no_gen_mu
c3a5dc2a41
admin_user 加 pages_override(可空 JSON)+ Alembic 迁移;role=="custom" 时可见页由这份逐页 勾选决定,否则跟随角色。create/update 收 pages_override(切回普通角色自动清空),_validate_role 放行 custom 哨兵角色。登录/me 下发有效页时优先用 override → 左侧导航直接按勾选生效。 补 4 个用例覆盖建/改/切回/切入,test_admin_roles 全绿。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
84 lines
3.8 KiB
Python
84 lines
3.8 KiB
Python
"""admin 后台「页面权限目录」—— RBAC 的权限侧单一真源。
|
|
|
|
一个权限 = 一个页面(= 左侧导航项)。角色持有一组 page key,登录后左侧只展示这些页(见前端
|
|
layout.tsx 按 pages 过滤导航)。key 必须与前端路由一级对齐(/dashboard → "dashboard")。
|
|
|
|
super_admin 为内建全权角色,恒可见全部页(effective_pages 特判)。新增页面 = 这里加一条 +
|
|
前端导航加对应项(key 一致即可被各角色勾选可见)。
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
SUPER_ADMIN_ROLE = "super_admin"
|
|
# 「自定义」哨兵角色:不是 admin_role 表里的行,而是标记「这个人的可见页由 pages_override 决定」。
|
|
# admin_user.role == CUSTOM_ROLE 时,有效可见页取 admin_user.pages_override(见 auth._admin_out_with_pages)。
|
|
CUSTOM_ROLE = "custom"
|
|
|
|
# 分组镜像前端导航(app/(main)/layout.tsx 的 NAV_GROUPS);key = 路由一级
|
|
PERMISSION_CATALOG: list[dict] = [
|
|
{"group": "看板", "pages": [
|
|
{"key": "dashboard", "label": "数据大盘"},
|
|
{"key": "coupon-data", "label": "领券数据"},
|
|
{"key": "ad-revenue-report", "label": "广告收益"},
|
|
{"key": "comparison-records", "label": "比价记录"},
|
|
{"key": "cps", "label": "CPS收益"},
|
|
{"key": "device-liveness", "label": "设备存活"},
|
|
]},
|
|
{"group": "奖励审核", "pages": [
|
|
{"key": "withdraws", "label": "提现审核"},
|
|
{"key": "price-reports", "label": "低价审核"},
|
|
{"key": "feedbacks", "label": "用户反馈"},
|
|
]},
|
|
{"group": "数据配置", "pages": [
|
|
{"key": "config", "label": "系统配置"},
|
|
{"key": "ad-revenue", "label": "广告配置"},
|
|
{"key": "users", "label": "用户管理"},
|
|
]},
|
|
{"group": "其他", "pages": [
|
|
{"key": "admins", "label": "权限管理"},
|
|
{"key": "event-logs", "label": "埋点日志"},
|
|
{"key": "audit-logs", "label": "审计日志"},
|
|
]},
|
|
]
|
|
|
|
# 全部页面 key(super_admin 有效可见 = 此全集;也用于校验角色 pages 合法性)
|
|
ALL_PAGE_KEYS: list[str] = [p["key"] for g in PERMISSION_CATALOG for p in g["pages"]]
|
|
_ALL_SET = set(ALL_PAGE_KEYS)
|
|
|
|
# 内建角色定义(种子 / ensure 兜底的单一真源):(key, 中文展示名, 默认可见页)。
|
|
# 页集对齐 Prototypes/dashboard/permissions.md 的 ROLES;super_admin 恒全权(pages 空、bypass)。
|
|
# key 承重(require_role / admin_user.role),勿改;label 为 UI 展示名。
|
|
BUILTIN_ROLES: list[dict] = [
|
|
{"name": SUPER_ADMIN_ROLE, "label": "管理员", "pages": []},
|
|
{"name": "operator", "label": "运营", "pages": [
|
|
"dashboard", "coupon-data", "ad-revenue-report", "comparison-records",
|
|
"cps", "device-liveness", "price-reports", "feedbacks",
|
|
]},
|
|
{"name": "finance", "label": "财务", "pages": [
|
|
"dashboard", "ad-revenue-report", "cps", "withdraws",
|
|
]},
|
|
{"name": "tech", "label": "技术", "pages": [
|
|
"dashboard", "device-liveness", "config", "ad-revenue", "event-logs", "audit-logs",
|
|
]},
|
|
]
|
|
|
|
# 内建 key → 中文展示名(展示 / 自愈用)
|
|
BUILTIN_LABELS: dict[str, str] = {r["name"]: r["label"] for r in BUILTIN_ROLES}
|
|
|
|
|
|
def sanitize_pages(pages: list[str] | None) -> list[str]:
|
|
"""过滤掉不在目录里的 key(去重、保序),防脏数据/目录收缩后的悬空 key。"""
|
|
seen: set[str] = set()
|
|
out: list[str] = []
|
|
for k in pages or []:
|
|
if k in _ALL_SET and k not in seen:
|
|
seen.add(k)
|
|
out.append(k)
|
|
return out
|
|
|
|
|
|
def effective_pages(role_name: str, role_pages: list[str] | None) -> list[str]:
|
|
"""某角色的有效可见页:super_admin → 全部;其余 → 其 pages 与目录取交(自愈悬空 key)。"""
|
|
if role_name == SUPER_ADMIN_ROLE:
|
|
return list(ALL_PAGE_KEYS)
|
|
return sanitize_pages(role_pages)
|