Update some interface permission checks (#158)

backend/app/api/v1/api.py

@@ -5,6 +5,7 @@ from typing import Annotated
 from fastapi import APIRouter, Query
 
 from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.pagination import PageDepends, paging_data
 from backend.app.common.response.response_schema import response_base
 from backend.app.database.db_mysql import CurrentSession
@@ -14,13 +15,13 @@ from backend.app.services.api_service import ApiService
 router = APIRouter()
 
 
-@router.get('/{pk}', summary='获取接口详情', dependencies=[DependsRBAC])
+@router.get('/{pk}', summary='获取接口详情', dependencies=[DependsJwtAuth])
 async def get_api(pk: int):
     api = await ApiService.get(pk=pk)
     return await response_base.success(data=api)
 
 
-@router.get('', summary='（模糊条件）分页获取所有接口', dependencies=[DependsRBAC, PageDepends])
+@router.get('', summary='（模糊条件）分页获取所有接口', dependencies=[DependsJwtAuth, PageDepends])
 async def get_all_apis(
     db: CurrentSession,
     name: Annotated[str | None, Query()] = None,

backend/app/api/v1/casbin.py

@@ -5,6 +5,7 @@ from typing import Annotated
 from fastapi import APIRouter, Query
 
 from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.pagination import PageDepends, paging_data
 from backend.app.common.response.response_schema import response_base
 from backend.app.database.db_mysql import CurrentSession
@@ -21,7 +22,7 @@ from backend.app.services.casbin_service import CasbinService
 router = APIRouter()
 
 
-@router.get('', summary='（模糊条件）分页获取所有权限规则', dependencies=[DependsRBAC, PageDepends])
+@router.get('', summary='（模糊条件）分页获取所有权限规则', dependencies=[DependsJwtAuth, PageDepends])
 async def get_all_casbin(
     db: CurrentSession,
     ptype: Annotated[str | None, Query()] = None,
@@ -32,7 +33,7 @@ async def get_all_casbin(
     return await response_base.success(data=page_data)
 
 
-@router.get('/policy', summary='获取所有访问权限规则', dependencies=[DependsRBAC])
+@router.get('/policy', summary='获取所有访问权限规则', dependencies=[DependsJwtAuth])
 async def get_all_policies():
     policies = await CasbinService.get_policy_list()
     return await response_base.success(data=policies)

backend/app/api/v1/dept.py

@@ -5,6 +5,7 @@ from typing import Annotated
 from fastapi import APIRouter, Query
 
 from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.response.response_schema import response_base
 from backend.app.schemas.dept import CreateDept, GetAllDept, UpdateDept
 from backend.app.services.dept_service import DeptService
@@ -13,14 +14,14 @@ from backend.app.utils.serializers import select_to_json
 router = APIRouter()
 
 
-@router.get('/{pk}', summary='获取部门详情', dependencies=[DependsRBAC])
+@router.get('/{pk}', summary='获取部门详情', dependencies=[DependsJwtAuth])
 async def get_dept(pk: int):
     dept = await DeptService.get(pk=pk)
     data = GetAllDept(**select_to_json(dept))
     return await response_base.success(data=data)
 
 
-@router.get('', summary='获取所有部门展示树', dependencies=[DependsRBAC])
+@router.get('', summary='获取所有部门展示树', dependencies=[DependsJwtAuth])
 async def get_all_depts(
     level: Annotated[int | None, Query()] = None,
     name: Annotated[str | None, Query()] = None,

backend/app/api/v1/dict_data.py

@@ -5,6 +5,7 @@ from typing import Annotated
 from fastapi import APIRouter, Query
 
 from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.pagination import PageDepends, paging_data
 from backend.app.common.response.response_schema import response_base
 from backend.app.database.db_mysql import CurrentSession
@@ -15,14 +16,14 @@ from backend.app.utils.serializers import select_to_json
 router = APIRouter()
 
 
-@router.get('/{pk}', summary='获取字典详情', dependencies=[DependsRBAC])
+@router.get('/{pk}', summary='获取字典详情', dependencies=[DependsJwtAuth])
 async def get_dict_data(pk: int):
     dict_data = await DictDataService.get(pk=pk)
     data = GetAllDictData(**select_to_json(dict_data))
     return await response_base.success(data=data)
 
 
-@router.get('', summary='（模糊条件）分页获取所有字典', dependencies=[DependsRBAC, PageDepends])
+@router.get('', summary='（模糊条件）分页获取所有字典', dependencies=[DependsJwtAuth, PageDepends])
 async def get_all_dict_datas(
     db: CurrentSession,
     label: Annotated[str | None, Query()] = None,

backend/app/api/v1/dict_type.py

@@ -5,6 +5,7 @@ from typing import Annotated
 from fastapi import APIRouter, Query
 
 from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.pagination import PageDepends, paging_data
 from backend.app.common.response.response_schema import response_base
 from backend.app.database.db_mysql import CurrentSession
@@ -14,7 +15,7 @@ from backend.app.services.dict_type_service import DictTypeService
 router = APIRouter()
 
 
-@router.get('', summary='（模糊条件）分页获取所有字典类型', dependencies=[DependsRBAC, PageDepends])
+@router.get('', summary='（模糊条件）分页获取所有字典类型', dependencies=[DependsJwtAuth, PageDepends])
 async def get_all_dict_types(
     db: CurrentSession,
     name: Annotated[str | None, Query()] = None,

backend/app/api/v1/log/login_log.py

@@ -5,6 +5,7 @@ from typing import Annotated
 from fastapi import APIRouter, Query
 
 from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.pagination import paging_data, PageDepends
 from backend.app.common.response.response_schema import response_base
 from backend.app.database.db_mysql import CurrentSession
@@ -14,7 +15,7 @@ from backend.app.services.login_log_service import LoginLogService
 router = APIRouter()
 
 
-@router.get('', summary='（模糊条件）分页获取登录日志', dependencies=[DependsRBAC, PageDepends])
+@router.get('', summary='（模糊条件）分页获取登录日志', dependencies=[DependsJwtAuth, PageDepends])
 async def get_all_login_logs(
     db: CurrentSession,
     username: Annotated[str | None, Query()] = None,

backend/app/api/v1/log/opera_log.py

@@ -5,6 +5,7 @@ from typing import Annotated
 from fastapi import APIRouter, Query
 
 from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.pagination import PageDepends, paging_data
 from backend.app.common.response.response_schema import response_base
 from backend.app.database.db_mysql import CurrentSession
@@ -14,7 +15,7 @@ from backend.app.services.opera_log_service import OperaLogService
 router = APIRouter()
 
 
-@router.get('', summary='（模糊条件）分页获取操作日志', dependencies=[DependsRBAC, PageDepends])
+@router.get('', summary='（模糊条件）分页获取操作日志', dependencies=[DependsJwtAuth, PageDepends])
 async def get_all_opera_logs(
     db: CurrentSession,
     username: Annotated[str | None, Query()] = None,

backend/app/api/v1/menu.py

@@ -5,6 +5,7 @@ from typing import Annotated
 from fastapi import APIRouter, Query, Request
 
 from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.response.response_schema import response_base
 from backend.app.schemas.menu import GetAllMenu, CreateMenu, UpdateMenu
 from backend.app.services.menu_service import MenuService
@@ -13,20 +14,20 @@ from backend.app.utils.serializers import select_to_json
 router = APIRouter()
 
 
-@router.get('/sidebar', summary='获取用户菜单展示树', dependencies=[DependsRBAC])
+@router.get('/sidebar', summary='获取用户菜单展示树', dependencies=[DependsJwtAuth])
 async def get_user_menus(request: Request):
     menu = await MenuService.get_user_menu_tree(request=request)
     return await response_base.success(data=menu)
 
 
-@router.get('/{pk}', summary='获取菜单详情', dependencies=[DependsRBAC])
+@router.get('/{pk}', summary='获取菜单详情', dependencies=[DependsJwtAuth])
 async def get_menu(pk: int):
     menu = await MenuService.get(pk=pk)
     data = GetAllMenu(**select_to_json(menu))
     return await response_base.success(data=data)
 
 
-@router.get('', summary='获取所有菜单展示树', dependencies=[DependsRBAC])
+@router.get('', summary='获取所有菜单展示树', dependencies=[DependsJwtAuth])
 async def get_all_menus(
     name: Annotated[str | None, Query()] = None,
     status: Annotated[int | None, Query()] = None,

backend/app/api/v1/role.py

@@ -5,6 +5,7 @@ from typing import Annotated
 from fastapi import APIRouter, Query
 
 from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.pagination import PageDepends, paging_data
 from backend.app.common.response.response_schema import response_base
 from backend.app.database.db_mysql import CurrentSession
@@ -15,14 +16,14 @@ from backend.app.utils.serializers import select_to_json
 router = APIRouter()
 
 
-@router.get('/{pk}', summary='获取角色详情', dependencies=[DependsRBAC])
+@router.get('/{pk}', summary='获取角色详情', dependencies=[DependsJwtAuth])
 async def get_role(pk: int):
     role = await RoleService.get(pk=pk)
     data = GetAllRole(**select_to_json(role))
     return await response_base.success(data=data)
 
 
-@router.get('', summary='（模糊条件）分页获取所有角色', dependencies=[DependsRBAC, PageDepends])
+@router.get('', summary='（模糊条件）分页获取所有角色', dependencies=[DependsJwtAuth, PageDepends])
 async def get_all_roles(
     db: CurrentSession,
     name: Annotated[str | None, Query()] = None,

backend/app/api/v1/user.py

@@ -5,6 +5,7 @@ from typing import Annotated
 from fastapi import APIRouter, Query, Request
 
 from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.pagination import paging_data, PageDepends
 from backend.app.common.response.response_schema import response_base
 from backend.app.database.db_mysql import CurrentSession
@@ -21,7 +22,7 @@ async def user_register(obj: CreateUser):
     return await response_base.success()
 
 
-@router.post('/password/reset', summary='密码重置', dependencies=[DependsRBAC])
+@router.post('/password/reset', summary='密码重置', dependencies=[DependsJwtAuth])
 async def password_reset(request: Request, obj: ResetPassword):
     count = await UserService.pwd_reset(request=request, obj=obj)
     if count > 0:
@@ -29,14 +30,14 @@ async def password_reset(request: Request, obj: ResetPassword):
     return await response_base.fail()
 
 
-@router.get('/{username}', summary='查看用户信息', dependencies=[DependsRBAC])
+@router.get('/{username}', summary='查看用户信息', dependencies=[DependsJwtAuth])
 async def get_user(username: str):
     current_user = await UserService.get_userinfo(username=username)
     data = GetAllUserInfo(**select_to_json(current_user))
     return await response_base.success(data=data)
 
 
-@router.put('/{username}', summary='更新用户信息', dependencies=[DependsRBAC])
+@router.put('/{username}', summary='更新用户信息', dependencies=[DependsJwtAuth])
 async def update_userinfo(request: Request, username: str, obj: UpdateUser):
     count = await UserService.update(request=request, username=username, obj=obj)
     if count > 0:
@@ -44,7 +45,7 @@ async def update_userinfo(request: Request, username: str, obj: UpdateUser):
     return await response_base.fail()
 
 
-@router.put('/{username}/avatar', summary='更新头像', dependencies=[DependsRBAC])
+@router.put('/{username}/avatar', summary='更新头像', dependencies=[DependsJwtAuth])
 async def update_avatar(request: Request, username: str, avatar: Avatar):
     count = await UserService.update_avatar(request=request, username=username, avatar=avatar)
     if count > 0:
@@ -52,7 +53,7 @@ async def update_avatar(request: Request, username: str, avatar: Avatar):
     return await response_base.fail()
 
 
-@router.get('', summary='（模糊条件）分页获取所有用户', dependencies=[DependsRBAC, PageDepends])
+@router.get('', summary='（模糊条件）分页获取所有用户', dependencies=[DependsJwtAuth, PageDepends])
 async def get_all_users(
     db: CurrentSession,
     username: Annotated[str | None, Query()] = None,

backend/app/common/casbin_rbac.py

@@ -41,11 +41,6 @@ class RBAC:
         super_user = request.user.is_superuser
         if super_user:
             return
-        # 免鉴权的接口
-        method = request.method
-        path = request.url.path
-        if (method, path) in settings.CASBIN_EXCLUDE:
-            return
         # 检测角色数据权限范围
         user_roles = request.user.roles
         data_scope = any(role.data_scope == 1 for role in user_roles)
@@ -57,10 +52,14 @@ class RBAC:
             menu_perms = []
             for role in user_roles:
                 menu_perms.extend([menu.perms for menu in role.menus])
-            if not menu_perms or path_auth not in menu_perms:
+            if not menu_perms or path_auth not in settings.MENU_EXCLUDE:
                 raise AuthorizationError
         else:
             # casbin 权限校验
+            method = request.method
+            path = request.url.path
+            if (method, path) in settings.CASBIN_EXCLUDE:
+                return
             user_uuid = request.user.uuid
             enforcer = self.enforcer()
             if not enforcer.enforce(user_uuid, path, method):

backend/app/common/jwt.py

@@ -194,7 +194,7 @@ def superuser_verify(request: Request) -> bool:
     """
     is_superuser = request.user.is_superuser
     if not is_superuser:
-        raise AuthorizationError
+        raise AuthorizationError(msg='仅管理员有权操作')
     return is_superuser