diff --git a/backend/app/generator/api/v1/gen.py b/backend/app/generator/api/v1/gen.py index 3dae6e62..ebad100e 100644 --- a/backend/app/generator/api/v1/gen.py +++ b/backend/app/generator/api/v1/gen.py @@ -149,7 +149,7 @@ async def get_all_tables(table_schema: Annotated[str, Query(..., description=' '/import', summary='导入代码生成业务和模型列', dependencies=[ - Depends(RequestPermission('')), + Depends(RequestPermission('gen:code:import')), DependsRBAC, ], ) diff --git a/backend/common/security/rbac.py b/backend/common/security/rbac.py index fd410444..fa92695f 100644 --- a/backend/common/security/rbac.py +++ b/backend/common/security/rbac.py @@ -11,7 +11,6 @@ from backend.common.exception.errors import AuthorizationError, TokenError from backend.common.security.jwt import DependsJwtAuth from backend.core.conf import settings from backend.database.db_mysql import async_engine -from backend.database.db_redis import redis_client class RBAC: @@ -78,48 +77,23 @@ class RBAC: if data_scope: return user_uuid = request.user.uuid - path_auth_perm = request.state.permission if settings.PERMISSION_MODE == 'role-menu': # 角色菜单权限校验 + path_auth_perm = getattr(request.state, 'permission', None) + # 没有菜单权限标识不校验 + if not path_auth_perm: + return if path_auth_perm in set(settings.ROLE_MENU_EXCLUDE): return - user_menu_perms = await redis_client.get(f'{settings.PERMISSION_REDIS_PREFIX}:{user_uuid}:enable') - user_forbid_menu_perms = await redis_client.get(f'{settings.PERMISSION_REDIS_PREFIX}:{user_uuid}:disable') - if not user_menu_perms or not user_forbid_menu_perms: - user_menu_perms = [] - user_forbid_menu_perms = [] - for role in user_roles: - for menu in role.menus: - if menu.status == StatusType.enable: - user_menu_perms.extend(menu.perms.split(',')) - else: - user_forbid_menu_perms.extend(menu.perms.split(',')) - await redis_client.set( - f'{settings.PERMISSION_REDIS_PREFIX}:{user_uuid}:enable', ','.join(user_menu_perms) - ) - await redis_client.set( - f'{settings.PERMISSION_REDIS_PREFIX}:{user_uuid}:disable', ','.join(user_forbid_menu_perms) - ) - if path_auth_perm in user_forbid_menu_perms: - raise AuthorizationError(msg='菜单已禁用,授权失败') - if path_auth_perm not in user_menu_perms: + allow_perms = [] + for role in user_roles: + for menu in role.menus: + if menu.status == StatusType.enable: + allow_perms.extend(menu.perms.split(',')) + if path_auth_perm not in allow_perms: raise AuthorizationError else: # casbin 权限校验 - user_forbid_menu_perms = await redis_client.get( - f'{settings.PERMISSION_REDIS_PREFIX}:{request.user.uuid}:disable' - ) - if not user_forbid_menu_perms: - user_forbid_menu_perms = [] - for role in user_roles: - for menu in role.menus: - if menu.status == StatusType.disable: - user_forbid_menu_perms.extend(menu.perms.split(',')) - await redis_client.set( - f'{settings.PERMISSION_REDIS_PREFIX}:{user_uuid}:disable', ','.join(user_forbid_menu_perms) - ) - if path_auth_perm in user_forbid_menu_perms: - raise AuthorizationError(msg='菜单已禁用,授权失败') if (method, path) in settings.CASBIN_EXCLUDE: return enforcer = await self.enforcer()