Remove Linux Do OAuth2 login (#994)

* Fix operation log queue status management

* Fix lint

.dockerignore

@@ -0,0 +1,12 @@
+__pycache__/
+.git/
+.github/
+.idea/
+.vscode/
+.cursor/
+venv/
+.venv/
+.ruff_cache/
+.pytest_cache/
+.claude/
+.serena/

.github/workflows/changelog.yml

@@ -18,4 +18,6 @@ jobs:
         with:
           file: CHANGELOG.md
           pull_request: true
+          commit_summary_template: 'Update the changelog for %s'
+          args: -c
           github_token: ${{ secrets.GH_TOKEN }}

.github/workflows/lint.yml

@@ -12,25 +12,23 @@ jobs:
     name: lint ${{ matrix.python-version }}
     strategy:
       matrix:
-        python-version: [ '3.10', '3.11', '3.12' ]
+        python-version: [ '3.10', '3.11', '3.12', '3.13', '3.14' ]
       fail-fast: false
     steps:
       - uses: actions/checkout@v4
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v5
 
       - name: Set up Python ${{ matrix.python-version }}
         run: uv python install ${{ matrix.python-version }}
 
       - name: Install dependencies
         run: |
-          cd backend
           uv sync --only-group lint
 
       - name: Run lint
         run: |
-          cd backend
           source .venv/bin/activate
-          chmod 755 scripts/lint.sh
-          ./scripts/lint.sh
+          chmod 755 backend/scripts/lint.sh
+          ./backend/scripts/lint.sh

.gitignore

@@ -1,2 +1,11 @@
 .idea/
 .vscode/
+.cursor/
+.DS_Store
+venv/
+.venv/
+.python-version
+.ruff_cache/
+.pytest_cache/
+.claude/
+.serena/

.pre-commit-config.yaml

@@ -1,37 +1,31 @@
+default_language_version:
+    python: '>= 3.10'
+
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
-      - id: check-added-large-files
       - id: end-of-file-fixer
+      - id: check-json
       - id: check-yaml
       - id: check-toml
 
   - repo: https://github.com/charliermarsh/ruff-pre-commit
-    rev: v0.9.5
+    rev: v0.14.10
     hooks:
-      - id: ruff
+      - id: ruff-check
         args:
           # https://github.com/astral-sh/ruff-pre-commit/issues/64
-          - '--config'
-          - 'backend/.ruff.toml'
           - '--fix'
           - '--unsafe-fixes'
       - id: ruff-format
 
   - repo: https://github.com/astral-sh/uv-pre-commit
-    rev: 0.5.29
+    rev: 0.9.18
     hooks:
       - id: uv-lock
-        args:
-          - '--directory'
-          - 'backend'
-        files: backend/uv\.lock$
       - id: uv-export
         args:
-          - '--directory'
-          - 'backend'
           - '-o'
           - 'requirements.txt'
           - '--no-hashes'
-        files: backend/uv\.lock$

.ruff.toml

@@ -0,0 +1,174 @@
+line-length = 120
+preview = true
+fix = true
+unsafe-fixes = true
+show-fixes = true
+required-version = ">=0.13.0"
+
+[lint]
+select = [
+    "FAST",
+    "ANN001",
+    "ANN201",
+    "ANN202",
+    "ANN204",
+    "ANN205",
+    "ANN206",
+    "ASYNC110",
+    "ASYNC116",
+    "ASYNC210",
+    "ASYNC212",
+    "ASYNC230",
+    "ASYNC240",
+    "ASYNC250",
+    "ASYNC251",
+    "S310",
+    "FBT001",
+    "FBT002",
+    "B002",
+    "B005",
+    "B006",
+    "B007",
+    "B008",
+    "B009",
+    "B010",
+    "B013",
+    "B014",
+    "B019",
+    "B020",
+    "B021",
+    "B024",
+    "B025",
+    "B026",
+    "B027",
+    "B039",
+    "COM",
+    "C402",
+    "C403",
+    "C404",
+    "C408",
+    "C410",
+    "C411",
+    "C414",
+    "C416",
+    "C417",
+    "C418",
+    "C419",
+    "C420",
+    "DTZ",
+    "EXE",
+    "ISC001",
+    "ISC002",
+    "ISC003",
+    "PIE",
+    "PYI009",
+    "PYI010",
+    "PYI011",
+    "PYI012",
+    "PYI013",
+    "PYI016",
+    "PYI017",
+    "PYI019",
+    "PYI020",
+    "PYI021",
+    "PYI024",
+    "PYI026",
+    "PYI030",
+    "PYI033",
+    "PYI034",
+    "PYI036",
+    "PYI041",
+    "PYI042",
+    "PYI055",
+    "PYI061",
+    "PYI062",
+    "PYI063",
+    "Q001",
+    "Q002",
+    "RSE102",
+    "RET501",
+    "RET505",
+    "RET506",
+    "RET507",
+    "RET508",
+    "SIM101",
+    "SIM102",
+    "SIM103",
+    "SIM107",
+    "SIM108",
+    "SIM109",
+    "SIM110",
+    "SIM114",
+    "SIM115",
+    "SIM201",
+    "SIM202",
+    "SIM210",
+    "SIM211",
+    "SIM212",
+    "SIM300",
+    "SIM401",
+    "SIM910",
+    "TID252",
+    "TC",
+    "FLY",
+    "I",
+    "C901",
+    "N",
+    "PERF",
+    "E",
+    "W",
+    "D404",
+    "D417",
+    "D419",
+    "F",
+    "PGH",
+    "PLC1901",
+    "UP",
+    "FURB",
+    "RUF",
+    "TRY",
+]
+ignore = [
+    "COM812",
+    "PGH003",
+    "RUF001",
+    "RUF002",
+    "RUF003",
+    "RUF006",
+    "RUF012",
+    "TRY400",
+    "TRY003",
+    "TRY301"
+]
+
+[lint.per-file-ignores]
+"**/model/*.py" = ["TC003"]
+"backend/common/socketio/server.py" = ["ANN001"]
+"backend/common/exception/exception_handler.py" = ["ANN202","RUF029"]
+
+[lint.flake8-pytest-style]
+parametrize-names-type = "list"
+parametrize-values-row-type = "list"
+parametrize-values-type = "list"
+
+[lint.flake8-quotes]
+inline-quotes = "single"
+
+[lint.flake8-type-checking]
+runtime-evaluated-base-classes = ["pydantic.BaseModel", "sqlalchemy.orm.DeclarativeBase"]
+
+[lint.flake8-unused-arguments]
+ignore-variadic-names = true
+
+[lint.isort]
+case-sensitive = true
+lines-between-types = 1
+order-by-type = true
+
+[lint.pylint]
+allow-dunder-method-names = ["__tablename__", "__table_args__"]
+
+[format]
+docstring-code-format = true
+preview = true
+quote-style = "single"

CONTRIBUTING.md

@@ -0,0 +1,62 @@
+## Backend
+
+1. Prerequisites
+
+    - Python >= 3.10
+    - Git
+    - [uv](https://docs.astral.sh/uv/getting-started/installation/)
+    - Fork this repository to your GitHub account
+
+2. Installation and setup
+
+   Clone your forked repository:
+
+   ```shell
+   git clone https://github.com/<your account>/fastapi_best_architecture.git
+   ```
+
+   Go to the root directory of the project, open the terminal, and run the following command:
+
+   ```sh
+   uv sync
+   ```
+
+3. Checkout
+
+   Checkout a new branch and make your changes
+
+   ```shell
+   git checkout -b your-new-feature-branch
+   ```
+
+4. Format and Lint
+
+   Auto-formatting and lint via `prek`
+
+   ```shell
+   prek run --all-files
+   ```
+
+5. Commit and push
+
+   Commit your changes and push your branch to the GitHub.
+
+6. PR
+
+   Create a PR via GitHub
+
+## Scripts
+
+> [!WARNING]
+>
+> The following script may not apply to the Windows platform
+>
+> It is recommended to execute under the backend directory, and chmod authorization may be required
+
+- `migrate.sh`: Perform automatic database migration
+
+- `scripts/format.sh`: Perform ruff format check
+
+- `scripts/lint.sh`: Perform prek formatting
+
+- `scripts/export.sh`: Execute uv export dependency package

Dockerfile

@@ -0,0 +1,84 @@
+# Select the image to build based on SERVER_TYPE, defaulting to fba_server, or docker-compose build args
+ARG SERVER_TYPE=fba_server
+
+# === Python environment from uv ===
+FROM ghcr.io/astral-sh/uv:python3.10-bookworm-slim AS builder
+
+# Used for build Python packages
+RUN sed -i 's/deb.debian.org/mirrors.ustc.edu.cn/g' /etc/apt/sources.list.d/debian.sources \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends gcc python3-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY . /fba
+
+WORKDIR /fba
+
+# Configure uv environment
+ENV UV_COMPILE_BYTECODE=1 \
+    UV_NO_CACHE=1 \
+    UV_LINK_MODE=copy \
+    UV_PROJECT_ENVIRONMENT=/usr/local
+
+# Install dependencies with cache
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --frozen --no-default-groups --group server
+
+# === Runtime base server image ===
+FROM python:3.10-slim AS base_server
+
+RUN sed -i 's/deb.debian.org/mirrors.ustc.edu.cn/g' /etc/apt/sources.list.d/debian.sources \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends supervisor \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /fba /fba
+
+COPY --from=builder /usr/local /usr/local
+
+COPY deploy/backend/supervisor/supervisord.conf /etc/supervisor/supervisord.conf
+
+WORKDIR /fba/backend
+
+# === FastAPI server image ===
+FROM base_server AS fba_server
+
+COPY deploy/backend/supervisor/fba_server.conf /etc/supervisor/conf.d/
+
+RUN mkdir -p /var/log/fba
+
+EXPOSE 8001
+
+CMD ["supervisord", "-c", "/etc/supervisor/supervisord.conf"]
+
+# === Celery Worker image ===
+FROM base_server AS fba_celery_worker
+
+COPY deploy/backend/supervisor/fba_celery_worker.conf /etc/supervisor/conf.d/
+
+RUN mkdir -p /var/log/fba
+
+CMD ["supervisord", "-c", "/etc/supervisor/supervisord.conf"]
+
+# === Celery Beat image ===
+FROM base_server AS fba_celery_beat
+
+COPY deploy/backend/supervisor/fba_celery_beat.conf /etc/supervisor/conf.d/
+
+RUN mkdir -p /var/log/fba
+
+CMD ["supervisord", "-c", "/etc/supervisor/supervisord.conf"]
+
+# === Celery Flower image ===
+FROM base_server AS fba_celery_flower
+
+COPY deploy/backend/supervisor/fba_celery_flower.conf /etc/supervisor/conf.d/
+
+RUN mkdir -p /var/log/fba
+
+EXPOSE 8555
+
+CMD ["supervisord", "-c", "/etc/supervisor/supervisord.conf"]
+
+# Build image
+FROM ${SERVER_TYPE}

README.md

@@ -4,14 +4,10 @@
 
 # FastAPI Best Architecture
 
+Enterprise-level backend architecture solution
+
 English | [简体中文](./README.zh-CN.md)
 
-A backend and frontend separation solution based on the FastAPI framework, following
-the [pseudo 3-tier architecture](#pseudo-3-tier-architecture) design, supporting **Python 3.10** and above
-versions
-
-**🔥Continuously updated and maintained🔥**
-
 [![GitHub](https://img.shields.io/github/license/fastapi-practices/fastapi_best_architecture)](https://github.com/fastapi-practices/fastapi_best_architecture/blob/master/LICENSE)
 [![Python](https://img.shields.io/badge/python-3.10%2B-blue)](https://www.python.org/downloads/)
 ![MySQL](https://img.shields.io/badge/MySQL-8.0%2B-%2300758f)
@@ -23,12 +19,10 @@ versions
 ![Docker](https://img.shields.io/badge/Docker-%232496ED?logo=docker&logoColor=white)
 [![Discord](https://img.shields.io/badge/Discord-%235865F2.svg?logo=discord&logoColor=white)](https://discord.com/invite/yNN3wTbVAC)
 ![Discord](https://img.shields.io/discord/1185035164577972344)
+[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/fastapi-practices/fastapi_best_architecture)
 
 </div>
 
-> [!NOTE]
-> This repository as a template library open to any person or enterprise can be used for free!
-
 ## Pseudo 3-tier architecture
 
 The mvc architecture is a common design pattern in python web, but the 3-tier architecture is even more fascinating
@@ -47,41 +41,7 @@ pattern, use templates to transform it to your heart's content!
 | data access    | dao / mapper   | crud                      |
 | model          | model / entity | model                     |
 
-## Features
-
-- [x] Design with FastAPI PEP 593 Annotated Parameters
-- [x] Global asynchronous design with async/await + asgiref
-- [x] Follows Restful API specification
-- [x] Global SQLAlchemy 2.0 syntax
-- [x] Pydantic v1 and v2 (different branches)
-- [x] Casbin RBAC access control model
-- [x] Role menu RBAC access control model
-- [x] Celery asynchronous tasks
-- [x] JWT middleware whitelist authentication
-- [x] Global customizable time zone time
-- [x] Docker / Docker-compose deployment
-- [x] Pytest Unit Testing
-
-## Built-in features
-
-- [x] User management: System User Role Management, Permission Allocation
-- [x] Department management: Configure system organization (company, department, team...)
-- [x] Menu management: Configure system menu, user menu, button permission tags
-- [x] Role management: role menu permission allocation, role route permission allocation
-- [x] Dictionary management: Maintain commonly used fixed data or parameters within the system
-- [x] Token management: System user online status detection, supports kicking users offline
-- [x] Login authentication: backend-based graphical captcha background authentication login
-- [x] Multipoint login: One-click modification of multipoint login through user information
-- [x] OAuth 2.0: Built-in self-developed OAuth 2.0 login integration
-- [x] Code generation: automatic backend code generation, supports preview, writing, and download
-- [x] Scheduled task: Automated task, asynchronous task, supports function calls
-- [x] Plugin system: Say goodbye to high coupling integration through hot-pluggable plugin mode
-- [x] Operation log: Record and query of system normal and abnormal operations
-- [x] Login log: Record and query of normal and abnormal user login
-- [x] Service monitoring: Server hardware device information and status
-- [x] API documentation: Automatically generate online interactive API documentation
-
-## Development and deployment
+## Help
 
 For more details, please check
 the [official documentation](https://fastapi-practices.github.io/fastapi_best_architecture_docs/)
@@ -103,7 +63,7 @@ the [official documentation](https://fastapi-practices.github.io/fastapi_best_ar
 
 ## Interactivity
 
-[TG / Discord](https://wu-clan.github.io/homepage/)
+[Discord](https://wu-clan.github.io/homepage/)
 
 ## Sponsor us
 

README.zh-CN.md

@@ -4,12 +4,10 @@
 
 # FastAPI Best Architecture
 
+企业级后端架构解决方案
+
 简体中文 | [English](./README.md)
 
-基于 FastAPI 框架的前后端分离中后台解决方案，遵循[伪三层架构](#伪三层架构)设计， 支持 **python3.10** 及以上版本
-
-**🔥持续更新维护中🔥**
-
 [![GitHub](https://img.shields.io/github/license/fastapi-practices/fastapi_best_architecture)](https://github.com/fastapi-practices/fastapi_best_architecture/blob/master/LICENSE)
 [![Python](https://img.shields.io/badge/python-3.10%2B-blue)](https://www.python.org/downloads/)
 ![MySQL](https://img.shields.io/badge/MySQL-8.0%2B-%2300758f)
@@ -21,12 +19,10 @@
 ![Docker](https://img.shields.io/badge/Docker-%232496ED?logo=docker&logoColor=white)
 [![Discord](https://img.shields.io/badge/Discord-%235865F2.svg?logo=discord&logoColor=white)](https://discord.com/invite/yNN3wTbVAC)
 ![Discord](https://img.shields.io/discord/1185035164577972344)
+[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/fastapi-practices/fastapi_best_architecture)
 
 </div>
 
-> [!NOTE]
-> 此仓库作为模板库公开，任何人或企业均可免费使用！
-
 ## 伪三层架构
 
 mvc 架构作为常规设计模式，在 python web 中也很常见，但是三层架构更令人着迷
@@ -43,41 +39,7 @@ mvc 架构作为常规设计模式，在 python web 中也很常见，但是三
 | 数据访问 | dao / mapper   | crud                      |
 | 模型   | model / entity | model                     |
 
-## 特征
-
-- [x] 全局 FastAPI PEP 593 Annotated 参数风格
-- [x] async/await + asgiref 的全局异步设计
-- [x] 遵循 Restful API 规范
-- [x] 全局 SQLAlchemy 2.0 语法
-- [x] Pydantic v1 和 v2 (不同分支)
-- [x] Casbin RBAC 访问控制模型
-- [x] 角色菜单 RBAC 访问控制模型
-- [x] Celery 异步任务
-- [x] JWT 中间件白名单认证
-- [x] 全局自定义时区时间
-- [x] Docker / Docker-compose 部署
-- [x] Pytest 单元测试
-
-## 内置功能
-
-- [x] 用户管理：系统用户角色管理，权限分配
-- [x] 部门管理：配置系统组织机构（公司、部门、小组...）
-- [x] 菜单管理：配置系统菜单，用户菜单，按钮权限标识
-- [x] 角色管理：角色菜单权限分配，角色路由权限分配
-- [x] 字典管理：维护系统内部常用固定数据或参数
-- [x] 令牌管理：系统用户在线状态检测，支持踢人下线
-- [x] 登录认证：基于后端的图形验证码后台认证登录
-- [x] 多点登录：通过用户信息一键修改多点登录支持
-- [x] OAuth20：内置自研 OAuth 2.0 登录集成
-- [x] 代码生成：后端代码自动生成，支持预览，写入及下载
-- [x] 定时任务：自动化任务，异步任务，支持函数调用
-- [x] 插件系统：通过热插拔插件模式告别高耦合集成
-- [x] 操作日志：系统正常和异常操作的日志记录与查询
-- [x] 登录日志：用户正常和异常登录的日志记录与查询
-- [x] 服务监控：服务器硬件设备信息与状态
-- [x] 接口文档：自动生成在线交互式 API 文档
-
-## 开发部署
+## 帮助
 
 更多详情请查看 [官方文档](https://fastapi-practices.github.io/fastapi_best_architecture_docs/)
 
@@ -98,7 +60,7 @@ mvc 架构作为常规设计模式，在 python web 中也很常见，但是三
 
 ## 互动
 
-[TG / Discord](https://wu-clan.github.io/homepage/)
+[Discord](https://wu-clan.github.io/homepage/)
 
 ## 赞助我们
 

backend/.dockerignore

@@ -1,4 +0,0 @@
-__pycache__/
-venv/
-.venv/
-.python-version

backend/.env.example

@@ -1,10 +1,10 @@
-# Env: dev、pro
+# Env
 ENVIRONMENT='dev'
 # Database
-DATABASE_TYPE='mysql'
+DATABASE_TYPE='postgresql'
 DATABASE_HOST='127.0.0.1'
-DATABASE_PORT=3306
-DATABASE_USER='root'
+DATABASE_PORT=5432
+DATABASE_USER='postgres'
 DATABASE_PASSWORD='123456'
 # Redis
 REDIS_HOST='127.0.0.1'
@@ -13,20 +13,19 @@ REDIS_PASSWORD=''
 REDIS_DATABASE=0
 # Token
 TOKEN_SECRET_KEY='1VkVF75nsNABBjK_7-qz7GtzNy3AMvktc9TCPwKczCk'
-# Opera Log
-OPERA_LOG_ENCRYPT_SECRET_KEY='d77b25790a804c2b4a339dd0207941e4cefa5751935a33735bc73bb7071a005b'
-# Admin
-# OAuth2
-OAUTH2_GITHUB_CLIENT_ID='test'
-OAUTH2_GITHUB_CLIENT_SECRET='test'
-OAUTH2_LINUX_DO_CLIENT_ID='test'
-OAUTH2_LINUX_DO_CLIENT_SECRET='test'
-# Task
+# [ App ] task
 # Celery
 CELERY_BROKER_REDIS_DATABASE=1
-CELERY_BACKEND_REDIS_DATABASE=2
 # Rabbitmq
-RABBITMQ_HOST='127.0.0.1'
-RABBITMQ_PORT=5672
-RABBITMQ_USERNAME='guest'
-RABBITMQ_PASSWORD='guest'
+CELERY_RABBITMQ_HOST='127.0.0.1'
+CELERY_RABBITMQ_PORT=5672
+CELERY_RABBITMQ_USERNAME='guest'
+CELERY_RABBITMQ_PASSWORD='guest'
+# [ Plugin ] oauth2
+OAUTH2_GITHUB_CLIENT_ID='test'
+OAUTH2_GITHUB_CLIENT_SECRET='test'
+OAUTH2_GOOGLE_CLIENT_ID='test'
+OAUTH2_GOOGLE_CLIENT_SECRET='test'
+# [ Plugin ] email
+EMAIL_USERNAME=''
+EMAIL_PASSWORD=''

backend/.gitignore

@@ -1,12 +1,6 @@
 __pycache__/
 .env
-venv/
-.venv/
-.mypy_cache/
-log/
 alembic/versions/
 static/media/
-.ruff_cache/
-.pytest_cache/
-.python-version
+*.log
 celerybeat-schedule.*

backend/.ruff.toml

@@ -1,55 +0,0 @@
-line-length = 120
-cache-dir = ".ruff_cache"
-target-version = "py310"
-unsafe-fixes = true
-show-fixes = true
-
-[lint]
-select = [
-    "E",
-    "F",
-    "I",
-    "TC",
-    # W
-    "W505",
-    # PT
-    "PT018",
-    # SIM
-    "SIM101",
-    "SIM114",
-    # PGH
-    "PGH004",
-    # PL
-    "PLE1142",
-    # RUF
-    "RUF100",
-    # UP
-    "UP007"
-]
-preview = true
-ignore = ["FURB101"]
-
-[lint.flake8-pytest-style]
-mark-parentheses = false
-parametrize-names-type = "list"
-parametrize-values-row-type = "list"
-parametrize-values-type = "tuple"
-
-[lint.flake8-unused-arguments]
-ignore-variadic-names = true
-
-[lint.isort]
-lines-between-types = 1
-order-by-type = true
-
-[lint.per-file-ignores]
-"**/api/v1/*.py" = ["TC"]
-"**/model/*.py" = ["TC003"]
-"**/model/__init__.py" = ["F401"]
-"**/tests/*.py" = ["E402"]
-
-[format]
-preview = true
-quote-style = "single"
-docstring-code-format = true
-skip-magic-trailing-comma = false

backend/README.md

@@ -1,79 +1,18 @@
-# FBA Project - Backend
+# FastAPI Best Architecture - Backend
 
 ## Docker
 
-> [!IMPORTANT]
-> Due to Docker context limitations, you can't build an image in this directory
-
 1. Make sure you're at the root of the project
 2. Run the following Docker command to build container:
 
    ```shell
-   docker build -f backend/backend.dockerfile -t fba_backend_independent .
+   docker build -f Dockerfile -t fba_backend_independent .
    ```
 
 3. Start container
 
-   ```shell
-   docker run -d fba_backend_independent -p 8000:8000 --name fba_app
-   ```
-
-## Contributing
-
-1. Prerequisites
-
-   You'll need the following prerequisites:
-    - Any python version between Python >= 3.10
-    - Git
-    - [uv](https://docs.astral.sh/uv/getting-started/installation/)
-    - Fork this repository to your GitHub account  
-
-2. Installation and setup
-
-   Clone your fork and cd into the repo directory
+   Native boot needs to change `127.0.0.1` in `.env` to `host.docker.internal`
 
    ```shell
-   git clone https://github.com/<your username>/fastapi_best_architecture.git
-   
-   cd fastapi_best_architecture/backend
-   
-   uv venv
-   
-   uv pip install -r requirements.txt
+   docker run -d -p 8000:8000 --name fba_server fba_backend_independent
    ```
-
-3. Checkout a new branch and make your changes
-
-   ```shell
-   # Checkout a new branch and make your changes
-   git checkout -b your-new-feature-branch
-   ```
-
-4. Run linting
-
-   ```shell
-   # Run automated code formatting and linting
-   pre-commit run --all-files
-   ```
-
-5. Commit and push your changes
-
-   Commit your changes, push your branch to GitHub, and create a pull request.
-
-## Scripts
-
-> [!WARNING]
->
-> The following script may not apply to the Windows platform
->
-> It is recommended to execute under the backend directory, and chmod authorization may be required
-
-- `pre_start.sh`: Perform automatic database migration and create database tables
-
-- `celery-start.sh`: For celery docker script, implementation is not recommended
-
-- `scripts/format.sh`: Perform ruff format check
-
-- `scripts/lint.sh`: Perform pre-commit formatting
-
-- `scripts/export.sh`: Execute uv export dependency package

backend/__init__.py

@@ -1,2 +1,17 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
+import sqlalchemy as sa
+
+from backend.utils.import_parse import get_all_models
+
+# import all models for auto create db tables
+for cls in get_all_models():
+    if isinstance(cls, sa.Table):
+        table_name = cls.name
+        if table_name not in globals():
+            globals()[table_name] = cls
+    else:
+        class_name = cls.__name__
+        if class_name not in globals():
+            globals()[class_name] = cls
+
+
+__version__ = '1.12.0'

backend/alembic/env.py

@@ -1,9 +1,6 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-# ruff: noqa: F403, F401, I001, RUF100
 import asyncio
 import os
-import sys
+
 from logging.config import fileConfig
 
 from alembic import context
@@ -11,24 +8,9 @@ from sqlalchemy import pool
 from sqlalchemy.engine import Connection
 from sqlalchemy.ext.asyncio import async_engine_from_config
 
-sys.path.append('../')
-
 from backend.common.model import MappedBase
 from backend.core import path_conf
 from backend.database.db import SQLALCHEMY_DATABASE_URL
-from backend.plugin.tools import get_plugin_models
-
-# import your new model here
-from backend.app.admin.model import *  # noqa: F401
-from backend.app.generator.model import *  # noqa: F401
-
-# import plugin model
-for cls in get_plugin_models():
-    class_name = cls.__name__
-    if class_name in globals():
-        print(f'\nWarning: Class "{class_name}" already exists in global namespace.')
-    else:
-        globals()[class_name] = cls
 
 if not os.path.exists(path_conf.ALEMBIC_VERSION_DIR):
     os.makedirs(path_conf.ALEMBIC_VERSION_DIR)
@@ -47,10 +29,13 @@ if alembic_config.config_file_name is not None:
 target_metadata = MappedBase.metadata
 
 # other values from the config, defined by the needs of env.py,
-alembic_config.set_main_option('sqlalchemy.url', SQLALCHEMY_DATABASE_URL.render_as_string(hide_password=False))
+alembic_config.set_main_option(
+    'sqlalchemy.url',
+    SQLALCHEMY_DATABASE_URL.render_as_string(hide_password=False).replace('%', '%%'),
+)
 
 
-def run_migrations_offline():
+def run_migrations_offline() -> None:
     """Run migrations in 'offline' mode.
 
     This configures the context with just a URL
@@ -79,7 +64,7 @@ def run_migrations_offline():
 
 def do_run_migrations(connection: Connection) -> None:
     # 当迁移无变化时，不生成迁移记录
-    def process_revision_directives(context, revision, directives):
+    def process_revision_directives(context, revision, directives) -> None:  # noqa: ANN001
         if alembic_config.cmd_opts.autogenerate:
             script = directives[0]
             if script.upgrade_ops.is_empty():

backend/alembic/script.py.mako

@@ -7,6 +7,7 @@ Create Date: ${create_date}
 """
 from alembic import op
 import sqlalchemy as sa
+import backend.common.model
 ${imports if imports else ""}
 
 # revision identifiers, used by Alembic.

backend/app/__init__.py

@@ -1,2 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-

backend/app/admin/__init__.py

@@ -1,2 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-

backend/app/admin/api/__init__.py

@@ -1,2 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-

backend/app/admin/api/router.py

@@ -1,18 +1,14 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from fastapi import APIRouter
 
 from backend.app.admin.api.v1.auth import router as auth_router
 from backend.app.admin.api.v1.log import router as log_router
 from backend.app.admin.api.v1.monitor import router as monitor_router
-from backend.app.admin.api.v1.oauth2 import router as oauth2_router
 from backend.app.admin.api.v1.sys import router as sys_router
 from backend.core.conf import settings
 
 v1 = APIRouter(prefix=settings.FASTAPI_API_V1_PATH)
 
 v1.include_router(auth_router)
-v1.include_router(oauth2_router)
 v1.include_router(sys_router)
 v1.include_router(log_router)
 v1.include_router(monitor_router)

backend/app/admin/api/v1/__init__.py

@@ -1,2 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-

backend/app/admin/api/v1/auth/__init__.py

@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from fastapi import APIRouter
 
 from backend.app.admin.api.v1.auth.auth import router as auth_router
@@ -8,4 +6,4 @@ from backend.app.admin.api.v1.auth.captcha import router as captcha_router
 router = APIRouter(prefix='/auth')
 
 router.include_router(auth_router, tags=['授权'])
-router.include_router(captcha_router, prefix='/captcha', tags=['验证码'])
+router.include_router(captcha_router, tags=['验证码'])

backend/app/admin/api/v1/auth/auth.py

@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from typing import Annotated
 
 from fastapi import APIRouter, Depends, Request, Response
@@ -12,13 +10,16 @@ from backend.app.admin.schema.user import AuthLoginParam
 from backend.app.admin.service.auth_service import auth_service
 from backend.common.response.response_schema import ResponseModel, ResponseSchemaModel, response_base
 from backend.common.security.jwt import DependsJwtAuth
+from backend.database.db import CurrentSession, CurrentSessionTransaction
 
 router = APIRouter()
 
 
 @router.post('/login/swagger', summary='swagger 调试专用', description='用于快捷获取 token 进行 swagger 认证')
-async def swagger_login(obj: Annotated[HTTPBasicCredentials, Depends()]) -> GetSwaggerToken:
-    token, user = await auth_service.swagger_login(obj=obj)
+async def login_swagger(
+    db: CurrentSessionTransaction, obj: Annotated[HTTPBasicCredentials, Depends()]
+) -> GetSwaggerToken:
+    token, user = await auth_service.swagger_login(db=db, obj=obj)
     return GetSwaggerToken(access_token=token, user=user)  # type: ignore
 
 
@@ -28,20 +29,29 @@ async def swagger_login(obj: Annotated[HTTPBasicCredentials, Depends()]) -> GetS
     description='json 格式登录, 仅支持在第三方api工具调试, 例如: postman',
     dependencies=[Depends(RateLimiter(times=5, minutes=1))],
 )
-async def user_login(
-    request: Request, response: Response, obj: AuthLoginParam, background_tasks: BackgroundTasks
+async def login(
+    db: CurrentSessionTransaction,
+    response: Response,
+    obj: AuthLoginParam,
+    background_tasks: BackgroundTasks,
 ) -> ResponseSchemaModel[GetLoginToken]:
-    data = await auth_service.login(request=request, response=response, obj=obj, background_tasks=background_tasks)
+    data = await auth_service.login(db=db, response=response, obj=obj, background_tasks=background_tasks)
     return response_base.success(data=data)
 
 
-@router.post('/token/new', summary='创建新 token')
-async def create_new_token(request: Request, response: Response) -> ResponseSchemaModel[GetNewToken]:
-    data = await auth_service.new_token(request=request)
+@router.get('/codes', summary='获取所有授权码', description='适配 vben admin v5', dependencies=[DependsJwtAuth])
+async def get_codes(db: CurrentSession, request: Request) -> ResponseSchemaModel[list[str]]:
+    codes = await auth_service.get_codes(db=db, request=request)
+    return response_base.success(data=codes)
+
+
+@router.post('/refresh', summary='刷新 token')
+async def refresh_token(db: CurrentSession, request: Request) -> ResponseSchemaModel[GetNewToken]:
+    data = await auth_service.refresh_token(db=db, request=request)
     return response_base.success(data=data)
 
 
-@router.post('/logout', summary='用户登出', dependencies=[DependsJwtAuth])
-async def user_logout(request: Request, response: Response) -> ResponseModel:
+@router.post('/logout', summary='用户登出')
+async def logout(request: Request, response: Response) -> ResponseModel:
     await auth_service.logout(request=request, response=response)
     return response_base.success()

backend/app/admin/api/v1/auth/captcha.py

@@ -1,34 +1,38 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
+import uuid
+
 from fast_captcha import img_captcha
-from fastapi import APIRouter, Depends, Request
+from fastapi import APIRouter, Depends
 from fastapi_limiter.depends import RateLimiter
 from starlette.concurrency import run_in_threadpool
 
-from backend.app.admin.conf import admin_settings
 from backend.app.admin.schema.captcha import GetCaptchaDetail
 from backend.common.response.response_schema import ResponseSchemaModel, response_base
+from backend.core.conf import settings
+from backend.database.db import CurrentSession
 from backend.database.redis import redis_client
+from backend.utils.dynamic_config import load_login_config
 
 router = APIRouter()
 
 
 @router.get(
-    '',
+    '/captcha',
     summary='获取登录验证码',
     dependencies=[Depends(RateLimiter(times=5, seconds=10))],
 )
-async def get_captcha(request: Request) -> ResponseSchemaModel[GetCaptchaDetail]:
-    """
-    此接口可能存在性能损耗，尽管是异步接口，但是验证码生成是IO密集型任务，使用线程池尽量减少性能损耗
-    """
-    img_type: str = 'base64'
-    img, code = await run_in_threadpool(img_captcha, img_byte=img_type)
-    ip = request.state.ip
+async def get_captcha(db: CurrentSession) -> ResponseSchemaModel[GetCaptchaDetail]:
+    await load_login_config(db)
+    img, code = await run_in_threadpool(img_captcha, img_byte='base64')
+    captcha_uuid = str(uuid.uuid4())
     await redis_client.set(
-        f'{admin_settings.CAPTCHA_LOGIN_REDIS_PREFIX}:{ip}',
+        f'{settings.LOGIN_CAPTCHA_REDIS_PREFIX}:{captcha_uuid}',
         code,
-        ex=admin_settings.CAPTCHA_LOGIN_EXPIRE_SECONDS,
+        ex=settings.LOGIN_CAPTCHA_EXPIRE_SECONDS,
+    )
+    data = GetCaptchaDetail(
+        is_enabled=settings.LOGIN_CAPTCHA_ENABLED,
+        expire_seconds=settings.LOGIN_CAPTCHA_EXPIRE_SECONDS,
+        uuid=captcha_uuid,
+        image=img,
     )
-    data = GetCaptchaDetail(image_type=img_type, image=img)
     return response_base.success(data=data)

backend/app/admin/api/v1/log/__init__.py

@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from fastapi import APIRouter
 
 from backend.app.admin.api.v1.log.login_log import router as login_log

backend/app/admin/api/v1/log/login_log.py

@@ -1,50 +1,48 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from typing import Annotated
 
 from fastapi import APIRouter, Depends, Query
 
-from backend.app.admin.schema.login_log import GetLoginLogDetail
+from backend.app.admin.schema.login_log import DeleteLoginLogParam, GetLoginLogDetail
 from backend.app.admin.service.login_log_service import login_log_service
-from backend.common.pagination import DependsPagination, PageData, paging_data
+from backend.common.pagination import DependsPagination, PageData
 from backend.common.response.response_schema import ResponseModel, ResponseSchemaModel, response_base
 from backend.common.security.jwt import DependsJwtAuth
 from backend.common.security.permission import RequestPermission
 from backend.common.security.rbac import DependsRBAC
-from backend.database.db import CurrentSession
+from backend.database.db import CurrentSession, CurrentSessionTransaction
 
 router = APIRouter()
 
 
 @router.get(
     '',
-    summary='（模糊条件）分页获取登录日志',
+    summary='分页获取登录日志',
     dependencies=[
         DependsJwtAuth,
         DependsPagination,
     ],
 )
-async def get_pagination_login_logs(
+async def get_login_logs_paginated(
     db: CurrentSession,
-    username: Annotated[str | None, Query()] = None,
-    status: Annotated[int | None, Query()] = None,
-    ip: Annotated[str | None, Query()] = None,
+    username: Annotated[str | None, Query(description='用户名')] = None,
+    status: Annotated[int | None, Query(description='状态')] = None,
+    ip: Annotated[str | None, Query(description='IP 地址')] = None,
 ) -> ResponseSchemaModel[PageData[GetLoginLogDetail]]:
-    log_select = await login_log_service.get_select(username=username, status=status, ip=ip)
-    page_data = await paging_data(db, log_select)
+    page_data = await login_log_service.get_list(db=db, username=username, status=status, ip=ip)
+
     return response_base.success(data=page_data)
 
 
 @router.delete(
     '',
-    summary='（批量）删除登录日志',
+    summary='批量删除登录日志',
     dependencies=[
         Depends(RequestPermission('log:login:del')),
         DependsRBAC,
     ],
 )
-async def delete_login_log(pk: Annotated[list[int], Query(...)]) -> ResponseModel:
-    count = await login_log_service.delete(pk=pk)
+async def delete_login_logs(db: CurrentSessionTransaction, obj: DeleteLoginLogParam) -> ResponseModel:
+    count = await login_log_service.delete(db=db, obj=obj)
     if count > 0:
         return response_base.success()
     return response_base.fail()
@@ -54,12 +52,10 @@ async def delete_login_log(pk: Annotated[list[int], Query(...)]) -> ResponseMode
     '/all',
     summary='清空登录日志',
     dependencies=[
-        Depends(RequestPermission('log:login:empty')),
+        Depends(RequestPermission('log:login:clear')),
         DependsRBAC,
     ],
 )
-async def delete_all_login_logs() -> ResponseModel:
-    count = await login_log_service.delete_all()
-    if count > 0:
+async def delete_all_login_logs(db: CurrentSessionTransaction) -> ResponseModel:
+    await login_log_service.delete_all(db=db)
     return response_base.success()
-    return response_base.fail()

backend/app/admin/api/v1/log/opera_log.py

@@ -1,50 +1,48 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from typing import Annotated
 
 from fastapi import APIRouter, Depends, Query
 
-from backend.app.admin.schema.opera_log import GetOperaLogDetail
+from backend.app.admin.schema.opera_log import DeleteOperaLogParam, GetOperaLogDetail
 from backend.app.admin.service.opera_log_service import opera_log_service
-from backend.common.pagination import DependsPagination, PageData, paging_data
+from backend.common.pagination import DependsPagination, PageData
 from backend.common.response.response_schema import ResponseModel, ResponseSchemaModel, response_base
 from backend.common.security.jwt import DependsJwtAuth
 from backend.common.security.permission import RequestPermission
 from backend.common.security.rbac import DependsRBAC
-from backend.database.db import CurrentSession
+from backend.database.db import CurrentSession, CurrentSessionTransaction
 
 router = APIRouter()
 
 
 @router.get(
     '',
-    summary='（模糊条件）分页获取操作日志',
+    summary='分页获取操作日志',
     dependencies=[
         DependsJwtAuth,
         DependsPagination,
     ],
 )
-async def get_pagination_opera_logs(
+async def get_opera_logs_paginated(
     db: CurrentSession,
-    username: Annotated[str | None, Query()] = None,
-    status: Annotated[int | None, Query()] = None,
-    ip: Annotated[str | None, Query()] = None,
+    username: Annotated[str | None, Query(description='用户名')] = None,
+    status: Annotated[int | None, Query(description='状态')] = None,
+    ip: Annotated[str | None, Query(description='IP 地址')] = None,
 ) -> ResponseSchemaModel[PageData[GetOperaLogDetail]]:
-    log_select = await opera_log_service.get_select(username=username, status=status, ip=ip)
-    page_data = await paging_data(db, log_select)
+    page_data = await opera_log_service.get_list(db=db, username=username, status=status, ip=ip)
+
     return response_base.success(data=page_data)
 
 
 @router.delete(
     '',
-    summary='（批量）删除操作日志',
+    summary='批量删除操作日志',
     dependencies=[
         Depends(RequestPermission('log:opera:del')),
         DependsRBAC,
     ],
 )
-async def delete_opera_log(pk: Annotated[list[int], Query(...)]) -> ResponseModel:
-    count = await opera_log_service.delete(pk=pk)
+async def delete_opera_logs(db: CurrentSessionTransaction, obj: DeleteOperaLogParam) -> ResponseModel:
+    count = await opera_log_service.delete(db=db, obj=obj)
     if count > 0:
         return response_base.success()
     return response_base.fail()
@@ -54,12 +52,10 @@ async def delete_opera_log(pk: Annotated[list[int], Query(...)]) -> ResponseMode
     '/all',
     summary='清空操作日志',
     dependencies=[
-        Depends(RequestPermission('log:opera:empty')),
+        Depends(RequestPermission('log:opera:clear')),
         DependsRBAC,
     ],
 )
-async def delete_all_opera_logs() -> ResponseModel:
-    count = await opera_log_service.delete_all()
-    if count > 0:
+async def delete_all_opera_logs(db: CurrentSessionTransaction) -> ResponseModel:
+    await opera_log_service.delete_all(db=db)
     return response_base.success()
-    return response_base.fail()

backend/app/admin/api/v1/monitor/__init__.py

@@ -1,7 +1,6 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from fastapi import APIRouter
 
+from backend.app.admin.api.v1.monitor.online import router as token_router
 from backend.app.admin.api.v1.monitor.redis import router as redis_router
 from backend.app.admin.api.v1.monitor.server import router as server_router
 
@@ -9,3 +8,4 @@ router = APIRouter(prefix='/monitors')
 
 router.include_router(redis_router, prefix='/redis', tags=['redis监控'])
 router.include_router(server_router, prefix='/server', tags=['服务器监控'])
+router.include_router(token_router, prefix='/sessions', tags=['会话监控'])

backend/app/admin/api/v1/monitor/online.py

@@ -0,0 +1,83 @@
+import json
+
+from typing import Annotated
+
+from fastapi import APIRouter, Path, Query
+
+from backend.app.admin.schema.token import GetTokenDetail
+from backend.common.enums import StatusType
+from backend.common.response.response_schema import ResponseModel, ResponseSchemaModel, response_base
+from backend.common.security.jwt import DependsJwtAuth, DependsSuperUser, jwt_decode, revoke_token
+from backend.core.conf import settings
+from backend.database.redis import redis_client
+
+router = APIRouter()
+
+
+@router.get('', summary='获取在线用户', dependencies=[DependsJwtAuth])
+async def get_sessions(
+    username: Annotated[str | None, Query(description='用户名')] = None,
+) -> ResponseSchemaModel[list[GetTokenDetail]]:
+    token_keys = await redis_client.get_prefix(f'{settings.TOKEN_REDIS_PREFIX}:*')
+    online_clients = await redis_client.smembers(settings.TOKEN_ONLINE_REDIS_PREFIX)
+    data: list[GetTokenDetail] = []
+
+    def append_token_detail() -> None:
+        data.append(
+            token_detail.model_copy(
+                update={
+                    'username': extra_info.get('username', '未知'),
+                    'nickname': extra_info.get('nickname', '未知'),
+                    'ip': extra_info.get('ip', '未知'),
+                    'os': extra_info.get('os', '未知'),
+                    'browser': extra_info.get('browser', '未知'),
+                    'device': extra_info.get('device', '未知'),
+                    'last_login_time': extra_info.get('last_login_time', '未知'),
+                },
+            ),
+        )
+
+    for key in token_keys:
+        token = await redis_client.get(key)
+        token_payload = jwt_decode(token)
+        user_id = token_payload.id
+        session_uuid = token_payload.session_uuid
+        token_detail = GetTokenDetail(
+            id=user_id,
+            session_uuid=session_uuid,
+            username='未知',
+            nickname='未知',
+            ip='未知',
+            os='未知',
+            browser='未知',
+            device='未知',
+            status=StatusType.enable if session_uuid in online_clients else StatusType.disable,
+            last_login_time='未知',
+            expire_time=token_payload.expire_time,
+        )
+        extra_info = await redis_client.get(f'{settings.TOKEN_EXTRA_INFO_REDIS_PREFIX}:{user_id}:{session_uuid}')
+        if extra_info:
+            extra_info = json.loads(extra_info)
+            # 排除 swagger 登录生成的 token
+            if extra_info.get('swagger') is None:
+                if username is not None:
+                    if username == extra_info.get('username'):
+                        append_token_detail()
+                else:
+                    append_token_detail()
+        else:
+            data.append(token_detail)
+    return response_base.success(data=data)
+
+
+@router.delete(
+    '/{pk}',
+    summary='强制下线',
+    dependencies=[DependsSuperUser],
+)
+async def delete_session(
+    pk: Annotated[int, Path(description='用户 ID')],
+    session_uuid: Annotated[str, Query(description='会话 UUID')],
+) -> ResponseModel:
+    await revoke_token(pk, session_uuid)
+    return response_base.success()

backend/app/admin/api/v1/monitor/redis.py

@@ -1,23 +1,16 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter
 
 from backend.common.response.response_schema import ResponseModel, response_base
 from backend.common.security.jwt import DependsJwtAuth
-from backend.common.security.permission import RequestPermission
 from backend.utils.redis_info import redis_info
 
 router = APIRouter()
 
 
-@router.get(
-    '',
-    summary='redis 监控',
-    dependencies=[
-        Depends(RequestPermission('sys:monitor:redis')),
-        DependsJwtAuth,
-    ],
-)
+@router.get('', summary='redis 监控', dependencies=[DependsJwtAuth])
 async def get_redis_info() -> ResponseModel:
-    data = {'info': await redis_info.get_info(), 'stats': await redis_info.get_stats()}
+    data = {
+        'info': await redis_info.get_info(),
+        'stats': await redis_info.get_stats(),
+    }
     return response_base.success(data=data)

backend/app/admin/api/v1/monitor/server.py

@@ -1,24 +1,14 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter
 from starlette.concurrency import run_in_threadpool
 
 from backend.common.response.response_schema import ResponseModel, response_base
 from backend.common.security.jwt import DependsJwtAuth
-from backend.common.security.permission import RequestPermission
 from backend.utils.server_info import server_info
 
 router = APIRouter()
 
 
-@router.get(
-    '',
-    summary='server 监控',
-    dependencies=[
-        Depends(RequestPermission('sys:monitor:server')),
-        DependsJwtAuth,
-    ],
-)
+@router.get('', summary='server 监控', dependencies=[DependsJwtAuth])
 async def get_server_info() -> ResponseModel:
     data = {
         # 扔到线程池，避免阻塞

backend/app/admin/api/v1/oauth2/__init__.py

@@ -1,11 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from fastapi import APIRouter
-
-from backend.app.admin.api.v1.oauth2.github import router as github_router
-from backend.app.admin.api.v1.oauth2.linux_do import router as linux_do_router
-
-router = APIRouter(prefix='/oauth2')
-
-router.include_router(github_router, prefix='/github', tags=['GitHub OAuth2'])
-router.include_router(linux_do_router, prefix='/linux-do', tags=['LinuxDo OAuth2'])

backend/app/admin/api/v1/oauth2/github.py

@@ -1,47 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from fastapi import APIRouter, BackgroundTasks, Depends, Request, Response
-from fastapi_limiter.depends import RateLimiter
-from fastapi_oauth20 import FastAPIOAuth20, GitHubOAuth20
-from starlette.responses import RedirectResponse
-
-from backend.app.admin.conf import admin_settings
-from backend.app.admin.service.oauth2_service import oauth2_service
-from backend.common.enums import UserSocialType
-from backend.common.response.response_schema import ResponseSchemaModel, response_base
-
-router = APIRouter()
-
-_github_client = GitHubOAuth20(admin_settings.OAUTH2_GITHUB_CLIENT_ID, admin_settings.OAUTH2_GITHUB_CLIENT_SECRET)
-_github_oauth2 = FastAPIOAuth20(_github_client, admin_settings.OAUTH2_GITHUB_REDIRECT_URI)
-
-
-@router.get('', summary='获取 Github 授权链接')
-async def github_auth2() -> ResponseSchemaModel[str]:
-    auth_url = await _github_client.get_authorization_url(redirect_uri=admin_settings.OAUTH2_GITHUB_REDIRECT_URI)
-    return response_base.success(data=auth_url)
-
-
-@router.get(
-    '/callback',
-    summary='Github 授权自动重定向',
-    description='Github 授权后，自动重定向到当前地址并获取用户信息，通过用户信息自动创建系统用户',
-    dependencies=[Depends(RateLimiter(times=5, minutes=1))],
-)
-async def github_login(
-    request: Request,
-    response: Response,
-    background_tasks: BackgroundTasks,
-    oauth2: FastAPIOAuth20 = Depends(_github_oauth2),
-):
-    token, _state = oauth2
-    access_token = token['access_token']
-    user = await _github_client.get_userinfo(access_token)
-    data = await oauth2_service.create_with_login(
-        request=request,
-        response=response,
-        background_tasks=background_tasks,
-        user=user,
-        social=UserSocialType.github,
-    )
-    return RedirectResponse(url=f'{admin_settings.OAUTH2_FRONTEND_REDIRECT_URI}?access_token={data.access_token}')

backend/app/admin/api/v1/oauth2/linux_do.py

@@ -1,50 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from fastapi import APIRouter, BackgroundTasks, Depends, Request, Response
-from fastapi_limiter.depends import RateLimiter
-from fastapi_oauth20 import FastAPIOAuth20, LinuxDoOAuth20
-from starlette.responses import RedirectResponse
-
-from backend.app.admin.conf import admin_settings
-from backend.app.admin.service.oauth2_service import oauth2_service
-from backend.common.enums import UserSocialType
-from backend.common.response.response_schema import ResponseSchemaModel, response_base
-
-router = APIRouter()
-
-_linux_do_client = LinuxDoOAuth20(
-    admin_settings.OAUTH2_LINUX_DO_CLIENT_ID,
-    admin_settings.OAUTH2_LINUX_DO_CLIENT_SECRET,
-)
-_linux_do_oauth2 = FastAPIOAuth20(_linux_do_client, admin_settings.OAUTH2_LINUX_DO_REDIRECT_URI)
-
-
-@router.get('', summary='获取 Linux Do 授权链接')
-async def linux_do_auth2() -> ResponseSchemaModel[str]:
-    auth_url = await _linux_do_client.get_authorization_url(redirect_uri=admin_settings.OAUTH2_LINUX_DO_REDIRECT_URI)
-    return response_base.success(data=auth_url)
-
-
-@router.get(
-    '/callback',
-    summary='Linux Do 授权自动重定向',
-    description='Linux Do 授权后，自动重定向到当前地址并获取用户信息，通过用户信息自动创建系统用户',
-    dependencies=[Depends(RateLimiter(times=5, minutes=1))],
-)
-async def linux_do_login(
-    request: Request,
-    response: Response,
-    background_tasks: BackgroundTasks,
-    oauth2: FastAPIOAuth20 = Depends(_linux_do_oauth2),
-):
-    token, _state = oauth2
-    access_token = token['access_token']
-    user = await _linux_do_client.get_userinfo(access_token)
-    data = await oauth2_service.create_with_login(
-        request=request,
-        response=response,
-        background_tasks=background_tasks,
-        user=user,
-        social=UserSocialType.linuxdo,
-    )
-    return RedirectResponse(url=f'{admin_settings.OAUTH2_FRONTEND_REDIRECT_URI}?access_token={data.access_token}')

backend/app/admin/api/v1/sys/__init__.py

@@ -1,27 +1,21 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from fastapi import APIRouter
 
-from backend.app.admin.api.v1.sys.config import router as config_router
 from backend.app.admin.api.v1.sys.data_rule import router as data_rule_router
+from backend.app.admin.api.v1.sys.data_scope import router as data_scope_router
 from backend.app.admin.api.v1.sys.dept import router as dept_router
-from backend.app.admin.api.v1.sys.dict_data import router as dict_data_router
-from backend.app.admin.api.v1.sys.dict_type import router as dict_type_router
+from backend.app.admin.api.v1.sys.file import router as file_router
 from backend.app.admin.api.v1.sys.menu import router as menu_router
+from backend.app.admin.api.v1.sys.plugin import router as plugin_router
 from backend.app.admin.api.v1.sys.role import router as role_router
-from backend.app.admin.api.v1.sys.token import router as token_router
-from backend.app.admin.api.v1.sys.upload import router as upload_router
 from backend.app.admin.api.v1.sys.user import router as user_router
 
 router = APIRouter(prefix='/sys')
 
-router.include_router(config_router, prefix='/configs', tags=['系统配置'])
 router.include_router(dept_router, prefix='/depts', tags=['系统部门'])
-router.include_router(dict_data_router, prefix='/dict-datas', tags=['系统字典数据'])
-router.include_router(dict_type_router, prefix='/dict-types', tags=['系统字典类型'])
 router.include_router(menu_router, prefix='/menus', tags=['系统菜单'])
 router.include_router(role_router, prefix='/roles', tags=['系统角色'])
 router.include_router(user_router, prefix='/users', tags=['系统用户'])
-router.include_router(data_rule_router, prefix='/data-rules', tags=['系统数据权限规则'])
-router.include_router(token_router, prefix='/tokens', tags=['系统令牌'])
-router.include_router(upload_router, prefix='/upload', tags=['系统上传'])
+router.include_router(data_rule_router, prefix='/data-rules', tags=['系统数据规则'])
+router.include_router(data_scope_router, prefix='/data-scopes', tags=['系统数据范围'])
+router.include_router(file_router, prefix='/files', tags=['系统文件'])
+router.include_router(plugin_router, prefix='/plugins', tags=['系统插件'])

backend/app/admin/api/v1/sys/config.py

@@ -1,145 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from typing import Annotated
-
-from fastapi import APIRouter, Depends, Path, Query
-
-from backend.app.admin.schema.config import (
-    CreateConfigParam,
-    GetConfigDetail,
-    SaveBuiltInConfigParam,
-    UpdateConfigParam,
-)
-from backend.app.admin.service.config_service import config_service
-from backend.common.pagination import DependsPagination, PageData, paging_data
-from backend.common.response.response_schema import ResponseModel, ResponseSchemaModel, response_base
-from backend.common.security.jwt import DependsJwtAuth
-from backend.common.security.permission import RequestPermission
-from backend.common.security.rbac import DependsRBAC
-from backend.database.db import CurrentSession
-
-router = APIRouter()
-
-
-@router.get('/website', summary='获取网站配置信息', dependencies=[DependsJwtAuth])
-async def get_website_config() -> ResponseSchemaModel[GetConfigDetail]:
-    config = await config_service.get_built_in_config('website')
-    return response_base.success(data=config)
-
-
-@router.post(
-    '/website',
-    summary='保存网站配置信息',
-    dependencies=[
-        Depends(RequestPermission('sys:config:website:add')),
-        DependsRBAC,
-    ],
-)
-async def save_website_config(objs: list[SaveBuiltInConfigParam]) -> ResponseModel:
-    await config_service.save_built_in_config(objs, 'website')
-    return response_base.success()
-
-
-@router.get('/protocol', summary='获取用户协议', dependencies=[DependsJwtAuth])
-async def get_protocol_config() -> ResponseSchemaModel[GetConfigDetail]:
-    config = await config_service.get_built_in_config('protocol')
-    return response_base.success(data=config)
-
-
-@router.post(
-    '/protocol',
-    summary='保存用户协议',
-    dependencies=[
-        Depends(RequestPermission('sys:config:protocol:add')),
-        DependsRBAC,
-    ],
-)
-async def save_protocol_config(objs: list[SaveBuiltInConfigParam]) -> ResponseModel:
-    await config_service.save_built_in_config(objs, 'protocol')
-    return response_base.success()
-
-
-@router.get('/policy', summary='获取用户政策', dependencies=[DependsJwtAuth])
-async def get_policy_config() -> ResponseSchemaModel[GetConfigDetail]:
-    config = await config_service.get_built_in_config('policy')
-    return response_base.success(data=config)
-
-
-@router.post(
-    '/policy',
-    summary='保存用户政策',
-    dependencies=[
-        Depends(RequestPermission('sys:config:policy:add')),
-        DependsRBAC,
-    ],
-)
-async def save_policy_config(objs: list[SaveBuiltInConfigParam]) -> ResponseModel:
-    await config_service.save_built_in_config(objs, 'policy')
-    return response_base.success()
-
-
-@router.get('/{pk}', summary='获取系统参数配置详情', dependencies=[DependsJwtAuth])
-async def get_config(pk: Annotated[int, Path(...)]) -> ResponseSchemaModel[GetConfigDetail]:
-    config = await config_service.get(pk)
-    return response_base.success(data=config)
-
-
-@router.get(
-    '',
-    summary='（模糊条件）分页获取所有系统参数配置',
-    dependencies=[
-        DependsJwtAuth,
-        DependsPagination,
-    ],
-)
-async def get_pagination_config(
-    db: CurrentSession,
-    name: Annotated[str | None, Query()] = None,
-    type: Annotated[str | None, Query()] = None,
-) -> ResponseSchemaModel[PageData[GetConfigDetail]]:
-    config_select = await config_service.get_select(name=name, type=type)
-    page_data = await paging_data(db, config_select)
-    return response_base.success(data=page_data)
-
-
-@router.post(
-    '',
-    summary='创建系统参数配置',
-    dependencies=[
-        Depends(RequestPermission('sys:config:add')),
-        DependsRBAC,
-    ],
-)
-async def create_config(obj: CreateConfigParam) -> ResponseModel:
-    await config_service.create(obj=obj)
-    return response_base.success()
-
-
-@router.put(
-    '/{pk}',
-    summary='更新系统参数配置',
-    dependencies=[
-        Depends(RequestPermission('sys:config:edit')),
-        DependsRBAC,
-    ],
-)
-async def update_config(pk: Annotated[int, Path(...)], obj: UpdateConfigParam) -> ResponseModel:
-    count = await config_service.update(pk=pk, obj=obj)
-    if count > 0:
-        return response_base.success()
-    return response_base.fail()
-
-
-@router.delete(
-    '',
-    summary='（批量）删除系统参数配置',
-    dependencies=[
-        Depends(RequestPermission('sys:config:del')),
-        DependsRBAC,
-    ],
-)
-async def delete_config(pk: Annotated[list[int], Query(...)]) -> ResponseModel:
-    count = await config_service.delete(pk=pk)
-    if count > 0:
-        return response_base.success()
-    return response_base.fail()

backend/app/admin/api/v1/sys/data_rule.py

@@ -1,87 +1,97 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from typing import Annotated
 
-from fastapi import APIRouter, Depends, Path, Query, Request
+from fastapi import APIRouter, Depends, Path, Query
 
-from backend.app.admin.schema.data_rule import CreateDataRuleParam, GetDataRuleDetail, UpdateDataRuleParam
+from backend.app.admin.schema.data_rule import (
+    CreateDataRuleParam,
+    DeleteDataRuleParam,
+    GetDataRuleColumnDetail,
+    GetDataRuleDetail,
+    UpdateDataRuleParam,
+)
 from backend.app.admin.service.data_rule_service import data_rule_service
-from backend.common.pagination import DependsPagination, PageData, paging_data
+from backend.common.pagination import DependsPagination, PageData
 from backend.common.response.response_schema import ResponseModel, ResponseSchemaModel, response_base
 from backend.common.security.jwt import DependsJwtAuth
 from backend.common.security.permission import RequestPermission
 from backend.common.security.rbac import DependsRBAC
-from backend.database.db import CurrentSession
-from backend.utils.serializers import select_as_dict, select_list_serialize
+from backend.database.db import CurrentSession, CurrentSessionTransaction
 
 router = APIRouter()
 
 
-@router.get('/models', summary='获取支持过滤的数据库模型', dependencies=[DependsJwtAuth])
+@router.get('/models', summary='获取数据规则可用模型', dependencies=[DependsJwtAuth])
 async def get_data_rule_models() -> ResponseSchemaModel[list[str]]:
     models = await data_rule_service.get_models()
     return response_base.success(data=models)
 
 
-@router.get('/model/{model}/columns', summary='获取支持过滤的数据库模型列', dependencies=[DependsJwtAuth])
-async def get_data_rule_model_columns(model: Annotated[str, Path()]) -> ResponseSchemaModel[list[str]]:
+@router.get('/models/{model}/columns', summary='获取数据规则可用模型列', dependencies=[DependsJwtAuth])
+async def get_data_rule_model_columns(
+    model: Annotated[str, Path(description='模型名称')],
+) -> ResponseSchemaModel[list[GetDataRuleColumnDetail]]:
     models = await data_rule_service.get_columns(model=model)
     return response_base.success(data=models)
 
 
 @router.get('/all', summary='获取所有数据规则', dependencies=[DependsJwtAuth])
-async def get_all_data_rule() -> ResponseSchemaModel[list[GetDataRuleDetail]]:
-    data_rules = await data_rule_service.get_all()
-    data = select_list_serialize(data_rules)
+async def get_all_data_rules(db: CurrentSession) -> ResponseSchemaModel[list[GetDataRuleDetail]]:
+    data = await data_rule_service.get_all(db=db)
     return response_base.success(data=data)
 
 
-@router.get('/{pk}', summary='获取数据权限规则详情', dependencies=[DependsJwtAuth])
-async def get_data_rule(pk: Annotated[int, Path(...)]) -> ResponseSchemaModel[GetDataRuleDetail]:
-    data_rule = await data_rule_service.get(pk=pk)
-    data = GetDataRuleDetail(**select_as_dict(data_rule))
+@router.get('/{pk}', summary='获取数据规则详情', dependencies=[DependsJwtAuth])
+async def get_data_rule(
+    db: CurrentSession,
+    pk: Annotated[int, Path(description='数据规则 ID')],
+) -> ResponseSchemaModel[GetDataRuleDetail]:
+    data = await data_rule_service.get(db=db, pk=pk)
     return response_base.success(data=data)
 
 
 @router.get(
     '',
-    summary='（模糊条件）分页获取所有数据权限规则',
+    summary='分页获取所有数据规则',
     dependencies=[
         DependsJwtAuth,
         DependsPagination,
     ],
 )
-async def get_pagination_data_rule(
-    db: CurrentSession, name: Annotated[str | None, Query()] = None
+async def get_data_rules_paginated(
+    db: CurrentSession,
+    name: Annotated[str | None, Query(description='规则名称')] = None,
 ) -> ResponseSchemaModel[PageData[GetDataRuleDetail]]:
-    data_rule_select = await data_rule_service.get_select(name=name)
-    page_data = await paging_data(db, data_rule_select)
+    page_data = await data_rule_service.get_list(db=db, name=name)
     return response_base.success(data=page_data)
 
 
 @router.post(
     '',
-    summary='创建数据权限规则',
+    summary='创建数据规则',
     dependencies=[
         Depends(RequestPermission('data:rule:add')),
         DependsRBAC,
     ],
 )
-async def create_data_rule(obj: CreateDataRuleParam) -> ResponseModel:
-    await data_rule_service.create(obj=obj)
+async def create_data_rule(db: CurrentSessionTransaction, obj: CreateDataRuleParam) -> ResponseModel:
+    await data_rule_service.create(db=db, obj=obj)
     return response_base.success()
 
 
 @router.put(
     '/{pk}',
-    summary='更新数据权限规则',
+    summary='更新数据规则',
     dependencies=[
         Depends(RequestPermission('data:rule:edit')),
         DependsRBAC,
     ],
 )
-async def update_data_rule(pk: Annotated[int, Path(...)], obj: UpdateDataRuleParam) -> ResponseModel:
-    count = await data_rule_service.update(pk=pk, obj=obj)
+async def update_data_rule(
+    db: CurrentSessionTransaction,
+    pk: Annotated[int, Path(description='数据规则 ID')],
+    obj: UpdateDataRuleParam,
+) -> ResponseModel:
+    count = await data_rule_service.update(db=db, pk=pk, obj=obj)
     if count > 0:
         return response_base.success()
     return response_base.fail()
@@ -89,14 +99,14 @@ async def update_data_rule(pk: Annotated[int, Path(...)], obj: UpdateDataRulePar
 
 @router.delete(
     '',
-    summary='（批量）删除数据权限规则',
+    summary='批量删除数据规则',
     dependencies=[
         Depends(RequestPermission('data:rule:del')),
         DependsRBAC,
     ],
 )
-async def delete_data_rule(request: Request, pk: Annotated[list[int], Query(...)]) -> ResponseModel:
-    count = await data_rule_service.delete(request=request, pk=pk)
+async def delete_data_rules(db: CurrentSessionTransaction, obj: DeleteDataRuleParam) -> ResponseModel:
+    count = await data_rule_service.delete(db=db, obj=obj)
     if count > 0:
         return response_base.success()
     return response_base.fail()

backend/app/admin/api/v1/sys/data_scope.py

@@ -0,0 +1,128 @@
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Path, Query
+
+from backend.app.admin.schema.data_scope import (
+    CreateDataScopeParam,
+    DeleteDataScopeParam,
+    GetDataScopeDetail,
+    GetDataScopeWithRelationDetail,
+    UpdateDataScopeParam,
+    UpdateDataScopeRuleParam,
+)
+from backend.app.admin.service.data_scope_service import data_scope_service
+from backend.common.pagination import DependsPagination, PageData
+from backend.common.response.response_schema import ResponseModel, ResponseSchemaModel, response_base
+from backend.common.security.jwt import DependsJwtAuth
+from backend.common.security.permission import RequestPermission
+from backend.common.security.rbac import DependsRBAC
+from backend.database.db import CurrentSession, CurrentSessionTransaction
+
+router = APIRouter()
+
+
+@router.get('/all', summary='获取所有数据范围', dependencies=[DependsJwtAuth])
+async def get_all_data_scope(db: CurrentSession) -> ResponseSchemaModel[list[GetDataScopeDetail]]:
+    data = await data_scope_service.get_all(db=db)
+    return response_base.success(data=data)
+
+
+@router.get('/{pk}', summary='获取数据范围详情', dependencies=[DependsJwtAuth])
+async def get_data_scope(
+    db: CurrentSession,
+    pk: Annotated[int, Path(description='数据范围 ID')],
+) -> ResponseSchemaModel[GetDataScopeDetail]:
+    data = await data_scope_service.get(db=db, pk=pk)
+    return response_base.success(data=data)
+
+
+@router.get('/{pk}/rules', summary='获取数据范围所有规则', dependencies=[DependsJwtAuth])
+async def get_data_scope_rules(
+    db: CurrentSession,
+    pk: Annotated[int, Path(description='数据范围 ID')],
+) -> ResponseSchemaModel[GetDataScopeWithRelationDetail]:
+    data = await data_scope_service.get_rules(db=db, pk=pk)
+    return response_base.success(data=data)
+
+
+@router.get(
+    '',
+    summary='分页获取所有数据范围',
+    dependencies=[
+        DependsJwtAuth,
+        DependsPagination,
+    ],
+)
+async def get_data_scopes_paginated(
+    db: CurrentSession,
+    name: Annotated[str | None, Query(description='范围名称')] = None,
+    status: Annotated[int | None, Query(description='状态')] = None,
+) -> ResponseSchemaModel[PageData[GetDataScopeDetail]]:
+    page_data = await data_scope_service.get_list(db=db, name=name, status=status)
+    return response_base.success(data=page_data)
+
+
+@router.post(
+    '',
+    summary='创建数据范围',
+    dependencies=[
+        Depends(RequestPermission('data:scope:add')),
+        DependsRBAC,
+    ],
+)
+async def create_data_scope(db: CurrentSessionTransaction, obj: CreateDataScopeParam) -> ResponseModel:
+    await data_scope_service.create(db=db, obj=obj)
+    return response_base.success()
+
+
+@router.put(
+    '/{pk}',
+    summary='更新数据范围',
+    dependencies=[
+        Depends(RequestPermission('data:scope:edit')),
+        DependsRBAC,
+    ],
+)
+async def update_data_scope(
+    db: CurrentSessionTransaction,
+    pk: Annotated[int, Path(description='数据范围 ID')],
+    obj: UpdateDataScopeParam,
+) -> ResponseModel:
+    count = await data_scope_service.update(db=db, pk=pk, obj=obj)
+    if count > 0:
+        return response_base.success()
+    return response_base.fail()
+
+
+@router.put(
+    '/{pk}/rules',
+    summary='更新数据范围规则',
+    dependencies=[
+        Depends(RequestPermission('data:scope:rule:edit')),
+        DependsRBAC,
+    ],
+)
+async def update_data_scope_rules(
+    db: CurrentSessionTransaction,
+    pk: Annotated[int, Path(description='数据范围 ID')],
+    rule_ids: UpdateDataScopeRuleParam,
+) -> ResponseModel:
+    count = await data_scope_service.update_data_scope_rule(db=db, pk=pk, rule_ids=rule_ids)
+    if count > 0:
+        return response_base.success()
+    return response_base.fail()
+
+
+@router.delete(
+    '',
+    summary='批量删除数据范围',
+    dependencies=[
+        Depends(RequestPermission('data:scope:del')),
+        DependsRBAC,
+    ],
+)
+async def delete_data_scopes(db: CurrentSessionTransaction, obj: DeleteDataScopeParam) -> ResponseModel:
+    count = await data_scope_service.delete(db=db, obj=obj)
+    if count > 0:
+        return response_base.success()
+    return response_base.fail()

backend/app/admin/api/v1/sys/dept.py

@@ -1,35 +1,40 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from typing import Annotated, Any
+from typing import Annotated
 
-from fastapi import APIRouter, Depends, Path, Query, Request
+from fastapi import APIRouter, Depends, Path, Query
+from sqlalchemy import ColumnElement
 
-from backend.app.admin.schema.dept import CreateDeptParam, GetDeptDetail, UpdateDeptParam
+from backend.app.admin.model import Dept
+from backend.app.admin.schema.dept import CreateDeptParam, GetDeptDetail, GetDeptTree, UpdateDeptParam
 from backend.app.admin.service.dept_service import dept_service
 from backend.common.response.response_schema import ResponseModel, ResponseSchemaModel, response_base
 from backend.common.security.jwt import DependsJwtAuth
-from backend.common.security.permission import RequestPermission
+from backend.common.security.permission import DataPermissionFilter, RequestPermission
 from backend.common.security.rbac import DependsRBAC
-from backend.utils.serializers import select_as_dict
+from backend.database.db import CurrentSession, CurrentSessionTransaction
 
 router = APIRouter()
 
 
 @router.get('/{pk}', summary='获取部门详情', dependencies=[DependsJwtAuth])
-async def get_dept(pk: Annotated[int, Path(...)]) -> ResponseSchemaModel[GetDeptDetail]:
-    dept = await dept_service.get(pk=pk)
-    data = GetDeptDetail(**select_as_dict(dept))
+async def get_dept(
+    db: CurrentSession, pk: Annotated[int, Path(description='部门 ID')]
+) -> ResponseSchemaModel[GetDeptDetail]:
+    data = await dept_service.get(db=db, pk=pk)
     return response_base.success(data=data)
 
 
-@router.get('', summary='获取所有部门展示树', dependencies=[DependsJwtAuth])
-async def get_all_depts_tree(
-    name: Annotated[str | None, Query()] = None,
-    leader: Annotated[str | None, Query()] = None,
-    phone: Annotated[str | None, Query()] = None,
-    status: Annotated[int | None, Query()] = None,
-) -> ResponseSchemaModel[list[dict[str, Any]]]:
-    dept = await dept_service.get_dept_tree(name=name, leader=leader, phone=phone, status=status)
+@router.get('', summary='获取部门树', dependencies=[DependsJwtAuth])
+async def get_dept_tree(
+    db: CurrentSession,
+    data_filter: Annotated[ColumnElement[bool], Depends(DataPermissionFilter(Dept))],
+    name: Annotated[str | None, Query(description='部门名称')] = None,
+    leader: Annotated[str | None, Query(description='部门负责人')] = None,
+    phone: Annotated[str | None, Query(description='联系电话')] = None,
+    status: Annotated[int | None, Query(description='状态')] = None,
+) -> ResponseSchemaModel[list[GetDeptTree]]:
+    dept = await dept_service.get_tree(
+        db=db, data_filter=data_filter, name=name, leader=leader, phone=phone, status=status
+    )
     return response_base.success(data=dept)
 
 
@@ -41,8 +46,8 @@ async def get_all_depts_tree(
         DependsRBAC,
     ],
 )
-async def create_dept(obj: CreateDeptParam) -> ResponseModel:
-    await dept_service.create(obj=obj)
+async def create_dept(db: CurrentSessionTransaction, obj: CreateDeptParam) -> ResponseModel:
+    await dept_service.create(db=db, obj=obj)
     return response_base.success()
 
 
@@ -54,8 +59,10 @@ async def create_dept(obj: CreateDeptParam) -> ResponseModel:
         DependsRBAC,
     ],
 )
-async def update_dept(pk: Annotated[int, Path(...)], obj: UpdateDeptParam) -> ResponseModel:
-    count = await dept_service.update(pk=pk, obj=obj)
+async def update_dept(
+    db: CurrentSessionTransaction, pk: Annotated[int, Path(description='部门 ID')], obj: UpdateDeptParam
+) -> ResponseModel:
+    count = await dept_service.update(db=db, pk=pk, obj=obj)
     if count > 0:
         return response_base.success()
     return response_base.fail()
@@ -69,8 +76,8 @@ async def update_dept(pk: Annotated[int, Path(...)], obj: UpdateDeptParam) -> Re
         DependsRBAC,
     ],
 )
-async def delete_dept(request: Request, pk: Annotated[int, Path(...)]) -> ResponseModel:
-    count = await dept_service.delete(request=request, pk=pk)
+async def delete_dept(db: CurrentSessionTransaction, pk: Annotated[int, Path(description='部门 ID')]) -> ResponseModel:
+    count = await dept_service.delete(db=db, pk=pk)
     if count > 0:
         return response_base.success()
     return response_base.fail()

backend/app/admin/api/v1/sys/dict_data.py

@@ -1,86 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from typing import Annotated
-
-from fastapi import APIRouter, Depends, Path, Query
-
-from backend.app.admin.schema.dict_data import CreateDictDataParam, GetDictDataDetail, UpdateDictDataParam
-from backend.app.admin.service.dict_data_service import dict_data_service
-from backend.common.pagination import DependsPagination, PageData, paging_data
-from backend.common.response.response_schema import ResponseModel, ResponseSchemaModel, response_base
-from backend.common.security.jwt import DependsJwtAuth
-from backend.common.security.permission import RequestPermission
-from backend.common.security.rbac import DependsRBAC
-from backend.database.db import CurrentSession
-from backend.utils.serializers import select_as_dict
-
-router = APIRouter()
-
-
-@router.get('/{pk}', summary='获取字典详情', dependencies=[DependsJwtAuth])
-async def get_dict_data(pk: Annotated[int, Path(...)]) -> ResponseSchemaModel[GetDictDataDetail]:
-    dict_data = await dict_data_service.get(pk=pk)
-    data = GetDictDataDetail(**select_as_dict(dict_data))
-    return response_base.success(data=data)
-
-
-@router.get(
-    '',
-    summary='（模糊条件）分页获取所有字典',
-    dependencies=[
-        DependsJwtAuth,
-        DependsPagination,
-    ],
-)
-async def get_pagination_dict_datas(
-    db: CurrentSession,
-    label: Annotated[str | None, Query()] = None,
-    value: Annotated[str | None, Query()] = None,
-    status: Annotated[int | None, Query()] = None,
-) -> ResponseSchemaModel[PageData[GetDictDataDetail]]:
-    dict_data_select = await dict_data_service.get_select(label=label, value=value, status=status)
-    page_data = await paging_data(db, dict_data_select)
-    return response_base.success(data=page_data)
-
-
-@router.post(
-    '',
-    summary='创建字典',
-    dependencies=[
-        Depends(RequestPermission('sys:dict:data:add')),
-        DependsRBAC,
-    ],
-)
-async def create_dict_data(obj: CreateDictDataParam) -> ResponseModel:
-    await dict_data_service.create(obj=obj)
-    return response_base.success()
-
-
-@router.put(
-    '/{pk}',
-    summary='更新字典',
-    dependencies=[
-        Depends(RequestPermission('sys:dict:data:edit')),
-        DependsRBAC,
-    ],
-)
-async def update_dict_data(pk: Annotated[int, Path(...)], obj: UpdateDictDataParam) -> ResponseModel:
-    count = await dict_data_service.update(pk=pk, obj=obj)
-    if count > 0:
-        return response_base.success()
-    return response_base.fail()
-
-
-@router.delete(
-    '',
-    summary='（批量）删除字典',
-    dependencies=[
-        Depends(RequestPermission('sys:dict:data:del')),
-        DependsRBAC,
-    ],
-)
-async def delete_dict_data(pk: Annotated[list[int], Query(...)]) -> ResponseModel:
-    count = await dict_data_service.delete(pk=pk)
-    if count > 0:
-        return response_base.success()
-    return response_base.fail()

backend/app/admin/api/v1/sys/dict_type.py

@@ -1,78 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from typing import Annotated
-
-from fastapi import APIRouter, Depends, Path, Query
-
-from backend.app.admin.schema.dict_type import CreateDictTypeParam, GetDictTypeDetail, UpdateDictTypeParam
-from backend.app.admin.service.dict_type_service import dict_type_service
-from backend.common.pagination import DependsPagination, PageData, paging_data
-from backend.common.response.response_schema import ResponseModel, ResponseSchemaModel, response_base
-from backend.common.security.jwt import DependsJwtAuth
-from backend.common.security.permission import RequestPermission
-from backend.common.security.rbac import DependsRBAC
-from backend.database.db import CurrentSession
-
-router = APIRouter()
-
-
-@router.get(
-    '',
-    summary='（模糊条件）分页获取所有字典类型',
-    dependencies=[
-        DependsJwtAuth,
-        DependsPagination,
-    ],
-)
-async def get_pagination_dict_types(
-    db: CurrentSession,
-    name: Annotated[str | None, Query()] = None,
-    code: Annotated[str | None, Query()] = None,
-    status: Annotated[int | None, Query()] = None,
-) -> ResponseSchemaModel[PageData[GetDictTypeDetail]]:
-    dict_type_select = await dict_type_service.get_select(name=name, code=code, status=status)
-    page_data = await paging_data(db, dict_type_select)
-    return response_base.success(data=page_data)
-
-
-@router.post(
-    '',
-    summary='创建字典类型',
-    dependencies=[
-        Depends(RequestPermission('sys:dict:type:add')),
-        DependsRBAC,
-    ],
-)
-async def create_dict_type(obj: CreateDictTypeParam) -> ResponseModel:
-    await dict_type_service.create(obj=obj)
-    return response_base.success()
-
-
-@router.put(
-    '/{pk}',
-    summary='更新字典类型',
-    dependencies=[
-        Depends(RequestPermission('sys:dict:type:edit')),
-        DependsRBAC,
-    ],
-)
-async def update_dict_type(pk: Annotated[int, Path(...)], obj: UpdateDictTypeParam) -> ResponseModel:
-    count = await dict_type_service.update(pk=pk, obj=obj)
-    if count > 0:
-        return response_base.success()
-    return response_base.fail()
-
-
-@router.delete(
-    '',
-    summary='（批量）删除字典类型',
-    dependencies=[
-        Depends(RequestPermission('sys:dict:type:del')),
-        DependsRBAC,
-    ],
-)
-async def delete_dict_type(pk: Annotated[list[int], Query(...)]) -> ResponseModel:
-    count = await dict_type_service.delete(pk=pk)
-    if count > 0:
-        return response_base.success()
-    return response_base.fail()

backend/app/admin/api/v1/sys/file.py

@@ -0,0 +1,25 @@
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, File, UploadFile
+
+from backend.common.dataclasses import UploadUrl
+from backend.common.response.response_schema import ResponseSchemaModel, response_base
+from backend.common.security.permission import RequestPermission
+from backend.common.security.rbac import DependsRBAC
+from backend.utils.file_ops import upload_file, upload_file_verify
+
+router = APIRouter()
+
+
+@router.post(
+    '/upload',
+    summary='本地文件上传',
+    dependencies=[
+        Depends(RequestPermission('sys:file:upload')),
+        DependsRBAC,
+    ],
+)
+async def upload_files(file: Annotated[UploadFile, File()]) -> ResponseSchemaModel[UploadUrl]:
+    upload_file_verify(file)
+    filename = await upload_file(file)
+    return response_base.success(data={'url': f'/static/upload/{filename}'})

backend/app/admin/api/v1/sys/menu.py

@@ -1,38 +1,39 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from typing import Annotated, Any
 
 from fastapi import APIRouter, Depends, Path, Query, Request
 
-from backend.app.admin.schema.menu import CreateMenuParam, GetMenuDetail, UpdateMenuParam
+from backend.app.admin.schema.menu import CreateMenuParam, GetMenuDetail, GetMenuTree, UpdateMenuParam
 from backend.app.admin.service.menu_service import menu_service
 from backend.common.response.response_schema import ResponseModel, ResponseSchemaModel, response_base
 from backend.common.security.jwt import DependsJwtAuth
 from backend.common.security.permission import RequestPermission
 from backend.common.security.rbac import DependsRBAC
-from backend.utils.serializers import select_as_dict
+from backend.database.db import CurrentSession, CurrentSessionTransaction
 
 router = APIRouter()
 
 
-@router.get('/sidebar', summary='获取用户菜单展示树', dependencies=[DependsJwtAuth])
-async def get_user_sidebar_tree(request: Request) -> ResponseSchemaModel[list[dict[str, Any]]]:
-    menu = await menu_service.get_user_menu_tree(request=request)
+@router.get('/sidebar', summary='获取用户菜单侧边栏', description='已适配 vben admin v5', dependencies=[DependsJwtAuth])
+async def get_user_sidebar(db: CurrentSession, request: Request) -> ResponseSchemaModel[list[dict[str, Any] | None]]:
+    menu = await menu_service.get_sidebar(db=db, request=request)
     return response_base.success(data=menu)
 
 
 @router.get('/{pk}', summary='获取菜单详情', dependencies=[DependsJwtAuth])
-async def get_menu(pk: Annotated[int, Path(...)]) -> ResponseSchemaModel[GetMenuDetail]:
-    menu = await menu_service.get(pk=pk)
-    data = GetMenuDetail(**select_as_dict(menu))
+async def get_menu(
+    db: CurrentSession, pk: Annotated[int, Path(description='菜单 ID')]
+) -> ResponseSchemaModel[GetMenuDetail]:
+    data = await menu_service.get(db=db, pk=pk)
     return response_base.success(data=data)
 
 
-@router.get('', summary='获取所有菜单展示树', dependencies=[DependsJwtAuth])
-async def get_all_menus(
-    title: Annotated[str | None, Query()] = None, status: Annotated[int | None, Query()] = None
-) -> ResponseSchemaModel[list[dict[str, Any]]]:
-    menu = await menu_service.get_menu_tree(title=title, status=status)
+@router.get('', summary='获取菜单树', dependencies=[DependsJwtAuth])
+async def get_menu_tree(
+    db: CurrentSession,
+    title: Annotated[str | None, Query(description='菜单标题')] = None,
+    status: Annotated[int | None, Query(description='状体')] = None,
+) -> ResponseSchemaModel[list[GetMenuTree]]:
+    menu = await menu_service.get_tree(db=db, title=title, status=status)
     return response_base.success(data=menu)
 
 
@@ -44,8 +45,8 @@ async def get_all_menus(
         DependsRBAC,
     ],
 )
-async def create_menu(obj: CreateMenuParam) -> ResponseModel:
-    await menu_service.create(obj=obj)
+async def create_menu(db: CurrentSessionTransaction, obj: CreateMenuParam) -> ResponseModel:
+    await menu_service.create(db=db, obj=obj)
     return response_base.success()
 
 
@@ -57,8 +58,10 @@ async def create_menu(obj: CreateMenuParam) -> ResponseModel:
         DependsRBAC,
     ],
 )
-async def update_menu(pk: Annotated[int, Path(...)], obj: UpdateMenuParam) -> ResponseModel:
-    count = await menu_service.update(pk=pk, obj=obj)
+async def update_menu(
+    db: CurrentSessionTransaction, pk: Annotated[int, Path(description='菜单 ID')], obj: UpdateMenuParam
+) -> ResponseModel:
+    count = await menu_service.update(db=db, pk=pk, obj=obj)
     if count > 0:
         return response_base.success()
     return response_base.fail()
@@ -72,8 +75,8 @@ async def update_menu(pk: Annotated[int, Path(...)], obj: UpdateMenuParam) -> Re
         DependsRBAC,
     ],
 )
-async def delete_menu(request: Request, pk: Annotated[int, Path(...)]) -> ResponseModel:
-    count = await menu_service.delete(request=request, pk=pk)
+async def delete_menu(db: CurrentSessionTransaction, pk: Annotated[int, Path(description='菜单 ID')]) -> ResponseModel:
+    count = await menu_service.delete(db=db, pk=pk)
     if count > 0:
         return response_base.success()
     return response_base.fail()

backend/app/admin/api/v1/sys/plugin.py

@@ -0,0 +1,89 @@
+from typing import Annotated, Any
+
+from fastapi import APIRouter, Depends, File, Path, UploadFile
+from fastapi.params import Query
+from starlette.responses import StreamingResponse
+
+from backend.app.admin.service.plugin_service import plugin_service
+from backend.common.enums import PluginType
+from backend.common.response.response_code import CustomResponse
+from backend.common.response.response_schema import ResponseModel, ResponseSchemaModel, response_base
+from backend.common.security.jwt import DependsJwtAuth
+from backend.common.security.permission import RequestPermission
+from backend.common.security.rbac import DependsRBAC
+
+router = APIRouter()
+
+
+@router.get('', summary='获取所有插件', dependencies=[DependsJwtAuth])
+async def get_all_plugins() -> ResponseSchemaModel[list[dict[str, Any]]]:
+    plugins = await plugin_service.get_all()
+    return response_base.success(data=plugins)
+
+
+@router.get('/changed', summary='是否存在插件变更', dependencies=[DependsJwtAuth])
+async def plugin_changed() -> ResponseSchemaModel[bool]:
+    plugins = await plugin_service.changed()
+    return response_base.success(data=bool(plugins))
+
+
+@router.post(
+    '',
+    summary='安装插件',
+    description='使用插件 zip 压缩包或 git 仓库地址进行安装',
+    dependencies=[
+        Depends(RequestPermission('sys:plugin:install')),
+        DependsRBAC,
+    ],
+)
+async def install_plugin(
+    type: Annotated[PluginType, Query(description='插件类型')],
+    file: Annotated[UploadFile | None, File()] = None,
+    repo_url: Annotated[str | None, Query(description='插件 git 仓库地址')] = None,
+) -> ResponseModel:
+    plugin_name = await plugin_service.install(type=type, file=file, repo_url=repo_url)
+    return response_base.success(
+        res=CustomResponse(
+            code=200,
+            msg=f'插件 {plugin_name} 安装成功，请根据插件说明（README.md）进行相关配置并重启服务',
+        ),
+    )
+
+
+@router.delete(
+    '/{plugin}',
+    summary='卸载插件',
+    description='此操作会直接删除插件依赖，但不会直接删除插件，而是将插件移动到备份目录',
+    dependencies=[
+        Depends(RequestPermission('sys:plugin:uninstall')),
+        DependsRBAC,
+    ],
+)
+async def uninstall_plugin(plugin: Annotated[str, Path(description='插件名称')]) -> ResponseModel:
+    await plugin_service.uninstall(plugin=plugin)
+    return response_base.success(
+        res=CustomResponse(code=200, msg=f'插件 {plugin} 卸载成功，请根据插件说明（README.md）移除相关配置并重启服务'),
+    )
+
+
+@router.put(
+    '/{plugin}/status',
+    summary='更新插件状态',
+    dependencies=[
+        Depends(RequestPermission('sys:plugin:edit')),
+        DependsRBAC,
+    ],
+)
+async def update_plugin_status(plugin: Annotated[str, Path(description='插件名称')]) -> ResponseModel:
+    await plugin_service.update_status(plugin=plugin)
+    return response_base.success()
+
+
+@router.get('/{plugin}', summary='下载插件', dependencies=[DependsJwtAuth])
+async def download_plugin(plugin: Annotated[str, Path(description='插件名称')]) -> StreamingResponse:
+    bio = await plugin_service.build(plugin=plugin)
+    return StreamingResponse(
+        bio,
+        media_type='application/x-zip-compressed',
+        headers={'Content-Disposition': f'attachment; filename={plugin}.zip'},
+    )

backend/app/admin/api/v1/sys/role.py

@@ -1,78 +1,73 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from typing import Annotated, Any
+from typing import Annotated
 
-from fastapi import APIRouter, Depends, Path, Query, Request
+from fastapi import APIRouter, Depends, Path, Query
 
+from backend.app.admin.schema.menu import GetMenuTree
 from backend.app.admin.schema.role import (
     CreateRoleParam,
+    DeleteRoleParam,
     GetRoleDetail,
+    GetRoleWithRelationDetail,
     UpdateRoleMenuParam,
     UpdateRoleParam,
-    UpdateRoleRuleParam,
+    UpdateRoleScopeParam,
 )
-from backend.app.admin.service.data_rule_service import data_rule_service
-from backend.app.admin.service.menu_service import menu_service
 from backend.app.admin.service.role_service import role_service
-from backend.common.pagination import DependsPagination, PageData, paging_data
+from backend.common.pagination import DependsPagination, PageData
 from backend.common.response.response_schema import ResponseModel, ResponseSchemaModel, response_base
 from backend.common.security.jwt import DependsJwtAuth
 from backend.common.security.permission import RequestPermission
 from backend.common.security.rbac import DependsRBAC
-from backend.database.db import CurrentSession
-from backend.utils.serializers import select_as_dict, select_list_serialize
+from backend.database.db import CurrentSession, CurrentSessionTransaction
 
 router = APIRouter()
 
 
 @router.get('/all', summary='获取所有角色', dependencies=[DependsJwtAuth])
-async def get_all_roles() -> ResponseSchemaModel[list[GetRoleDetail]]:
-    roles = await role_service.get_all()
-    data = select_list_serialize(roles)
+async def get_all_roles(db: CurrentSession) -> ResponseSchemaModel[list[GetRoleDetail]]:
+    data = await role_service.get_all(db=db)
     return response_base.success(data=data)
 
 
-@router.get('/{pk}/all', summary='获取用户所有角色', dependencies=[DependsJwtAuth])
-async def get_user_all_roles(pk: Annotated[int, Path(...)]) -> ResponseSchemaModel[list[GetRoleDetail]]:
-    roles = await role_service.get_by_user(pk=pk)
-    data = select_list_serialize(roles)
-    return response_base.success(data=data)
-
-
-@router.get('/{pk}/menus', summary='获取角色所有菜单', dependencies=[DependsJwtAuth])
-async def get_role_all_menus(pk: Annotated[int, Path(...)]) -> ResponseSchemaModel[list[dict[str, Any]]]:
-    menu = await menu_service.get_role_menu_tree(pk=pk)
+@router.get('/{pk}/menus', summary='获取角色菜单树', dependencies=[DependsJwtAuth])
+async def get_role_menu_tree(
+    db: CurrentSession,
+    pk: Annotated[int, Path(description='角色 ID')],
+) -> ResponseSchemaModel[list[GetMenuTree] | None]:
+    menu = await role_service.get_menu_tree(db=db, pk=pk)
     return response_base.success(data=menu)
 
 
-@router.get('/{pk}/rules', summary='获取角色所有数据规则', dependencies=[DependsJwtAuth])
-async def get_role_all_rules(pk: Annotated[int, Path(...)]) -> ResponseSchemaModel[list[int]]:
-    rule = await data_rule_service.get_role_rules(pk=pk)
+@router.get('/{pk}/scopes', summary='获取角色所有数据范围', dependencies=[DependsJwtAuth])
+async def get_role_scopes(
+    db: CurrentSession, pk: Annotated[int, Path(description='角色 ID')]
+) -> ResponseSchemaModel[list[int]]:
+    rule = await role_service.get_scopes(db=db, pk=pk)
     return response_base.success(data=rule)
 
 
 @router.get('/{pk}', summary='获取角色详情', dependencies=[DependsJwtAuth])
-async def get_role(pk: Annotated[int, Path(...)]) -> ResponseSchemaModel[GetRoleDetail]:
-    role = await role_service.get(pk=pk)
-    data = GetRoleDetail(**select_as_dict(role))
+async def get_role(
+    db: CurrentSession, pk: Annotated[int, Path(description='角色 ID')]
+) -> ResponseSchemaModel[GetRoleWithRelationDetail]:
+    data = await role_service.get(db=db, pk=pk)
     return response_base.success(data=data)
 
 
 @router.get(
     '',
-    summary='（模糊条件）分页获取所有角色',
+    summary='分页获取所有角色',
     dependencies=[
         DependsJwtAuth,
         DependsPagination,
     ],
 )
-async def get_pagination_roles(
+async def get_roles_paginated(
     db: CurrentSession,
-    name: Annotated[str | None, Query()] = None,
-    status: Annotated[int | None, Query()] = None,
+    name: Annotated[str | None, Query(description='角色名称')] = None,
+    status: Annotated[int | None, Query(description='状态')] = None,
 ) -> ResponseSchemaModel[PageData[GetRoleDetail]]:
-    role_select = await role_service.get_select(name=name, status=status)
-    page_data = await paging_data(db, role_select)
+    page_data = await role_service.get_list(db=db, name=name, status=status)
     return response_base.success(data=page_data)
 
 
@@ -84,8 +79,8 @@ async def get_pagination_roles(
         DependsRBAC,
     ],
 )
-async def create_role(obj: CreateRoleParam) -> ResponseModel:
-    await role_service.create(obj=obj)
+async def create_role(db: CurrentSessionTransaction, obj: CreateRoleParam) -> ResponseModel:
+    await role_service.create(db=db, obj=obj)
     return response_base.success()
 
 
@@ -97,15 +92,17 @@ async def create_role(obj: CreateRoleParam) -> ResponseModel:
         DependsRBAC,
     ],
 )
-async def update_role(pk: Annotated[int, Path(...)], obj: UpdateRoleParam) -> ResponseModel:
-    count = await role_service.update(pk=pk, obj=obj)
+async def update_role(
+    db: CurrentSessionTransaction, pk: Annotated[int, Path(description='角色 ID')], obj: UpdateRoleParam
+) -> ResponseModel:
+    count = await role_service.update(db=db, pk=pk, obj=obj)
     if count > 0:
         return response_base.success()
     return response_base.fail()
 
 
 @router.put(
-    '/{pk}/menu',
+    '/{pk}/menus',
     summary='更新角色菜单',
     dependencies=[
         Depends(RequestPermission('sys:role:menu:edit')),
@@ -113,26 +110,30 @@ async def update_role(pk: Annotated[int, Path(...)], obj: UpdateRoleParam) -> Re
     ],
 )
 async def update_role_menus(
-    request: Request, pk: Annotated[int, Path(...)], menu_ids: UpdateRoleMenuParam
+    db: CurrentSessionTransaction,
+    pk: Annotated[int, Path(description='角色 ID')],
+    menu_ids: UpdateRoleMenuParam,
 ) -> ResponseModel:
-    count = await role_service.update_role_menu(request=request, pk=pk, menu_ids=menu_ids)
+    count = await role_service.update_role_menu(db=db, pk=pk, menu_ids=menu_ids)
     if count > 0:
         return response_base.success()
     return response_base.fail()
 
 
 @router.put(
-    '/{pk}/rule',
-    summary='更新角色数据权限规则',
+    '/{pk}/scopes',
+    summary='更新角色数据范围',
     dependencies=[
-        Depends(RequestPermission('sys:role:rule:edit')),
+        Depends(RequestPermission('sys:role:scope:edit')),
         DependsRBAC,
     ],
 )
-async def update_role_rules(
-    request: Request, pk: Annotated[int, Path(...)], rule_ids: UpdateRoleRuleParam
+async def update_role_scopes(
+    db: CurrentSessionTransaction,
+    pk: Annotated[int, Path(description='角色 ID')],
+    scope_ids: UpdateRoleScopeParam,
 ) -> ResponseModel:
-    count = await role_service.update_role_rule(request=request, pk=pk, rule_ids=rule_ids)
+    count = await role_service.update_role_scope(db=db, pk=pk, scope_ids=scope_ids)
     if count > 0:
         return response_base.success()
     return response_base.fail()
@@ -140,14 +141,14 @@ async def update_role_rules(
 
 @router.delete(
     '',
-    summary='（批量）删除角色',
+    summary='批量删除角色',
     dependencies=[
         Depends(RequestPermission('sys:role:del')),
         DependsRBAC,
     ],
 )
-async def delete_role(request: Request, pk: Annotated[list[int], Query(...)]) -> ResponseModel:
-    count = await role_service.delete(request=request, pk=pk)
+async def delete_roles(db: CurrentSessionTransaction, obj: DeleteRoleParam) -> ResponseModel:
+    count = await role_service.delete(db=db, obj=obj)
     if count > 0:
         return response_base.success()
     return response_base.fail()

backend/app/admin/api/v1/sys/token.py

@@ -1,84 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-import json
-
-from typing import Annotated
-
-from fastapi import APIRouter, Depends, Path, Query, Request
-
-from backend.app.admin.schema.token import GetTokenDetail, KickOutToken
-from backend.common.enums import StatusType
-from backend.common.response.response_schema import ResponseModel, ResponseSchemaModel, response_base
-from backend.common.security.jwt import DependsJwtAuth, jwt_decode, superuser_verify
-from backend.common.security.permission import RequestPermission
-from backend.common.security.rbac import DependsRBAC
-from backend.core.conf import settings
-from backend.database.redis import redis_client
-
-router = APIRouter()
-
-
-@router.get('', summary='获取令牌列表', dependencies=[DependsJwtAuth])
-async def get_tokens(username: Annotated[str | None, Query()] = None) -> ResponseSchemaModel[list[GetTokenDetail]]:
-    token_keys = await redis_client.keys(f'{settings.TOKEN_REDIS_PREFIX}:*')
-    token_online = await redis_client.smembers(settings.TOKEN_ONLINE_REDIS_PREFIX)
-    data = []
-    for key in token_keys:
-        token = await redis_client.get(key)
-        token_payload = jwt_decode(token)
-        session_uuid = token_payload.session_uuid
-        token_detail = GetTokenDetail(
-            id=token_payload.id,
-            session_uuid=session_uuid,
-            username='未知',
-            nickname='未知',
-            ip='未知',
-            os='未知',
-            browser='未知',
-            device='未知',
-            status=StatusType.disable if session_uuid not in token_online else StatusType.enable,
-            last_login_time='未知',
-            expire_time=token_payload.expire_time,
-        )
-        extra_info = await redis_client.get(f'{settings.TOKEN_EXTRA_INFO_REDIS_PREFIX}:{session_uuid}')
-        if extra_info:
-
-            def append_token_detail():
-                data.append(
-                    token_detail.model_copy(
-                        update={
-                            'username': extra_info.get('username'),
-                            'nickname': extra_info.get('nickname'),
-                            'ip': extra_info.get('ip'),
-                            'os': extra_info.get('os'),
-                            'browser': extra_info.get('browser'),
-                            'device': extra_info.get('device'),
-                            'last_login_time': extra_info.get('last_login_time'),
-                        }
-                    )
-                )
-
-            extra_info = json.loads(extra_info)
-            if extra_info.get('login_type') != 'swagger':
-                if username:
-                    if username == extra_info.get('username'):
-                        append_token_detail()
-                else:
-                    append_token_detail()
-        else:
-            data.append(token_detail)
-    return response_base.success(data=data)
-
-
-@router.delete(
-    '/{pk}',
-    summary='踢下线',
-    dependencies=[
-        Depends(RequestPermission('sys:token:kick')),
-        DependsRBAC,
-    ],
-)
-async def kick_out(request: Request, pk: Annotated[int, Path(...)], session_uuid: KickOutToken) -> ResponseModel:
-    superuser_verify(request)
-    await redis_client.delete(f'{settings.TOKEN_REDIS_PREFIX}:{pk}:{session_uuid}')
-    return response_base.success()

backend/app/admin/api/v1/sys/upload.py

@@ -1,28 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
-from typing import Annotated
-
-from fastapi import APIRouter, File, UploadFile
-
-from backend.common.dataclasses import UploadUrl
-from backend.common.enums import FileType
-from backend.common.response.response_schema import ResponseSchemaModel, response_base
-from backend.common.security.jwt import DependsJwtAuth
-from backend.utils.file_ops import file_verify, upload_file
-
-router = APIRouter()
-
-
-@router.post('/image', summary='上传图片', dependencies=[DependsJwtAuth])
-async def upload_image(file: Annotated[UploadFile, File()]) -> ResponseSchemaModel[UploadUrl]:
-    file_verify(file, FileType.image)
-    filename = await upload_file(file)
-    return response_base.success(data={'url': f'/static/upload/{filename}'})
-
-
-@router.post('/video', summary='上传视频', dependencies=[DependsJwtAuth])
-async def upload_video(file: Annotated[UploadFile, File()]) -> ResponseSchemaModel[UploadUrl]:
-    file_verify(file, FileType.video)
-    filename = await upload_file(file)
-    return response_base.success(data={'url': f'/static/upload/{filename}'})

backend/app/admin/api/v1/sys/user.py

@@ -1,160 +1,172 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from typing import Annotated
 
-from fastapi import APIRouter, Depends, Path, Query, Request
+from fastapi import APIRouter, Body, Depends, Path, Query, Request
 
+from backend.app.admin.schema.role import GetRoleDetail
 from backend.app.admin.schema.user import (
     AddUserParam,
-    AvatarParam,
-    GetCurrentUserInfoDetail,
-    GetUserInfoDetail,
-    RegisterUserParam,
+    GetCurrentUserInfoWithRelationDetail,
+    GetUserInfoWithRelationDetail,
     ResetPasswordParam,
     UpdateUserParam,
-    UpdateUserRoleParam,
 )
 from backend.app.admin.service.user_service import user_service
-from backend.common.pagination import DependsPagination, PageData, paging_data
+from backend.common.enums import UserPermissionType
+from backend.common.pagination import DependsPagination, PageData
 from backend.common.response.response_schema import ResponseModel, ResponseSchemaModel, response_base
-from backend.common.security.jwt import DependsJwtAuth
+from backend.common.security.jwt import DependsJwtAuth, DependsSuperUser
 from backend.common.security.permission import RequestPermission
 from backend.common.security.rbac import DependsRBAC
-from backend.database.db import CurrentSession
-from backend.utils.serializers import select_as_dict
+from backend.database.db import CurrentSession, CurrentSessionTransaction
 
 router = APIRouter()
 
 
-@router.post('/register', summary='注册用户')
-async def register_user(obj: RegisterUserParam) -> ResponseModel:
-    await user_service.register(obj=obj)
-    return response_base.success()
-
-
-@router.post('/add', summary='添加用户', dependencies=[DependsRBAC])
-async def add_user(request: Request, obj: AddUserParam) -> ResponseSchemaModel[GetUserInfoDetail]:
-    await user_service.add(request=request, obj=obj)
-    current_user = await user_service.get_userinfo(username=obj.username)
-    data = GetUserInfoDetail(**select_as_dict(current_user))
+@router.get('/me', summary='获取当前用户信息', dependencies=[DependsJwtAuth])
+async def get_current_user(request: Request) -> ResponseSchemaModel[GetCurrentUserInfoWithRelationDetail]:
+    data = request.user.model_dump()
     return response_base.success(data=data)
 
 
-@router.post('/password/reset', summary='密码重置', dependencies=[DependsJwtAuth])
-async def password_reset(request: Request, obj: ResetPasswordParam) -> ResponseModel:
-    count = await user_service.pwd_reset(request=request, obj=obj)
-    if count > 0:
-        return response_base.success()
-    return response_base.fail()
-
-
-@router.get('/me', summary='获取当前用户信息', dependencies=[DependsJwtAuth], response_model_exclude={'password'})
-async def get_current_user(request: Request) -> ResponseSchemaModel[GetCurrentUserInfoDetail]:
-    data = GetCurrentUserInfoDetail(**request.user.model_dump())
+@router.get('/{pk}', summary='获取用户信息', dependencies=[DependsJwtAuth])
+async def get_userinfo(
+    db: CurrentSession,
+    pk: Annotated[int, Path(description='用户 ID')],
+) -> ResponseSchemaModel[GetUserInfoWithRelationDetail]:
+    data = await user_service.get_userinfo(db=db, pk=pk)
     return response_base.success(data=data)
 
 
-@router.get('/{username}', summary='查看用户信息', dependencies=[DependsJwtAuth])
-async def get_user(username: Annotated[str, Path(...)]) -> ResponseSchemaModel[GetUserInfoDetail]:
-    current_user = await user_service.get_userinfo(username=username)
-    data = GetUserInfoDetail(**select_as_dict(current_user))
+@router.get('/{pk}/roles', summary='获取用户所有角色', dependencies=[DependsJwtAuth])
+async def get_user_roles(
+    db: CurrentSession, pk: Annotated[int, Path(description='用户 ID')]
+) -> ResponseSchemaModel[list[GetRoleDetail]]:
+    data = await user_service.get_roles(db=db, pk=pk)
     return response_base.success(data=data)
 
 
-@router.put('/{username}', summary='更新用户信息', dependencies=[DependsJwtAuth])
-async def update_user(request: Request, username: Annotated[str, Path(...)], obj: UpdateUserParam) -> ResponseModel:
-    count = await user_service.update(request=request, username=username, obj=obj)
-    if count > 0:
-        return response_base.success()
-    return response_base.fail()
-
-
-@router.put(
-    '/{username}/role',
-    summary='更新用户角色',
-    dependencies=[
-        Depends(RequestPermission('sys:user:role:edit')),
-        DependsRBAC,
-    ],
-)
-async def update_user_role(
-    request: Request, username: Annotated[str, Path(...)], obj: UpdateUserRoleParam
-) -> ResponseModel:
-    await user_service.update_roles(request=request, username=username, obj=obj)
-    return response_base.success()
-
-
-@router.put('/{username}/avatar', summary='更新头像', dependencies=[DependsJwtAuth])
-async def update_avatar(request: Request, username: Annotated[str, Path(...)], avatar: AvatarParam) -> ResponseModel:
-    count = await user_service.update_avatar(request=request, username=username, avatar=avatar)
-    if count > 0:
-        return response_base.success()
-    return response_base.fail()
-
-
 @router.get(
     '',
-    summary='（模糊条件）分页获取所有用户',
+    summary='分页获取所有用户',
     dependencies=[
         DependsJwtAuth,
         DependsPagination,
     ],
 )
-async def get_pagination_users(
+async def get_users_paginated(
     db: CurrentSession,
-    dept: Annotated[int | None, Query()] = None,
-    username: Annotated[str | None, Query()] = None,
-    phone: Annotated[str | None, Query()] = None,
-    status: Annotated[int | None, Query()] = None,
-) -> ResponseSchemaModel[PageData[GetUserInfoDetail]]:
-    user_select = await user_service.get_select(dept=dept, username=username, phone=phone, status=status)
-    page_data = await paging_data(db, user_select)
+    dept: Annotated[int | None, Query(description='部门 ID')] = None,
+    username: Annotated[str | None, Query(description='用户名')] = None,
+    phone: Annotated[str | None, Query(description='手机号')] = None,
+    status: Annotated[int | None, Query(description='状态')] = None,
+) -> ResponseSchemaModel[PageData[GetUserInfoWithRelationDetail]]:
+    page_data = await user_service.get_list(db=db, dept=dept, username=username, phone=phone, status=status)
     return response_base.success(data=page_data)
 
 
-@router.put('/{pk}/super', summary='修改用户超级权限', dependencies=[DependsRBAC])
-async def super_set(request: Request, pk: Annotated[int, Path(...)]) -> ResponseModel:
-    count = await user_service.update_permission(request=request, pk=pk)
+@router.post('', summary='创建用户', dependencies=[DependsSuperUser])
+async def create_user(
+    db: CurrentSessionTransaction, obj: AddUserParam
+) -> ResponseSchemaModel[GetUserInfoWithRelationDetail]:
+    await user_service.create(db=db, obj=obj)
+    data = await user_service.get_userinfo(db=db, username=obj.username)
+    return response_base.success(data=data)
+
+
+@router.put('/{pk}', summary='更新用户信息', dependencies=[DependsSuperUser])
+async def update_user(
+    db: CurrentSessionTransaction,
+    pk: Annotated[int, Path(description='用户 ID')],
+    obj: UpdateUserParam,
+) -> ResponseModel:
+    count = await user_service.update(db=db, pk=pk, obj=obj)
     if count > 0:
         return response_base.success()
     return response_base.fail()
 
 
-@router.put('/{pk}/staff', summary='修改用户后台登录权限', dependencies=[DependsRBAC])
-async def staff_set(request: Request, pk: Annotated[int, Path(...)]) -> ResponseModel:
-    count = await user_service.update_staff(request=request, pk=pk)
+@router.put('/{pk}/permissions', summary='更新用户权限', dependencies=[DependsSuperUser])
+async def update_user_permission(
+    db: CurrentSessionTransaction,
+    request: Request,
+    pk: Annotated[int, Path(description='用户 ID')],
+    type: Annotated[UserPermissionType, Query(description='权限类型')],
+) -> ResponseModel:
+    count = await user_service.update_permission(db=db, request=request, pk=pk, type=type)
     if count > 0:
         return response_base.success()
     return response_base.fail()
 
 
-@router.put('/{pk}/status', summary='修改用户状态', dependencies=[DependsRBAC])
-async def status_set(request: Request, pk: Annotated[int, Path(...)]) -> ResponseModel:
-    count = await user_service.update_status(request=request, pk=pk)
+@router.put('/me/password', summary='更新当前用户密码', dependencies=[DependsJwtAuth])
+async def update_user_password(
+    db: CurrentSessionTransaction, request: Request, obj: ResetPasswordParam
+) -> ResponseModel:
+    count = await user_service.update_password(db=db, user_id=request.user.id, obj=obj)
     if count > 0:
         return response_base.success()
     return response_base.fail()
 
 
-@router.put('/{pk}/multi', summary='修改用户多点登录状态', dependencies=[DependsRBAC])
-async def multi_set(request: Request, pk: Annotated[int, Path(...)]) -> ResponseModel:
-    count = await user_service.update_multi_login(request=request, pk=pk)
+@router.put('/{pk}/password', summary='重置用户密码', dependencies=[DependsSuperUser])
+async def reset_user_password(
+    db: CurrentSessionTransaction,
+    pk: Annotated[int, Path(description='用户 ID')],
+    password: Annotated[str, Body(embed=True, description='新密码')],
+) -> ResponseModel:
+    count = await user_service.reset_password(db=db, pk=pk, password=password)
+    if count > 0:
+        return response_base.success()
+    return response_base.fail()
+
+
+@router.put('/me/nickname', summary='更新当前用户昵称', dependencies=[DependsJwtAuth])
+async def update_user_nickname(
+    db: CurrentSessionTransaction,
+    request: Request,
+    nickname: Annotated[str, Body(embed=True, description='用户昵称')],
+) -> ResponseModel:
+    count = await user_service.update_nickname(db=db, user_id=request.user.id, nickname=nickname)
+    if count > 0:
+        return response_base.success()
+    return response_base.fail()
+
+
+@router.put('/me/avatar', summary='更新当前用户头像', dependencies=[DependsJwtAuth])
+async def update_user_avatar(
+    db: CurrentSessionTransaction,
+    request: Request,
+    avatar: Annotated[str, Body(embed=True, description='用户头像地址')],
+) -> ResponseModel:
+    count = await user_service.update_avatar(db=db, user_id=request.user.id, avatar=avatar)
+    if count > 0:
+        return response_base.success()
+    return response_base.fail()
+
+
+@router.put('/me/email', summary='更新当前用户邮箱', dependencies=[DependsJwtAuth])
+async def update_user_email(
+    db: CurrentSessionTransaction,
+    request: Request,
+    captcha: Annotated[str, Body(embed=True, description='邮箱验证码')],
+    email: Annotated[str, Body(embed=True, description='用户邮箱')],
+) -> ResponseModel:
+    count = await user_service.update_email(db=db, user_id=request.user.id, captcha=captcha, email=email)
     if count > 0:
         return response_base.success()
     return response_base.fail()
 
 
 @router.delete(
-    path='/{username}',
-    summary='用户注销',
-    description='用户注销 != 用户登出，注销之后用户将从数据库删除',
+    path='/{pk}',
+    summary='删除用户',
     dependencies=[
         Depends(RequestPermission('sys:user:del')),
         DependsRBAC,
     ],
 )
-async def delete_user(username: Annotated[str, Path(...)]) -> ResponseModel:
-    count = await user_service.delete(username=username)
+async def delete_user(db: CurrentSessionTransaction, pk: Annotated[int, Path(description='用户 ID')]) -> ResponseModel:
+    count = await user_service.delete(db=db, pk=pk)
     if count > 0:
         return response_base.success()
     return response_base.fail()

backend/app/admin/conf.py

@@ -1,43 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from functools import lru_cache
-
-from pydantic_settings import BaseSettings, SettingsConfigDict
-
-from backend.core.path_conf import BasePath
-
-
-class AdminSettings(BaseSettings):
-    """Admin Settings"""
-
-    model_config = SettingsConfigDict(env_file=f'{BasePath}/.env', env_file_encoding='utf-8', extra='ignore')
-
-    # OAuth2：https://github.com/fastapi-practices/fastapi_oauth20
-    # GitHub
-    OAUTH2_GITHUB_CLIENT_ID: str
-    OAUTH2_GITHUB_CLIENT_SECRET: str
-    OAUTH2_GITHUB_REDIRECT_URI: str = 'http://127.0.0.1:8000/api/v1/oauth2/github/callback'
-
-    # Linux Do
-    OAUTH2_LINUX_DO_CLIENT_ID: str
-    OAUTH2_LINUX_DO_CLIENT_SECRET: str
-    OAUTH2_LINUX_DO_REDIRECT_URI: str = 'http://127.0.0.1:8000/api/v1/oauth2/linux-do/callback'
-
-    # Front-end redirect address
-    OAUTH2_FRONTEND_REDIRECT_URI: str = 'http://localhost:5173/oauth2/callback'
-
-    # Captcha
-    CAPTCHA_LOGIN_REDIS_PREFIX: str = 'fba:login:captcha'
-    CAPTCHA_LOGIN_EXPIRE_SECONDS: int = 60 * 5  # 过期时间，单位：秒
-
-    # Config
-    CONFIG_BUILT_IN_TYPES: list = ['website', 'protocol', 'policy']
-
-
-@lru_cache
-def get_admin_settings() -> AdminSettings:
-    """获取 admin 配置"""
-    return AdminSettings()
-
-
-admin_settings = get_admin_settings()

backend/app/admin/crud/__init__.py

@@ -1,2 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-

backend/app/admin/crud/crud_config.py

@@ -1,109 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from typing import Sequence
-
-from sqlalchemy import Select
-from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy_crud_plus import CRUDPlus
-
-from backend.app.admin.conf import admin_settings
-from backend.app.admin.model import Config
-from backend.app.admin.schema.config import CreateConfigParam, UpdateConfigParam
-
-
-class CRUDConfig(CRUDPlus[Config]):
-    async def get(self, db: AsyncSession, pk: int) -> Config | None:
-        """
-        获取系统参数配置
-
-        :param db:
-        :param pk:
-        :return:
-        """
-        return await self.select_model_by_column(db, id=pk, type__not_in=admin_settings.CONFIG_BUILT_IN_TYPES)
-
-    async def get_by_type(self, db: AsyncSession, type: str) -> Sequence[Config]:
-        """
-        通过 type 获取内置系统配置
-
-        :param db:
-        :param type:
-        :return:
-        """
-        return await self.select_models(db, type=type)
-
-    async def get_by_key_and_type(self, db: AsyncSession, key: str, type: str) -> Config | None:
-        """
-        通过 name 和 type 获取内置系统配置
-
-        :param db:
-        :param key:
-        :param type:
-        :return:
-        """
-        return await self.select_model_by_column(db, key=key, type=type)
-
-    async def get_by_key(self, db: AsyncSession, key: str, built_in: bool = False) -> Config | None:
-        """
-        通过 key 获取系统配置参数
-
-        :param db:
-        :param key:
-        :param built_in:
-        :return:
-        """
-        filters = {'key': key}
-        if not built_in:
-            filters.update({'type__not_in': admin_settings.CONFIG_BUILT_IN_TYPES})
-        return await self.select_model_by_column(db, **filters)
-
-    async def get_list(self, name: str = None, type: str = None) -> Select:
-        """
-        获取系统参数配置列表
-
-        :param name:
-        :param type:
-        :return:
-        """
-        filters = {'type__not_in': admin_settings.CONFIG_BUILT_IN_TYPES}
-        if name is not None:
-            filters.update(name__like=f'%{name}%')
-        if type is not None:
-            filters.update(type__like=f'%{type}%')
-        return await self.select_order('created_time', 'desc', **filters)
-
-    async def create(self, db: AsyncSession, obj_in: CreateConfigParam) -> None:
-        """
-        创建 Config
-
-        :param db:
-        :param obj_in:
-        :return:
-        """
-        await self.create_model(db, obj_in)
-
-    async def update(self, db: AsyncSession, pk: int, obj_in: UpdateConfigParam) -> int:
-        """
-        更新 Config
-
-        :param db:
-        :param pk:
-        :param obj_in:
-        :return:
-        """
-        return await self.update_model(db, pk, obj_in)
-
-    async def delete(self, db: AsyncSession, pk: list[int]) -> int:
-        """
-        删除 Config
-
-        :param db:
-        :param pk:
-        :return:
-        """
-        return await self.delete_model_by_column(
-            db, allow_multiple=True, id__in=pk, type__not_in=admin_settings.CONFIG_BUILT_IN_TYPES
-        )
-
-
-config_dao: CRUDConfig = CRUDConfig(Config)

backend/app/admin/crud/crud_data_rule.py

@@ -1,10 +1,7 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from typing import Sequence
+from collections.abc import Sequence
 
-from sqlalchemy import Select, desc, select
+from sqlalchemy import Select
 from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy.orm import noload
 from sqlalchemy_crud_plus import CRUDPlus
 
 from backend.app.admin.model import DataRule
@@ -12,79 +9,81 @@ from backend.app.admin.schema.data_rule import CreateDataRuleParam, UpdateDataRu
 
 
 class CRUDDataRule(CRUDPlus[DataRule]):
+    """数据规则数据库操作类"""
+
     async def get(self, db: AsyncSession, pk: int) -> DataRule | None:
         """
-        获取数据权限规则
+        获取规则详情
 
-        :param db:
-        :param pk:
+        :param db: 数据库会话
+        :param pk: 规则 ID
         :return:
         """
         return await self.select_model(db, pk)
 
-    async def get_list(self, name: str = None) -> Select:
+    async def get_select(self, name: str | None) -> Select:
         """
-        获取数据权限规则列表
+        获取规则列表查询表达式
 
+        :param name: 规则名称
         :return:
         """
-        stmt = select(self.model).options(noload(self.model.roles)).order_by(desc(self.model.created_time))
-        where_list = []
+        filters = {}
+
         if name is not None:
-            where_list.append(self.model.name.like(f'%{name}%'))
-        if where_list:
-            stmt = stmt.where(*where_list)
-        return stmt
+            filters['name__like'] = f'%{name}%'
 
-    async def get_by_name(self, db: AsyncSession, name: str):
+        return await self.select_order('id', **filters)
+
+    async def get_by_name(self, db: AsyncSession, name: str) -> DataRule | None:
         """
-        通过 name 获取数据权限规则
+        通过名称获取规则
 
-        :param db:
-        :param name:
+        :param db: 数据库会话
+        :param name: 规则名称
         :return:
         """
         return await self.select_model_by_column(db, name=name)
 
     async def get_all(self, db: AsyncSession) -> Sequence[DataRule]:
         """
-        获取所有数据权限规则
+        获取所有规则
 
-        :param db:
+        :param db: 数据库会话
         :return:
         """
         return await self.select_models(db)
 
-    async def create(self, db: AsyncSession, obj_in: CreateDataRuleParam) -> None:
+    async def create(self, db: AsyncSession, obj: CreateDataRuleParam) -> None:
         """
-        创建数据权限规则
+        创建规则
 
-        :param db:
-        :param obj_in:
+        :param db: 数据库会话
+        :param obj: 创建规则参数
         :return:
         """
-        await self.create_model(db, obj_in)
+        await self.create_model(db, obj)
 
-    async def update(self, db: AsyncSession, pk: int, obj_in: UpdateDataRuleParam) -> int:
+    async def update(self, db: AsyncSession, pk: int, obj: UpdateDataRuleParam) -> int:
         """
-        更新数据权限规则
+        更新规则
 
-        :param db:
-        :param pk:
-        :param obj_in:
+        :param db: 数据库会话
+        :param pk: 规则 ID
+        :param obj: 更新规则参数
         :return:
         """
-        return await self.update_model(db, pk, obj_in)
+        return await self.update_model(db, pk, obj)
 
-    async def delete(self, db: AsyncSession, pk: list[int]) -> int:
+    async def delete(self, db: AsyncSession, pks: list[int]) -> int:
         """
-        删除数据权限规则
+        批量删除规则
 
-        :param db:
-        :param pk:
+        :param db: 数据库会话
+        :param pks: 规则 ID 列表
         :return:
         """
-        return await self.delete_model_by_column(db, allow_multiple=True, id__in=pk)
+        return await self.delete_model_by_column(db, allow_multiple=True, id__in=pks)
 
 
 data_rule_dao: CRUDDataRule = CRUDDataRule(DataRule)

backend/app/admin/crud/crud_data_scope.py

@@ -0,0 +1,139 @@
+from collections.abc import Sequence
+from typing import Any
+
+from sqlalchemy import Select, delete, insert
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy_crud_plus import CRUDPlus, JoinConfig
+
+from backend.app.admin.model import DataRule, DataScope, data_scope_rule
+from backend.app.admin.schema.data_scope import (
+    CreateDataScopeParam,
+    CreateDataScopeRuleParam,
+    UpdateDataScopeParam,
+    UpdateDataScopeRuleParam,
+)
+from backend.utils.serializers import select_join_serialize
+
+
+class CRUDDataScope(CRUDPlus[DataScope]):
+    """数据范围数据库操作类"""
+
+    async def get(self, db: AsyncSession, pk: int) -> DataScope | None:
+        """
+        获取数据范围详情
+
+        :param db: 数据库会话
+        :param pk: 范围 ID
+        :return:
+        """
+        return await self.select_model(db, pk)
+
+    async def get_by_name(self, db: AsyncSession, name: str) -> DataScope | None:
+        """
+        通过名称获取数据范围
+
+        :param db: 数据库会话
+        :param name: 范围名称
+        :return:
+        """
+        return await self.select_model_by_column(db, name=name)
+
+    async def get_join(self, db: AsyncSession, pk: int) -> Any:
+        """
+        获取数据范围关联数据
+
+        :param db: 数据库会话
+        :param pk: 范围 ID
+        :return:
+        """
+        result = await self.select_models(
+            db,
+            id=pk,
+            join_conditions=[
+                JoinConfig(model=data_scope_rule, join_on=data_scope_rule.c.data_scope_id == self.model.id),
+                JoinConfig(model=DataRule, join_on=DataRule.id == data_scope_rule.c.data_rule_id, fill_result=True),
+            ],
+        )
+
+        return select_join_serialize(result, relationships=['DataScope-m2m-DataRule:rules'])
+
+    async def get_all(self, db: AsyncSession) -> Sequence[DataScope]:
+        """
+        获取所有数据范围
+
+        :param db: 数据库会话
+        :return:
+        """
+        return await self.select_models(db)
+
+    async def get_select(self, name: str | None, status: int | None) -> Select:
+        """
+        获取数据范围列表查询表达式
+
+        :param name: 范围名称
+        :param status: 范围状态
+        :return:
+        """
+        filters = {}
+
+        if name is not None:
+            filters['name__like'] = f'%{name}%'
+        if status is not None:
+            filters['status'] = status
+
+        return await self.select_order('id', **filters)
+
+    async def create(self, db: AsyncSession, obj: CreateDataScopeParam) -> None:
+        """
+        创建数据范围
+
+        :param db: 数据库会话
+        :param obj: 创建数据范围参数
+        :return:
+        """
+        await self.create_model(db, obj)
+
+    async def update(self, db: AsyncSession, pk: int, obj: UpdateDataScopeParam) -> int:
+        """
+        更新数据范围
+
+        :param db: 数据库会话
+        :param pk: 范围 ID
+        :param obj: 更新数据范围参数
+        :return:
+        """
+        return await self.update_model(db, pk, obj)
+
+    @staticmethod
+    async def update_rules(db: AsyncSession, pk: int, rule_ids: UpdateDataScopeRuleParam) -> int:
+        """
+        更新数据范围规则
+
+        :param db: 数据库会话
+        :param pk: 范围 ID
+        :param rule_ids: 数据规则 ID 列表
+        :return:
+        """
+        data_scope_rule_stmt = delete(data_scope_rule).where(data_scope_rule.c.data_scope_id == pk)
+        await db.execute(data_scope_rule_stmt)
+
+        data_scope_rule_data = [
+            CreateDataScopeRuleParam(data_scope_id=pk, data_rule_id=rule_id).model_dump() for rule_id in rule_ids.rules
+        ]
+        data_scope_rule_stmt = insert(data_scope_rule)
+        await db.execute(data_scope_rule_stmt, data_scope_rule_data)
+
+        return len(rule_ids.rules)
+
+    async def delete(self, db: AsyncSession, pks: list[int]) -> int:
+        """
+        批量删除数据范围
+
+        :param db: 数据库会话
+        :param pks: 范围 ID 列表
+        :return:
+        """
+        return await self.delete_model_by_column(db, allow_multiple=True, id__in=pks)
+
+
+data_scope_dao: CRUDDataScope = CRUDDataScope(DataScope)

backend/app/admin/crud/crud_dept.py

@@ -1,117 +1,126 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from typing import Sequence
+from collections.abc import Sequence
+from typing import Any
 
-from sqlalchemy import select
+from sqlalchemy import ColumnElement
 from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy.orm import selectinload
-from sqlalchemy_crud_plus import CRUDPlus
+from sqlalchemy_crud_plus import CRUDPlus, JoinConfig
 
 from backend.app.admin.model import Dept, User
 from backend.app.admin.schema.dept import CreateDeptParam, UpdateDeptParam
+from backend.utils.serializers import select_join_serialize
 
 
 class CRUDDept(CRUDPlus[Dept]):
+    """部门数据库操作类"""
+
     async def get(self, db: AsyncSession, dept_id: int) -> Dept | None:
         """
-        获取部门
+        获取部门详情
 
-        :param db:
-        :param dept_id:
+        :param db: 数据库会话
+        :param dept_id: 部门 ID
         :return:
         """
-        return await self.select_model_by_column(db, id=dept_id, del_flag=0)
+        return await self.select_model_by_column(db, id=dept_id, del_flag=False)
 
     async def get_by_name(self, db: AsyncSession, name: str) -> Dept | None:
         """
-        通过 name 获取 API
+        通过名称获取部门
 
-        :param db:
-        :param name:
+        :param db: 数据库会话
+        :param name: 部门名称
         :return:
         """
-        return await self.select_model_by_column(db, name=name, del_flag=0)
+        return await self.select_model_by_column(db, name=name, del_flag=False)
 
     async def get_all(
-        self, db: AsyncSession, name: str = None, leader: str = None, phone: str = None, status: int = None
+        self,
+        db: AsyncSession,
+        data_filter: ColumnElement[bool],
+        name: str | None,
+        leader: str | None,
+        phone: str | None,
+        status: int | None,
     ) -> Sequence[Dept]:
         """
         获取所有部门
 
-        :param db:
-        :param name:
-        :param leader:
-        :param phone:
-        :param status:
+        :param db: 数据库会话
+        :param data_filter: 请求用户
+        :param name: 部门名称
+        :param leader: 负责人
+        :param phone: 联系电话
+        :param status: 部门状态
         :return:
         """
-        filters = {'del_flag__eq': 0}
-        if name is not None:
-            filters.update(name__like=f'%{name}%')
-        if leader is not None:
-            filters.update(leader__like=f'%{leader}%')
-        if phone is not None:
-            filters.update(phone__startswith=phone)
-        if status is not None:
-            filters.update(status=status)
-        return await self.select_models_order(db, sort_columns='sort', **filters)
+        filters = {'del_flag': False}
 
-    async def create(self, db: AsyncSession, obj_in: CreateDeptParam) -> None:
+        if name is not None:
+            filters['name__like'] = f'%{name}%'
+        if leader is not None:
+            filters['leader__like'] = f'%{leader}%'
+        if phone is not None:
+            filters['phone__startswith'] = phone
+        if status is not None:
+            filters['status'] = status
+
+        return await self.select_models_order(db, 'sort', 'desc', data_filter, **filters)
+
+    async def create(self, db: AsyncSession, obj: CreateDeptParam) -> None:
         """
         创建部门
 
-        :param db:
-        :param obj_in:
+        :param db: 数据库会话
+        :param obj: 创建部门参数
         :return:
         """
-        await self.create_model(db, obj_in)
+        await self.create_model(db, obj)
 
-    async def update(self, db: AsyncSession, dept_id: int, obj_in: UpdateDeptParam) -> int:
+    async def update(self, db: AsyncSession, dept_id: int, obj: UpdateDeptParam) -> int:
         """
         更新部门
 
-        :param db:
-        :param dept_id:
-        :param obj_in:
+        :param db: 数据库会话
+        :param dept_id: 部门 ID
+        :param obj: 更新部门参数
         :return:
         """
-        return await self.update_model(db, dept_id, obj_in)
+        return await self.update_model(db, dept_id, obj)
 
     async def delete(self, db: AsyncSession, dept_id: int) -> int:
         """
         删除部门
 
-        :param db:
-        :param dept_id:
+        :param db: 数据库会话
+        :param dept_id: 部门 ID
         :return:
         """
         return await self.delete_model_by_column(db, id=dept_id, logical_deletion=True, deleted_flag_column='del_flag')
 
-    async def get_with_relation(self, db: AsyncSession, dept_id: int) -> list[User]:
+    async def get_join(self, db: AsyncSession, dept_id: int) -> Any | None:
         """
-        获取关联
+        获取部门及关联数据
 
-        :param db:
-        :param dept_id:
+        :param db: 数据库会话
+        :param dept_id: 部门 ID
         :return:
         """
-        stmt = select(self.model).options(selectinload(self.model.users)).where(self.model.id == dept_id)
-        result = await db.execute(stmt)
-        user_relation = result.scalars().first()
-        return user_relation.users
+        result = await self.select_model(
+            db,
+            dept_id,
+            join_conditions=[JoinConfig(model=User, join_on=User.dept_id == self.model.id, fill_result=True)],
+        )
+        return select_join_serialize(result, relationships=['Dept-o2m-User'])
 
-    async def get_children(self, db: AsyncSession, dept_id: int) -> list[Dept]:
+    async def get_children(self, db: AsyncSession, dept_id: int) -> Sequence[Dept | None]:
         """
-        获取子部门
+        获取子部门列表
 
-        :param db:
-        :param dept_id:
+        :param db: 数据库会话
+        :param dept_id: 部门 ID
         :return:
         """
-        stmt = select(self.model).options(selectinload(self.model.children)).where(self.model.id == dept_id)
-        result = await db.execute(stmt)
-        dept = result.scalars().first()
-        return dept.children
+        return await self.select_models(db, parent_id=dept_id, del_flag=False)
 
 
 dept_dao: CRUDDept = CRUDDept(Dept)

backend/app/admin/crud/crud_dict_data.py

@@ -1,98 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from sqlalchemy import Select, and_, desc, select
-from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy.orm import noload, selectinload
-from sqlalchemy_crud_plus import CRUDPlus
-
-from backend.app.admin.model import DictData
-from backend.app.admin.schema.dict_data import CreateDictDataParam, UpdateDictDataParam
-
-
-class CRUDDictData(CRUDPlus[DictData]):
-    async def get(self, db: AsyncSession, pk: int) -> DictData | None:
-        """
-        获取字典数据
-
-        :param db:
-        :param pk:
-        :return:
-        """
-        return await self.select_model(db, pk)
-
-    async def get_list(self, label: str = None, value: str = None, status: int = None) -> Select:
-        """
-        获取所有字典数据
-
-        :param label:
-        :param value:
-        :param status:
-        :return:
-        """
-        stmt = select(self.model).options(noload(self.model.type)).order_by(desc(self.model.sort))
-        where_list = []
-        if label is not None:
-            where_list.append(self.model.label.like(f'%{label}%'))
-        if value is not None:
-            where_list.append(self.model.value.like(f'%{value}%'))
-        if status is not None:
-            where_list.append(self.model.status == status)
-        if where_list:
-            stmt = stmt.where(and_(*where_list))
-        return stmt
-
-    async def get_by_label(self, db: AsyncSession, label: str) -> DictData | None:
-        """
-        通过 label 获取字典数据
-
-        :param db:
-        :param label:
-        :return:
-        """
-        return await self.select_model_by_column(db, label=label)
-
-    async def create(self, db: AsyncSession, obj_in: CreateDictDataParam) -> None:
-        """
-        创建数据字典
-
-        :param db:
-        :param obj_in:
-        :return:
-        """
-        await self.create_model(db, obj_in)
-
-    async def update(self, db: AsyncSession, pk: int, obj_in: UpdateDictDataParam) -> int:
-        """
-        更新数据字典
-
-        :param db:
-        :param pk:
-        :param obj_in:
-        :return:
-        """
-        return await self.update_model(db, pk, obj_in)
-
-    async def delete(self, db: AsyncSession, pk: list[int]) -> int:
-        """
-        删除字典数据
-
-        :param db:
-        :param pk:
-        :return:
-        """
-        return await self.delete_model_by_column(db, allow_multiple=True, id__in=pk)
-
-    async def get_with_relation(self, db: AsyncSession, pk: int) -> DictData | None:
-        """
-        获取字典数据和类型
-
-        :param db:
-        :param pk:
-        :return:
-        """
-        stmt = select(self.model).options(selectinload(self.model.type)).where(self.model.id == pk)
-        dict_data = await db.execute(stmt)
-        return dict_data.scalars().first()
-
-
-dict_data_dao: CRUDDictData = CRUDDictData(DictData)

backend/app/admin/crud/crud_dict_type.py

@@ -1,82 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from sqlalchemy import Select
-from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy_crud_plus import CRUDPlus
-
-from backend.app.admin.model import DictType
-from backend.app.admin.schema.dict_type import CreateDictTypeParam, UpdateDictTypeParam
-
-
-class CRUDDictType(CRUDPlus[DictType]):
-    async def get(self, db: AsyncSession, pk: int) -> DictType | None:
-        """
-        获取字典类型
-
-        :param db:
-        :param pk:
-        :return:
-        """
-        return await self.select_model(db, pk)
-
-    async def get_list(self, *, name: str = None, code: str = None, status: int = None) -> Select:
-        """
-        获取所有字典类型
-
-        :param name:
-        :param code:
-        :param status:
-        :return:
-        """
-        filters = {}
-        if name is not None:
-            filters.update(name__like=f'%{name}%')
-        if code is not None:
-            filters.update(code__like=f'%{code}%')
-        if status is not None:
-            filters.update(status=status)
-        return await self.select_order('created_time', 'desc', **filters)
-
-    async def get_by_code(self, db: AsyncSession, code: str) -> DictType | None:
-        """
-        通过 code 获取字典类型
-
-        :param db:
-        :param code:
-        :return:
-        """
-        return await self.select_model_by_column(db, code=code)
-
-    async def create(self, db: AsyncSession, obj_in: CreateDictTypeParam) -> None:
-        """
-        创建字典类型
-
-        :param db:
-        :param obj_in:
-        :return:
-        """
-        await self.create_model(db, obj_in)
-
-    async def update(self, db: AsyncSession, pk: int, obj_in: UpdateDictTypeParam) -> int:
-        """
-        更新字典类型
-
-        :param db:
-        :param pk:
-        :param obj_in:
-        :return:
-        """
-        return await self.update_model(db, pk, obj_in)
-
-    async def delete(self, db: AsyncSession, pk: list[int]) -> int:
-        """
-        删除字典类型
-
-        :param db:
-        :param pk:
-        :return:
-        """
-        return await self.delete_model_by_column(db, allow_multiple=True, id__in=pk)
-
-
-dict_type_dao: CRUDDictType = CRUDDictType(DictType)

backend/app/admin/crud/crud_login_log.py

@@ -1,6 +1,5 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from sqlalchemy import Select
+from sqlalchemy import delete as sa_delete
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy_crud_plus import CRUDPlus
 
@@ -9,52 +8,57 @@ from backend.app.admin.schema.login_log import CreateLoginLogParam
 
 
 class CRUDLoginLog(CRUDPlus[LoginLog]):
-    async def get_list(self, username: str | None = None, status: int | None = None, ip: str | None = None) -> Select:
-        """
-        获取登录日志列表
+    """登录日志数据库操作类"""
 
-        :param username:
-        :param status:
-        :param ip:
+    async def get_select(self, username: str | None, status: int | None, ip: str | None) -> Select:
+        """
+        获取登录日志列表查询表达式
+
+        :param username: 用户名
+        :param status: 登录状态
+        :param ip: IP 地址
         :return:
         """
         filters = {}
+
         if username is not None:
-            filters.update(username__like=f'%{username}%')
+            filters['username__like'] = f'%{username}%'
         if status is not None:
-            filters.update(status=status)
+            filters['status'] = status
         if ip is not None:
-            filters.update(ip__like=f'%{ip}%')
+            filters['ip__like'] = f'%{ip}%'
+
         return await self.select_order('created_time', 'desc', **filters)
 
-    async def create(self, db: AsyncSession, obj_in: CreateLoginLogParam) -> None:
+    async def create(self, db: AsyncSession, obj: CreateLoginLogParam) -> None:
         """
         创建登录日志
 
-        :param db:
-        :param obj_in:
+        :param db: 数据库会话
+        :param obj: 创建登录日志参数
         :return:
         """
-        await self.create_model(db, obj_in, commit=True)
+        await self.create_model(db, obj, commit=True)
 
-    async def delete(self, db: AsyncSession, pk: list[int]) -> int:
+    async def delete(self, db: AsyncSession, pks: list[int]) -> int:
         """
-        删除登录日志
+        批量删除登录日志
 
-        :param db:
-        :param pk:
+        :param db: 数据库会话
+        :param pks: 登录日志 ID 列表
         :return:
         """
-        return await self.delete_model_by_column(db, allow_multiple=True, id__in=pk)
+        return await self.delete_model_by_column(db, allow_multiple=True, id__in=pks)
 
-    async def delete_all(self, db: AsyncSession) -> int:
+    @staticmethod
+    async def delete_all(db: AsyncSession) -> None:
         """
-        删除所有登录日志
+        删除所有日志
 
-        :param db:
+        :param db: 数据库会话
         :return:
         """
-        return await self.delete_model_by_column(db, allow_multiple=True)
+        await db.execute(sa_delete(LoginLog))
 
 
 login_log_dao: CRUDLoginLog = CRUDLoginLog(LoginLog)

backend/app/admin/crud/crud_menu.py

@@ -1,112 +1,112 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from typing import Sequence
+from collections.abc import Sequence
 
-from sqlalchemy import and_, asc, select
-from sqlalchemy.orm import selectinload
+from sqlalchemy import delete
+from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy_crud_plus import CRUDPlus
 
-from backend.app.admin.model import Menu
+from backend.app.admin.model import Menu, role_menu
 from backend.app.admin.schema.menu import CreateMenuParam, UpdateMenuParam
 
 
 class CRUDMenu(CRUDPlus[Menu]):
-    async def get(self, db, menu_id: int) -> Menu | None:
-        """
-        获取菜单
+    """菜单数据库操作类"""
 
-        :param db:
-        :param menu_id:
+    async def get(self, db: AsyncSession, menu_id: int) -> Menu | None:
+        """
+        获取菜单详情
+
+        :param db: 数据库会话
+        :param menu_id: 菜单 ID
         :return:
         """
         return await self.select_model(db, menu_id)
 
-    async def get_by_title(self, db, title: str) -> Menu | None:
+    async def get_by_title(self, db: AsyncSession, title: str) -> Menu | None:
         """
-        通过 title 获取菜单
+        通过标题获取菜单
 
-        :param db:
-        :param title:
+        :param db: 数据库会话
+        :param title: 菜单标题
         :return:
         """
-        return await self.select_model_by_column(db, title=title, menu_type__ne=2)
+        return await self.select_model_by_column(db, title=title, type__ne=2)
 
-    async def get_all(self, db, title: str | None = None, status: int | None = None) -> Sequence[Menu]:
+    async def get_all(self, db: AsyncSession, title: str | None, status: int | None) -> Sequence[Menu]:
         """
-        获取所有菜单
+        获取菜单列表
 
-        :param db:
-        :param title:
-        :param status:
+        :param db: 数据库会话
+        :param title: 菜单标题
+        :param status: 菜单状态
         :return:
         """
         filters = {}
+
         if title is not None:
-            filters.update(title=f'%{title}%')
+            filters['title__like'] = f'%{title}%'
         if status is not None:
-            filters.update(status=status)
+            filters['status'] = status
+
         return await self.select_models_order(db, 'sort', **filters)
 
-    async def get_role_menus(self, db, superuser: bool, menu_ids: list[int]) -> Sequence[Menu]:
+    async def get_sidebar(self, db: AsyncSession, menu_ids: list[int] | None) -> Sequence[Menu]:
         """
-        获取角色菜单
+        获取用户的菜单侧边栏
 
-        :param db:
-        :param superuser:
-        :param menu_ids:
+        :param db: 数据库会话
+        :param menu_ids: 菜单 ID 列表
         :return:
         """
-        stmt = select(self.model).order_by(asc(self.model.sort))
-        where_list = [self.model.menu_type.in_([0, 1])]
-        if not superuser:
-            where_list.append(self.model.id.in_(menu_ids))
-        stmt = stmt.where(and_(*where_list))
-        menu = await db.execute(stmt)
-        return menu.scalars().all()
+        filters = {'type__in': [0, 1, 3, 4]}
 
-    async def create(self, db, obj_in: CreateMenuParam) -> None:
+        if menu_ids:
+            filters['id__in'] = menu_ids
+
+        return await self.select_models_order(db, 'sort', 'asc', **filters)
+
+    async def create(self, db: AsyncSession, obj: CreateMenuParam) -> None:
         """
         创建菜单
 
-        :param db:
-        :param obj_in:
+        :param db: 数据库会话
+        :param obj: 创建菜单参数
         :return:
         """
-        await self.create_model(db, obj_in)
+        await self.create_model(db, obj)
 
-    async def update(self, db, menu_id: int, obj_in: UpdateMenuParam) -> int:
+    async def update(self, db: AsyncSession, menu_id: int, obj: UpdateMenuParam) -> int:
         """
         更新菜单
 
-        :param db:
-        :param menu_id:
-        :param obj_in:
+        :param db: 数据库会话
+        :param menu_id: 菜单 ID
+        :param obj: 更新菜单参数
         :return:
         """
-        return await self.update_model(db, menu_id, obj_in)
+        return await self.update_model(db, menu_id, obj)
 
-    async def delete(self, db, menu_id: int) -> int:
+    async def delete(self, db: AsyncSession, menu_id: int) -> int:
         """
         删除菜单
 
-        :param db:
-        :param menu_id:
+        :param db: 数据库会话
+        :param menu_id: 菜单 ID
         :return:
         """
+        role_menu_stmt = delete(role_menu).where(role_menu.c.menu_id == menu_id)
+        await db.execute(role_menu_stmt)
+
         return await self.delete_model(db, menu_id)
 
-    async def get_children(self, db, menu_id: int) -> list[Menu]:
+    async def get_children(self, db: AsyncSession, menu_id: int) -> Sequence[Menu | None]:
         """
-        获取子菜单
+        获取子菜单列表
 
-        :param db:
-        :param menu_id:
+        :param db: 数据库会话
+        :param menu_id: 菜单 ID
         :return:
         """
-        stmt = select(self.model).options(selectinload(self.model.children)).where(self.model.id == menu_id)
-        result = await db.execute(stmt)
-        menu = result.scalars().first()
-        return menu.children
+        return await self.select_models(db, parent_id=menu_id)
 
 
 menu_dao: CRUDMenu = CRUDMenu(Menu)

backend/app/admin/crud/crud_opera_log.py

@@ -1,6 +1,5 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from sqlalchemy import Select
+from sqlalchemy import delete as sa_delete
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy_crud_plus import CRUDPlus
 
@@ -9,52 +8,67 @@ from backend.app.admin.schema.opera_log import CreateOperaLogParam
 
 
 class CRUDOperaLogDao(CRUDPlus[OperaLog]):
-    async def get_list(self, username: str | None = None, status: int | None = None, ip: str | None = None) -> Select:
-        """
-        获取操作日志列表
+    """操作日志数据库操作类"""
 
-        :param username:
-        :param status:
-        :param ip:
+    async def get_select(self, username: str | None, status: int | None, ip: str | None) -> Select:
+        """
+        获取操作日志列表查询表达式
+
+        :param username: 用户名
+        :param status: 操作状态
+        :param ip: IP 地址
         :return:
         """
         filters = {}
+
         if username is not None:
-            filters.update(username=f'%{username}%')
+            filters['username__like'] = f'%{username}%'
         if status is not None:
-            filters.update(status=status)
+            filters['status__eq'] = status
         if ip is not None:
-            filters.update(ip=f'%{ip}%')
+            filters['ip__like'] = f'%{ip}%'
+
         return await self.select_order('created_time', 'desc', **filters)
 
-    async def create(self, db: AsyncSession, obj_in: CreateOperaLogParam) -> None:
+    async def create(self, db: AsyncSession, obj: CreateOperaLogParam) -> None:
         """
         创建操作日志
 
-        :param db:
-        :param obj_in:
+        :param db: 数据库会话
+        :param obj: 操作日志创建参数
         :return:
         """
-        await self.create_model(db, obj_in)
+        await self.create_model(db, obj)
 
-    async def delete(self, db: AsyncSession, pk: list[int]) -> int:
+    async def bulk_create(self, db: AsyncSession, objs: list[CreateOperaLogParam]) -> None:
         """
-        删除操作日志
+        批量创建操作日志
 
-        :param db:
-        :param pk:
+        :param db: 数据库会话
+        :param objs: 操作日志创建参数列表
         :return:
         """
-        return await self.delete_model_by_column(db, allow_multiple=True, id__in=pk)
+        await self.create_models(db, objs)
 
-    async def delete_all(self, db: AsyncSession) -> int:
+    async def delete(self, db: AsyncSession, pks: list[int]) -> int:
         """
-        删除所有操作日志
+        批量删除操作日志
 
-        :param db:
+        :param db: 数据库会话
+        :param pks: 操作日志 ID 列表
         :return:
         """
-        return await self.delete_model_by_column(db, allow_multiple=True)
+        return await self.delete_model_by_column(db, allow_multiple=True, id__in=pks)
+
+    @staticmethod
+    async def delete_all(db: AsyncSession) -> None:
+        """
+        删除所有日志
+
+        :param db: 数据库会话
+        :return:
+        """
+        await db.execute(sa_delete(OperaLog))
 
 
 opera_log_dao: CRUDOperaLogDao = CRUDOperaLogDao(OperaLog)

backend/app/admin/crud/crud_role.py

@@ -1,162 +1,178 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from typing import Sequence
+from collections.abc import Sequence
+from typing import Any
 
-from sqlalchemy import Select, desc, select
-from sqlalchemy.orm import noload, selectinload
-from sqlalchemy_crud_plus import CRUDPlus
+from sqlalchemy import Select, delete, insert, select
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy_crud_plus import CRUDPlus, JoinConfig
 
-from backend.app.admin.model import DataRule, Menu, Role, User
+from backend.app.admin.model import DataScope, Menu, Role, role_data_scope, role_menu
 from backend.app.admin.schema.role import (
+    CreateRoleMenuParam,
     CreateRoleParam,
+    CreateRoleScopeParam,
     UpdateRoleMenuParam,
     UpdateRoleParam,
-    UpdateRoleRuleParam,
+    UpdateRoleScopeParam,
 )
+from backend.utils.serializers import select_join_serialize
 
 
 class CRUDRole(CRUDPlus[Role]):
-    async def get(self, db, role_id: int) -> Role | None:
-        """
-        获取角色
+    """角色数据库操作类"""
 
-        :param db:
-        :param role_id:
+    async def get(self, db: AsyncSession, role_id: int) -> Role | None:
+        """
+        获取角色详情
+
+        :param db: 数据库会话
+        :param role_id: 角色 ID
         :return:
         """
         return await self.select_model(db, role_id)
 
-    async def get_with_relation(self, db, role_id: int) -> Role | None:
+    @staticmethod
+    async def get_menus(db: AsyncSession, role_id: int) -> Sequence[Menu] | None:
         """
-        获取角色和菜单
+        获取角色菜单
 
-        :param db:
-        :param role_id:
+        :param db: 数据库会话
+        :param role_id: 角色 ID
         :return:
         """
-        stmt = (
-            select(self.model)
-            .options(selectinload(self.model.menus), selectinload(self.model.rules))
-            .where(self.model.id == role_id)
-        )
-        role = await db.execute(stmt)
-        return role.scalars().first()
+        menu_stmt = select(Menu).join(role_menu, Menu.id == role_menu.c.menu_id).where(role_menu.c.role_id == role_id)
+        result = await db.execute(menu_stmt)
+        return result.scalars().all()
 
-    async def get_all(self, db) -> Sequence[Role]:
+    async def get_join(self, db: AsyncSession, role_id: int) -> Any:
+        """
+        获取角色及关联数据
+
+        :param db: 数据库会话
+        :param role_id: 角色 ID
+        :return:
+        """
+        result = await self.select_models(
+            db,
+            id=role_id,
+            join_conditions=[
+                JoinConfig(model=role_menu, join_on=role_menu.c.role_id == self.model.id),
+                JoinConfig(model=Menu, join_on=Menu.id == role_menu.c.menu_id, fill_result=True),
+                JoinConfig(model=role_data_scope, join_on=role_data_scope.c.role_id == self.model.id),
+                JoinConfig(model=DataScope, join_on=DataScope.id == role_data_scope.c.data_scope_id, fill_result=True),
+            ],
+        )
+
+        return select_join_serialize(result, relationships=['Role-m2m-Menu', 'Role-m2m-DataScope:scopes'])
+
+    async def get_all(self, db: AsyncSession) -> Sequence[Role]:
         """
         获取所有角色
 
-        :param db:
+        :param db: 数据库会话
         :return:
         """
         return await self.select_models(db)
 
-    async def get_by_user(self, db, user_id: int) -> Sequence[Role]:
+    async def get_select(self, name: str | None, status: int | None) -> Select:
         """
-        获取用户所有角色
+        获取角色列表查询表达式
 
-        :param db:
-        :param user_id:
+        :param name: 角色名称
+        :param status: 角色状态
         :return:
         """
-        stmt = select(self.model).join(self.model.users).where(User.id == user_id)
-        roles = await db.execute(stmt)
-        return roles.scalars().all()
 
-    async def get_list(self, name: str = None, status: int = None) -> Select:
-        """
-        获取角色列表
+        filters = {}
 
-        :param name:
-        :param status:
-        :return:
-        """
-        stmt = (
-            select(self.model)
-            .options(noload(self.model.users), noload(self.model.menus), noload(self.model.rules))
-            .order_by(desc(self.model.created_time))
-        )
-        where_list = []
-        if name:
-            where_list.append(self.model.name.like(f'%{name}%'))
+        if name is not None:
+            filters['name__like'] = f'%{name}%'
         if status is not None:
-            where_list.append(self.model.status == status)
-        if where_list:
-            stmt = stmt.where(*where_list)
-        return stmt
+            filters['status'] = status
 
-    async def get_by_name(self, db, name: str) -> Role | None:
+        return await self.select_order('id', **filters)
+
+    async def get_by_name(self, db: AsyncSession, name: str) -> Role | None:
         """
-        通过 name 获取角色
+        通过名称获取角色
 
-        :param db:
-        :param name:
+        :param db: 数据库会话
+        :param name: 角色名称
         :return:
         """
         return await self.select_model_by_column(db, name=name)
 
-    async def create(self, db, obj_in: CreateRoleParam) -> None:
+    async def create(self, db: AsyncSession, obj: CreateRoleParam) -> None:
         """
         创建角色
 
-        :param db:
-        :param obj_in:
+        :param db: 数据库会话
+        :param obj: 创建角色参数
         :return:
         """
-        await self.create_model(db, obj_in)
+        await self.create_model(db, obj)
 
-    async def update(self, db, role_id: int, obj_in: UpdateRoleParam) -> int:
+    async def update(self, db: AsyncSession, role_id: int, obj: UpdateRoleParam) -> int:
         """
         更新角色
 
-        :param db:
-        :param role_id:
-        :param obj_in:
+        :param db: 数据库会话
+        :param role_id: 角色 ID
+        :param obj: 更新角色参数
         :return:
         """
-        return await self.update_model(db, role_id, obj_in)
+        return await self.update_model(db, role_id, obj)
 
-    async def update_menus(self, db, role_id: int, menu_ids: UpdateRoleMenuParam) -> int:
+    @staticmethod
+    async def update_menus(db: AsyncSession, role_id: int, menu_ids: UpdateRoleMenuParam) -> int:
         """
         更新角色菜单
 
-        :param db:
-        :param role_id:
-        :param menu_ids:
+        :param db: 数据库会话
+        :param role_id: 角色 ID
+        :param menu_ids: 菜单 ID 列表
         :return:
         """
-        current_role = await self.get_with_relation(db, role_id)
-        # 更新菜单
-        stmt = select(Menu).where(Menu.id.in_(menu_ids.menus))
-        menus = await db.execute(stmt)
-        current_role.menus = menus.scalars().all()
-        return len(current_role.menus)
+        role_menu_stmt = delete(role_menu).where(role_menu.c.role_id == role_id)
+        await db.execute(role_menu_stmt)
 
-    async def update_rules(self, db, role_id: int, rule_ids: UpdateRoleRuleParam) -> int:
+        role_menu_data = [
+            CreateRoleMenuParam(role_id=role_id, menu_id=menu_id).model_dump() for menu_id in menu_ids.menus
+        ]
+        role_menu_stmt = insert(role_menu)
+        await db.execute(role_menu_stmt, role_menu_data)
+
+        return len(menu_ids.menus)
+
+    @staticmethod
+    async def update_scopes(db: AsyncSession, role_id: int, scope_ids: UpdateRoleScopeParam) -> int:
         """
-        更新角色数据权限
+        更新角色数据范围
 
-        :param db:
-        :param role_id:
-        :param rule_ids:
+        :param db: 数据库会话
+        :param role_id: 角色 ID
+        :param scope_ids: 权限范围 ID 列表
         :return:
         """
-        current_role = await self.get_with_relation(db, role_id)
-        # 更新数据权限
-        stmt = select(DataRule).where(DataRule.id.in_(rule_ids.rules))
-        rules = await db.execute(stmt)
-        current_role.rules = rules.scalars().all()
-        return len(current_role.rules)
+        role_scope_stmt = delete(role_data_scope).where(role_data_scope.c.role_id == role_id)
+        await db.execute(role_scope_stmt)
 
-    async def delete(self, db, role_id: list[int]) -> int:
+        role_scope_data = [
+            CreateRoleScopeParam(role_id=role_id, data_scope_id=scope_id).model_dump() for scope_id in scope_ids.scopes
+        ]
+        role_scope_stmt = insert(role_data_scope)
+        await db.execute(role_scope_stmt, role_scope_data)
+
+        return len(scope_ids.scopes)
+
+    async def delete(self, db: AsyncSession, role_ids: list[int]) -> int:
         """
-        删除角色
+        批量删除角色
 
-        :param db:
-        :param role_id:
+        :param db: 数据库会话
+        :param role_ids: 角色 ID 列表
         :return:
         """
-        return await self.delete_model_by_column(db, allow_multiple=True, id__in=role_id)
+        return await self.delete_model_by_column(db, allow_multiple=True, id__in=role_ids)
 
 
 role_dao: CRUDRole = CRUDRole(Role)

backend/app/admin/crud/crud_user.py

@@ -1,320 +1,362 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
+from typing import Any
+
 import bcrypt
 
-from sqlalchemy import and_, desc, select
+from sqlalchemy import Select, delete, insert, select
 from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy.orm import noload, selectinload
-from sqlalchemy.sql import Select
-from sqlalchemy_crud_plus import CRUDPlus
+from sqlalchemy_crud_plus import CRUDPlus, JoinConfig
 
-from backend.app.admin.model import Dept, Role, User
-from backend.app.admin.schema.user import (
-    AddUserParam,
-    AvatarParam,
-    RegisterUserParam,
-    UpdateUserParam,
-    UpdateUserRoleParam,
+from backend.app.admin.model import (
+    DataRule,
+    DataScope,
+    Dept,
+    Menu,
+    Role,
+    User,
+    data_scope_rule,
+    role_data_scope,
+    role_menu,
+    user_role,
 )
-from backend.common.security.jwt import get_hash_password
+from backend.app.admin.schema.user import (
+    AddOAuth2UserParam,
+    AddUserParam,
+    AddUserRoleParam,
+    UpdateUserParam,
+)
+from backend.app.admin.utils.password_security import get_hash_password
+from backend.utils.import_parse import import_module_cached
+from backend.utils.serializers import select_join_serialize
 from backend.utils.timezone import timezone
 
 
 class CRUDUser(CRUDPlus[User]):
+    """用户数据库操作类"""
+
     async def get(self, db: AsyncSession, user_id: int) -> User | None:
         """
-        获取用户
+        获取用户详情
 
-        :param db:
-        :param user_id:
+        :param db: 数据库会话
+        :param user_id: 用户 ID
         :return:
         """
         return await self.select_model(db, user_id)
 
     async def get_by_username(self, db: AsyncSession, username: str) -> User | None:
         """
-        通过 username 获取用户
+        通过用户名获取用户
 
-        :param db:
-        :param username:
+        :param db: 数据库会话
+        :param username: 用户名
         :return:
         """
         return await self.select_model_by_column(db, username=username)
 
     async def get_by_nickname(self, db: AsyncSession, nickname: str) -> User | None:
         """
-        通过 nickname 获取用户
+        通过昵称获取用户
 
-        :param db:
-        :param nickname:
+        :param db: 数据库会话
+        :param nickname: 用户昵称
         :return:
         """
         return await self.select_model_by_column(db, nickname=nickname)
 
-    async def update_login_time(self, db: AsyncSession, username: str) -> int:
+    async def check_email(self, db: AsyncSession, email: str) -> User | None:
         """
-        更新用户登录时间
+        检查邮箱是否已被绑定
 
-        :param db:
-        :param username:
+        :param db: 数据库会话
+        :param email: 电子邮箱
         :return:
         """
-        return await self.update_model_by_column(db, {'last_login_time': timezone.now()}, username=username)
+        return await self.select_model_by_column(db, email=email)
 
-    async def create(self, db: AsyncSession, obj: RegisterUserParam, *, social: bool = False) -> None:
+    async def get_select(self, dept: int | None, username: str | None, phone: str | None, status: int | None) -> Select:
         """
-        创建用户
+        获取用户列表查询表达式
 
-        :param db:
-        :param obj:
-        :param social: 社交用户，适配 oauth 2.0
+        :param dept: 部门 ID
+        :param username: 用户名
+        :param phone: 电话号码
+        :param status: 用户状态
+        :return:
+        """
+        filters = {}
+
+        if dept:
+            filters['dept_id'] = dept
+        if username:
+            filters['username__like'] = f'%{username}%'
+        if phone:
+            filters['phone__like'] = f'%{phone}%'
+        if status is not None:
+            filters['status'] = status
+
+        return await self.select_order(
+            'id',
+            'desc',
+            join_conditions=[
+                JoinConfig(model=Dept, join_on=Dept.id == self.model.dept_id, fill_result=True),
+                JoinConfig(model=user_role, join_on=user_role.c.user_id == self.model.id),
+                JoinConfig(model=Role, join_on=Role.id == user_role.c.role_id, fill_result=True),
+            ],
+            **filters,
+        )
+
+    async def add(self, db: AsyncSession, obj: AddUserParam) -> None:
+        """
+        添加用户
+
+        :param db: 数据库会话
+        :param obj: 添加用户参数
         :return:
         """
-        if not social:
         salt = bcrypt.gensalt()
         obj.password = get_hash_password(obj.password, salt)
-            dict_obj = obj.model_dump()
-            dict_obj.update({'is_staff': True, 'salt': salt})
-        else:
+
+        dict_obj = obj.model_dump(exclude={'roles'})
+        dict_obj.update({'salt': salt})
+        new_user = self.model(**dict_obj)
+        db.add(new_user)
+        await db.flush()
+
+        role_stmt = select(Role).where(Role.id.in_(obj.roles))
+        result = await db.execute(role_stmt)
+        roles = result.scalars().all()
+
+        user_role_data = [AddUserRoleParam(user_id=new_user.id, role_id=role.id).model_dump() for role in roles]
+        user_role_stmt = insert(user_role)
+        await db.execute(user_role_stmt, user_role_data)
+
+    async def add_by_oauth2(self, db: AsyncSession, obj: AddOAuth2UserParam) -> None:
+        """
+        通过 OAuth2 添加用户
+
+        :param db: 数据库会话
+        :param obj: 注册用户参数
+        :return:
+        """
         dict_obj = obj.model_dump()
         dict_obj.update({'is_staff': True, 'salt': None})
         new_user = self.model(**dict_obj)
         db.add(new_user)
+        await db.flush()
 
-    async def add(self, db: AsyncSession, obj: AddUserParam) -> None:
-        """
-        后台添加用户
+        role_stmt = select(Role)
+        result = await db.execute(role_stmt)
+        role = result.scalars().first()  # 默认绑定第一个角色
 
-        :param db:
-        :param obj:
-        :return:
-        """
-        salt = bcrypt.gensalt()
-        obj.password = get_hash_password(obj.password, salt)
-        dict_obj = obj.model_dump(exclude={'roles'})
-        dict_obj.update({'salt': salt})
-        new_user = self.model(**dict_obj)
-        role_list = []
-        for role_id in obj.roles:
-            role_list.append(await db.get(Role, role_id))
-        new_user.roles.extend(role_list)
-        db.add(new_user)
+        user_role_stmt = insert(user_role).values(AddUserRoleParam(user_id=new_user.id, role_id=role.id).model_dump())
+        await db.execute(user_role_stmt)
 
-    async def update_userinfo(self, db: AsyncSession, input_user: int, obj: UpdateUserParam) -> int:
+    async def update(self, db: AsyncSession, user_id: int, obj: UpdateUserParam) -> int:
         """
         更新用户信息
 
-        :param db:
-        :param input_user:
-        :param obj:
+        :param db: 数据库会话
+        :param user_id: 用户 ID
+        :param obj: 更新用户参数
         :return:
         """
-        return await self.update_model(db, input_user, obj)
+        role_ids = obj.roles
+        del obj.roles
 
-    @staticmethod
-    async def update_role(db: AsyncSession, input_user: User, obj: UpdateUserRoleParam) -> None:
+        count = await self.update_model(db, user_id, obj)
+
+        role_stmt = select(Role).where(Role.id.in_(role_ids))
+        result = await db.execute(role_stmt)
+        roles = result.scalars().all()
+
+        user_role_stmt = delete(user_role).where(user_role.c.user_id == user_id)
+        await db.execute(user_role_stmt)
+
+        user_role_data = [AddUserRoleParam(user_id=user_id, role_id=role.id).model_dump() for role in roles]
+        user_role_stmt = insert(user_role)
+        await db.execute(user_role_stmt, user_role_data)
+
+        return count
+
+    async def update_login_time(self, db: AsyncSession, username: str) -> int:
         """
-        更新用户角色
+        更新用户上次登录时间
 
-        :param db:
-        :param input_user:
-        :param obj:
+        :param db: 数据库会话
+        :param username: 用户名
         :return:
         """
-        # 删除用户所有角色
-        for i in list(input_user.roles):
-            input_user.roles.remove(i)
-        # 添加用户角色
-        role_list = []
-        for role_id in obj.roles:
-            role_list.append(await db.get(Role, role_id))
-        input_user.roles.extend(role_list)
+        return await self.update_model_by_column(db, {'last_login_time': timezone.now()}, username=username)
 
-    async def update_avatar(self, db: AsyncSession, input_user: int, avatar: AvatarParam) -> int:
+    async def update_password_changed_time(self, db: AsyncSession, user_id: int) -> int:
+        """
+        更新用户上次密码变更时间
+
+        :param db: 数据库会话
+        :param user_id: 用户 ID
+        :return:
+        """
+        return await self.update_model(db, user_id, {'last_password_changed_time': timezone.now()})
+
+    async def update_nickname(self, db: AsyncSession, user_id: int, nickname: str) -> int:
+        """
+        更新用户昵称
+
+        :param db: 数据库会话
+        :param user_id: 用户 ID
+        :param nickname: 用户昵称
+        :return:
+        """
+        return await self.update_model(db, user_id, {'nickname': nickname})
+
+    async def update_avatar(self, db: AsyncSession, user_id: int, avatar: str) -> int:
         """
         更新用户头像
 
-        :param db:
-        :param input_user:
-        :param avatar:
+        :param db: 数据库会话
+        :param user_id: 用户 ID
+        :param avatar: 头像地址
         :return:
         """
-        return await self.update_model(db, input_user, {'avatar': avatar.url})
+        return await self.update_model(db, user_id, {'avatar': avatar})
+
+    async def update_email(self, db: AsyncSession, user_id: int, email: str) -> int:
+        """
+        更新用户邮箱
+
+        :param db: 数据库会话
+        :param user_id: 用户 ID
+        :param email: 邮箱
+        :return:
+        """
+        return await self.update_model(db, user_id, {'email': email})
+
+    async def reset_password(self, db: AsyncSession, pk: int, password: str) -> int:
+        """
+        重置用户密码
+
+        :param db: 数据库会话
+        :param pk: 用户 ID
+        :param password: 新密码
+        :return:
+        """
+        salt = bcrypt.gensalt()
+        new_pwd = get_hash_password(password, salt)
+        return await self.update_model(db, pk, {'password': new_pwd, 'salt': salt}, flush=True)
+
+    async def set_super(self, db: AsyncSession, user_id: int, *, is_super: bool) -> int:
+        """
+        设置用户超级管理员状态
+
+        :param db: 数据库会话
+        :param user_id: 用户 ID
+        :param is_super: 是否超级管理员
+        :return:
+        """
+        return await self.update_model(db, user_id, {'is_superuser': is_super})
+
+    async def set_staff(self, db: AsyncSession, user_id: int, *, is_staff: bool) -> int:
+        """
+        设置用户后台登录状态
+
+        :param db: 数据库会话
+        :param user_id: 用户 ID
+        :param is_staff: 是否可登录后台
+        :return:
+        """
+        return await self.update_model(db, user_id, {'is_staff': is_staff})
+
+    async def set_status(self, db: AsyncSession, user_id: int, status: int) -> int:
+        """
+        设置用户状态
+
+        :param db: 数据库会话
+        :param user_id: 用户 ID
+        :param status: 状态
+        :return:
+        """
+        return await self.update_model(db, user_id, {'status': status})
+
+    async def set_multi_login(self, db: AsyncSession, user_id: int, *, multi_login: bool) -> int:
+        """
+        设置用户多端登录状态
+
+        :param db: 数据库会话
+        :param user_id: 用户 ID
+        :param multi_login: 是否允许多端登录
+        :return:
+        """
+        return await self.update_model(db, user_id, {'is_multi_login': multi_login})
 
     async def delete(self, db: AsyncSession, user_id: int) -> int:
         """
         删除用户
 
-        :param db:
-        :param user_id:
+        :param db: 数据库会话
+        :param user_id: 用户 ID
         :return:
         """
+        user_role_stmt = delete(user_role).where(user_role.c.user_id == user_id)
+        await db.execute(user_role_stmt)
+
+        try:
+            user_social = import_module_cached('backend.plugin.oauth2.crud.crud_user_social')
+            user_social_dao = user_social.user_social_dao
+        except (ImportError, AttributeError):
+            pass
+        else:
+            await user_social_dao.delete_by_user_id(db, user_id)
+
         return await self.delete_model(db, user_id)
 
-    async def check_email(self, db: AsyncSession, email: str) -> User | None:
+    async def get_join(
+        self,
+        db: AsyncSession,
+        *,
+        user_id: int | None = None,
+        username: str | None = None,
+    ) -> Any | None:
         """
-        检查邮箱是否存在
+        获取用户关联信息
 
-        :param db:
-        :param email:
+        :param db: 数据库会话
+        :param user_id: 用户 ID
+        :param username: 用户名
         :return:
         """
-        return await self.select_model_by_column(db, email=email)
+        filters = {}
 
-    async def reset_password(self, db: AsyncSession, pk: int, new_pwd: str) -> int:
-        """
-        重置用户密码
-
-        :param db:
-        :param pk:
-        :param new_pwd:
-        :return:
-        """
-        return await self.update_model(db, pk, {'password': new_pwd})
-
-    async def get_list(self, dept: int = None, username: str = None, phone: str = None, status: int = None) -> Select:
-        """
-        获取用户列表
-
-        :param dept:
-        :param username:
-        :param phone:
-        :param status:
-        :return:
-        """
-        stmt = (
-            select(self.model)
-            .options(
-                selectinload(self.model.dept).options(noload(Dept.parent), noload(Dept.children), noload(Dept.users)),
-                noload(self.model.socials),
-                selectinload(self.model.roles).options(noload(Role.users), noload(Role.menus), noload(Role.rules)),
-            )
-            .order_by(desc(self.model.join_time))
-        )
-        where_list = []
-        if dept:
-            where_list.append(self.model.dept_id == dept)
-        if username:
-            where_list.append(self.model.username.like(f'%{username}%'))
-        if phone:
-            where_list.append(self.model.phone.like(f'%{phone}%'))
-        if status is not None:
-            where_list.append(self.model.status == status)
-        if where_list:
-            stmt = stmt.where(and_(*where_list))
-        return stmt
-
-    async def get_super(self, db: AsyncSession, user_id: int) -> bool:
-        """
-        获取用户超级管理员状态
-
-        :param db:
-        :param user_id:
-        :return:
-        """
-        user = await self.get(db, user_id)
-        return user.is_superuser
-
-    async def get_staff(self, db: AsyncSession, user_id: int) -> bool:
-        """
-        获取用户后台登录状态
-
-        :param db:
-        :param user_id:
-        :return:
-        """
-        user = await self.get(db, user_id)
-        return user.is_staff
-
-    async def get_status(self, db: AsyncSession, user_id: int) -> int:
-        """
-        获取用户状态
-
-        :param db:
-        :param user_id:
-        :return:
-        """
-        user = await self.get(db, user_id)
-        return user.status
-
-    async def get_multi_login(self, db: AsyncSession, user_id: int) -> bool:
-        """
-        获取用户多点登录状态
-
-        :param db:
-        :param user_id:
-        :return:
-        """
-        user = await self.get(db, user_id)
-        return user.is_multi_login
-
-    async def set_super(self, db: AsyncSession, user_id: int, _super: bool) -> int:
-        """
-        设置用户超级管理员
-
-        :param db:
-        :param user_id:
-        :param _super:
-        :return:
-        """
-        return await self.update_model(db, user_id, {'is_superuser': _super})
-
-    async def set_staff(self, db: AsyncSession, user_id: int, staff: bool) -> int:
-        """
-        设置用户后台登录
-
-        :param db:
-        :param user_id:
-        :param staff:
-        :return:
-        """
-        return await self.update_model(db, user_id, {'is_staff': staff})
-
-    async def set_status(self, db: AsyncSession, user_id: int, status: bool) -> int:
-        """
-        设置用户状态
-
-        :param db:
-        :param user_id:
-        :param status:
-        :return:
-        """
-        return await self.update_model(db, user_id, {'status': status})
-
-    async def set_multi_login(self, db: AsyncSession, user_id: int, multi_login: bool) -> int:
-        """
-        设置用户多点登录
-
-        :param db:
-        :param user_id:
-        :param multi_login:
-        :return:
-        """
-        return await self.update_model(db, user_id, {'is_multi_login': multi_login})
-
-    async def get_with_relation(self, db: AsyncSession, *, user_id: int = None, username: str = None) -> User | None:
-        """
-        获取用户和（部门，角色，菜单，规则）
-
-        :param db:
-        :param user_id:
-        :param username:
-        :return:
-        """
-        stmt = select(self.model).options(
-            selectinload(self.model.dept),
-            selectinload(self.model.roles).options(
-                selectinload(Role.menus),
-                selectinload(Role.rules),
-            ),
-        )
-        filters = []
         if user_id:
-            filters.append(self.model.id == user_id)
+            filters['id'] = user_id
         if username:
-            filters.append(self.model.username == username)
-        user = await db.execute(stmt.where(*filters))
-        return user.scalars().first()
+            filters['username'] = username
+
+        result = await self.select_models(
+            db,
+            join_conditions=[
+                JoinConfig(model=Dept, join_on=Dept.id == self.model.dept_id, fill_result=True),
+                JoinConfig(model=user_role, join_on=user_role.c.user_id == self.model.id),
+                JoinConfig(model=Role, join_on=Role.id == user_role.c.role_id, fill_result=True),
+                JoinConfig(model=role_menu, join_on=role_menu.c.role_id == Role.id),
+                JoinConfig(model=Menu, join_on=Menu.id == role_menu.c.menu_id, fill_result=True),
+                JoinConfig(model=role_data_scope, join_on=role_data_scope.c.role_id == Role.id),
+                JoinConfig(model=DataScope, join_on=DataScope.id == role_data_scope.c.data_scope_id, fill_result=True),
+                JoinConfig(model=data_scope_rule, join_on=data_scope_rule.c.data_scope_id == DataScope.id),
+                JoinConfig(model=DataRule, join_on=DataRule.id == data_scope_rule.c.data_rule_id, fill_result=True),
+            ],
+            **filters,
+        )
+
+        return select_join_serialize(
+            result,
+            relationships=[
+                'User-m2o-Dept',
+                'User-m2m-Role',
+                'Role-m2m-Menu',
+                'Role-m2m-DataScope:scopes',
+                'DataScope-m2m-DataRule:rules',
+            ],
+        )
 
 
 user_dao: CRUDUser = CRUDUser(User)

backend/app/admin/crud/crud_user_password_history.py

@@ -0,0 +1,34 @@
+from collections.abc import Sequence
+
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy_crud_plus import CRUDPlus
+
+from backend.app.admin.model.user_password_history import UserPasswordHistory
+from backend.app.admin.schema.user_password_history import CreateUserPasswordHistoryParam
+
+
+class CRUDUserPasswordHistory(CRUDPlus[UserPasswordHistory]):
+    """用户密码历史记录数据库操作类"""
+
+    async def create(self, db: AsyncSession, obj: CreateUserPasswordHistoryParam) -> None:
+        """
+        创建密码历史记录
+
+        :param db: 数据库会话
+        :param obj: 创建密码历史记录参数
+        :return:
+        """
+        await self.create_model(db, obj)
+
+    async def get_by_user_id(self, db: AsyncSession, user_id: int) -> Sequence[UserPasswordHistory]:
+        """
+        获取用户的密码历史记录
+
+        :param db: 数据库会话
+        :param user_id: 用户 ID
+        :return:
+        """
+        return await self.select_models_order(db, 'id', 'desc', self.model.user_id == user_id)
+
+
+user_password_history_dao: CRUDUserPasswordHistory = CRUDUserPasswordHistory(UserPasswordHistory)

backend/app/admin/crud/crud_user_social.py

@@ -1,44 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy_crud_plus import CRUDPlus
-
-from backend.app.admin.model import UserSocial
-from backend.app.admin.schema.user_social import CreateUserSocialParam
-from backend.common.enums import UserSocialType
-
-
-class CRUDOUserSocial(CRUDPlus[UserSocial]):
-    async def get(self, db: AsyncSession, pk: int, source: UserSocialType) -> UserSocial | None:
-        """
-        获取用户社交账号绑定
-
-        :param db:
-        :param pk:
-        :param source:
-        :return:
-        """
-        return await self.select_model_by_column(db, user_id=pk, source=source)
-
-    async def create(self, db: AsyncSession, obj_in: CreateUserSocialParam) -> None:
-        """
-        创建用户社交账号绑定
-
-        :param db:
-        :param obj_in:
-        :return:
-        """
-        await self.create_model(db, obj_in)
-
-    async def delete(self, db: AsyncSession, social_id: int) -> int:
-        """
-        删除用户社交账号绑定
-
-        :param db:
-        :param social_id:
-        :return:
-        """
-        return await self.delete_model(db, social_id)
-
-
-user_social_dao: CRUDOUserSocial = CRUDOUserSocial(UserSocial)

backend/app/admin/model/__init__.py

@@ -1,13 +1,13 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from backend.app.admin.model.config import Config
-from backend.app.admin.model.data_rule import DataRule
-from backend.app.admin.model.dept import Dept
-from backend.app.admin.model.dict_data import DictData
-from backend.app.admin.model.dict_type import DictType
-from backend.app.admin.model.login_log import LoginLog
-from backend.app.admin.model.menu import Menu
-from backend.app.admin.model.opera_log import OperaLog
-from backend.app.admin.model.role import Role
-from backend.app.admin.model.user import User
-from backend.app.admin.model.user_social import UserSocial
+from backend.app.admin.model.data_rule import DataRule as DataRule
+from backend.app.admin.model.data_scope import DataScope as DataScope
+from backend.app.admin.model.dept import Dept as Dept
+from backend.app.admin.model.login_log import LoginLog as LoginLog
+from backend.app.admin.model.m2m import data_scope_rule as data_scope_rule
+from backend.app.admin.model.m2m import role_data_scope as role_data_scope
+from backend.app.admin.model.m2m import role_menu as role_menu
+from backend.app.admin.model.m2m import user_role as user_role
+from backend.app.admin.model.menu import Menu as Menu
+from backend.app.admin.model.opera_log import OperaLog as OperaLog
+from backend.app.admin.model.role import Role as Role
+from backend.app.admin.model.user import User as User
+from backend.app.admin.model.user_password_history import UserPasswordHistory as UserPasswordHistory

backend/app/admin/model/config.py

@@ -1,26 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from sqlalchemy import Boolean, String
-from sqlalchemy.dialects.mysql import LONGTEXT
-from sqlalchemy.dialects.postgresql import INTEGER, TEXT
-from sqlalchemy.orm import Mapped, mapped_column
-
-from backend.common.model import Base, id_key
-
-
-class Config(Base):
-    """系统配置表"""
-
-    __tablename__ = 'sys_config'
-
-    id: Mapped[id_key] = mapped_column(init=False)
-    name: Mapped[str] = mapped_column(String(20), comment='名称')
-    type: Mapped[str | None] = mapped_column(String(20), server_default=None, comment='类型')
-    key: Mapped[str] = mapped_column(String(50), unique=True, comment='键名')
-    value: Mapped[str] = mapped_column(LONGTEXT().with_variant(TEXT, 'postgresql'), comment='键值')
-    is_frontend: Mapped[bool] = mapped_column(
-        Boolean().with_variant(INTEGER, 'postgresql'), default=False, comment='是否前端'
-    )
-    remark: Mapped[str | None] = mapped_column(
-        LONGTEXT().with_variant(TEXT, 'postgresql'), default=None, comment='备注'
-    )

backend/app/admin/model/data_rule.py

@@ -1,26 +1,21 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from sqlalchemy import String
-from sqlalchemy.orm import Mapped, mapped_column, relationship
+import sqlalchemy as sa
+
+from sqlalchemy.orm import Mapped, mapped_column
 
-from backend.app.admin.model.m2m import sys_role_data_rule
 from backend.common.model import Base, id_key
 
 
 class DataRule(Base):
-    """数据权限规则表"""
+    """数据规则表"""
 
     __tablename__ = 'sys_data_rule'
 
     id: Mapped[id_key] = mapped_column(init=False)
-    name: Mapped[str] = mapped_column(String(255), unique=True, comment='规则名称')
-    model: Mapped[str] = mapped_column(String(50), comment='SQLA 模型类')
-    column: Mapped[str] = mapped_column(String(20), comment='数据库字段')
+    name: Mapped[str] = mapped_column(sa.String(512), unique=True, comment='名称')
+    model: Mapped[str] = mapped_column(sa.String(64), comment='模型名称')
+    column: Mapped[str] = mapped_column(sa.String(32), comment='模型字段名')
     operator: Mapped[int] = mapped_column(comment='运算符（0：and、1：or）')
     expression: Mapped[int] = mapped_column(
-        comment='表达式（0：==、1：!=、2：>、3：>=、4：<、5：<=、6：in、7：not_in）'
+        comment='表达式（0：==、1：!=、2：>、3：>=、4：<、5：<=、6：in、7：not_in）',
     )
-    value: Mapped[str] = mapped_column(String(255), comment='规则值')
-
-    # 角色规则多对多
-    roles: Mapped[list['Role']] = relationship(init=False, secondary=sys_role_data_rule, back_populates='rules')  # noqa: F821
+    value: Mapped[str] = mapped_column(sa.String(256), comment='规则值')

backend/app/admin/model/data_scope.py

@@ -0,0 +1,15 @@
+import sqlalchemy as sa
+
+from sqlalchemy.orm import Mapped, mapped_column
+
+from backend.common.model import Base, id_key
+
+
+class DataScope(Base):
+    """数据范围表"""
+
+    __tablename__ = 'sys_data_scope'
+
+    id: Mapped[id_key] = mapped_column(init=False)
+    name: Mapped[str] = mapped_column(sa.String(64), unique=True, comment='名称')
+    status: Mapped[int] = mapped_column(default=1, comment='状态（0停用 1正常）')

backend/app/admin/model/dept.py

@@ -1,10 +1,6 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from typing import Union
+import sqlalchemy as sa
 
-from sqlalchemy import Boolean, ForeignKey, String
-from sqlalchemy.dialects.postgresql import INTEGER
-from sqlalchemy.orm import Mapped, mapped_column, relationship
+from sqlalchemy.orm import Mapped, mapped_column
 
 from backend.common.model import Base, id_key
 
@@ -15,22 +11,13 @@ class Dept(Base):
     __tablename__ = 'sys_dept'
 
     id: Mapped[id_key] = mapped_column(init=False)
-    name: Mapped[str] = mapped_column(String(50), comment='部门名称')
+    name: Mapped[str] = mapped_column(sa.String(64), comment='部门名称')
     sort: Mapped[int] = mapped_column(default=0, comment='排序')
-    leader: Mapped[str | None] = mapped_column(String(20), default=None, comment='负责人')
-    phone: Mapped[str | None] = mapped_column(String(11), default=None, comment='手机')
-    email: Mapped[str | None] = mapped_column(String(50), default=None, comment='邮箱')
+    leader: Mapped[str | None] = mapped_column(sa.String(32), default=None, comment='负责人')
+    phone: Mapped[str | None] = mapped_column(sa.String(11), default=None, comment='手机')
+    email: Mapped[str | None] = mapped_column(sa.String(64), default=None, comment='邮箱')
     status: Mapped[int] = mapped_column(default=1, comment='部门状态(0停用 1正常)')
-    del_flag: Mapped[bool] = mapped_column(
-        Boolean().with_variant(INTEGER, 'postgresql'), default=False, comment='删除标志（0删除 1存在）'
-    )
+    del_flag: Mapped[bool] = mapped_column(default=False, comment='删除标志（0删除 1存在）')
 
-    # 父级部门一对多
-    parent_id: Mapped[int | None] = mapped_column(
-        ForeignKey('sys_dept.id', ondelete='SET NULL'), default=None, index=True, comment='父部门ID'
-    )
-    parent: Mapped[Union['Dept', None]] = relationship(init=False, back_populates='children', remote_side=[id])
-    children: Mapped[list['Dept'] | None] = relationship(init=False, back_populates='parent')
-
-    # 部门用户一对多
-    users: Mapped[list['User']] = relationship(init=False, back_populates='dept')  # noqa: F821
+    # 父级部门
+    parent_id: Mapped[int | None] = mapped_column(sa.BigInteger, default=None, index=True, comment='父部门ID')

backend/app/admin/model/dict_data.py

@@ -1,29 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from sqlalchemy import ForeignKey, String
-from sqlalchemy.dialects.mysql import LONGTEXT
-from sqlalchemy.dialects.postgresql import TEXT
-from sqlalchemy.orm import Mapped, mapped_column, relationship
-
-from backend.common.model import Base, id_key
-
-
-class DictData(Base):
-    """字典数据"""
-
-    __tablename__ = 'sys_dict_data'
-
-    id: Mapped[id_key] = mapped_column(init=False)
-    label: Mapped[str] = mapped_column(String(32), unique=True, comment='字典标签')
-    value: Mapped[str] = mapped_column(String(32), unique=True, comment='字典值')
-    sort: Mapped[int] = mapped_column(default=0, comment='排序')
-    status: Mapped[int] = mapped_column(default=1, comment='状态（0停用 1正常）')
-    remark: Mapped[str | None] = mapped_column(
-        LONGTEXT().with_variant(TEXT, 'postgresql'), default=None, comment='备注'
-    )
-
-    # 字典类型一对多
-    type_id: Mapped[int] = mapped_column(
-        ForeignKey('sys_dict_type.id', ondelete='CASCADE'), default=0, comment='字典类型关联ID'
-    )
-    type: Mapped['DictType'] = relationship(init=False, back_populates='datas')  # noqa: F821

backend/app/admin/model/dict_type.py

@@ -1,25 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from sqlalchemy import String
-from sqlalchemy.dialects.mysql import LONGTEXT
-from sqlalchemy.dialects.postgresql import TEXT
-from sqlalchemy.orm import Mapped, mapped_column, relationship
-
-from backend.common.model import Base, id_key
-
-
-class DictType(Base):
-    """字典类型"""
-
-    __tablename__ = 'sys_dict_type'
-
-    id: Mapped[id_key] = mapped_column(init=False)
-    name: Mapped[str] = mapped_column(String(32), unique=True, comment='字典类型名称')
-    code: Mapped[str] = mapped_column(String(32), unique=True, comment='字典类型编码')
-    status: Mapped[int] = mapped_column(default=1, comment='状态（0停用 1正常）')
-    remark: Mapped[str | None] = mapped_column(
-        LONGTEXT().with_variant(TEXT, 'postgresql'), default=None, comment='备注'
-    )
-
-    # 字典类型一对多
-    datas: Mapped[list['DictData']] = relationship(init=False, back_populates='type')  # noqa: F821

backend/app/admin/model/login_log.py

@@ -1,13 +1,10 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from datetime import datetime
 
-from sqlalchemy import DateTime, String
-from sqlalchemy.dialects.mysql import LONGTEXT
-from sqlalchemy.dialects.postgresql import TEXT
+import sqlalchemy as sa
+
 from sqlalchemy.orm import Mapped, mapped_column
 
-from backend.common.model import DataClassBase, id_key
+from backend.common.model import DataClassBase, TimeZone, UniversalText, id_key
 from backend.utils.timezone import timezone
 
 
@@ -17,19 +14,22 @@ class LoginLog(DataClassBase):
     __tablename__ = 'sys_login_log'
 
     id: Mapped[id_key] = mapped_column(init=False)
-    user_uuid: Mapped[str] = mapped_column(String(50), comment='用户UUID')
-    username: Mapped[str] = mapped_column(String(20), comment='用户名')
+    user_uuid: Mapped[str] = mapped_column(sa.String(64), comment='用户UUID')
+    username: Mapped[str] = mapped_column(sa.String(64), comment='用户名')
     status: Mapped[int] = mapped_column(insert_default=0, comment='登录状态(0失败 1成功)')
-    ip: Mapped[str] = mapped_column(String(50), comment='登录IP地址')
-    country: Mapped[str | None] = mapped_column(String(50), comment='国家')
-    region: Mapped[str | None] = mapped_column(String(50), comment='地区')
-    city: Mapped[str | None] = mapped_column(String(50), comment='城市')
-    user_agent: Mapped[str] = mapped_column(String(255), comment='请求头')
-    os: Mapped[str | None] = mapped_column(String(50), comment='操作系统')
-    browser: Mapped[str | None] = mapped_column(String(50), comment='浏览器')
-    device: Mapped[str | None] = mapped_column(String(50), comment='设备')
-    msg: Mapped[str] = mapped_column(LONGTEXT().with_variant(TEXT, 'postgresql'), comment='提示消息')
-    login_time: Mapped[datetime] = mapped_column(DateTime(timezone=True), comment='登录时间')
+    ip: Mapped[str] = mapped_column(sa.String(64), comment='登录IP地址')
+    country: Mapped[str | None] = mapped_column(sa.String(64), comment='国家')
+    region: Mapped[str | None] = mapped_column(sa.String(64), comment='地区')
+    city: Mapped[str | None] = mapped_column(sa.String(64), comment='城市')
+    user_agent: Mapped[str | None] = mapped_column(sa.String(256), comment='请求头')
+    os: Mapped[str | None] = mapped_column(sa.String(64), comment='操作系统')
+    browser: Mapped[str | None] = mapped_column(sa.String(64), comment='浏览器')
+    device: Mapped[str | None] = mapped_column(sa.String(64), comment='设备')
+    msg: Mapped[str] = mapped_column(UniversalText, comment='提示消息')
+    login_time: Mapped[datetime] = mapped_column(TimeZone, comment='登录时间')
     created_time: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), init=False, default_factory=timezone.now, comment='创建时间'
+        TimeZone,
+        init=False,
+        default_factory=timezone.now,
+        comment='创建时间',
     )

backend/app/admin/model/m2m.py

@@ -1,35 +1,39 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from sqlalchemy import INT, Column, ForeignKey, Integer, Table
+import sqlalchemy as sa
 
 from backend.common.model import MappedBase
 
-sys_user_role = Table(
+# 用户角色表
+user_role = sa.Table(
     'sys_user_role',
     MappedBase.metadata,
-    Column('id', INT, primary_key=True, unique=True, index=True, autoincrement=True, comment='主键ID'),
-    Column('user_id', Integer, ForeignKey('sys_user.id', ondelete='CASCADE'), primary_key=True, comment='用户ID'),
-    Column('role_id', Integer, ForeignKey('sys_role.id', ondelete='CASCADE'), primary_key=True, comment='角色ID'),
+    sa.Column('id', sa.BigInteger, primary_key=True, unique=True, index=True, autoincrement=True, comment='主键ID'),
+    sa.Column('user_id', sa.BigInteger, primary_key=True, comment='用户ID'),
+    sa.Column('role_id', sa.BigInteger, primary_key=True, comment='角色ID'),
 )
 
-sys_role_menu = Table(
+# 角色菜单表
+role_menu = sa.Table(
     'sys_role_menu',
     MappedBase.metadata,
-    Column('id', INT, primary_key=True, unique=True, index=True, autoincrement=True, comment='主键ID'),
-    Column('role_id', Integer, ForeignKey('sys_role.id', ondelete='CASCADE'), primary_key=True, comment='角色ID'),
-    Column('menu_id', Integer, ForeignKey('sys_menu.id', ondelete='CASCADE'), primary_key=True, comment='菜单ID'),
+    sa.Column('id', sa.BigInteger, primary_key=True, unique=True, index=True, autoincrement=True, comment='主键ID'),
+    sa.Column('role_id', sa.BigInteger, primary_key=True, comment='角色ID'),
+    sa.Column('menu_id', sa.BigInteger, primary_key=True, comment='菜单ID'),
 )
 
-sys_role_data_rule = Table(
-    'sys_role_data_rule',
+# 角色数据范围表
+role_data_scope = sa.Table(
+    'sys_role_data_scope',
     MappedBase.metadata,
-    Column('id', INT, primary_key=True, unique=True, index=True, autoincrement=True, comment='主键ID'),
-    Column('role_id', Integer, ForeignKey('sys_role.id', ondelete='CASCADE'), primary_key=True, comment='角色ID'),
-    Column(
-        'data_rule_id',
-        Integer,
-        ForeignKey('sys_data_rule.id', ondelete='CASCADE'),
-        primary_key=True,
-        comment='数据权限规则ID',
-    ),
+    sa.Column('id', sa.BigInteger, primary_key=True, unique=True, index=True, autoincrement=True, comment='主键 ID'),
+    sa.Column('role_id', sa.BigInteger, primary_key=True, comment='角色 ID'),
+    sa.Column('data_scope_id', sa.BigInteger, primary_key=True, comment='数据范围 ID'),
+)
+
+# 数据范围规则表
+data_scope_rule = sa.Table(
+    'sys_data_scope_rule',
+    MappedBase.metadata,
+    sa.Column('id', sa.BigInteger, primary_key=True, unique=True, index=True, autoincrement=True, comment='主键ID'),
+    sa.Column('data_scope_id', sa.BigInteger, primary_key=True, comment='数据范围 ID'),
+    sa.Column('data_rule_id', sa.BigInteger, primary_key=True, comment='数据规则 ID'),
 )

backend/app/admin/model/menu.py

@@ -1,14 +1,8 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from typing import Union
+import sqlalchemy as sa
 
-from sqlalchemy import ForeignKey, String
-from sqlalchemy.dialects.mysql import LONGTEXT
-from sqlalchemy.dialects.postgresql import TEXT
-from sqlalchemy.orm import Mapped, mapped_column, relationship
+from sqlalchemy.orm import Mapped, mapped_column
 
-from backend.app.admin.model.m2m import sys_role_menu
-from backend.common.model import Base, id_key
+from backend.common.model import Base, UniversalText, id_key
 
 
 class Menu(Base):
@@ -17,27 +11,19 @@ class Menu(Base):
     __tablename__ = 'sys_menu'
 
     id: Mapped[id_key] = mapped_column(init=False)
-    title: Mapped[str] = mapped_column(String(50), comment='菜单标题')
-    name: Mapped[str] = mapped_column(String(50), comment='菜单名称')
+    title: Mapped[str] = mapped_column(sa.String(64), comment='菜单标题')
+    name: Mapped[str] = mapped_column(sa.String(64), comment='菜单名称')
+    path: Mapped[str | None] = mapped_column(sa.String(200), comment='路由地址')
     sort: Mapped[int] = mapped_column(default=0, comment='排序')
-    icon: Mapped[str | None] = mapped_column(String(100), default=None, comment='菜单图标')
-    path: Mapped[str | None] = mapped_column(String(200), default=None, comment='路由地址')
-    menu_type: Mapped[int] = mapped_column(default=0, comment='菜单类型（0目录 1菜单 2按钮）')
-    component: Mapped[str | None] = mapped_column(String(255), default=None, comment='组件路径')
-    perms: Mapped[str | None] = mapped_column(String(100), default=None, comment='权限标识')
+    icon: Mapped[str | None] = mapped_column(sa.String(128), default=None, comment='菜单图标')
+    type: Mapped[int] = mapped_column(default=0, comment='菜单类型（0目录 1菜单 2按钮 3内嵌 4外链）')
+    component: Mapped[str | None] = mapped_column(sa.String(256), default=None, comment='组件路径')
+    perms: Mapped[str | None] = mapped_column(sa.String(128), default=None, comment='权限标识')
     status: Mapped[int] = mapped_column(default=1, comment='菜单状态（0停用 1正常）')
     display: Mapped[int] = mapped_column(default=1, comment='是否显示（0否 1是）')
     cache: Mapped[int] = mapped_column(default=1, comment='是否缓存（0否 1是）')
-    remark: Mapped[str | None] = mapped_column(
-        LONGTEXT().with_variant(TEXT, 'postgresql'), default=None, comment='备注'
-    )
+    link: Mapped[str | None] = mapped_column(UniversalText, default=None, comment='外链地址')
+    remark: Mapped[str | None] = mapped_column(UniversalText, default=None, comment='备注')
 
-    # 父级菜单一对多
-    parent_id: Mapped[int | None] = mapped_column(
-        ForeignKey('sys_menu.id', ondelete='SET NULL'), default=None, index=True, comment='父菜单ID'
-    )
-    parent: Mapped[Union['Menu', None]] = relationship(init=False, back_populates='children', remote_side=[id])
-    children: Mapped[list['Menu'] | None] = relationship(init=False, back_populates='parent')
-
-    # 菜单角色多对多
-    roles: Mapped[list['Role']] = relationship(init=False, secondary=sys_role_menu, back_populates='menus')  # noqa: F821
+    # 父级菜单
+    parent_id: Mapped[int | None] = mapped_column(sa.BigInteger, default=None, index=True, comment='父菜单ID')

backend/app/admin/model/opera_log.py

@@ -1,12 +1,10 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from datetime import datetime
 
-from sqlalchemy import DateTime, String
-from sqlalchemy.dialects.mysql import JSON, LONGTEXT, TEXT
+import sqlalchemy as sa
+
 from sqlalchemy.orm import Mapped, mapped_column
 
-from backend.common.model import DataClassBase, id_key
+from backend.common.model import DataClassBase, TimeZone, UniversalText, id_key
 from backend.utils.timezone import timezone
 
 
@@ -16,25 +14,25 @@ class OperaLog(DataClassBase):
     __tablename__ = 'sys_opera_log'
 
     id: Mapped[id_key] = mapped_column(init=False)
-    trace_id: Mapped[str] = mapped_column(String(32), comment='请求跟踪 ID')
-    username: Mapped[str | None] = mapped_column(String(20), comment='用户名')
-    method: Mapped[str] = mapped_column(String(20), comment='请求类型')
-    title: Mapped[str] = mapped_column(String(255), comment='操作模块')
-    path: Mapped[str] = mapped_column(String(500), comment='请求路径')
-    ip: Mapped[str] = mapped_column(String(50), comment='IP地址')
-    country: Mapped[str | None] = mapped_column(String(50), comment='国家')
-    region: Mapped[str | None] = mapped_column(String(50), comment='地区')
-    city: Mapped[str | None] = mapped_column(String(50), comment='城市')
-    user_agent: Mapped[str] = mapped_column(String(255), comment='请求头')
-    os: Mapped[str | None] = mapped_column(String(50), comment='操作系统')
-    browser: Mapped[str | None] = mapped_column(String(50), comment='浏览器')
-    device: Mapped[str | None] = mapped_column(String(50), comment='设备')
-    args: Mapped[str | None] = mapped_column(JSON(), comment='请求参数')
+    trace_id: Mapped[str] = mapped_column(sa.String(32), comment='请求跟踪 ID')
+    username: Mapped[str | None] = mapped_column(sa.String(64), comment='用户名')
+    method: Mapped[str] = mapped_column(sa.String(32), comment='请求类型')
+    title: Mapped[str] = mapped_column(sa.String(256), comment='操作模块')
+    path: Mapped[str] = mapped_column(sa.String(512), comment='请求路径')
+    ip: Mapped[str] = mapped_column(sa.String(64), comment='IP地址')
+    country: Mapped[str | None] = mapped_column(sa.String(64), comment='国家')
+    region: Mapped[str | None] = mapped_column(sa.String(64), comment='地区')
+    city: Mapped[str | None] = mapped_column(sa.String(64), comment='城市')
+    user_agent: Mapped[str | None] = mapped_column(sa.String(512), comment='请求头')
+    os: Mapped[str | None] = mapped_column(sa.String(64), comment='操作系统')
+    browser: Mapped[str | None] = mapped_column(sa.String(64), comment='浏览器')
+    device: Mapped[str | None] = mapped_column(sa.String(64), comment='设备')
+    args: Mapped[str | None] = mapped_column(sa.JSON(), comment='请求参数')
     status: Mapped[int] = mapped_column(comment='操作状态（0异常 1正常）')
-    code: Mapped[str] = mapped_column(String(20), insert_default='200', comment='操作状态码')
-    msg: Mapped[str | None] = mapped_column(LONGTEXT().with_variant(TEXT, 'postgresql'), comment='提示消息')
+    code: Mapped[str] = mapped_column(sa.String(32), insert_default='200', comment='操作状态码')
+    msg: Mapped[str | None] = mapped_column(UniversalText, comment='提示消息')
     cost_time: Mapped[float] = mapped_column(insert_default=0.0, comment='请求耗时（ms）')
-    opera_time: Mapped[datetime] = mapped_column(DateTime(timezone=True), comment='操作时间')
+    opera_time: Mapped[datetime] = mapped_column(TimeZone, comment='操作时间')
     created_time: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), init=False, default_factory=timezone.now, comment='创建时间'
+        TimeZone, init=False, default_factory=timezone.now, comment='创建时间'
     )

backend/app/admin/model/role.py

@@ -1,12 +1,8 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from sqlalchemy import String
-from sqlalchemy.dialects.mysql import LONGTEXT
-from sqlalchemy.dialects.postgresql import TEXT
-from sqlalchemy.orm import Mapped, mapped_column, relationship
+import sqlalchemy as sa
 
-from backend.app.admin.model.m2m import sys_role_data_rule, sys_role_menu, sys_user_role
-from backend.common.model import Base, id_key
+from sqlalchemy.orm import Mapped, mapped_column
+
+from backend.common.model import Base, UniversalText, id_key
 
 
 class Role(Base):
@@ -15,17 +11,7 @@ class Role(Base):
     __tablename__ = 'sys_role'
 
     id: Mapped[id_key] = mapped_column(init=False)
-    name: Mapped[str] = mapped_column(String(20), unique=True, comment='角色名称')
+    name: Mapped[str] = mapped_column(sa.String(32), unique=True, comment='角色名称')
     status: Mapped[int] = mapped_column(default=1, comment='角色状态（0停用 1正常）')
-    remark: Mapped[str | None] = mapped_column(
-        LONGTEXT().with_variant(TEXT, 'postgresql'), default=None, comment='备注'
-    )
-
-    # 角色用户多对多
-    users: Mapped[list['User']] = relationship(init=False, secondary=sys_user_role, back_populates='roles')  # noqa: F821
-
-    # 角色菜单多对多
-    menus: Mapped[list['Menu']] = relationship(init=False, secondary=sys_role_menu, back_populates='roles')  # noqa: F821
-
-    # 角色数据权限规则多对多
-    rules: Mapped[list['DataRule']] = relationship(init=False, secondary=sys_role_data_rule, back_populates='roles')  # noqa: F821
+    is_filter_scopes: Mapped[bool] = mapped_column(default=True, comment='过滤数据权限(0否 1是)')
+    remark: Mapped[str | None] = mapped_column(UniversalText, default=None, comment='备注')

backend/app/admin/model/user.py

@@ -1,14 +1,10 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from datetime import datetime
-from typing import Union
 
-from sqlalchemy import VARBINARY, Boolean, DateTime, ForeignKey, String
-from sqlalchemy.dialects.postgresql import BYTEA, INTEGER
-from sqlalchemy.orm import Mapped, mapped_column, relationship
+import sqlalchemy as sa
 
-from backend.app.admin.model.m2m import sys_user_role
-from backend.common.model import Base, id_key
+from sqlalchemy.orm import Mapped, mapped_column
+
+from backend.common.model import Base, TimeZone, id_key
 from backend.database.db import uuid4_str
 from backend.utils.timezone import timezone
 
@@ -19,39 +15,25 @@ class User(Base):
     __tablename__ = 'sys_user'
 
     id: Mapped[id_key] = mapped_column(init=False)
-    uuid: Mapped[str] = mapped_column(String(50), init=False, default_factory=uuid4_str, unique=True)
-    username: Mapped[str] = mapped_column(String(20), unique=True, index=True, comment='用户名')
-    nickname: Mapped[str] = mapped_column(String(20), unique=True, comment='昵称')
-    password: Mapped[str | None] = mapped_column(String(255), comment='密码')
-    salt: Mapped[bytes | None] = mapped_column(VARBINARY(255).with_variant(BYTEA(255), 'postgresql'), comment='加密盐')
-    email: Mapped[str] = mapped_column(String(50), unique=True, index=True, comment='邮箱')
-    is_superuser: Mapped[bool] = mapped_column(
-        Boolean().with_variant(INTEGER, 'postgresql'), default=False, comment='超级权限(0否 1是)'
-    )
-    is_staff: Mapped[bool] = mapped_column(
-        Boolean().with_variant(INTEGER, 'postgresql'), default=False, comment='后台管理登陆(0否 1是)'
-    )
-    status: Mapped[int] = mapped_column(default=1, comment='用户账号状态(0停用 1正常)')
-    is_multi_login: Mapped[bool] = mapped_column(
-        Boolean().with_variant(INTEGER, 'postgresql'), default=False, comment='是否重复登陆(0否 1是)'
-    )
-    avatar: Mapped[str | None] = mapped_column(String(255), default=None, comment='头像')
-    phone: Mapped[str | None] = mapped_column(String(11), default=None, comment='手机号')
-    join_time: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), init=False, default_factory=timezone.now, comment='注册时间'
-    )
+    uuid: Mapped[str] = mapped_column(sa.String(64), init=False, default_factory=uuid4_str, unique=True)
+    username: Mapped[str] = mapped_column(sa.String(64), unique=True, index=True, comment='用户名')
+    nickname: Mapped[str] = mapped_column(sa.String(64), comment='昵称')
+    password: Mapped[str | None] = mapped_column(sa.String(256), comment='密码')
+    salt: Mapped[bytes | None] = mapped_column(sa.LargeBinary(255), comment='加密盐')
+    email: Mapped[str | None] = mapped_column(sa.String(256), default=None, unique=True, index=True, comment='邮箱')
+    phone: Mapped[str | None] = mapped_column(sa.String(11), default=None, comment='手机号')
+    avatar: Mapped[str | None] = mapped_column(sa.String(256), default=None, comment='头像')
+    status: Mapped[int] = mapped_column(default=1, index=True, comment='用户账号状态(0停用 1正常)')
+    is_superuser: Mapped[bool] = mapped_column(default=False, comment='超级权限(0否 1是)')
+    is_staff: Mapped[bool] = mapped_column(default=False, comment='后台管理登陆(0否 1是)')
+    is_multi_login: Mapped[bool] = mapped_column(default=False, comment='是否重复登陆(0否 1是)')
+    join_time: Mapped[datetime] = mapped_column(TimeZone, init=False, default_factory=timezone.now, comment='注册时间')
     last_login_time: Mapped[datetime | None] = mapped_column(
-        DateTime(timezone=True), init=False, onupdate=timezone.now, comment='上次登录'
+        TimeZone, init=False, onupdate=timezone.now, comment='上次登录时间'
+    )
+    last_password_changed_time: Mapped[datetime | None] = mapped_column(
+        TimeZone, init=False, default_factory=timezone.now, comment='上次密码变更时间'
     )
 
-    # 部门用户一对多
-    dept_id: Mapped[int | None] = mapped_column(
-        ForeignKey('sys_dept.id', ondelete='SET NULL'), default=None, comment='部门关联ID'
-    )
-    dept: Mapped[Union['Dept', None]] = relationship(init=False, back_populates='users')  # noqa: F821
-
-    # 用户社交信息一对多
-    socials: Mapped[list['UserSocial']] = relationship(init=False, back_populates='user')  # noqa: F821
-
-    # 用户角色多对多
-    roles: Mapped[list['Role']] = relationship(init=False, secondary=sys_user_role, back_populates='users')  # noqa: F821
+    # 逻辑外键
+    dept_id: Mapped[int | None] = mapped_column(sa.BigInteger, default=None, comment='部门关联ID')

backend/app/admin/model/user_password_history.py

@@ -0,0 +1,24 @@
+from datetime import datetime
+
+import sqlalchemy as sa
+
+from sqlalchemy.orm import Mapped, mapped_column
+
+from backend.common.model import DataClassBase, TimeZone, id_key
+from backend.utils.timezone import timezone
+
+
+class UserPasswordHistory(DataClassBase):
+    """用户密码历史记录表"""
+
+    __tablename__ = 'sys_user_password_history'
+
+    id: Mapped[id_key] = mapped_column(init=False)
+    user_id: Mapped[int] = mapped_column(sa.BigInteger, index=True, comment='用户 ID')
+    password: Mapped[str] = mapped_column(sa.String(256), comment='历史密码')
+    created_time: Mapped[datetime] = mapped_column(
+        TimeZone,
+        init=False,
+        default_factory=timezone.now,
+        comment='创建时间',
+    )

backend/app/admin/model/user_social.py

@@ -1,28 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from typing import Union
-
-from sqlalchemy import ForeignKey, String
-from sqlalchemy.orm import Mapped, mapped_column, relationship
-
-from backend.common.model import Base, id_key
-
-
-class UserSocial(Base):
-    """用户社交表（OAuth2）"""
-
-    __tablename__ = 'sys_user_social'
-
-    id: Mapped[id_key] = mapped_column(init=False)
-    source: Mapped[str] = mapped_column(String(20), comment='第三方用户来源')
-    open_id: Mapped[str | None] = mapped_column(String(20), default=None, comment='第三方用户的 open id')
-    uid: Mapped[str | None] = mapped_column(String(20), default=None, comment='第三方用户的 ID')
-    union_id: Mapped[str | None] = mapped_column(String(20), default=None, comment='第三方用户的 union id')
-    scope: Mapped[str | None] = mapped_column(String(120), default=None, comment='第三方用户授予的权限')
-    code: Mapped[str | None] = mapped_column(String(50), default=None, comment='用户的授权 code')
-
-    # 用户社交信息一对多
-    user_id: Mapped[int | None] = mapped_column(
-        ForeignKey('sys_user.id', ondelete='SET NULL'), default=None, comment='用户关联ID'
-    )
-    user: Mapped[Union['User', None]] = relationship(init=False, back_populates='socials')  # noqa: F821

backend/app/admin/schema/__init__.py

@@ -1,2 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-

backend/app/admin/schema/captcha.py

@@ -1,10 +1,12 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from pydantic import Field
 
 from backend.common.schema import SchemaBase
 
 
 class GetCaptchaDetail(SchemaBase):
-    image_type: str = Field(description='图片类型')
+    """验证码详情"""
+
+    is_enabled: bool = Field(description='是否启用')
+    expire_seconds: int = Field(description='过期秒数')
+    uuid: str = Field(description='图片唯一标识')
     image: str = Field(description='图片内容')

backend/app/admin/schema/config.py

@@ -1,38 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from datetime import datetime
-
-from pydantic import ConfigDict
-
-from backend.common.schema import SchemaBase
-
-
-class SaveBuiltInConfigParam(SchemaBase):
-    name: str
-    key: str
-    value: str
-
-
-class ConfigSchemaBase(SchemaBase):
-    name: str
-    type: str | None
-    key: str
-    value: str
-    is_frontend: bool
-    remark: str | None
-
-
-class CreateConfigParam(ConfigSchemaBase):
-    pass
-
-
-class UpdateConfigParam(ConfigSchemaBase):
-    pass
-
-
-class GetConfigDetail(ConfigSchemaBase):
-    model_config = ConfigDict(from_attributes=True)
-
-    id: int
-    created_time: datetime
-    updated_time: datetime | None = None

backend/app/admin/schema/data_rule.py

@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from datetime import datetime
 
 from pydantic import ConfigDict, Field
@@ -9,28 +7,42 @@ from backend.common.schema import SchemaBase
 
 
 class DataRuleSchemaBase(SchemaBase):
-    name: str
-    model: str
-    column: str
-    operator: RoleDataRuleOperatorType = Field(RoleDataRuleOperatorType.OR)
-    expression: RoleDataRuleExpressionType = Field(RoleDataRuleExpressionType.eq)
-    value: str
+    """数据规则基础模型"""
+
+    name: str = Field(description='规则名称')
+    model: str = Field(description='模型名称')
+    column: str = Field(description='字段名称')
+    operator: RoleDataRuleOperatorType = Field(description='操作符（AND/OR）')
+    expression: RoleDataRuleExpressionType = Field(description='表达式类型')
+    value: str = Field(description='规则值')
 
 
 class CreateDataRuleParam(DataRuleSchemaBase):
-    pass
+    """创建数据规则参数"""
 
 
 class UpdateDataRuleParam(DataRuleSchemaBase):
-    pass
+    """更新数据规则参数"""
+
+
+class DeleteDataRuleParam(SchemaBase):
+    """删除数据规则参数"""
+
+    pks: list[int] = Field(description='规则 ID 列表')
 
 
 class GetDataRuleDetail(DataRuleSchemaBase):
-    model_config = ConfigDict(from_attributes=True)
+    """数据规则详情"""
 
-    id: int
-    created_time: datetime
-    updated_time: datetime | None = None
+    model_config = ConfigDict(from_attributes=True, frozen=True)
 
-    def __hash__(self):
-        return hash(self.name)
+    id: int = Field(description='规则 ID')
+    created_time: datetime = Field(description='创建时间')
+    updated_time: datetime | None = Field(None, description='更新时间')
+
+
+class GetDataRuleColumnDetail(SchemaBase):
+    """数据规则可用模型字段详情"""
+
+    key: str = Field(description='字段名')
+    comment: str | None = Field(description='字段评论')

backend/app/admin/schema/data_scope.py

@@ -0,0 +1,57 @@
+from datetime import datetime
+
+from pydantic import ConfigDict, Field
+
+from backend.app.admin.schema.data_rule import GetDataRuleDetail
+from backend.common.enums import StatusType
+from backend.common.schema import SchemaBase
+
+
+class DataScopeBase(SchemaBase):
+    """数据范围基础模型"""
+
+    name: str = Field(description='名称')
+    status: StatusType = Field(description='状态')
+
+
+class CreateDataScopeParam(DataScopeBase):
+    """创建数据范围参数"""
+
+
+class UpdateDataScopeParam(DataScopeBase):
+    """更新数据范围参数"""
+
+
+class CreateDataScopeRuleParam(SchemaBase):
+    """创建数据范围规则参数"""
+
+    data_scope_id: int = Field(description='数据范围 ID')
+    data_rule_id: int = Field(description='数据规则 ID')
+
+
+class UpdateDataScopeRuleParam(SchemaBase):
+    """更新数据范围规则参数"""
+
+    rules: list[int] = Field(description='数据规则 ID 列表')
+
+
+class DeleteDataScopeParam(SchemaBase):
+    """删除数据范围参数"""
+
+    pks: list[int] = Field(description='数据范围 ID 列表')
+
+
+class GetDataScopeDetail(DataScopeBase):
+    """数据范围详情"""
+
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int = Field(description='数据范围 ID')
+    created_time: datetime = Field(description='创建时间')
+    updated_time: datetime | None = Field(None, description='更新时间')
+
+
+class GetDataScopeWithRelationDetail(GetDataScopeDetail):
+    """数据范围关联详情"""
+
+    rules: list[GetDataRuleDetail | None] = Field([], description='数据规则列表')

backend/app/admin/schema/dept.py

@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from datetime import datetime
 
 from pydantic import ConfigDict, Field
@@ -9,27 +7,37 @@ from backend.common.schema import CustomEmailStr, CustomPhoneNumber, SchemaBase
 
 
 class DeptSchemaBase(SchemaBase):
-    name: str
-    parent_id: int | None = Field(default=None, description='部门父级ID')
-    sort: int = Field(default=0, ge=0, description='排序')
-    leader: str | None = None
-    phone: CustomPhoneNumber | None = None
-    email: CustomEmailStr | None = None
-    status: StatusType = Field(default=StatusType.enable)
+    """部门基础模型"""
+
+    name: str = Field(description='部门名称')
+    parent_id: int | None = Field(None, description='部门父级 ID')
+    sort: int = Field(0, ge=0, description='排序')
+    leader: str | None = Field(None, description='负责人')
+    phone: CustomPhoneNumber | None = Field(None, description='联系电话')
+    email: CustomEmailStr | None = Field(None, description='邮箱')
+    status: StatusType = Field(description='状态')
 
 
 class CreateDeptParam(DeptSchemaBase):
-    pass
+    """创建部门参数"""
 
 
 class UpdateDeptParam(DeptSchemaBase):
-    pass
+    """更新部门参数"""
 
 
 class GetDeptDetail(DeptSchemaBase):
+    """部门详情"""
+
     model_config = ConfigDict(from_attributes=True)
 
-    id: int
-    del_flag: bool
-    created_time: datetime
-    updated_time: datetime | None = None
+    id: int = Field(description='部门 ID')
+    del_flag: bool = Field(description='是否删除')
+    created_time: datetime = Field(description='创建时间')
+    updated_time: datetime | None = Field(None, description='更新时间')
+
+
+class GetDeptTree(GetDeptDetail):
+    """获取部门树"""
+
+    children: list['GetDeptTree'] | None = Field(None, description='子菜单')

backend/app/admin/schema/dict_data.py

@@ -1,35 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from datetime import datetime
-
-from pydantic import ConfigDict, Field
-
-from backend.app.admin.schema.dict_type import GetDictTypeDetail
-from backend.common.enums import StatusType
-from backend.common.schema import SchemaBase
-
-
-class DictDataSchemaBase(SchemaBase):
-    type_id: int
-    label: str
-    value: str
-    sort: int
-    status: StatusType = Field(default=StatusType.enable)
-    remark: str | None = None
-
-
-class CreateDictDataParam(DictDataSchemaBase):
-    pass
-
-
-class UpdateDictDataParam(DictDataSchemaBase):
-    pass
-
-
-class GetDictDataDetail(DictDataSchemaBase):
-    model_config = ConfigDict(from_attributes=True)
-
-    id: int
-    type: GetDictTypeDetail | None = None
-    created_time: datetime
-    updated_time: datetime | None = None

backend/app/admin/schema/dict_type.py

@@ -1,31 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from datetime import datetime
-
-from pydantic import ConfigDict, Field
-
-from backend.common.enums import StatusType
-from backend.common.schema import SchemaBase
-
-
-class DictTypeSchemaBase(SchemaBase):
-    name: str
-    code: str
-    status: StatusType = Field(default=StatusType.enable)
-    remark: str | None = None
-
-
-class CreateDictTypeParam(DictTypeSchemaBase):
-    pass
-
-
-class UpdateDictTypeParam(DictTypeSchemaBase):
-    pass
-
-
-class GetDictTypeDetail(DictTypeSchemaBase):
-    model_config = ConfigDict(from_attributes=True)
-
-    id: int
-    created_time: datetime
-    updated_time: datetime | None = None

backend/app/admin/schema/login_log.py

@@ -1,38 +1,46 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from datetime import datetime
 
-from pydantic import ConfigDict
+from pydantic import ConfigDict, Field
 
 from backend.common.schema import SchemaBase
 
 
 class LoginLogSchemaBase(SchemaBase):
-    user_uuid: str
-    username: str
-    status: int
-    ip: str
-    country: str | None
-    region: str | None
-    city: str | None
-    user_agent: str
-    browser: str | None
-    os: str | None
-    device: str | None
-    msg: str
-    login_time: datetime
+    """登录日志基础模型"""
+
+    user_uuid: str = Field(description='用户 UUID')
+    username: str = Field(description='用户名')
+    status: int = Field(description='登录状态')
+    ip: str = Field(description='IP 地址')
+    country: str | None = Field(None, description='国家')
+    region: str | None = Field(None, description='地区')
+    city: str | None = Field(None, description='城市')
+    user_agent: str | None = Field(description='用户代理')
+    browser: str | None = Field(None, description='浏览器')
+    os: str | None = Field(None, description='操作系统')
+    device: str | None = Field(None, description='设备')
+    msg: str = Field(description='消息')
+    login_time: datetime = Field(description='登录时间')
 
 
 class CreateLoginLogParam(LoginLogSchemaBase):
-    pass
+    """创建登录日志参数"""
 
 
 class UpdateLoginLogParam(LoginLogSchemaBase):
-    pass
+    """更新登录日志参数"""
+
+
+class DeleteLoginLogParam(SchemaBase):
+    """删除登录日志参数"""
+
+    pks: list[int] = Field(description='登录日志 ID 列表')
 
 
 class GetLoginLogDetail(LoginLogSchemaBase):
+    """登录日志详情"""
+
     model_config = ConfigDict(from_attributes=True)
 
-    id: int
-    created_time: datetime
+    id: int = Field(description='日志 ID')
+    created_time: datetime = Field(description='创建时间')

backend/app/admin/schema/menu.py

@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from datetime import datetime
 
 from pydantic import ConfigDict, Field
@@ -9,32 +7,43 @@ from backend.common.schema import SchemaBase
 
 
 class MenuSchemaBase(SchemaBase):
-    title: str
-    name: str
-    parent_id: int | None = Field(default=None, description='菜单父级ID')
-    sort: int = Field(default=0, ge=0, description='排序')
-    icon: str | None = None
-    path: str | None = None
-    menu_type: MenuType = Field(default=MenuType.directory, description='菜单类型（0目录 1菜单 2按钮）')
-    component: str | None = None
-    perms: str | None = None
-    status: StatusType = Field(default=StatusType.enable)
-    display: StatusType = Field(default=StatusType.enable)
-    cache: StatusType = Field(default=StatusType.enable)
-    remark: str | None = None
+    """菜单基础模型"""
+
+    title: str = Field(description='菜单标题')
+    name: str = Field(description='菜单名称')
+    path: str | None = Field(None, description='路由地址')
+    parent_id: int | None = Field(None, description='菜单父级 ID')
+    sort: int = Field(0, ge=0, description='排序')
+    icon: str | None = Field(None, description='图标')
+    type: MenuType = Field(description='菜单类型（0目录 1菜单 2按钮 3内嵌 4外链）')
+    component: str | None = Field(None, description='组件路径')
+    perms: str | None = Field(None, description='权限标识')
+    status: StatusType = Field(description='状态')
+    display: StatusType = Field(description='是否显示')
+    cache: StatusType = Field(description='是否缓存')
+    link: str | None = Field(None, description='外链地址')
+    remark: str | None = Field(None, description='备注')
 
 
 class CreateMenuParam(MenuSchemaBase):
-    pass
+    """创建菜单参数"""
 
 
 class UpdateMenuParam(MenuSchemaBase):
-    pass
+    """更新菜单参数"""
 
 
 class GetMenuDetail(MenuSchemaBase):
+    """菜单详情"""
+
     model_config = ConfigDict(from_attributes=True)
 
-    id: int
-    created_time: datetime
-    updated_time: datetime | None = None
+    id: int = Field(description='菜单 ID')
+    created_time: datetime = Field(description='创建时间')
+    updated_time: datetime | None = Field(None, description='更新时间')
+
+
+class GetMenuTree(GetMenuDetail):
+    """获取菜单树"""
+
+    children: list['GetMenuTree'] | None = Field(None, description='子菜单')

backend/app/admin/schema/opera_log.py

@@ -1,6 +1,5 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from datetime import datetime
+from typing import Any
 
 from pydantic import ConfigDict, Field
 
@@ -9,37 +8,47 @@ from backend.common.schema import SchemaBase
 
 
 class OperaLogSchemaBase(SchemaBase):
-    trace_id: str
-    username: str | None = None
-    method: str
-    title: str
-    path: str
-    ip: str
-    country: str | None = None
-    region: str | None = None
-    city: str | None = None
-    user_agent: str
-    os: str | None = None
-    browser: str | None = None
-    device: str | None = None
-    args: dict | None = None
-    status: StatusType = Field(default=StatusType.enable)
-    code: str
-    msg: str | None = None
-    cost_time: float
-    opera_time: datetime
+    """操作日志基础模型"""
+
+    trace_id: str = Field(description='追踪 ID')
+    username: str | None = Field(None, description='用户名')
+    method: str = Field(description='请求方法')
+    title: str = Field(description='操作标题')
+    path: str = Field(description='请求路径')
+    ip: str = Field(description='IP 地址')
+    country: str | None = Field(None, description='国家')
+    region: str | None = Field(None, description='地区')
+    city: str | None = Field(None, description='城市')
+    user_agent: str | None = Field(description='用户代理')
+    os: str | None = Field(None, description='操作系统')
+    browser: str | None = Field(None, description='浏览器')
+    device: str | None = Field(None, description='设备')
+    args: dict[str, Any] | None = Field(None, description='请求参数')
+    status: StatusType = Field(description='状态')
+    code: str = Field(description='状态码')
+    msg: str | None = Field(None, description='消息')
+    cost_time: float = Field(description='耗时')
+    opera_time: datetime = Field(description='操作时间')
 
 
 class CreateOperaLogParam(OperaLogSchemaBase):
-    pass
+    """创建操作日志参数"""
 
 
 class UpdateOperaLogParam(OperaLogSchemaBase):
-    pass
+    """更新操作日志参数"""
+
+
+class DeleteOperaLogParam(SchemaBase):
+    """删除操作日志参数"""
+
+    pks: list[int] = Field(description='操作日志 ID 列表')
 
 
 class GetOperaLogDetail(OperaLogSchemaBase):
+    """操作日志详情"""
+
     model_config = ConfigDict(from_attributes=True)
 
-    id: int
-    created_time: datetime
+    id: int = Field(description='日志 ID')
+    created_time: datetime = Field(description='创建时间')

backend/app/admin/schema/role.py

@@ -1,42 +1,74 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from datetime import datetime
 
 from pydantic import ConfigDict, Field
 
-from backend.app.admin.schema.data_rule import GetDataRuleDetail
+from backend.app.admin.schema.data_scope import GetDataScopeWithRelationDetail
 from backend.app.admin.schema.menu import GetMenuDetail
 from backend.common.enums import StatusType
 from backend.common.schema import SchemaBase
 
 
 class RoleSchemaBase(SchemaBase):
-    name: str
-    status: StatusType = Field(default=StatusType.enable)
-    remark: str | None = None
+    """角色基础模型"""
+
+    name: str = Field(description='角色名称')
+    status: StatusType = Field(description='状态')
+    is_filter_scopes: bool = Field(True, description='过滤数据权限')
+    remark: str | None = Field(None, description='备注')
 
 
 class CreateRoleParam(RoleSchemaBase):
-    pass
+    """创建角色参数"""
 
 
 class UpdateRoleParam(RoleSchemaBase):
-    pass
+    """更新角色参数"""
+
+
+class DeleteRoleParam(SchemaBase):
+    """删除角色参数"""
+
+    pks: list[int] = Field(description='角色 ID 列表')
+
+
+class CreateRoleMenuParam(SchemaBase):
+    """创建角色菜单参数"""
+
+    role_id: int = Field(description='角色 ID')
+    menu_id: int = Field(description='菜单 ID')
 
 
 class UpdateRoleMenuParam(SchemaBase):
-    menus: list[int]
+    """更新角色菜单参数"""
+
+    menus: list[int] = Field(description='菜单 ID 列表')
 
 
-class UpdateRoleRuleParam(SchemaBase):
-    rules: list[int]
+class CreateRoleScopeParam(SchemaBase):
+    """创建角色数据范围参数"""
+
+    role_id: int = Field(description='角色 ID')
+    data_scope_id: int = Field(description='数据范围 ID')
+
+
+class UpdateRoleScopeParam(SchemaBase):
+    """更新角色数据范围参数"""
+
+    scopes: list[int] = Field(description='数据范围 ID 列表')
 
 
 class GetRoleDetail(RoleSchemaBase):
+    """角色详情"""
+
     model_config = ConfigDict(from_attributes=True)
 
-    id: int
-    created_time: datetime
-    updated_time: datetime | None = None
-    menus: list[GetMenuDetail | None] = []
-    rules: list[GetDataRuleDetail | None] = []
+    id: int = Field(description='角色 ID')
+    created_time: datetime = Field(description='创建时间')
+    updated_time: datetime | None = Field(None, description='更新时间')
+
+
+class GetRoleWithRelationDetail(GetRoleDetail):
+    """角色关联详情"""
+
+    menus: list[GetMenuDetail | None] = Field([], description='菜单详情列表')
+    scopes: list[GetDataScopeWithRelationDetail | None] = Field([], description='数据范围列表')

backend/app/admin/schema/token.py

@@ -1,45 +1,50 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from datetime import datetime
 
-from backend.app.admin.schema.user import GetUserInfoNoRelationDetail
+from pydantic import Field
+
+from backend.app.admin.schema.user import GetUserInfoDetail
 from backend.common.enums import StatusType
 from backend.common.schema import SchemaBase
 
 
 class GetSwaggerToken(SchemaBase):
-    access_token: str
-    token_type: str = 'Bearer'
-    user: GetUserInfoNoRelationDetail
+    """Swagger 认证令牌"""
+
+    access_token: str = Field(description='访问令牌')
+    token_type: str = Field('Bearer', description='令牌类型')
+    user: GetUserInfoDetail = Field(description='用户信息')
 
 
 class AccessTokenBase(SchemaBase):
-    access_token: str
-    access_token_expire_time: datetime
-    session_uuid: str
+    """访问令牌基础模型"""
+
+    access_token: str = Field(description='访问令牌')
+    access_token_expire_time: datetime = Field(description='令牌过期时间')
+    session_uuid: str = Field(description='会话 UUID')
 
 
 class GetNewToken(AccessTokenBase):
-    pass
+    """获取新令牌"""
 
 
 class GetLoginToken(AccessTokenBase):
-    user: GetUserInfoNoRelationDetail
+    """获取登录令牌"""
 
-
-class KickOutToken(SchemaBase):
-    session_uuid: str
+    password_expire_days_remaining: int | None = Field(None, description='密码过期剩余天数')
+    user: GetUserInfoDetail = Field(description='用户信息')
 
 
 class GetTokenDetail(SchemaBase):
-    id: int
-    session_uuid: str
-    username: str
-    nickname: str
-    ip: str
-    os: str
-    browser: str
-    device: str
-    status: StatusType
-    last_login_time: str
-    expire_time: datetime
+    """令牌详情"""
+
+    id: int = Field(description='用户 ID')
+    session_uuid: str = Field(description='会话 UUID')
+    username: str = Field(description='用户名')
+    nickname: str = Field(description='昵称')
+    ip: str = Field(description='IP 地址')
+    os: str = Field(description='操作系统')
+    browser: str = Field(description='浏览器')
+    device: str = Field(description='设备')
+    status: StatusType = Field(description='状态')
+    last_login_time: str = Field(description='最后登录时间')
+    expire_time: datetime = Field(description='过期时间')

backend/app/admin/schema/user.py

@@ -1,90 +1,117 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from datetime import datetime
-from typing import Any
+from typing import Annotated, Any
 
-from pydantic import ConfigDict, EmailStr, Field, HttpUrl, model_validator
+from pydantic import ConfigDict, Field, HttpUrl, PlainSerializer, model_validator
 from typing_extensions import Self
 
 from backend.app.admin.schema.dept import GetDeptDetail
-from backend.app.admin.schema.role import GetRoleDetail
+from backend.app.admin.schema.role import GetRoleWithRelationDetail
 from backend.common.enums import StatusType
-from backend.common.schema import CustomPhoneNumber, SchemaBase
+from backend.common.schema import CustomEmailStr, CustomPhoneNumber, SchemaBase, ser_string
 
 
 class AuthSchemaBase(SchemaBase):
-    username: str
-    password: str | None
+    """用户认证基础模型"""
+
+    username: str = Field(description='用户名')
+    password: str = Field(description='密码')
 
 
 class AuthLoginParam(AuthSchemaBase):
-    captcha: str
+    """用户登录参数"""
 
-
-class RegisterUserParam(AuthSchemaBase):
-    nickname: str | None = None
-    email: EmailStr = Field(examples=['user@example.com'])
+    uuid: str | None = Field(None, description='验证码 UUID')
+    captcha: str | None = Field(None, description='验证码')
 
 
 class AddUserParam(AuthSchemaBase):
-    dept_id: int
-    roles: list[int]
-    nickname: str | None = None
-    email: EmailStr = Field(examples=['user@example.com'])
+    """添加用户参数"""
+
+    nickname: str | None = Field(None, description='昵称')
+    email: CustomEmailStr | None = Field(None, description='邮箱')
+    phone: CustomPhoneNumber | None = Field(None, description='手机号码')
+    dept_id: int = Field(description='部门 ID')
+    roles: list[int] = Field(description='角色 ID 列表')
+
+
+class AddUserRoleParam(SchemaBase):
+    """添加用户角色"""
+
+    user_id: int = Field(description='用户 ID')
+    role_id: int = Field(description='角色 ID')
+
+
+class AddOAuth2UserParam(AuthSchemaBase):
+    """添加 OAuth2 用户参数"""
+
+    password: str | None = Field(None, description='密码')
+    nickname: str | None = Field(None, description='昵称')
+    email: CustomEmailStr | None = Field(None, description='邮箱')
+    avatar: Annotated[HttpUrl, PlainSerializer(ser_string)] | None = Field(None, description='头像地址')
+
+
+class ResetPasswordParam(SchemaBase):
+    """重置密码参数"""
+
+    old_password: str = Field(description='旧密码')
+    new_password: str = Field(description='新密码')
+    confirm_password: str = Field(description='确认密码')
 
 
 class UserInfoSchemaBase(SchemaBase):
-    dept_id: int | None = None
-    username: str
-    nickname: str
-    email: EmailStr = Field(examples=['user@example.com'])
-    phone: CustomPhoneNumber | None = None
+    """用户信息基础模型"""
+
+    dept_id: int | None = Field(None, description='部门 ID')
+    username: str = Field(description='用户名')
+    nickname: str = Field(description='昵称')
+    avatar: Annotated[HttpUrl, PlainSerializer(ser_string)] | None = Field(None, description='头像地址')
+    email: CustomEmailStr | None = Field(None, description='邮箱')
+    phone: CustomPhoneNumber | None = Field(None, description='手机号')
 
 
 class UpdateUserParam(UserInfoSchemaBase):
-    pass
+    """更新用户参数"""
+
+    roles: list[int] = Field(description='角色 ID 列表')
 
 
-class UpdateUserRoleParam(SchemaBase):
-    roles: list[int]
+class GetUserInfoDetail(UserInfoSchemaBase):
+    """用户信息详情"""
 
-
-class AvatarParam(SchemaBase):
-    url: HttpUrl = Field(description='头像 http 地址')
-
-
-class GetUserInfoNoRelationDetail(UserInfoSchemaBase):
     model_config = ConfigDict(from_attributes=True)
 
-    dept_id: int | None = None
-    id: int
-    uuid: str
-    avatar: str | None = None
-    status: StatusType = Field(default=StatusType.enable)
-    is_superuser: bool
-    is_staff: bool
-    is_multi_login: bool
-    join_time: datetime = None
-    last_login_time: datetime | None = None
+    dept_id: int | None = Field(None, description='部门 ID')
+    id: int = Field(description='用户 ID')
+    uuid: str = Field(description='用户 UUID')
+    status: StatusType = Field(description='状态')
+    is_superuser: bool = Field(description='是否超级管理员')
+    is_staff: bool = Field(description='是否管理员')
+    is_multi_login: bool = Field(description='是否允许多端登录')
+    join_time: datetime = Field(description='加入时间')
+    last_login_time: datetime | None = Field(None, description='最后登录时间')
 
 
-class GetUserInfoDetail(GetUserInfoNoRelationDetail):
+class GetUserInfoWithRelationDetail(GetUserInfoDetail):
+    """用户信息关联详情"""
+
     model_config = ConfigDict(from_attributes=True)
 
-    dept: GetDeptDetail | None = None
-    roles: list[GetRoleDetail]
+    dept: GetDeptDetail | None = Field(None, description='部门信息')
+    roles: list[GetRoleWithRelationDetail] = Field(description='角色列表')
 
 
-class GetCurrentUserInfoDetail(GetUserInfoDetail):
+class GetCurrentUserInfoWithRelationDetail(GetUserInfoWithRelationDetail):
+    """当前用户信息关联详情"""
+
     model_config = ConfigDict(from_attributes=True)
 
-    dept: str | None = None
-    roles: list[str]
+    dept: str | None = Field(None, description='部门名称')
+    roles: list[str] = Field(description='角色名称列表')
 
     @model_validator(mode='before')
     @classmethod
     def handel(cls, data: Any) -> Self:
-        """处理部门和角色"""
+        """处理部门和角色数据"""
         dept = data['dept']
         if dept:
             data['dept'] = dept['name']
@@ -92,13 +119,3 @@ class GetCurrentUserInfoDetail(GetUserInfoDetail):
         if roles:
             data['roles'] = [role['name'] for role in roles]
         return data
-
-
-class CurrentUserIns(GetUserInfoDetail):
-    model_config = ConfigDict(from_attributes=True)
-
-
-class ResetPasswordParam(SchemaBase):
-    old_password: str
-    new_password: str
-    confirm_password: str

backend/app/admin/schema/user_password_history.py

@@ -0,0 +1,14 @@
+from pydantic import Field
+
+from backend.common.schema import SchemaBase
+
+
+class UserPasswordHistoryBase(SchemaBase):
+    """用户历史密码记录基础模型"""
+
+    user_id: int = Field(description='用户 ID')
+    password: str = Field(description='历史密码')
+
+
+class CreateUserPasswordHistoryParam(UserPasswordHistoryBase):
+    """创建用户历史密码记录"""

backend/app/admin/schema/user_social.py

@@ -1,21 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from backend.common.enums import UserSocialType
-from backend.common.schema import SchemaBase
-
-
-class UserSocialSchemaBase(SchemaBase):
-    source: UserSocialType
-    open_id: str | None = None
-    uid: str | None = None
-    union_id: str | None = None
-    scope: str | None = None
-    code: str | None = None
-
-
-class CreateUserSocialParam(UserSocialSchemaBase):
-    user_id: int
-
-
-class UpdateUserSocialParam(SchemaBase):
-    pass

backend/app/admin/service/__init__.py

@@ -1,2 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-

backend/app/admin/service/auth_service.py

@@ -1,18 +1,20 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from fastapi import Request, Response
 from fastapi.security import HTTPBasicCredentials
 from sqlalchemy.ext.asyncio import AsyncSession
 from starlette.background import BackgroundTask, BackgroundTasks
 
-from backend.app.admin.conf import admin_settings
+from backend.app.admin.crud.crud_menu import menu_dao
 from backend.app.admin.crud.crud_user import user_dao
 from backend.app.admin.model import User
 from backend.app.admin.schema.token import GetLoginToken, GetNewToken
 from backend.app.admin.schema.user import AuthLoginParam
 from backend.app.admin.service.login_log_service import login_log_service
+from backend.app.admin.service.user_password_history_service import password_security_service
+from backend.app.admin.utils.password_security import password_verify
+from backend.common.context import ctx
 from backend.common.enums import LoginLogStatusType
 from backend.common.exception import errors
+from backend.common.i18n import t
 from backend.common.log import log
 from backend.common.response.response_code import CustomErrorCode
 from backend.common.security.jwt import (
@@ -21,143 +23,216 @@ from backend.common.security.jwt import (
     create_refresh_token,
     get_token,
     jwt_decode,
-    password_verify,
 )
 from backend.core.conf import settings
-from backend.database.db import async_db_session, uuid4_str
+from backend.database.db import uuid4_str
 from backend.database.redis import redis_client
+from backend.utils.dynamic_config import load_login_config
 from backend.utils.timezone import timezone
 
 
 class AuthService:
+    """认证服务类"""
+
     @staticmethod
-    async def user_verify(db: AsyncSession, username: str, password: str) -> User:
+    async def user_verify(db: AsyncSession, username: str, password: str) -> tuple[User, int | None]:
+        """
+        验证用户名和密码
+
+        :param db: 数据库会话
+        :param username: 用户名
+        :param password: 密码
+        :return:
+        """
         user = await user_dao.get_by_username(db, username)
         if not user:
             raise errors.NotFoundError(msg='用户名或密码有误')
-        elif not password_verify(password, user.password):
-            raise errors.AuthorizationError(msg='用户名或密码有误')
-        elif not user.status:
-            raise errors.AuthorizationError(msg='用户已被锁定, 请联系统管理员')
-        return user
 
-    async def swagger_login(self, *, obj: HTTPBasicCredentials) -> tuple[str, User]:
-        async with async_db_session.begin() as db:
-            user = await self.user_verify(db, obj.username, obj.password)
-            await user_dao.update_login_time(db, obj.username)
-            a_token = await create_access_token(
-                str(user.id),
-                user.is_multi_login,
-                # extra info
-                login_type='swagger',
+        await password_security_service.check_status(user.id, user.status)
+
+        if user.password is None or not password_verify(password, user.password):
+            await password_security_service.handle_login_failure(db, user.id)
+            raise errors.AuthorizationError(msg='用户名或密码有误')
+
+        days_remaining = await password_security_service.check_password_expiry_status(
+            db, user.last_password_changed_time
         )
-            return a_token.access_token, user
+
+        await password_security_service.handle_login_success(user.id)
+
+        return user, days_remaining
+
+    async def swagger_login(self, *, db: AsyncSession, obj: HTTPBasicCredentials) -> tuple[str, User]:
+        """
+        Swagger 文档登录
+
+        :param db: 数据库会话
+        :param obj: 登录凭证
+        :return:
+        """
+        user, _ = await self.user_verify(db, obj.username, obj.password)
+        await user_dao.update_login_time(db, obj.username)
+        access_token_data = await create_access_token(
+            user.id,
+            multi_login=user.is_multi_login,
+            # extra info
+            swagger=True,
+        )
+        return access_token_data.access_token, user
 
     async def login(
-        self, *, request: Request, response: Response, obj: AuthLoginParam, background_tasks: BackgroundTasks
+        self,
+        *,
+        db: AsyncSession,
+        response: Response,
+        obj: AuthLoginParam,
+        background_tasks: BackgroundTasks,
     ) -> GetLoginToken:
-        async with async_db_session.begin() as db:
+        """
+        用户登录
+
+        :param db: 数据库会话
+        :param response: 响应对象
+        :param obj: 登录参数
+        :param background_tasks: 后台任务
+        :return:
+        """
         user = None
         try:
-                user = await self.user_verify(db, obj.username, obj.password)
-                captcha_code = await redis_client.get(f'{admin_settings.CAPTCHA_LOGIN_REDIS_PREFIX}:{request.state.ip}')
+            user, days_remaining = await self.user_verify(db, obj.username, obj.password)
+
+            await load_login_config(db)
+            if settings.LOGIN_CAPTCHA_ENABLED:
+                if not obj.uuid or not obj.captcha:
+                    raise errors.RequestError(msg=t('error.captcha.invalid'))
+                captcha_code = await redis_client.get(f'{settings.LOGIN_CAPTCHA_REDIS_PREFIX}:{obj.uuid}')
                 if not captcha_code:
-                    raise errors.AuthorizationError(msg='验证码失效，请重新获取')
+                    raise errors.RequestError(msg=t('error.captcha.expired'))
                 if captcha_code.lower() != obj.captcha.lower():
                     raise errors.CustomError(error=CustomErrorCode.CAPTCHA_ERROR)
-                await redis_client.delete(f'{admin_settings.CAPTCHA_LOGIN_REDIS_PREFIX}:{request.state.ip}')
+                await redis_client.delete(f'{settings.LOGIN_CAPTCHA_REDIS_PREFIX}:{obj.uuid}')
+
             await user_dao.update_login_time(db, obj.username)
             await db.refresh(user)
-                a_token = await create_access_token(
-                    str(user.id),
-                    user.is_multi_login,
+            access_token_data = await create_access_token(
+                user.id,
+                multi_login=user.is_multi_login,
                 # extra info
                 username=user.username,
                 nickname=user.nickname,
-                    last_login_time=timezone.t_str(user.last_login_time),
-                    ip=request.state.ip,
-                    os=request.state.os,
-                    browser=request.state.browser,
-                    device=request.state.device,
+                last_login_time=timezone.to_str(user.last_login_time),
+                ip=ctx.ip,
+                os=ctx.os,
+                browser=ctx.browser,
+                device=ctx.device,
+            )
+            refresh_token_data = await create_refresh_token(
+                access_token_data.session_uuid,
+                user.id,
+                multi_login=user.is_multi_login,
             )
-                r_token = await create_refresh_token(str(user.id), user.is_multi_login)
             response.set_cookie(
                 key=settings.COOKIE_REFRESH_TOKEN_KEY,
-                    value=r_token.refresh_token,
+                value=refresh_token_data.refresh_token,
                 max_age=settings.COOKIE_REFRESH_TOKEN_EXPIRE_SECONDS,
-                    expires=timezone.f_utc(r_token.refresh_token_expire_time),
+                expires=timezone.to_utc(refresh_token_data.refresh_token_expire_time),
                 httponly=True,
             )
         except errors.NotFoundError as e:
             log.error('登陆错误: 用户名不存在')
             raise errors.NotFoundError(msg=e.msg)
-            except (errors.AuthorizationError, errors.CustomError) as e:
+        except (errors.RequestError, errors.CustomError) as e:
             if not user:
                 log.error('登陆错误: 用户密码有误')
             task = BackgroundTask(
                 login_log_service.create,
-                    **dict(
-                        db=db,
-                        request=request,
                 user_uuid=user.uuid if user else uuid4_str(),
                 username=obj.username,
                 login_time=timezone.now(),
                 status=LoginLogStatusType.fail.value,
                 msg=e.msg,
-                    ),
             )
-                raise errors.AuthorizationError(msg=e.msg, background=task)
+            raise errors.RequestError(code=e.code, msg=e.msg, background=task)
         except Exception as e:
             log.error(f'登陆错误: {e}')
-                raise e
+            raise
         else:
             background_tasks.add_task(
                 login_log_service.create,
-                    **dict(
-                        db=db,
-                        request=request,
                 user_uuid=user.uuid,
                 username=obj.username,
                 login_time=timezone.now(),
                 status=LoginLogStatusType.success.value,
-                        msg='登录成功',
-                    ),
+                msg=t('success.login.success'),
             )
             data = GetLoginToken(
-                    access_token=a_token.access_token,
-                    access_token_expire_time=a_token.access_token_expire_time,
-                    session_uuid=a_token.session_uuid,
+                access_token=access_token_data.access_token,
+                access_token_expire_time=access_token_data.access_token_expire_time,
+                session_uuid=access_token_data.session_uuid,
+                password_expire_days_remaining=days_remaining,
                 user=user,  # type: ignore
             )
             return data
 
     @staticmethod
-    async def new_token(*, request: Request) -> GetNewToken:
+    async def get_codes(*, db: AsyncSession, request: Request) -> list[str]:
+        """
+        获取用户权限码
+
+        :param db: 数据库会话
+        :param request: FastAPI 请求对象
+        :return:
+        """
+        codes = set()
+        if request.user.is_superuser:
+            menus = await menu_dao.get_all(db, None, None)
+            for menu in menus:
+                if menu.perms:
+                    codes.add(*menu.perms.split(','))
+        else:
+            roles = request.user.roles
+            if roles:
+                for role in roles:
+                    for menu in role.menus:
+                        if menu.perms:
+                            codes.add(*menu.perms.split(','))
+
+        return list(codes)
+
+    @staticmethod
+    async def refresh_token(*, db: AsyncSession, request: Request) -> GetNewToken:
+        """
+        刷新令牌
+
+        :param db: 数据库会话
+        :param request: FastAPI 请求对象
+        :return:
+        """
         refresh_token = request.cookies.get(settings.COOKIE_REFRESH_TOKEN_KEY)
         if not refresh_token:
-            raise errors.TokenError(msg='Refresh Token 已过期，请重新登录')
-        try:
-            user_id = jwt_decode(refresh_token).id
-        except Exception:
-            raise errors.TokenError(msg='Refresh Token 无效')
-        async with async_db_session() as db:
-            user = await user_dao.get(db, user_id)
+            raise errors.RequestError(msg='Refresh Token 已过期，请重新登录')
+        token_payload = jwt_decode(refresh_token)
+
+        user = await user_dao.get(db, token_payload.id)
         if not user:
-                raise errors.NotFoundError(msg='用户名或密码有误')
-            elif not user.status:
+            raise errors.NotFoundError(msg='用户不存在')
+        if not user.status:
             raise errors.AuthorizationError(msg='用户已被锁定, 请联系统管理员')
+        if not user.is_multi_login and await redis_client.get_prefix(f'{settings.TOKEN_REDIS_PREFIX}:{user.id}:*'):
+            raise errors.ForbiddenError(msg='此用户已在异地登录，请重新登录并及时修改密码')
         new_token = await create_new_token(
-                user_id=str(user.id),
-                refresh_token=refresh_token,
+            refresh_token,
+            token_payload.session_uuid,
+            user.id,
             multi_login=user.is_multi_login,
             # extra info
             username=user.username,
             nickname=user.nickname,
-                last_login_time=timezone.t_str(user.last_login_time),
-                ip=request.state.ip,
-                os=request.state.os,
-                browser=request.state.browser,
-                device_type=request.state.device,
+            last_login_time=timezone.to_str(user.last_login_time),
+            ip=ctx.ip,
+            os=ctx.os,
+            browser=ctx.browser,
+            device_type=ctx.device,
         )
         data = GetNewToken(
             access_token=new_token.new_access_token,
@@ -168,22 +243,28 @@ class AuthService:
 
     @staticmethod
     async def logout(*, request: Request, response: Response) -> None:
+        """
+        用户登出
+
+        :param request: FastAPI 请求对象
+        :param response: FastAPI 响应对象
+        :return:
+        """
+        try:
             token = get_token(request)
             token_payload = jwt_decode(token)
             user_id = token_payload.id
+            session_uuid = token_payload.session_uuid
             refresh_token = request.cookies.get(settings.COOKIE_REFRESH_TOKEN_KEY)
+        except errors.TokenError:
+            return
+        finally:
             response.delete_cookie(settings.COOKIE_REFRESH_TOKEN_KEY)
-        if request.user.is_multi_login:
-            await redis_client.delete(f'{settings.TOKEN_REDIS_PREFIX}:{user_id}:{token_payload.session_uuid}')
+
+        await redis_client.delete(f'{settings.TOKEN_REDIS_PREFIX}:{user_id}:{session_uuid}')
+        await redis_client.delete(f'{settings.TOKEN_EXTRA_INFO_REDIS_PREFIX}:{user_id}:{session_uuid}')
         if refresh_token:
-                await redis_client.delete(f'{settings.TOKEN_REFRESH_REDIS_PREFIX}:{user_id}:{refresh_token}')
-        else:
-            key_prefix = [
-                f'{settings.TOKEN_REDIS_PREFIX}:{user_id}:',
-                f'{settings.TOKEN_REFRESH_REDIS_PREFIX}:{user_id}:',
-            ]
-            for prefix in key_prefix:
-                await redis_client.delete_prefix(prefix)
+            await redis_client.delete(f'{settings.TOKEN_REFRESH_REDIS_PREFIX}:{user_id}:{session_uuid}')
 
 
 auth_service: AuthService = AuthService()

backend/app/admin/service/config_service.py

@@ -1,75 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-from typing import Sequence
-
-from sqlalchemy import Select
-
-from backend.app.admin.conf import admin_settings
-from backend.app.admin.crud.crud_config import config_dao
-from backend.app.admin.model import Config
-from backend.app.admin.schema.config import (
-    CreateConfigParam,
-    SaveBuiltInConfigParam,
-    UpdateConfigParam,
-)
-from backend.common.exception import errors
-from backend.database.db import async_db_session
-
-
-class ConfigService:
-    @staticmethod
-    async def get_built_in_config(type: str) -> Sequence[Config]:
-        async with async_db_session() as db:
-            return await config_dao.get_by_type(db, type)
-
-    @staticmethod
-    async def save_built_in_config(objs: list[SaveBuiltInConfigParam], type: str) -> None:
-        async with async_db_session.begin() as db:
-            for obj in objs:
-                config = await config_dao.get_by_key_and_type(db, obj.key, type)
-                if config is None:
-                    if await config_dao.get_by_key(db, obj.key, built_in=True):
-                        raise errors.ForbiddenError(msg=f'参数配置 {obj.key} 已存在')
-                    await config_dao.create_model(db, obj, flush=True, type=type)
-                else:
-                    await config_dao.update_model(db, config.id, obj, type=type)
-
-    @staticmethod
-    async def get(pk) -> Config | dict:
-        async with async_db_session() as db:
-            config = await config_dao.get(db, pk)
-            if not config:
-                raise errors.NotFoundError(msg='参数配置不存在')
-            return config
-
-    @staticmethod
-    async def get_select(*, name: str = None, type: str = None) -> Select:
-        return await config_dao.get_list(name=name, type=type)
-
-    @staticmethod
-    async def create(*, obj: CreateConfigParam) -> None:
-        async with async_db_session.begin() as db:
-            if obj.type in admin_settings.CONFIG_BUILT_IN_TYPES:
-                raise errors.ForbiddenError(msg='非法类型参数')
-            config = await config_dao.get_by_key(db, obj.key)
-            if config:
-                raise errors.ForbiddenError(msg=f'参数配置 {obj.key} 已存在')
-            await config_dao.create(db, obj)
-
-    @staticmethod
-    async def update(*, pk: int, obj: UpdateConfigParam) -> int:
-        async with async_db_session.begin() as db:
-            config = await config_dao.get(db, pk)
-            if not config:
-                raise errors.NotFoundError(msg='参数配置不存在')
-            count = await config_dao.update(db, pk, obj)
-            return count
-
-    @staticmethod
-    async def delete(*, pk: list[int]) -> int:
-        async with async_db_session.begin() as db:
-            count = await config_dao.delete(db, pk)
-            return count
-
-
-config_service: ConfigService = ConfigService()