Codex
419 lines
13 KiB
Python
419 lines
13 KiB
Python
#!/usr/bin/env python
|
||
# -*- coding: utf-8 -*-
|
||
"""
|
||
Permission Utils - 基于API路径的动态权限鉴权
|
||
|
||
工作原理：
|
||
1. 用户访问某个API时，根据请求的路径和方法，查找Permission表中是否有对应的权限记录
|
||
2. 如果有权限记录，检查用户的角色是否关联了该权限
|
||
3. 如果用户角色有该权限，则放行；否则返回403
|
||
4. 如果Permission表中没有该API的权限记录，则默认放行（未配置权限的API不做限制）
|
||
"""
|
||
import json
|
||
import re
|
||
from typing import List, Optional, Dict, Any, Set
|
||
|
||
from fastapi import HTTPException, status
|
||
from sqlalchemy import select
|
||
from sqlalchemy.ext.asyncio import AsyncSession
|
||
from sqlalchemy.orm import selectinload
|
||
|
||
from utils.redis import RedisClient
|
||
|
||
# Redis 缓存 key 前缀和 TTL
|
||
API_PERMISSION_CACHE_KEY = "api_permission:path_map" # Hash: (path:method) -> permission_id
|
||
ROLE_PERMISSION_CACHE_PREFIX = "api_permission:role:" # role_permission:role:{role_id} -> Set[permission_id]
|
||
API_PERMISSION_CACHE_TTL = 300 # API路径映射缓存 5分钟
|
||
ROLE_PERMISSION_CACHE_TTL = 300 # 角色权限缓存 5分钟
|
||
|
||
|
||
# HTTP方法映射（与Permission模型中的定义一致）
|
||
HTTP_METHOD_MAP = {
|
||
'GET': 0,
|
||
'POST': 1,
|
||
'PUT': 2,
|
||
'DELETE': 3,
|
||
'PATCH': 4,
|
||
'ALL': 5,
|
||
}
|
||
|
||
|
||
class APIPermissionChecker:
|
||
"""
|
||
基于API路径的动态权限检查器
|
||
|
||
在AuthMiddleware中调用，根据请求的API路径和方法检查用户是否有权限
|
||
"""
|
||
|
||
def __init__(self):
|
||
pass
|
||
|
||
async def load_permissions_cache(self, db: AsyncSession):
|
||
"""
|
||
加载所有API权限到 Redis 缓存
|
||
|
||
建议在应用启动时调用，或者定期刷新
|
||
"""
|
||
from core.permission.model import Permission
|
||
|
||
result = await db.execute(
|
||
select(Permission).where(
|
||
Permission.is_active == True, # noqa: E712
|
||
Permission.is_deleted == False, # noqa: E712
|
||
Permission.permission_type == 1, # 只缓存API权限
|
||
Permission.api_path.isnot(None)
|
||
)
|
||
)
|
||
permissions = result.scalars().all()
|
||
|
||
redis = await RedisClient.get_client()
|
||
# 先删除旧缓存
|
||
await redis.delete(API_PERMISSION_CACHE_KEY)
|
||
|
||
cache_data = {}
|
||
for perm in permissions:
|
||
if perm.api_path:
|
||
# 存储权限ID，key为 "path:method"
|
||
cache_key = f"{perm.api_path}:{perm.http_method}"
|
||
cache_data[cache_key] = perm.id
|
||
# 如果是ALL方法，也存储到各个具体方法
|
||
if perm.http_method == 5: # ALL
|
||
for method_code in [0, 1, 2, 3, 4]:
|
||
key = f"{perm.api_path}:{method_code}"
|
||
if key not in cache_data:
|
||
cache_data[key] = perm.id
|
||
|
||
if cache_data:
|
||
await redis.hset(API_PERMISSION_CACHE_KEY, mapping=cache_data)
|
||
await redis.expire(API_PERMISSION_CACHE_KEY, API_PERMISSION_CACHE_TTL)
|
||
|
||
async def clear_cache(self):
|
||
"""清除所有权限相关的 Redis 缓存"""
|
||
redis = await RedisClient.get_client()
|
||
# 清除 API 路径映射缓存
|
||
await redis.delete(API_PERMISSION_CACHE_KEY)
|
||
# 清除所有角色权限缓存
|
||
cursor = 0
|
||
while True:
|
||
cursor, keys = await redis.scan(cursor, match=f"{ROLE_PERMISSION_CACHE_PREFIX}*", count=100)
|
||
if keys:
|
||
await redis.delete(*keys)
|
||
if cursor == 0:
|
||
break
|
||
|
||
def _match_path(self, request_path: str, permission_path: str) -> bool:
|
||
"""
|
||
匹配请求路径和权限路径
|
||
|
||
支持路径参数，如 /api/user/{id} 匹配 /api/user/123
|
||
"""
|
||
# 将权限路径中的{xxx}替换为正则表达式
|
||
pattern = re.sub(r'\{[^}]+\}', r'[^/]+', permission_path)
|
||
pattern = f'^{pattern}$'
|
||
return bool(re.match(pattern, request_path))
|
||
|
||
async def find_permission_id(self, request_path: str, http_method: str) -> Optional[str]:
|
||
"""
|
||
根据请求路径和方法查找对应的权限ID（从 Redis 缓存查询）
|
||
|
||
:param request_path: 请求路径，如 /api/core/user
|
||
:param http_method: HTTP方法，如 GET, POST
|
||
:return: 权限ID，如果没有找到则返回None
|
||
"""
|
||
method_code = HTTP_METHOD_MAP.get(http_method.upper(), 0)
|
||
redis = await RedisClient.get_client()
|
||
|
||
# 1. 精确匹配
|
||
cache_key = f"{request_path}:{method_code}"
|
||
perm_id = await redis.hget(API_PERMISSION_CACHE_KEY, cache_key)
|
||
if perm_id:
|
||
return perm_id
|
||
|
||
# 2. 尝试匹配ALL方法
|
||
cache_key_all = f"{request_path}:5"
|
||
perm_id = await redis.hget(API_PERMISSION_CACHE_KEY, cache_key_all)
|
||
if perm_id:
|
||
return perm_id
|
||
|
||
# 3. 路径参数匹配（需要获取所有缓存条目）
|
||
all_entries = await redis.hgetall(API_PERMISSION_CACHE_KEY)
|
||
if all_entries:
|
||
for entry_key, entry_perm_id in all_entries.items():
|
||
# entry_key 格式: "path:method"
|
||
# 需要从末尾分离出 method（最后一个冒号后的数字）
|
||
last_colon = entry_key.rfind(':')
|
||
if last_colon == -1:
|
||
continue
|
||
perm_path = entry_key[:last_colon]
|
||
try:
|
||
perm_method = int(entry_key[last_colon + 1:])
|
||
except ValueError:
|
||
continue
|
||
|
||
if perm_method in (method_code, 5): # 匹配具体方法或ALL
|
||
if '{' in perm_path and self._match_path(request_path, perm_path):
|
||
return entry_perm_id
|
||
|
||
return None
|
||
|
||
async def check_permission(
|
||
self,
|
||
db: AsyncSession,
|
||
user_id: str,
|
||
role_id: Optional[str] = None,
|
||
is_superuser: bool = False,
|
||
request_path: str = "",
|
||
http_method: str = "",
|
||
role_ids: Optional[List[str]] = None,
|
||
) -> tuple[bool, str]:
|
||
"""
|
||
检查用户是否有访问指定API的权限（支持多角色）
|
||
|
||
:param db: 数据库会话
|
||
:param user_id: 用户ID
|
||
:param role_id: 角色ID（单个，向后兼容）
|
||
:param is_superuser: 是否超级管理员
|
||
:param request_path: 请求路径
|
||
:param http_method: HTTP方法
|
||
:param role_ids: 角色ID列表（多个角色）
|
||
:return: (是否有权限, 错误信息)
|
||
"""
|
||
# 超级管理员跳过权限检查
|
||
if is_superuser:
|
||
return True, ""
|
||
|
||
# 确保缓存已加载
|
||
redis = await RedisClient.get_client()
|
||
cache_exists = await redis.exists(API_PERMISSION_CACHE_KEY)
|
||
if not cache_exists:
|
||
await self.load_permissions_cache(db)
|
||
|
||
# 查找该API对应的权限
|
||
permission_id = await self.find_permission_id(request_path, http_method)
|
||
|
||
# 如果该API没有配置权限，默认放行
|
||
if not permission_id:
|
||
return True, ""
|
||
|
||
# 处理角色ID列表
|
||
if role_ids is None:
|
||
role_ids = [role_id] if role_id else []
|
||
|
||
# 用户没有角色，无权限
|
||
if not role_ids:
|
||
return False, "用户未分配角色，无权访问此接口"
|
||
|
||
# 检查用户的任一角色是否有该权限（只要有一个角色有权限即可）
|
||
for rid in role_ids:
|
||
has_permission = await self._check_role_has_permission(db, rid, permission_id)
|
||
if has_permission:
|
||
return True, ""
|
||
|
||
return False, "权限不足，无权访问此接口"
|
||
|
||
async def _get_role_permission_ids(
|
||
self,
|
||
db: AsyncSession,
|
||
role_id: str,
|
||
) -> Set[str]:
|
||
"""
|
||
获取角色的所有权限ID集合（Redis 缓存）
|
||
"""
|
||
redis = await RedisClient.get_client()
|
||
cache_key = f"{ROLE_PERMISSION_CACHE_PREFIX}{role_id}"
|
||
|
||
# 从 Redis 获取缓存
|
||
cached = await redis.get(cache_key)
|
||
# if cached:
|
||
# try:
|
||
# return set(json.loads(cached))
|
||
# except (json.JSONDecodeError, TypeError):
|
||
# pass
|
||
|
||
# 缓存未命中，从数据库加载
|
||
from core.role.model import Role
|
||
|
||
result = await db.execute(
|
||
select(Role)
|
||
.options(selectinload(Role.permissions))
|
||
.where(
|
||
Role.id == role_id,
|
||
Role.status == True, # noqa: E712
|
||
Role.is_deleted == False # noqa: E712
|
||
)
|
||
)
|
||
role = result.scalar_one_or_none()
|
||
|
||
perm_ids: Set[str] = set()
|
||
if role and role.permissions:
|
||
for perm in role.permissions:
|
||
if perm.is_active:
|
||
perm_ids.add(perm.id)
|
||
|
||
# 写入 Redis 缓存
|
||
await redis.set(cache_key, json.dumps(list(perm_ids)), ex=ROLE_PERMISSION_CACHE_TTL)
|
||
return perm_ids
|
||
|
||
async def _check_role_has_permission(
|
||
self,
|
||
db: AsyncSession,
|
||
role_id: str,
|
||
permission_id: str
|
||
) -> bool:
|
||
"""
|
||
检查角色是否有指定权限
|
||
"""
|
||
perm_ids = await self._get_role_permission_ids(db, role_id)
|
||
return permission_id in perm_ids
|
||
|
||
|
||
# 全局权限检查器实例
|
||
api_permission_checker = APIPermissionChecker()
|
||
|
||
|
||
async def check_api_permission(
|
||
db: AsyncSession,
|
||
user_id: str,
|
||
role_id: Optional[str] = None,
|
||
is_superuser: bool = False,
|
||
request_path: str = "",
|
||
http_method: str = "",
|
||
role_ids: Optional[List[str]] = None,
|
||
) -> tuple[bool, str]:
|
||
"""
|
||
检查API权限的便捷函数（支持多角色）
|
||
|
||
:return: (是否有权限, 错误信息)
|
||
"""
|
||
return await api_permission_checker.check_permission(
|
||
db, user_id, role_id, is_superuser, request_path, http_method, role_ids
|
||
)
|
||
|
||
|
||
async def refresh_permission_cache(db: AsyncSession):
|
||
"""
|
||
刷新权限缓存
|
||
|
||
当权限数据变更时调用此函数
|
||
"""
|
||
await api_permission_checker.load_permissions_cache(db)
|
||
|
||
|
||
async def clear_permission_cache():
|
||
"""
|
||
清除权限缓存
|
||
"""
|
||
await api_permission_checker.clear_cache()
|
||
|
||
|
||
async def clear_role_permission_cache(role_id: str):
|
||
"""
|
||
清除指定角色的权限缓存
|
||
|
||
:param role_id: 角色ID
|
||
"""
|
||
redis = await RedisClient.get_client()
|
||
await redis.delete(f"{ROLE_PERMISSION_CACHE_PREFIX}{role_id}")
|
||
|
||
|
||
async def clear_all_role_permission_cache():
|
||
"""
|
||
清除所有角色的权限缓存
|
||
"""
|
||
redis = await RedisClient.get_client()
|
||
cursor = 0
|
||
while True:
|
||
cursor, keys = await redis.scan(cursor, match=f"{ROLE_PERMISSION_CACHE_PREFIX}*", count=100)
|
||
if keys:
|
||
await redis.delete(*keys)
|
||
if cursor == 0:
|
||
break
|
||
|
||
|
||
async def get_user_api_permissions(
|
||
db: AsyncSession,
|
||
role_id: Optional[str] = None,
|
||
is_superuser: bool = False,
|
||
role_ids: Optional[List[str]] = None,
|
||
) -> Set[str]:
|
||
"""
|
||
获取用户的API权限列表（返回API路径集合，支持多角色）
|
||
"""
|
||
if is_superuser:
|
||
return {"*"} # 超级管理员有所有权限
|
||
|
||
# 处理角色ID列表
|
||
if role_ids is None:
|
||
role_ids = [role_id] if role_id else []
|
||
|
||
if not role_ids:
|
||
return set()
|
||
|
||
from core.role.model import Role
|
||
|
||
api_paths = set()
|
||
|
||
# 合并所有角色的权限
|
||
for rid in role_ids:
|
||
result = await db.execute(
|
||
select(Role)
|
||
.options(selectinload(Role.permissions))
|
||
.where(
|
||
Role.id == rid,
|
||
Role.status == True, # noqa: E712
|
||
Role.is_deleted == False # noqa: E712
|
||
)
|
||
)
|
||
role = result.scalar_one_or_none()
|
||
|
||
if role and role.permissions:
|
||
for perm in role.permissions:
|
||
if perm.is_active and perm.api_path:
|
||
api_paths.add(perm.api_path)
|
||
|
||
return api_paths
|
||
|
||
|
||
async def get_user_permission_codes(
|
||
db: AsyncSession,
|
||
role_id: Optional[str] = None,
|
||
is_superuser: bool = False,
|
||
role_ids: Optional[List[str]] = None,
|
||
) -> Set[str]:
|
||
"""
|
||
获取用户的权限代码列表（返回权限代码集合，支持多角色）
|
||
"""
|
||
if is_superuser:
|
||
return {"*"} # 超级管理员有所有权限
|
||
|
||
# 处理角色ID列表
|
||
if role_ids is None:
|
||
role_ids = [role_id] if role_id else []
|
||
|
||
if not role_ids:
|
||
return set()
|
||
|
||
from core.role.model import Role
|
||
|
||
permission_codes = set()
|
||
|
||
# 合并所有角色的权限
|
||
for rid in role_ids:
|
||
result = await db.execute(
|
||
select(Role)
|
||
.options(selectinload(Role.permissions))
|
||
.where(
|
||
Role.id == rid,
|
||
Role.status == True, # noqa: E712
|
||
Role.is_deleted == False # noqa: E712
|
||
)
|
||
)
|
||
role = result.scalar_one_or_none()
|
||
|
||
if role and role.permissions:
|
||
for perm in role.permissions:
|
||
if perm.is_active and perm.code:
|
||
permission_codes.add(perm.code)
|
||
|
||
return permission_codes
|