完善项目权限前置依赖保存校验
- 以接口权限定义中的 prerequisite_permissions 作为前置依赖单一事实源，生成运行时前置权限映射\n- 保存项目角色权限前预检缺失前置权限与受影响下游权限，未确认时返回 409 调整详情\n- 确认保存时自动合并补齐前置权限与取消下游权限，并提供有效权限矩阵读取接口\n- 前端角色权限编辑改为保存时执行依赖校验，弹窗展示需补充前置权限和受影响下游权限\n- 新增编辑权限取消按钮，清理权限选择即时确认弹窗残留\n- 补充后端接口测试、前端权限编辑测试与优化设计文档
This commit is contained in:
Cheng Zhou
@@ -16,6 +16,14 @@ from app.core.api_permissions import (
|
||||
from app.core.permission_cache import get_permission_cache
|
||||
|
||||
|
||||
class PrerequisitePermissionConfirmationRequired(ValueError):
|
||||
"""权限调整需要授权人确认。"""
|
||||
|
||||
def __init__(self, adjustments: dict):
|
||||
super().__init__("需要确认前置权限调整")
|
||||
self.adjustments = adjustments
|
||||
|
||||
|
||||
async def _get_project_permission_overrides(
|
||||
db: AsyncSession,
|
||||
study_id: uuid.UUID,
|
||||
@@ -48,6 +56,126 @@ async def _get_project_permission_overrides(
|
||||
return permissions
|
||||
|
||||
|
||||
def _empty_role_adjustment() -> dict[str, dict[str, list[str]]]:
|
||||
return {"add": {}, "remove": {}}
|
||||
|
||||
|
||||
def _flatten_role_permissions(
|
||||
matrix: dict[str, dict[str, dict[str, bool]]],
|
||||
role: str,
|
||||
) -> dict[str, bool]:
|
||||
permissions: dict[str, bool] = {
|
||||
endpoint_key: False
|
||||
for endpoint_key in API_ENDPOINT_PERMISSIONS.keys()
|
||||
}
|
||||
if role in matrix:
|
||||
for endpoint_key, value in matrix[role].items():
|
||||
endpoint_key = canonical_permission_key(endpoint_key)
|
||||
if endpoint_key not in API_ENDPOINT_PERMISSIONS:
|
||||
continue
|
||||
permissions[endpoint_key] = bool(value["allowed"] if isinstance(value, dict) else value)
|
||||
return permissions
|
||||
|
||||
|
||||
def _canonicalize_payload(payload: dict[str, dict[str, bool]]) -> dict[str, dict[str, bool]]:
|
||||
normalized: dict[str, dict[str, bool]] = {}
|
||||
for role, endpoints in payload.items():
|
||||
normalized[role] = {}
|
||||
for endpoint_key, allowed in endpoints.items():
|
||||
endpoint_key = canonical_permission_key(endpoint_key)
|
||||
if endpoint_key not in API_ENDPOINT_PERMISSIONS:
|
||||
continue
|
||||
normalized[role][endpoint_key] = bool(allowed)
|
||||
return normalized
|
||||
|
||||
|
||||
def _add_adjustment(target: dict[str, list[str]], key: str, value: str) -> None:
|
||||
values = target.setdefault(key, [])
|
||||
if value not in values:
|
||||
values.append(value)
|
||||
|
||||
|
||||
async def preview_api_permission_prerequisite_adjustments(
|
||||
db: AsyncSession,
|
||||
study_id: uuid.UUID,
|
||||
payload: dict[str, dict[str, bool]],
|
||||
) -> dict:
|
||||
"""预检权限草稿需要授权人确认的前置补齐和下游消除项。"""
|
||||
normalized_payload = _canonicalize_payload(payload)
|
||||
matrix = await get_api_endpoint_permissions(db, study_id)
|
||||
roles: dict[str, dict[str, dict[str, list[str]]]] = {}
|
||||
|
||||
for role, endpoints in normalized_payload.items():
|
||||
if role in ("ADMIN", "PM"):
|
||||
continue
|
||||
|
||||
candidate = _flatten_role_permissions(matrix, role)
|
||||
explicitly_denied = {
|
||||
endpoint_key
|
||||
for endpoint_key, allowed in endpoints.items()
|
||||
if not allowed
|
||||
}
|
||||
for endpoint_key, allowed in endpoints.items():
|
||||
candidate[endpoint_key] = allowed
|
||||
|
||||
role_adjustment = _empty_role_adjustment()
|
||||
denied_sources = set(explicitly_denied)
|
||||
|
||||
changed = True
|
||||
while changed:
|
||||
changed = False
|
||||
for endpoint_key, allowed in list(candidate.items()):
|
||||
if not allowed or endpoint_key in denied_sources:
|
||||
continue
|
||||
for prereq in OPERATION_PREREQUISITES.get(endpoint_key, []):
|
||||
prereq = canonical_permission_key(prereq)
|
||||
if prereq in denied_sources:
|
||||
_add_adjustment(role_adjustment["remove"], prereq, endpoint_key)
|
||||
candidate[endpoint_key] = False
|
||||
denied_sources.add(endpoint_key)
|
||||
changed = True
|
||||
break
|
||||
|
||||
changed = True
|
||||
while changed:
|
||||
changed = False
|
||||
for endpoint_key, allowed in list(candidate.items()):
|
||||
if not allowed:
|
||||
continue
|
||||
for prereq in OPERATION_PREREQUISITES.get(endpoint_key, []):
|
||||
prereq = canonical_permission_key(prereq)
|
||||
if candidate.get(prereq, False):
|
||||
continue
|
||||
_add_adjustment(role_adjustment["add"], endpoint_key, prereq)
|
||||
candidate[prereq] = True
|
||||
changed = True
|
||||
|
||||
if role_adjustment["add"] or role_adjustment["remove"]:
|
||||
roles[role] = role_adjustment
|
||||
|
||||
return {
|
||||
"requires_confirmation": bool(roles),
|
||||
"roles": roles,
|
||||
}
|
||||
|
||||
|
||||
def apply_prerequisite_adjustments_to_payload(
|
||||
payload: dict[str, dict[str, bool]],
|
||||
adjustments: dict,
|
||||
) -> dict[str, dict[str, bool]]:
|
||||
"""把已确认的补齐和消除项合并到待保存 payload。"""
|
||||
normalized = _canonicalize_payload(payload)
|
||||
for role, role_adjustment in adjustments.get("roles", {}).items():
|
||||
role_payload = normalized.setdefault(role, {})
|
||||
for prerequisites in role_adjustment.get("add", {}).values():
|
||||
for prereq in prerequisites:
|
||||
role_payload[canonical_permission_key(prereq)] = True
|
||||
for dependents in role_adjustment.get("remove", {}).values():
|
||||
for dependent in dependents:
|
||||
role_payload[canonical_permission_key(dependent)] = False
|
||||
return normalized
|
||||
|
||||
|
||||
async def role_has_api_permission(
|
||||
db: AsyncSession,
|
||||
study_id: uuid.UUID,
|
||||
@@ -150,21 +278,58 @@ async def get_api_endpoint_permissions(
|
||||
return matrix
|
||||
|
||||
|
||||
async def get_effective_api_endpoint_permissions(
|
||||
db: AsyncSession,
|
||||
study_id: uuid.UUID,
|
||||
) -> dict[str, dict[str, dict[str, bool]]]:
|
||||
"""获取考虑前置权限后的有效权限矩阵。"""
|
||||
matrix = await get_api_endpoint_permissions(db, study_id)
|
||||
effective: dict[str, dict[str, dict[str, bool]]] = {}
|
||||
for role, endpoints in matrix.items():
|
||||
effective[role] = {}
|
||||
for endpoint_key in endpoints.keys():
|
||||
effective[role][endpoint_key] = {
|
||||
"allowed": await role_has_api_permission(
|
||||
db,
|
||||
study_id,
|
||||
role,
|
||||
endpoint_key,
|
||||
check_prerequisites=True,
|
||||
)
|
||||
}
|
||||
return effective
|
||||
|
||||
|
||||
async def replace_api_endpoint_permissions(
|
||||
db: AsyncSession,
|
||||
study_id: uuid.UUID,
|
||||
payload: dict[str, dict[str, bool]],
|
||||
*,
|
||||
confirm_prerequisite_adjustments: bool = False,
|
||||
) -> dict[str, dict[str, dict[str, bool]]]:
|
||||
"""更新 payload 中指定的角色权限项。未提交的权限项保持不变。
|
||||
|
||||
ADMIN 与 PM 权限不会被持久化：ADMIN 始终拥有全部权限，PM 默认拥有
|
||||
全部项目权限，应当通过专门的渠道而不是项目权限矩阵调整。
|
||||
"""
|
||||
for role, endpoints in payload.items():
|
||||
normalized_payload = _canonicalize_payload(payload)
|
||||
adjustments = await preview_api_permission_prerequisite_adjustments(
|
||||
db,
|
||||
study_id,
|
||||
normalized_payload,
|
||||
)
|
||||
if adjustments["requires_confirmation"]:
|
||||
if not confirm_prerequisite_adjustments:
|
||||
raise PrerequisitePermissionConfirmationRequired(adjustments)
|
||||
normalized_payload = apply_prerequisite_adjustments_to_payload(
|
||||
normalized_payload,
|
||||
adjustments,
|
||||
)
|
||||
|
||||
for role, endpoints in normalized_payload.items():
|
||||
if role in ("ADMIN", "PM"):
|
||||
continue
|
||||
for endpoint_key, allowed in endpoints.items():
|
||||
endpoint_key = canonical_permission_key(endpoint_key)
|
||||
if endpoint_key not in API_ENDPOINT_PERMISSIONS:
|
||||
continue
|
||||
result = await db.execute(
|
||||
|
||||
Reference in New Issue
Block a user