duxingchen/KCGL
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 防自锁 — 操作者修改自己角色时强制保留 system_permission + system_permission:operation

Browse Source
This commit is contained in:
yueli
2026-07-17 15:42:31 +08:00
parent efe04c5d42
commit 266a0e011f
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
inventory-backend/app/api/v1/permission.py
View File

@ -79,6 +79,14 @@ def assign_perms():
role_code = data.get('role_code') role_code = data.get('role_code')
permissions = data.get('permissions', []) permissions = data.get('permissions', [])
# ★ 防自锁：操作者修改自己角色时，强制保留权限管理的关键权限
claims = get_jwt()
operator_role = claims.get('role', '')
if operator_role and operator_role.upper() == role_code.upper():
for required in ('system_permission', 'system_permission:operation'):
if required not in permissions:
permissions.append(required)
company_name = _get_operator_company() company_name = _get_operator_company()
PermissionService.assign_permissions(role_code, permissions, company_name=company_name) PermissionService.assign_permissions(role_code, permissions, company_name=company_name)
return jsonify({'code': 200, 'msg': '保存成功'}), 200 return jsonify({'code': 200, 'msg': '保存成功'}), 200