forked from xiaohei/taiji-AI-PAD
160 lines
3.7 KiB
Python
160 lines
3.7 KiB
Python
"""
|
|
权限管理辅助模块
|
|
"""
|
|
|
|
from typing import List, Set
|
|
|
|
# 权限定义
|
|
PERMISSIONS = {
|
|
"view:overview": "查看概览",
|
|
"manage:tenants": "管理租户",
|
|
"manage:resources": "管理资源",
|
|
"view:billing": "查看计费",
|
|
"manage:billing": "管理计费（含充值）",
|
|
"manage:settings": "管理设置",
|
|
"approve:applications": "审批申请",
|
|
"manage:channels": "管理渠道",
|
|
"manage:providers": "管理供应商",
|
|
"view:monitoring": "查看监控",
|
|
}
|
|
|
|
# 角色权限映射
|
|
ROLE_PERMISSIONS = {
|
|
# 租户用户
|
|
"user": [
|
|
"view:overview",
|
|
"view:billing",
|
|
],
|
|
|
|
# 渠道管理员
|
|
"channel_admin": [
|
|
"view:overview",
|
|
"manage:tenants",
|
|
"manage:resources",
|
|
"view:billing",
|
|
"manage:billing",
|
|
],
|
|
|
|
# 计费管理员（渠道或平台的计费管理）
|
|
"billing_admin": [
|
|
"view:overview",
|
|
"view:billing",
|
|
"manage:billing",
|
|
],
|
|
|
|
# 运营管理员（渠道或平台的运营管理）
|
|
"operations_admin": [
|
|
"view:overview",
|
|
"manage:tenants",
|
|
"manage:resources",
|
|
"view:billing",
|
|
],
|
|
|
|
# 管理员（平台管理员，权限低于超级管理员）
|
|
"admin": [
|
|
"view:overview",
|
|
"manage:tenants",
|
|
"manage:resources",
|
|
"view:billing",
|
|
"manage:billing",
|
|
"manage:settings",
|
|
"view:monitoring",
|
|
],
|
|
|
|
# 超级管理员（全部权限）
|
|
"super_admin": list(PERMISSIONS.keys()),
|
|
|
|
# 供应商管理员
|
|
"provider_admin": [
|
|
"view:overview",
|
|
"manage:providers",
|
|
],
|
|
}
|
|
|
|
|
|
def get_role_permissions(role: str) -> List[str]:
|
|
"""
|
|
获取角色的权限列表
|
|
|
|
Args:
|
|
role: 角色名称
|
|
|
|
Returns:
|
|
权限列表
|
|
"""
|
|
return ROLE_PERMISSIONS.get(role, [])
|
|
|
|
|
|
def has_permission(role: str, permission: str) -> bool:
|
|
"""
|
|
检查角色是否拥有某个权限
|
|
|
|
Args:
|
|
role: 角色名称
|
|
permission: 权限名称
|
|
|
|
Returns:
|
|
是否拥有权限
|
|
"""
|
|
return permission in ROLE_PERMISSIONS.get(role, [])
|
|
|
|
|
|
def has_any_permission(role: str, permissions: List[str]) -> bool:
|
|
"""
|
|
检查角色是否拥有任意一个权限
|
|
|
|
Args:
|
|
role: 角色名称
|
|
permissions: 权限列表
|
|
|
|
Returns:
|
|
是否拥有任意一个权限
|
|
"""
|
|
role_perms = set(ROLE_PERMISSIONS.get(role, []))
|
|
return bool(role_perms.intersection(set(permissions)))
|
|
|
|
|
|
def has_all_permissions(role: str, permissions: List[str]) -> bool:
|
|
"""
|
|
检查角色是否拥有所有权限
|
|
|
|
Args:
|
|
role: 角色名称
|
|
permissions: 权限列表
|
|
|
|
Returns:
|
|
是否拥有所有权限
|
|
"""
|
|
role_perms = set(ROLE_PERMISSIONS.get(role, []))
|
|
return set(permissions).issubset(role_perms)
|
|
|
|
|
|
def require_permission(required_permission: str):
|
|
"""
|
|
权限装饰器（用于FastAPI路由）
|
|
|
|
Args:
|
|
required_permission: 需要的权限
|
|
|
|
Returns:
|
|
装饰器函数
|
|
"""
|
|
def decorator(func):
|
|
async def wrapper(*args, **kwargs):
|
|
# 从kwargs中获取principal
|
|
principal = kwargs.get("principal", {})
|
|
role = principal.get("claims", {}).get("role", "")
|
|
|
|
if not has_permission(role, required_permission):
|
|
from fastapi import HTTPException, status
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail=f"需要权限: {required_permission}"
|
|
)
|
|
|
|
return await func(*args, **kwargs)
|
|
return wrapper
|
|
return decorator
|
|
|
|
|