duxingchen
3286a11bc7
- 复制来源: /home/yueli/track @ 192c8ee (feature/ai-audit-update) - 组织隔离目标: LICA - 端口规划: 前端 8030 / 后端 8031 / 数据库 8032 - 已排除 deploy.sh、deploy_full.sh、docker-compose.prod.yml（IRIS 生产发布脚本） - 已排除工作区未提交改动，取干净的 192c8ee 状态
36 lines
1.0 KiB
Python
36 lines
1.0 KiB
Python
"""通用 FastAPI 依赖"""
|
|
from __future__ import annotations
|
|
|
|
from fastapi import Depends, HTTPException, status
|
|
|
|
from app.core.roles import ADMIN_ROLES
|
|
from app.services.auth_service import get_current_user
|
|
|
|
|
|
def require_roles(*roles: str):
|
|
"""生成「限定角色」依赖，避免同一个内联判断被复制到每个端点。
|
|
|
|
用法::
|
|
|
|
@router.get("/x")
|
|
async def x(current_user: dict = Depends(require_admin)):
|
|
...
|
|
|
|
失败一律 403 且不透露允许的角色集合（避免给探测者提供线索）。
|
|
"""
|
|
allowed = frozenset(roles)
|
|
|
|
async def _guard(current_user: dict = Depends(get_current_user)) -> dict:
|
|
if (current_user or {}).get("role") not in allowed:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="当前角色无权访问该接口",
|
|
)
|
|
return current_user
|
|
|
|
return _guard
|
|
|
|
|
|
# 审计日志等高权限接口复用同一实例
|
|
require_admin = require_roles(*ADMIN_ROLES)
|