8f468a0a39
根因: /permissions/role/<role_code> 接口要求 system_permission, 非管理员角色无法获取自身权限 → 权限数组为空 → 前后端字段全被过滤 修复: - permission.py: 查自己角色不再需要 system_permission, 解除权限死锁 - 5个 inbound API: 恢复完整 field_to_perm 映射, 每个字段均可独立权限管控 - 补齐遗漏字段(qty_inbound/qty_stock/qty_available/request_id/request_no) - buy.vue: 入库表单价格字段加入 hasFormFieldPermission 守卫
87 lines
3.3 KiB
Python
87 lines
3.3 KiB
Python
# inventory-backend/app/api/v1/permission.py
|
||
from flask import Blueprint, request, jsonify, current_app
|
||
from flask_jwt_extended import jwt_required, get_jwt
|
||
from app.services.permission_service import PermissionService
|
||
from app.utils.decorators import permission_required, audit_log
|
||
|
||
permission_bp = Blueprint('permission', __name__)
|
||
|
||
|
||
def _get_operator_company():
|
||
"""从 JWT 获取当前操作者公司（None=超管）"""
|
||
claims = get_jwt()
|
||
role = claims.get('role', '')
|
||
if role and role.upper() == 'SUPER_ADMIN':
|
||
return None # 超管不限制公司
|
||
|
||
|
||
def _has_system_permission(role_code):
|
||
"""检查角色是否有 system_permission"""
|
||
try:
|
||
from app.services.auth_service import AuthService
|
||
perm_dict = AuthService.get_user_permissions(role_code)
|
||
all_perms = perm_dict.get('menus', []) + perm_dict.get('elements', [])
|
||
return 'system_permission' in all_perms
|
||
except Exception:
|
||
return False
|
||
return claims.get('company_name', '')
|
||
|
||
|
||
@permission_bp.route('/tree', methods=['GET'])
|
||
@jwt_required()
|
||
@permission_required('system_permission')
|
||
def get_tree():
|
||
"""获取权限树"""
|
||
try:
|
||
data = PermissionService.get_permission_tree()
|
||
return jsonify({'code': 200, 'msg': '获取成功', 'data': data}), 200
|
||
except Exception as e:
|
||
current_app.logger.error(f"Get Tree Failed: {str(e)}")
|
||
return jsonify({'code': 500, 'msg': f'服务器内部错误: {str(e)}'}), 500
|
||
|
||
|
||
@permission_bp.route('/role/<string:role_code>', methods=['GET'])
|
||
@jwt_required()
|
||
def get_role_perms(role_code):
|
||
"""获取某个角色的权限列表。
|
||
- 查自己角色：不需要额外权限
|
||
- 查其他角色：需要 system_permission
|
||
"""
|
||
try:
|
||
claims = get_jwt()
|
||
current_role = (claims.get('role') or '').upper()
|
||
|
||
# 非管理员查其他角色 → 拒绝
|
||
if current_role != role_code.upper() and current_role != 'SUPER_ADMIN':
|
||
if not _has_system_permission(current_role):
|
||
return jsonify({'code': 403, 'msg': '无权查看其他角色的权限'}), 403
|
||
|
||
company_name = _get_operator_company()
|
||
data = PermissionService.get_role_permissions(role_code, company_name=company_name)
|
||
return jsonify({'code': 200, 'msg': '获取成功', 'data': data}), 200
|
||
except Exception as e:
|
||
current_app.logger.error(f"Get Role Perms Failed: {str(e)}")
|
||
return jsonify({'code': 500, 'msg': str(e)}), 500
|
||
|
||
|
||
@permission_bp.route('/assign', methods=['POST'])
|
||
@jwt_required()
|
||
@permission_required('system_permission:operation')
|
||
@audit_log(
|
||
module='权限管理',
|
||
action='分配',
|
||
get_target_name_fn=lambda: request.get_json().get('role_code') if request.get_json() else None
|
||
)
|
||
def assign_perms():
|
||
"""保存权限分配（自动带上当前操作者的公司标识）"""
|
||
try:
|
||
data = request.get_json()
|
||
role_code = data.get('role_code')
|
||
permissions = data.get('permissions', [])
|
||
|
||
company_name = _get_operator_company()
|
||
PermissionService.assign_permissions(role_code, permissions, company_name=company_name)
|
||
return jsonify({'code': 200, 'msg': '保存成功'}), 200
|
||
except Exception as e:
|
||
current_app.logger.error(f"Assign Perms Failed: {str(e)}")
|
||
return jsonify({'code': 500, 'msg': str(e)}), 500 |