mirror of
https://github.com/jumpserver/jumpserver.git
synced 2025-09-10 03:39:59 +00:00
fix: fix rbac to dev (#7636)
* feat: 添加 RBAC 应用模块 * feat: 添加 RBAC Model、API * feat: 添加 RBAC Model、API 2 * feat: 添加 RBAC Model、API 3 * feat: 添加 RBAC Model、API 4 * feat: RBAC * feat: RBAC * feat: RBAC * feat: RBAC * feat: RBAC * feat: RBAC 整理权限位 * feat: RBAC 整理权限位2 * feat: RBAC 整理权限位2 * feat: RBAC 整理权限位 * feat: RBAC 添加默认角色 * feat: RBAC 添加迁移文件；迁移用户角色->用户角色绑定 * feat: RBAC 添加迁移文件；迁移用户角色->用户角色绑定 * feat: RBAC 修改用户模块API * feat: RBAC 添加组织模块迁移文件 & 修改组织模块API * feat: RBAC 添加组织模块迁移文件 & 修改组织模块API * feat: RBAC 修改用户角色属性的使用 * feat: RBAC No.1 * xxx * perf: 暂存 * perf: ... * perf(rbac): 添加 perms 到 profile serializer 中 * stash * perf: 使用init * perf: 修改migrations * perf: rbac * stash * stash * pref: 修改rbac * stash it * stash: 先去修复其他bug * perf: 修改 role 添加 users * pref: 修改 RBAC Model * feat: 添加权限的 tree api * stash: 暂存一下 * stash: 暂存一下 * perf: 修改 model verbose name * feat: 添加model各种 verbose name * perf: 生成 migrations * perf: 优化权限位 * perf: 添加迁移脚本 * feat: 添加组织角色迁移 * perf: 添加迁移脚本 * stash * perf: 添加migrateion * perf: 暂存一下 * perf: 修改rbac * perf: stash it * fix: 迁移冲突 * fix: 迁移冲突 * perf: 暂存一下 * perf: 修改 rbac 逻辑 * stash: 暂存一下 * perf: 修改内置角色 * perf: 解决 root 组织的问题 * perf: stash it * perf: 优化 rbac * perf: 优化 rolebinding 处理 * perf: 完成用户离开组织的问题 * perf: 暂存一下 * perf: 修改翻译 * perf: 去掉了 IsSuperUser * perf: IsAppUser 去掉完成 * perf: 修改 connection token 的权限 * perf: 去掉导入的问题 * perf: perms define 格式，修改 app 用户 的全新啊 * perf: 修改 permission * perf: 去掉一些 org admin * perf: 去掉部分 org admin * perf: 再去掉点 org admin role * perf: 再去掉部分 org admin * perf: user 角色搜索 * perf: 去掉很多 js * perf: 添加权限位 * perf: 修改权限 * perf: 去掉一个 todo * merge: with dev * fix: 修复冲突 Co-authored-by: Bai <bugatti_it@163.com> Co-authored-by: Michael Bai <baijiangjie@gmail.com> Co-authored-by: ibuler <ibuler@qq.com>
This commit is contained in:
fit2bot
GitHub
137
apps/rbac/models/rolebinding.py
Normal file
137
apps/rbac/models/rolebinding.py
Normal file
@@ -0,0 +1,137 @@
|
||||
from django.utils.translation import gettext_lazy as _
|
||||
from django.db import models
|
||||
from django.db.models import Q
|
||||
from rest_framework.serializers import ValidationError
|
||||
|
||||
from common.db.models import JMSModel
|
||||
from common.utils import lazyproperty
|
||||
from orgs.utils import current_org
|
||||
from .role import Role
|
||||
from ..const import Scope
|
||||
|
||||
__all__ = ['RoleBinding', 'SystemRoleBinding', 'OrgRoleBinding']
|
||||
|
||||
|
||||
class RoleBindingManager(models.Manager):
|
||||
def get_queryset(self):
|
||||
queryset = super(RoleBindingManager, self).get_queryset()
|
||||
q = Q(scope=Scope.system)
|
||||
if not current_org.is_root():
|
||||
q |= Q(org_id=current_org.id, scope=Scope.org)
|
||||
queryset = queryset.filter(q)
|
||||
return queryset
|
||||
|
||||
|
||||
class RoleBinding(JMSModel):
|
||||
Scope = Scope
|
||||
""" 定义 用户-角色 关系 """
|
||||
scope = models.CharField(
|
||||
max_length=128, choices=Scope.choices, default=Scope.system,
|
||||
verbose_name=_('Scope')
|
||||
)
|
||||
user = models.ForeignKey(
|
||||
'users.User', related_name='role_bindings', on_delete=models.CASCADE, verbose_name=_('User')
|
||||
)
|
||||
role = models.ForeignKey(
|
||||
Role, related_name='role_bindings', on_delete=models.CASCADE, verbose_name=_('Role')
|
||||
)
|
||||
org = models.ForeignKey(
|
||||
'orgs.Organization', related_name='role_bindings', blank=True, null=True,
|
||||
on_delete=models.CASCADE, verbose_name=_('Organization')
|
||||
)
|
||||
objects = RoleBindingManager()
|
||||
|
||||
class Meta:
|
||||
verbose_name = _('Role binding')
|
||||
unique_together = [
|
||||
('user', 'role', 'org'),
|
||||
]
|
||||
|
||||
def __str__(self):
|
||||
display = '{user} & {role}'.format(user=self.user, role=self.role)
|
||||
if self.org:
|
||||
display += ' | {org}'.format(org=self.org)
|
||||
return display
|
||||
|
||||
def save(self, *args, **kwargs):
|
||||
self.scope = self.role.scope
|
||||
return super().save(*args, **kwargs)
|
||||
|
||||
@classmethod
|
||||
def get_user_perms(cls, user):
|
||||
roles = cls.get_user_roles(user)
|
||||
return Role.get_roles_perms(roles)
|
||||
|
||||
@classmethod
|
||||
def get_role_users(cls, role):
|
||||
from users.models import User
|
||||
bindings = cls.objects.filter(role=role, scope=role.scope)
|
||||
user_ids = bindings.values_list('user', flat=True).distinct()
|
||||
return User.objects.filter(id__in=user_ids)
|
||||
|
||||
@classmethod
|
||||
def get_user_roles(cls, user):
|
||||
bindings = cls.objects.filter(user=user)
|
||||
roles_id = bindings.values_list('role', flat=True).distinct()
|
||||
return Role.objects.filter(id__in=roles_id)
|
||||
|
||||
@lazyproperty
|
||||
def user_display(self):
|
||||
return self.user.name
|
||||
|
||||
@lazyproperty
|
||||
def role_display(self):
|
||||
return self.role.display_name
|
||||
|
||||
|
||||
class OrgRoleBindingManager(models.Manager):
|
||||
def get_queryset(self):
|
||||
queryset = super().get_queryset()
|
||||
if current_org.is_root():
|
||||
return queryset.none()
|
||||
|
||||
queryset = queryset.filter(org=current_org.id)
|
||||
return queryset
|
||||
|
||||
|
||||
class OrgRoleBinding(RoleBinding):
|
||||
objects = OrgRoleBindingManager()
|
||||
|
||||
def save(self, *args, **kwargs):
|
||||
self.org_id = current_org.id
|
||||
self.scope = Scope.org
|
||||
return super().save(*args, **kwargs)
|
||||
|
||||
def delete(self, **kwargs):
|
||||
has_other_role = self.__class__.objects \
|
||||
.filter(user=self.user, scope=self.scope) \
|
||||
.exclude(id=self.id) \
|
||||
.exists()
|
||||
if not has_other_role:
|
||||
error = _('User last role in org, can not be delete, '
|
||||
'you can remove user from org instead')
|
||||
raise ValidationError({'error': error})
|
||||
return super().delete(**kwargs)
|
||||
|
||||
class Meta:
|
||||
proxy = True
|
||||
verbose_name = _('Organization role binding')
|
||||
|
||||
|
||||
class SystemRoleBindingManager(models.Manager):
|
||||
def get_queryset(self):
|
||||
queryset = super().get_queryset().\
|
||||
filter(scope=Scope.org)
|
||||
return queryset
|
||||
|
||||
|
||||
class SystemRoleBinding(RoleBinding):
|
||||
objects = SystemRoleBindingManager()
|
||||
|
||||
class Meta:
|
||||
proxy = True
|
||||
verbose_name = _('System role binding')
|
||||
|
||||
def save(self, *args, **kwargs):
|
||||
self.scope = Scope.system
|
||||
return super().save(*args, **kwargs)
|
||||
Reference in New Issue
Block a user