mirror of
https://github.com/fastapiadmin/FastapiAdmin.git
synced 2026-09-22 05:02:57 +00:00
zhangtao
a222cd9e43
此次提交进行了大规模的架构重构： 1. 移除所有平台租户相关模块和代码，包括租户管理、套餐、订单、发票等功能 2. 将菜单模块从platform迁移到system模块，统一系统功能入口 3. 移除租户隔离相关的模型混入、中间件和配置 4. 简化文件上传、SSE事件总线、定时任务等模块的租户逻辑 5. 重构所有业务schema和模型，移除租户相关字段和关联 6. 清理初始化脚本、模板和常量中的租户相关代码 7. 简化认证和权限控制逻辑，移除数据范围检查相关代码
222 lines
7.2 KiB
Python
222 lines
7.2 KiB
Python
import json
|
||
from collections.abc import AsyncGenerator
|
||
from dataclasses import replace
|
||
from typing import Any
|
||
|
||
from fastapi import Depends, Query, Request
|
||
from redis.asyncio.client import Redis
|
||
from sqlalchemy import select
|
||
from sqlalchemy.ext.asyncio import AsyncSession
|
||
|
||
from app.common.enums import RET, RedisInitKeyConfig
|
||
from app.config.setting import settings
|
||
from app.core.base_schema import AuthSchema, CoreUserSchema
|
||
from app.core.database import async_db_session
|
||
from app.core.exceptions import CustomException
|
||
from app.core.logger import logger
|
||
from app.core.redis_crud import RedisCURD
|
||
from app.core.request_context import RequestContext
|
||
from app.core.security import OAuth2Schema, decode_access_token
|
||
|
||
|
||
async def db_getter() -> AsyncGenerator[AsyncSession, None]:
|
||
"""数据库会话 — 请求级生命周期管理。
|
||
|
||
一个 HTTP 请求内所有 SQL 共享同一个事务：要么全成功，要么全失败。
|
||
读操作也走这个事务（牺牲一点 MVCC 隔离换取读已写一致性）。
|
||
"""
|
||
async with async_db_session() as session, session.begin():
|
||
yield session
|
||
|
||
|
||
async def redis_getter(request: Request) -> Redis:
|
||
"""获取Redis连接
|
||
|
||
参数:
|
||
- request (Request): 请求对象
|
||
|
||
返回:
|
||
- Redis: Redis连接
|
||
"""
|
||
return request.app.state.redis
|
||
|
||
|
||
async def get_current_user(
|
||
request: Request,
|
||
db: AsyncSession = Depends(db_getter),
|
||
redis: Redis = Depends(redis_getter),
|
||
token: str = Depends(OAuth2Schema),
|
||
) -> AuthSchema:
|
||
"""获取当前用户
|
||
|
||
用户查询使用独立的只读数据库会话（不参与请求事务，查询完成后立即释放快照），
|
||
返回的 auth.db 指向请求级事务会话供后续写操作使用。
|
||
|
||
参数:
|
||
- request (Request): 请求对象
|
||
- db (AsyncSession): 请求级事务会话
|
||
- redis (Redis): Redis连接
|
||
- token (str): 访问令牌
|
||
|
||
返回:
|
||
- AuthSchema: 已认证的信息模型
|
||
"""
|
||
return await _authenticate(token, db, redis, request)
|
||
|
||
|
||
async def get_current_user_ws(
|
||
token: str = Query(..., description="认证token"),
|
||
db: AsyncSession = Depends(db_getter),
|
||
redis: Redis = Depends(redis_getter),
|
||
) -> AuthSchema:
|
||
"""获取当前用户（WebSocket专用，从查询参数获取token）
|
||
|
||
参数:
|
||
- token (str): 认证token
|
||
- db (AsyncSession): 数据库会话
|
||
- redis (Redis): Redis连接
|
||
|
||
返回:
|
||
- AuthSchema: 已认证的信息模型
|
||
"""
|
||
return await _authenticate(token, db, redis)
|
||
|
||
|
||
async def _authenticate(
|
||
token: str,
|
||
db: AsyncSession,
|
||
redis: Redis,
|
||
request: Request | None = None,
|
||
) -> AuthSchema:
|
||
"""核心认证逻辑（HTTP 与 WebSocket 共享）
|
||
|
||
参数:
|
||
- token: 访问令牌
|
||
- db: 请求级事务会话
|
||
- redis: Redis连接
|
||
- request: HTTP 请求对象（WebSocket 场景为 None）
|
||
|
||
返回:
|
||
- AuthSchema: 认证信息模型
|
||
"""
|
||
if not token:
|
||
raise CustomException(msg="认证已失效", code=RET.UNAUTHORIZED.code, status_code=401)
|
||
|
||
# 处理Bearer token
|
||
if token.startswith("Bearer"):
|
||
token = token.split(" ")[1]
|
||
|
||
# 滑动模式下跳过 JWT exp 校验，由 Redis session TTL 决定实际有效期
|
||
payload = decode_access_token(token, verify_exp=not settings.TOKEN_SLIDING_EXPIRE)
|
||
if not payload or payload.is_refresh:
|
||
raise CustomException(msg="非法凭证", code=RET.INVALID_CREDENTIALS.code, status_code=401)
|
||
|
||
session_id = payload.sub
|
||
if not session_id:
|
||
raise CustomException(msg="认证已失效", code=RET.UNAUTHORIZED.code, status_code=401)
|
||
|
||
raw = await RedisCURD(redis).get(f"{RedisInitKeyConfig.USER_SESSION.key}:{session_id}")
|
||
if not raw:
|
||
raise CustomException(msg="认证已失效", code=RET.UNAUTHORIZED.code, status_code=401)
|
||
user_info = json.loads(raw)
|
||
|
||
# 校验 session 数据完整性
|
||
if not user_info.get("session_id"):
|
||
raise CustomException(msg="认证已失效", code=RET.UNAUTHORIZED.code, status_code=401)
|
||
|
||
# 滑动过期续期
|
||
if settings.TOKEN_SLIDING_EXPIRE:
|
||
ttl = await RedisCURD(redis).ttl(key=f"{RedisInitKeyConfig.ACCESS_TOKEN.key}:{session_id}")
|
||
expire_seconds = settings.ACCESS_TOKEN_EXPIRE_SECONDS
|
||
if ttl > 0 and ttl < expire_seconds // 2:
|
||
await RedisCURD(redis).expire(
|
||
key=f"{RedisInitKeyConfig.ACCESS_TOKEN.key}:{session_id}",
|
||
expire=expire_seconds,
|
||
)
|
||
await RedisCURD(redis).expire(
|
||
key=f"{RedisInitKeyConfig.REFRESH_TOKEN.key}:{session_id}",
|
||
expire=settings.REFRESH_TOKEN_EXPIRE_SECONDS,
|
||
)
|
||
|
||
username = user_info.get("user_name")
|
||
if not username:
|
||
raise CustomException(msg="认证已失效", code=RET.UNAUTHORIZED.code, status_code=401)
|
||
|
||
user_status = user_info.get("user_status", 0)
|
||
user_id = user_info.get("user_id")
|
||
|
||
if user_status == 1:
|
||
raise CustomException(msg="用户已被停用", code=RET.UNAUTHORIZED.code, status_code=401)
|
||
|
||
if request:
|
||
request.state.ctx = replace(
|
||
(getattr(request.state, "ctx", None) or RequestContext()),
|
||
user_id=user_id,
|
||
user_username=username,
|
||
session_id=session_id,
|
||
session_info=user_info,
|
||
)
|
||
|
||
if not user_id:
|
||
raise CustomException(msg="认证已失效", code=RET.UNAUTHORIZED.code, status_code=401)
|
||
|
||
from app.api.v1.module_system.user.model import UserModel
|
||
|
||
stmt = select(UserModel).where(UserModel.id == user_id, UserModel.is_deleted == False)
|
||
result = await db.execute(stmt)
|
||
user_obj = result.scalars().first()
|
||
if not user_obj:
|
||
raise CustomException(msg="用户不存在", code=RET.NOT_FOUND.code, status_code=401)
|
||
|
||
user = CoreUserSchema.model_validate(user_obj)
|
||
return AuthSchema(
|
||
user=user,
|
||
permissions=user_info.get("permissions", []),
|
||
menu_ids=user_info.get("menu_ids", []),
|
||
)
|
||
|
||
|
||
class AuthPermission:
|
||
"""权限验证类"""
|
||
|
||
def __init__(
|
||
self,
|
||
permissions: list[str] | None = None,
|
||
) -> None:
|
||
"""初始化权限验证
|
||
|
||
参数:
|
||
- permissions (list[str] | None): 权限标识列表。
|
||
"""
|
||
self.permissions = permissions or []
|
||
|
||
async def __call__(self, auth: AuthSchema = Depends(get_current_user), db: AsyncSession = Depends(db_getter)) -> AuthSchema:
|
||
"""调用权限验证
|
||
|
||
参数:
|
||
- auth (AuthSchema): 认证信息对象。
|
||
|
||
返回:
|
||
- AuthSchema: 已认证的权限信息对象。
|
||
"""
|
||
user = auth.user
|
||
if user.id is None or user.is_superuser:
|
||
return auth
|
||
|
||
if not self.permissions:
|
||
return auth
|
||
|
||
if "*" in self.permissions or "*:*:*" in self.permissions:
|
||
return auth
|
||
|
||
user_permissions = set[Any](auth.permissions)
|
||
|
||
if not user_permissions:
|
||
raise CustomException(msg="无权限操作", code=RET.FORBIDDEN.code, status_code=403)
|
||
|
||
if not any(perm in user_permissions for perm in self.permissions):
|
||
logger.error(f"用户缺少任何所需的权限: {self.permissions}")
|
||
raise CustomException(msg="无权限操作", code=10403, status_code=403)
|
||
|
||
return auth
|