一下 * perf: 修改 model verbose name * feat: 添加model各种 verbose name * perf: 生成 migrations * perf: 优化权限位 * perf: 添加迁移脚本 * feat: 添加组织角色迁移 * perf: 添加迁移脚本 * stash * perf: 添加migrateion * perf: 暂存一下 * perf: 修改rbac * perf: stash it * fix: 迁移冲突 * fix: 迁移冲突 * perf: 暂存一下 * perf: 修改 rbac 逻辑 * stash: 暂存一下 * perf: 修改内置角色 * perf: 解决 root 组织的问题 * perf: stash it * perf: 优化 rbac * perf: 优化 rolebinding 处理 * perf: 完成用户离开组织的问题 * perf: 暂存一下 * perf: 修改翻译 * perf: 去掉了 IsSuperUser * perf: IsAppUser 去掉完成 * perf: 修改 connection token 的权限 * perf: 去掉导入的问题 * perf: perms define 格式，修改 app 用户的全新啊 * perf: 修改 permission * perf: 去掉一些 org admin * perf: 去掉部分 org admin * perf: 再去掉点 org admin role * perf: 再去掉部分 org admin * perf: user 角色搜索 * perf: 去掉很多 js * perf: 添加权限位 * perf: 修改权限 * perf: 去掉一个 todo * merge: with dev * fix: 修复冲突 Co-authored-by: Bai <bugatti_it@163.com> Co-authored-by: Michael Bai <baijiangjie@gmail.com> Co-authored-by: ibuler <ibuler@qq.com>
2025-09-11 20:29:40 +00:00 · 2022-02-17 20:13:31 +08:00
parent b088362ae3
commit e259d2a9e9
263 changed files with 3049 additions and 62465 deletions
--- a/apps/rbac/models/role.py
+++ b/apps/rbac/models/role.py
@@ -0,0 +1,135 @@
+from django.utils.translation import ugettext_lazy as _, gettext
+from django.db import models
+
+from common.db.models import JMSModel
+from common.utils import lazyproperty
+from .permission import Permission
+from ..builtin import BuiltinRole
+from .. import const
+
+__all__ = ['Role', 'SystemRole', 'OrgRole']
+
+
+class SystemRoleManager(models.Manager):
+    def get_queryset(self):
+        queryset = super().get_queryset()
+        return queryset.filter(scope=const.Scope.system)
+
+
+class OrgRoleManager(models.Manager):
+    def get_queryset(self):
+        queryset = super().get_queryset()
+        return queryset.filter(scope=const.Scope.org)
+
+
+class Role(JMSModel):
+    """ 定义 角色 ｜ 角色-权限 关系 """
+    Scope = const.Scope
+
+    name = models.CharField(max_length=128, verbose_name=_('Name'))
+    scope = models.CharField(
+        max_length=128, choices=Scope.choices, default=Scope.system, verbose_name=_('Scope')
+    )
+    permissions = models.ManyToManyField(
+        'rbac.Permission', related_name='roles', blank=True, verbose_name=_('Permissions')
+    )
+    builtin = models.BooleanField(default=False, verbose_name=_('Built-in'))
+    comment = models.TextField(max_length=128, default='', blank=True, verbose_name=_('Comment'))
+
+    BuiltinRole = BuiltinRole
+    objects = models.Manager()
+    org_roles = OrgRoleManager()
+    system_roles = SystemRoleManager()
+
+    class Meta:
+        unique_together = [('name', 'scope')]
+        verbose_name = _('Role')
+
+    def __str__(self):
+        return '%s(%s)' % (self.name, self.get_scope_display())
+
+    def is_system_admin(self):
+        return self.name == self.BuiltinRole.system_admin.name and self.builtin
+
+    def is_org_admin(self):
+        return self.name == self.BuiltinRole.org_admin.name and self.builtin
+
+    def is_admin(self):
+        yes = self.is_system_admin() or self.is_org_admin()
+        return yes
+
+    @staticmethod
+    def get_scope_roles_perms(roles, scope):
+        has_admin = any([r.is_admin() for r in roles])
+        if has_admin:
+            perms = Permission.objects.all()
+        else:
+            perms = Permission.objects.filter(roles__in=roles).distinct()
+        perms = Permission.clean_permissions(perms, scope=scope)
+        return perms
+
+    @classmethod
+    def get_roles_permissions(cls, roles):
+        org_roles = [role for role in roles if role.scope == cls.Scope.org]
+        org_perms_id = cls.get_scope_roles_perms(org_roles, cls.Scope.org)\
+            .values_list('id', flat=True)
+
+        system_roles = [role for role in roles if role.scope == cls.Scope.system]
+        system_perms_id = cls.get_scope_roles_perms(system_roles, cls.Scope.system)\
+            .values_list('id', flat=True)
+        perms_id = set(org_perms_id) | set(system_perms_id)
+        permissions = Permission.objects.filter(id__in=perms_id)\
+            .prefetch_related('content_type')
+        return permissions
+
+    @classmethod
+    def get_roles_perms(cls, roles):
+        permissions = cls.get_roles_permissions(roles)
+        return Permission.to_perms(permissions)
+
+    def get_permissions(self):
+        if self.is_admin():
+            permissions = Permission.objects.all()
+        else:
+            permissions = self.permissions.all()
+        permissions = Permission.clean_permissions(permissions, self.scope)
+        return permissions
+
+    @lazyproperty
+    def users(self):
+        from .rolebinding import RoleBinding
+        return RoleBinding.get_role_users(self)
+
+    @lazyproperty
+    def users_amount(self):
+        return self.users.count()
+
+    @lazyproperty
+    def permissions_amount(self):
+        return self.permissions.count()
+
+    @classmethod
+    def create_builtin_roles(cls):
+        BuiltinRole.sync_to_db()
+
+    @property
+    def display_name(self):
+        if not self.builtin:
+            return self.name
+        return gettext(self.name)
+
+
+class SystemRole(Role):
+    objects = SystemRoleManager()
+
+    class Meta:
+        proxy = True
+        verbose_name = _('System role')
+
+
+class OrgRole(Role):
+    objects = OrgRoleManager()
+
+    class Meta:
+        proxy = True
+        verbose_name = _('Organization role')