Skip to content

Commit 35a34a9

Browse files
shaohuzhang1shaohuzhang1
committed
feat: UserResourcePermission
1 parent 700351f commit 35a34a9

File tree

6 files changed

+190
-21
lines changed

6 files changed

+190
-21
lines changed

‎apps/common/auth/handle/impl/user_token.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -101,14 +101,14 @@ def get_workspace_resource_permission_list_by_workspace_user_permission(
101101
workspace_user_resource_permission.workspace_id)]
102102
role_permission_mapping_list = reduce(lambda x, y: [*x, *y], role_permission_mapping_list, [])
103103
# 如果是根据角色
104-
if (workspace_user_resource_permission.auth_target_type == ResourceAuthType.ROLE
104+
if (workspace_user_resource_permission.auth_type == ResourceAuthType.ROLE
105105
and workspace_user_resource_permission.permission_list.__contains__(
106106
ResourcePermissionRole.ROLE)):
107107
return [
108108
f"{role_permission_mapping.permission_id}:/WORKSPACE/{workspace_user_resource_permission.workspace_id}/{workspace_user_resource_permission.auth_target_type}/{workspace_user_resource_permission.target}"
109109
for role_permission_mapping in role_permission_mapping_list]
110110

111-
elif workspace_user_resource_permission.auth_target_type == ResourceAuthType.RESOURCE_PERMISSION_GROUP:
111+
elif workspace_user_resource_permission.auth_type == ResourceAuthType.RESOURCE_PERMISSION_GROUP:
112112
resource_permission_list = [
113113
[
114114
f"{permission}:/WORKSPACE/{workspace_user_resource_permission.workspace_id}/{workspace_user_resource_permission.auth_target_type}/{workspace_user_resource_permission.target}"
@@ -136,7 +136,7 @@ def get_permission_list(user,
136136
# 获取工作空间 用户 角色映射数据
137137
workspace_user_role_mapping_list = QuerySet(workspace_user_role_mapping_model).filter(user_id=user_id)
138138
workspace_user_role_mapping_dict = group_by(workspace_user_role_mapping_list,
139-
lambda item: item.role_id)
139+
lambda item: item.workspace_id)
140140
# 获取角色权限映射数据
141141
role_permission_mapping_list = QuerySet(role_permission_mapping_model).filter(
142142
role_id__in=[workspace_user_role_mapping.role_id for workspace_user_role_mapping in
@@ -168,7 +168,7 @@ def get_permission_list(user,
168168
role_permission_mapping_dict = group_by(role_permission_mapping_list, lambda item: item.role_id)
169169
workspace_user_role_mapping_list = get_default_workspace_user_role_mapping_list([user.role])
170170
workspace_user_role_mapping_dict = group_by(workspace_user_role_mapping_list,
171-
lambda item: item.role_id)
171+
lambda item: item.workspace_id)
172172
# 资源权限
173173
workspace_resource_permission_list = get_workspace_resource_permission_list(
174174
workspace_user_resource_permission_list,

‎apps/system_manage/api/user_resource_permission.py‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,8 @@
1111

1212
from common.mixins.api_mixin import APIMixin
1313
from common.result import ResultSerializer
14-
from system_manage.serializers.user_resource_permission import UserResourcePermissionResponse
14+
from system_manage.serializers.user_resource_permission import UserResourcePermissionResponse, \
15+
UpdateUserResourcePermissionRequest
1516

1617

1718
class APIUserResourcePermissionResponse(ResultSerializer):
@@ -35,3 +36,9 @@ def get_parameters():
3536
@staticmethod
3637
def get_response():
3738
return APIUserResourcePermissionResponse
39+
40+
41+
class EditUserResourcePermissionAPI(APIMixin):
42+
@staticmethod
43+
def get_request():
44+
return UpdateUserResourcePermissionRequest()

‎apps/system_manage/serializers/user_resource_permission.py‎

Lines changed: 128 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -6,30 +6,145 @@
66
@date：2025/4/28 17:17
77
@desc:
88
"""
9+
import json
10+
import os
11+
912
from django.db.models import QuerySet
10-
from rest_framework import serializers
1113
from django.utils.translation import gettext_lazy as _
14+
from rest_framework import serializers
15+
16+
from common.constants.permission_constants import get_default_workspace_user_role_mapping_list, RoleConstants, \
17+
ResourcePermissionGroup, ResourcePermissionRole, ResourceAuthType
18+
from common.database_model_manage.database_model_manage import DatabaseModelManage
19+
from common.db.search import native_search
20+
from common.db.sql_execute import select_list
21+
from common.exception.app_exception import AppApiException
22+
from common.utils.common import get_file_content
23+
from common.utils.split_model import group_by
24+
from knowledge.models import Knowledge
25+
from maxkb.conf import PROJECT_DIR
26+
from system_manage.models import WorkspaceUserResourcePermission, AuthTargetType
27+
28+
29+
class PermissionSerializer(serializers.Serializer):
30+
VIEW = serializers.BooleanField(required=True, label="可读")
31+
MANAGE = serializers.BooleanField(required=True, label="管理")
32+
ROLE = serializers.BooleanField(required=True, label="跟随角色")
33+
34+
35+
class UserResourcePermissionItemResponse(serializers.Serializer):
36+
id = serializers.UUIDField(required=True, label="主键id")
37+
name = serializers.CharField(required=True, label="资源名称")
38+
auth_target_type = serializers.ChoiceField(required=True, choices=AuthTargetType.choices, label="授权资源")
39+
user_id = serializers.UUIDField(required=True, label="用户id")
40+
auth_type = serializers.ChoiceField(required=True, choices=ResourceAuthType.choices, label="授权类型")
41+
permission = PermissionSerializer()
42+
1243

13-
from system_manage.models import WorkspaceUserResourcePermission
44+
class UserResourcePermissionResponse(serializers.Serializer):
45+
KNOWLEDGE = UserResourcePermissionItemResponse(many=True)
1446

1547

16-
class UserResourcePermissionResponse(serializers.ModelSerializer):
17-
class Meta:
18-
model = WorkspaceUserResourcePermission
19-
fields = [
20-
'id', 'workspace_id', 'user_id', 'auth_target_type', 'target',
21-
'auth_type', 'permission_list', 'create_time', 'update_time'
22-
]
48+
class UpdateTeamMemberItemPermissionSerializer(serializers.Serializer):
49+
auth_target_type = serializers.ChoiceField(required=True, choices=AuthTargetType.choices, label="授权资源")
50+
target_id = serializers.CharField(required=True, label=_('target id'))
51+
auth_type = serializers.ChoiceField(required=True, choices=ResourceAuthType.choices, label="授权类型")
52+
permission = PermissionSerializer(required=True, many=False)
53+
54+
55+
class UpdateUserResourcePermissionRequest(serializers.Serializer):
56+
user_resource_permission_list = UpdateTeamMemberItemPermissionSerializer(required=True, many=True)
57+
58+
def is_valid(self, *, workspace_id=None, raise_exception=False):
59+
super().is_valid(raise_exception=True)
60+
user_resource_permission_list = self.data.get("user_resource_permission_list")
61+
illegal_target_id_list = select_list(
62+
get_file_content(
63+
os.path.join(PROJECT_DIR, "apps", "system_manage", 'sql', 'check_member_permission_target_exists.sql')),
64+
[json.dumps(user_resource_permission_list), workspace_id])
65+
if illegal_target_id_list is not None and len(illegal_target_id_list) > 0:
66+
raise AppApiException(500,
67+
_('Non-existent application|knowledge base id[') + str(illegal_target_id_list) + ']')
2368

2469

2570
class UserResourcePermissionSerializer(serializers.Serializer):
2671
workspace_id = serializers.CharField(required=True, label=_('workspace id'))
2772

28-
def list(self, with_valid=True):
73+
def get_queryset(self):
74+
return {
75+
"knowledge_query_set": QuerySet(Knowledge)
76+
.filter(workspace_id=self.data.get('workspace_id')),
77+
'workspace_user_resource_permission_query_set': QuerySet(WorkspaceUserResourcePermission).filter(
78+
workspace_id=self.data.get('workspace_id'))
79+
}
80+
81+
def list(self, user, with_valid=True):
82+
if with_valid:
83+
self.is_valid(raise_exception=True)
84+
workspace_id = self.data.get("workspace_id")
85+
# 用户权限列表
86+
user_resource_permission_list = native_search(self.get_queryset(), get_file_content(
87+
os.path.join(PROJECT_DIR, "apps", "system_manage", 'sql', 'get_user_resource_permission.sql')))
88+
workspace_user_role_mapping_model = DatabaseModelManage.get_model("workspace_user_role_mapping")
89+
workspace_model = DatabaseModelManage.get_model("workspace_model")
90+
if workspace_user_role_mapping_model and workspace_model:
91+
workspace_user_role_mapping_list = QuerySet(workspace_user_role_mapping_model).filter(user_id=user.id,
92+
workspace_id=workspace_id)
93+
else:
94+
workspace_user_role_mapping_list = get_default_workspace_user_role_mapping_list([user.role])
95+
is_workspace_manage = any(
96+
[workspace_user_role_mapping for workspace_user_role_mapping in workspace_user_role_mapping_list if
97+
workspace_user_role_mapping.role_id == RoleConstants.WORKSPACE_MANAGE.value])
98+
# 如果当前用户是当前工作空间管理员那么就拥有所有权限
99+
if is_workspace_manage:
100+
user_resource_permission_list = list(
101+
map(lambda row: {**row,
102+
'permission': {ResourcePermissionGroup.VIEW.value: True,
103+
ResourcePermissionGroup.MANAGE.value: True,
104+
ResourcePermissionRole.ROLE.value: True}},
105+
user_resource_permission_list))
106+
return group_by([{**user_resource_permission, 'permission': {
107+
permission: True if user_resource_permission.get('permission_list').__contains__(permission) else False for
108+
permission in
109+
[ResourcePermissionGroup.VIEW.value, ResourcePermissionGroup.MANAGE.value,
110+
ResourcePermissionRole.ROLE.value]}}
111+
for user_resource_permission in user_resource_permission_list],
112+
key=lambda item: item.get('auth_target_type'))
113+
114+
def edit(self, instance, user, with_valid=True):
29115
if with_valid:
30116
self.is_valid(raise_exception=True)
117+
UpdateUserResourcePermissionRequest(data=instance).is_valid(raise_exception=True,
118+
workspace_id=self.data.get('workspace_id'))
31119
workspace_id = self.data.get("workspace_id")
32-
workspace_user_resource_permission_list = QuerySet(WorkspaceUserResourcePermission).filter(
120+
update_list = []
121+
save_list = []
122+
user_resource_permission_list = instance.get('user_resource_permission_list')
123+
workspace_user_resource_permission_exist_list = QuerySet(WorkspaceUserResourcePermission).filter(
33124
workspace_id=workspace_id)
34-
return [UserResourcePermissionResponse(data=user_resource_permission).data for user_resource_permission in
35-
workspace_user_resource_permission_list]
125+
for user_resource_permission in user_resource_permission_list:
126+
exist_list = [user_resource_permission_exist for user_resource_permission_exist in
127+
workspace_user_resource_permission_exist_list if
128+
user_resource_permission.get('target_id') == str(user_resource_permission_exist.target)]
129+
if len(exist_list) > 0:
130+
exist_list[0].permission_list = [key for key in user_resource_permission.get('permission').keys() if
131+
user_resource_permission.get('permission').get(key)]
132+
update_list.append(exist_list[0])
133+
else:
134+
save_list.append(WorkspaceUserResourcePermission(target=user_resource_permission.get('target_id'),
135+
auth_target_type=user_resource_permission.get(
136+
'auth_target_type'),
137+
permission_list=[key for key in
138+
user_resource_permission.get(
139+
'permission').keys() if
140+
user_resource_permission.get(
141+
'permission').get(key)],
142+
workspace_id=workspace_id,
143+
user_id=user.id,
144+
auth_type=user_resource_permission.get('auth_type')))
145+
# 批量更新
146+
QuerySet(WorkspaceUserResourcePermission).bulk_update(update_list, ['permission_list']) if len(
147+
update_list) > 0 else None
148+
# 批量插入
149+
QuerySet(WorkspaceUserResourcePermission).bulk_create(save_list) if len(save_list) > 0 else None
150+
return True

‎apps/system_manage/sql/check_member_permission_target_exists.sql‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
SELECT
2+
static_temp."target_id"::text
3+
FROM
4+
(SELECT * FROM json_to_recordset(
5+
%s
6+
) AS x(target_id uuid,auth_target_type text)) static_temp
7+
LEFT JOIN (
8+
SELECT
9+
"id",
10+
'KNOWLEDGE' AS "auth_target_type"
11+
FROM
12+
knowledge
13+
WHERE workspace_id= %s
14+
) "app_and_knowledge_temp"
15+
ON "app_and_knowledge_temp"."id" = static_temp."target_id" and app_and_knowledge_temp."auth_target_type"=static_temp."auth_target_type"
16+
WHERE app_and_knowledge_temp.id is NULL ;

‎apps/system_manage/sql/get_user_resource_permission.sql‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
SELECT app_or_knowledge.*,
2+
COALESCE(workspace_user_resource_permission.permission_list,'{}')::varchar[] as permission_list,
3+
COALESCE(workspace_user_resource_permission.auth_type,'ROLE') as auth_type
4+
FROM (SELECT "id",
5+
"name",
6+
'KNOWLEDGE' AS "auth_target_type",
7+
user_id,
8+
workspace_id,
9+
"type" AS "icon"
10+
FROM knowledge
11+
${knowledge_query_set}
12+
) app_or_knowledge
13+
LEFT JOIN (SELECT *
14+
FROM workspace_user_resource_permission
15+
${workspace_user_resource_permission_query_set}) workspace_user_resource_permission
16+
ON workspace_user_resource_permission.target = app_or_knowledge."id";

‎apps/system_manage/views/user_resource_permission.py‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,17 +6,18 @@
66
@date：2025/4/28 16:38
77
@desc:
88
"""
9-
from urllib.request import Request
109

1110
from django.utils.translation import gettext_lazy as _
1211
from drf_spectacular.utils import extend_schema
12+
from rest_framework.request import Request
1313
from rest_framework.views import APIView
1414

1515
from common import result
1616
from common.auth import TokenAuth
1717
from common.auth.authentication import has_permissions
1818
from common.constants.permission_constants import PermissionConstants
19-
from system_manage.api.user_resource_permission import UserResourcePermissionAPI
19+
from common.result import DefaultResultSerializer
20+
from system_manage.api.user_resource_permission import UserResourcePermissionAPI, EditUserResourcePermissionAPI
2021
from system_manage.serializers.user_resource_permission import UserResourcePermissionSerializer
2122

2223

@@ -35,4 +36,18 @@ class WorkSpaceUserResourcePermissionView(APIView):
3536
def get(self, request: Request, workspace_id: str):
3637
return result.success(UserResourcePermissionSerializer(
3738
data={'workspace_id': workspace_id}
38-
).list())
39+
).list(request.user))
40+
41+
@extend_schema(
42+
methods=['PUT'],
43+
description=_('Modify the resource authorization list'),
44+
operation_id=_('Modify the resource authorization list'),
45+
parameters=UserResourcePermissionAPI.get_parameters(),
46+
request=EditUserResourcePermissionAPI.get_request(),
47+
responses=DefaultResultSerializer(),
48+
tags=[_('Resources authorization')]
49+
)
50+
def put(self, request: Request, workspace_id: str):
51+
return result.success(UserResourcePermissionSerializer(
52+
data={'workspace_id': workspace_id}
53+
).edit(request.data, request.user))

0 commit comments

Comments
 (0)