xuelong
3dd5731751
- move the relational data center to MySQL and a standalone workbench\n- add Interface Center API credentials, policies, logs, and DBeaver SSH guidance\n- harden authentication and deployment while retiring unused management surfaces
136 lines
4.3 KiB
Python
136 lines
4.3 KiB
Python
"""RBAC & Accounts (P1) — roles, capability matrix, users CRUD."""
|
|
from fastapi import APIRouter, HTTPException
|
|
|
|
from app.auth import AdminUser
|
|
from app.contracts import (
|
|
CapabilityCreate,
|
|
RoleCapCell,
|
|
RoleCreate,
|
|
RoleUpdate,
|
|
UserCreate,
|
|
UserUpdate,
|
|
)
|
|
from app.db import (
|
|
create_capability,
|
|
create_role,
|
|
create_user,
|
|
delete_capability,
|
|
delete_role,
|
|
delete_user,
|
|
get_permission_matrix,
|
|
list_capabilities,
|
|
list_roles,
|
|
list_users,
|
|
set_role_cap,
|
|
update_role,
|
|
update_user,
|
|
)
|
|
from app.security import hash_password
|
|
|
|
router = APIRouter()
|
|
|
|
|
|
# ── Roles ────────────────────────────────────────────────────────────────────
|
|
|
|
@router.get("/roles")
|
|
async def _list_roles(_user: AdminUser):
|
|
return await list_roles()
|
|
|
|
|
|
@router.post("/roles")
|
|
async def _create_role(body: RoleCreate, _user: AdminUser):
|
|
try:
|
|
return await create_role(body.model_dump())
|
|
except Exception as e: # unique violation etc.
|
|
raise HTTPException(400, f"创建角色失败：{str(e)[:200]}")
|
|
|
|
|
|
@router.patch("/roles/{role_key}")
|
|
async def _update_role(role_key: str, body: RoleUpdate, _user: AdminUser):
|
|
row = await update_role(role_key, body.model_dump(exclude_none=True))
|
|
if not row:
|
|
raise HTTPException(404, "角色不存在")
|
|
return row
|
|
|
|
|
|
@router.delete("/roles/{role_key}")
|
|
async def _delete_role(role_key: str, _user: AdminUser):
|
|
try:
|
|
ok = await delete_role(role_key)
|
|
except ValueError as e:
|
|
raise HTTPException(400, str(e))
|
|
if not ok:
|
|
raise HTTPException(404, "角色不存在")
|
|
return {"deleted": role_key}
|
|
|
|
|
|
# ── Capabilities ─────────────────────────────────────────────────────────────
|
|
|
|
@router.get("/capabilities")
|
|
async def _list_caps(_user: AdminUser):
|
|
return await list_capabilities()
|
|
|
|
|
|
@router.post("/capabilities")
|
|
async def _create_cap(body: CapabilityCreate, _user: AdminUser):
|
|
try:
|
|
return await create_capability(body.model_dump())
|
|
except Exception as e:
|
|
raise HTTPException(400, f"创建能力项失败：{str(e)[:200]}")
|
|
|
|
|
|
@router.delete("/capabilities/{cap_key}")
|
|
async def _delete_cap(cap_key: str, _user: AdminUser):
|
|
await delete_capability(cap_key)
|
|
return {"deleted": cap_key}
|
|
|
|
|
|
# ── Permission matrix ────────────────────────────────────────────────────────
|
|
|
|
@router.get("/permission-matrix")
|
|
async def _matrix(_user: AdminUser):
|
|
return await get_permission_matrix()
|
|
|
|
|
|
@router.put("/permission-matrix")
|
|
async def _set_cell(body: RoleCapCell, _user: AdminUser):
|
|
await set_role_cap(body.role_key, body.cap_key, body.value)
|
|
return {"ok": True, "role_key": body.role_key, "cap_key": body.cap_key, "value": body.value}
|
|
|
|
|
|
# ── Users ────────────────────────────────────────────────────────────────────
|
|
|
|
@router.get("/users")
|
|
async def _list_users(_user: AdminUser):
|
|
return await list_users()
|
|
|
|
|
|
@router.post("/users")
|
|
async def _create_user(body: UserCreate, _user: AdminUser):
|
|
data = body.model_dump()
|
|
roles = data.pop("roles", [])
|
|
pw = data.pop("password")
|
|
data["hashed_password"] = hash_password(pw)
|
|
try:
|
|
return await create_user(data, roles)
|
|
except Exception as e:
|
|
raise HTTPException(400, f"创建用户失败：{str(e)[:200]}")
|
|
|
|
|
|
@router.patch("/users/{user_id}")
|
|
async def _update_user(user_id: int, body: UserUpdate, _user: AdminUser):
|
|
data = body.model_dump(exclude_none=True)
|
|
roles = data.pop("roles", None)
|
|
if "password" in data:
|
|
data["hashed_password"] = hash_password(data.pop("password"))
|
|
row = await update_user(user_id, data, roles)
|
|
if not row:
|
|
raise HTTPException(404, "用户不存在")
|
|
return row
|
|
|
|
|
|
@router.delete("/users/{user_id}")
|
|
async def _delete_user(user_id: int, _user: AdminUser):
|
|
await delete_user(user_id)
|
|
return {"deleted": user_id}
|