修正
This commit is contained in:
@@ -5,7 +5,7 @@ from functools import lru_cache
|
||||
from django.core.exceptions import ObjectDoesNotExist
|
||||
from django.db.models import Q
|
||||
from rest_framework.response import Response
|
||||
from .models import AbnormalUserLog, UserRole, Permission, PlayerDailyStats, MerchantDailyStats, \
|
||||
from .models import AbnormalUserLog, UserRole, RolePermission, Permission, PlayerDailyStats, MerchantDailyStats, \
|
||||
ManagerRenewalDailyStats, ManagerDailyStats, LeaderDailyStats, WithdrawalDailyStats
|
||||
|
||||
from django.db import transaction
|
||||
@@ -96,13 +96,45 @@ def verify_kefu_permission(request, username_from_frontend=None):
|
||||
'msg': '身份错误，无权操作其他账号，相关操作已记录'
|
||||
}, status=403)
|
||||
|
||||
# ---------- 4. 获取用户的所有权限（通过角色） ----------
|
||||
# 步骤1：获取用户的所有角色ID
|
||||
role_ids = UserRole.query.filter(account_id=current_user.phone).values_list('role_id', flat=True)
|
||||
# 步骤2：通过角色ID获取权限编码
|
||||
permissions = list(Permission.query.filter(
|
||||
rolepermission__role_id__in=role_ids
|
||||
).values_list('perm_code', flat=True).distinct())
|
||||
# ---------- 4. 获取用户的所有权限 ----------
|
||||
# 优先从 RBAC 表获取，若 RBAC 表不存在/无数据则回退到旧 account_permission 表
|
||||
try:
|
||||
user_roles = UserRole.query.filter(account_id=current_user.phone).select_related('role')
|
||||
role_ids = [ur.role_id for ur in user_roles]
|
||||
if role_ids:
|
||||
perm_ids = RolePermission.query.filter(role_id__in=role_ids).values_list('permission_id', flat=True)
|
||||
permissions = list(Permission.query.filter(
|
||||
perm_id__in=perm_ids
|
||||
).values_list('perm_code', flat=True).distinct())
|
||||
else:
|
||||
permissions = []
|
||||
except Exception:
|
||||
permissions = []
|
||||
|
||||
# RBAC 无数据时，回退到旧 account_permission 表
|
||||
if not permissions:
|
||||
try:
|
||||
from config.models import AccountPermission
|
||||
old_perms = AccountPermission.query.filter(
|
||||
account_id=current_user.phone,
|
||||
is_enabled=True
|
||||
).values_list('permission_code', flat=True)
|
||||
# 旧权限码映射到新权限编码
|
||||
perm_code_map = {
|
||||
1: '001', # 超级管理员
|
||||
2: '002ab', # 平台订单管理
|
||||
3: '002ac', # 处罚管理
|
||||
4: '002ad', # 退款管理
|
||||
5: '002ae', # 店铺管理
|
||||
6: '002af', # 商品审核
|
||||
7: '002ag', # 提现审核
|
||||
8: '002ah', # 用户管理
|
||||
9: '002ai', # 数据统计
|
||||
10: '002aj', # 系统配置
|
||||
}
|
||||
permissions = [perm_code_map.get(code, str(code)) for code in old_perms if code in perm_code_map]
|
||||
except Exception:
|
||||
permissions = []
|
||||
|
||||
if not permissions:
|
||||
logger.warning(f"用户 {current_user.phone} 没有任何权限，请检查角色分配")
|
||||
|
||||
82
create_rbac_tables.sql
Normal file
82
create_rbac_tables.sql
Normal file
@@ -0,0 +1,82 @@
|
||||
-- ============================================================
|
||||
-- RBAC 表创建脚本
|
||||
-- 仅创建生产数据库中缺失的表，已存在的表会被跳过
|
||||
-- 执行方式: mysql -u root -p xaio_cheng_xu < create_rbac_tables.sql
|
||||
-- 注意: 索引和外键单独处理，避免重复创建报错
|
||||
-- ============================================================
|
||||
|
||||
-- ============================================================
|
||||
-- Part 1: backend RBAC 表（小写表名，verify_kefu_permission 使用）
|
||||
-- ============================================================
|
||||
|
||||
CREATE TABLE IF NOT EXISTS `role` (
|
||||
`role_id` integer AUTO_INCREMENT NOT NULL PRIMARY KEY,
|
||||
`role_code` varchar(50) NOT NULL UNIQUE,
|
||||
`role_name` varchar(50) NOT NULL,
|
||||
`description` varchar(200) NOT NULL,
|
||||
`create_time` datetime(6) NOT NULL,
|
||||
`update_time` datetime(6) NOT NULL
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS `permission` (
|
||||
`perm_id` integer AUTO_INCREMENT NOT NULL PRIMARY KEY,
|
||||
`perm_code` varchar(100) NOT NULL UNIQUE,
|
||||
`perm_name` varchar(100) NOT NULL,
|
||||
`description` varchar(200) NOT NULL,
|
||||
`create_time` datetime(6) NOT NULL,
|
||||
`update_time` datetime(6) NOT NULL
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS `user_role` (
|
||||
`id` integer AUTO_INCREMENT NOT NULL PRIMARY KEY,
|
||||
`account_id` varchar(11) NOT NULL,
|
||||
`create_time` datetime(6) NOT NULL,
|
||||
`update_time` datetime(6) NOT NULL,
|
||||
`role_id` integer NOT NULL,
|
||||
UNIQUE KEY `user_role_account_id_role_id_uniq` (`account_id`, `role_id`)
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS `role_permission` (
|
||||
`id` integer AUTO_INCREMENT NOT NULL PRIMARY KEY,
|
||||
`create_time` datetime(6) NOT NULL,
|
||||
`permission_id` integer NOT NULL,
|
||||
`role_id` integer NOT NULL,
|
||||
UNIQUE KEY `role_permission_role_id_permission_id_uniq` (`role_id`, `permission_id`)
|
||||
);
|
||||
|
||||
-- backend 表索引（忽略已存在的错误）
|
||||
CREATE INDEX `user_role_account_id_idx` ON `user_role` (`account_id`);
|
||||
|
||||
-- backend 外键约束
|
||||
ALTER TABLE `user_role` ADD CONSTRAINT `user_role_role_fk` FOREIGN KEY (`role_id`) REFERENCES `role` (`role_id`);
|
||||
ALTER TABLE `role_permission` ADD CONSTRAINT `role_permission_permission_fk` FOREIGN KEY (`permission_id`) REFERENCES `permission` (`perm_id`);
|
||||
ALTER TABLE `role_permission` ADD CONSTRAINT `role_permission_role_fk` FOREIGN KEY (`role_id`) REFERENCES `role` (`role_id`);
|
||||
|
||||
-- ============================================================
|
||||
-- Part 2: gvsdsdk RBAC 表（大写表名，UUID 主键）
|
||||
-- ============================================================
|
||||
|
||||
CREATE TABLE IF NOT EXISTS `AccountActivation` (`AccountActivationCode` BINARY(6) NOT NULL PRIMARY KEY, `UserUUID` BINARY(16) NOT NULL, `CreateTime` datetime(6) NOT NULL);
|
||||
CREATE TABLE IF NOT EXISTS `EphemeralToken` (`ELTUUID` BINARY(16) NOT NULL PRIMARY KEY, `ELTUserUUID` BINARY(16) NOT NULL, `ELTCreateTime` datetime(6) NOT NULL, `ELTEndTime` datetime(6) NOT NULL, `ELTType` smallint NOT NULL, `ELTAllowIP` json NOT NULL, `ELTStatus` smallint NOT NULL);
|
||||
CREATE TABLE IF NOT EXISTS `Password` (`UserUUID` BINARY(16) NOT NULL PRIMARY KEY, `Password` varchar(1024) NOT NULL);
|
||||
CREATE TABLE IF NOT EXISTS `Permission` (`PermUUID` BINARY(16) NOT NULL PRIMARY KEY, `TenantUUID` BINARY(16) NOT NULL, `PermName` varchar(128) NOT NULL, `PermCode` varchar(128) NOT NULL, `PermCategory` varchar(64) NOT NULL, `PermStatus` smallint NOT NULL, `PermDesc` varchar(512) NOT NULL, `CreateTime` datetime(6) NOT NULL);
|
||||
CREATE TABLE IF NOT EXISTS `Position` (`PositionUUID` BINARY(16) NOT NULL PRIMARY KEY, `TenantUUID` BINARY(16) NOT NULL, `PositionName` varchar(128) NOT NULL, `PositionCode` varchar(64) NOT NULL, `PositionLevel` smallint NOT NULL, `PositionStatus` smallint NOT NULL, `PositionDesc` varchar(512) NOT NULL, `CreateTime` datetime(6) NOT NULL, `UpdateTime` datetime(6) NOT NULL);
|
||||
CREATE TABLE IF NOT EXISTS `PositionTemplate` (`PositionTemplateUUID` BINARY(16) NOT NULL PRIMARY KEY, `TenantUUID` BINARY(16) NOT NULL, `TemplateName` varchar(128) NOT NULL, `TemplateCode` varchar(64) NOT NULL, `TemplateStatus` smallint NOT NULL, `TemplateDesc` varchar(512) NOT NULL, `CreateTime` datetime(6) NOT NULL, `UpdateTime` datetime(6) NOT NULL);
|
||||
CREATE TABLE IF NOT EXISTS `PositionTemplatePermission` (`PTPermUUID` BINARY(16) NOT NULL PRIMARY KEY, `PositionTemplateUUID` BINARY(16) NOT NULL, `PermUUID` BINARY(16) NOT NULL, `CreateTime` datetime(6) NOT NULL);
|
||||
CREATE TABLE IF NOT EXISTS `Role` (`RoleUUID` BINARY(16) NOT NULL PRIMARY KEY, `TenantUUID` BINARY(16) NOT NULL, `RoleName` varchar(128) NOT NULL, `RoleType` smallint NOT NULL, `RoleStatus` smallint NOT NULL, `AssignScope` smallint NOT NULL, `AssignScopeUUID` BINARY(16) NULL, `RoleDesc` varchar(512) NOT NULL, `CreateTime` datetime(6) NOT NULL);
|
||||
CREATE TABLE IF NOT EXISTS `RolePermission` (`RolePermUUID` BINARY(16) NOT NULL PRIMARY KEY, `RoleUUID` BINARY(16) NOT NULL, `PermUUID` BINARY(16) NOT NULL, `CreateTime` datetime(6) NOT NULL);
|
||||
CREATE TABLE IF NOT EXISTS `RoleShop` (`RoleShopUUID` BINARY(16) NOT NULL PRIMARY KEY, `RoleUUID` BINARY(16) NOT NULL, `ShopUUID` BINARY(16) NOT NULL, `IsMainShop` smallint NOT NULL, `CreateTime` datetime(6) NOT NULL);
|
||||
CREATE TABLE IF NOT EXISTS `Shop` (`ShopUUID` BINARY(16) NOT NULL PRIMARY KEY, `CompanyUUID` BINARY(16) NOT NULL, `ShopName` varchar(128) NOT NULL, `ShopCode` varchar(64) NOT NULL, `ShopType` smallint NOT NULL, `ShopStatus` smallint NOT NULL, `ShopAddress` varchar(512) NOT NULL, `ShopContact` varchar(128) NOT NULL, `ShopPhone` varchar(32) NOT NULL, `ShopDesc` varchar(512) NOT NULL, `CreateTime` datetime(6) NOT NULL, `UpdateTime` datetime(6) NOT NULL);
|
||||
CREATE TABLE IF NOT EXISTS `User2FA` (`User2FAUUID` BINARY(16) NOT NULL PRIMARY KEY, `UserUUID` BINARY(16) NOT NULL, `SecretKey` varchar(64) NOT NULL, `IsEnabled` smallint NOT NULL, `Verified` smallint NOT NULL, `LastUsedAt` datetime(6) NULL, `CreateTime` datetime(6) NOT NULL);
|
||||
CREATE TABLE IF NOT EXISTS `UserABAC` (`UserABACUUID` BINARY(16) NOT NULL PRIMARY KEY, `UserUUID` BINARY(16) NOT NULL, `HierarchicalPermissionIdentifiers` varchar(256) NOT NULL);
|
||||
CREATE TABLE IF NOT EXISTS `UserAvatar` (`UserUUID` BINARY(16) NOT NULL PRIMARY KEY, `UserAvatar` longblob NOT NULL, `AvatarUploadTime` datetime(6) NOT NULL, `AvatarFileType` varchar(16) NOT NULL);
|
||||
CREATE TABLE IF NOT EXISTS `UserDept` (`UserDeptUUID` BINARY(16) NOT NULL PRIMARY KEY, `UserUUID` BINARY(16) NOT NULL, `DeptUUID` BINARY(16) NOT NULL, `PositionUUID` BINARY(16) NULL, `IsMainDept` smallint NOT NULL, `CreateTime` datetime(6) NOT NULL);
|
||||
CREATE TABLE IF NOT EXISTS `UserLoginLog` (`LogUUID` BINARY(16) NOT NULL PRIMARY KEY, `UserUUID` BINARY(16) NOT NULL, `LoginIP` varchar(39) NOT NULL, `LoginPlatform` varchar(32) NOT NULL, `LoginStatus` smallint NOT NULL, `LoginTime` datetime(6) NOT NULL, `UserAgent` varchar(512) NOT NULL);
|
||||
CREATE TABLE IF NOT EXISTS `UserPending2FA` (`PendingUUID` BINARY(16) NOT NULL PRIMARY KEY, `UserUUID` BINARY(16) NOT NULL UNIQUE, `SecretKey` varchar(64) NOT NULL, `ExpireAt` datetime(6) NOT NULL);
|
||||
CREATE TABLE IF NOT EXISTS `UserRole` (`UserRoleUUID` BINARY(16) NOT NULL PRIMARY KEY, `UserUUID` BINARY(16) NOT NULL, `RoleUUID` BINARY(16) NOT NULL, `CompanyUUID` BINARY(16) NOT NULL, `CreateTime` datetime(6) NOT NULL);
|
||||
|
||||
-- gvsdsdk 索引
|
||||
CREATE INDEX `EphemELTUserUUID_idx` ON `EphemeralToken` (`ELTUserUUID`);
|
||||
CREATE INDEX `EphemELTStatus_idx` ON `EphemeralToken` (`ELTStatus`);
|
||||
CREATE INDEX `User2FA_UserUUID_idx` ON `User2FA` (`UserUUID`);
|
||||
CREATE INDEX `UserLoginLog_UserUUID_idx` ON `UserLoginLog` (`UserUUID`);
|
||||
Reference in New Issue
Block a user