Spaces:
Sleeping
Sleeping
File size: 3,905 Bytes
d70361b | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 | """Permission resolution for the dynamic RBAC system — used by the new admin
routes/pages, and by the navbar to filter which menu items a user sees."""
from __future__ import annotations
from typing import List, Optional
from fastapi import Depends, HTTPException
from sqlalchemy.orm import Session
from ...database import get_db
from ...models import User
from ..dda_auth import current_dda_user
from .models import MenuItem, Module, Role, RolePermission
def get_user_role_row(user: User, db: Session) -> Optional[Role]:
"""Resolve the user's Role row: by role_id if backfilled, else by matching
the legacy `User.role` string (case-insensitive) — covers any user created
before the RBAC seed ran."""
if user.role_id:
role = db.query(Role).filter(Role.id == user.role_id).first()
if role:
return role
legacy = (user.role or "").strip().lower()
if legacy:
return db.query(Role).filter(Role.name == legacy).first()
return None
def get_role_rank(user: User, db: Session) -> Optional[int]:
role = get_user_role_row(user, db)
return role.rank if role else None
def user_can(user: User, db: Session, module_key: str, action: str = "view") -> bool:
"""action: 'view' | 'create' | 'edit' | 'delete'."""
role = get_user_role_row(user, db)
if not role:
return False
module = db.query(Module).filter(Module.key == module_key).first()
if not module:
return False
perm = (
db.query(RolePermission)
.filter(RolePermission.role_id == role.id, RolePermission.module_id == module.id)
.first()
)
if not perm:
return False
return bool(getattr(perm, f"can_{action}", False))
def require_module_permission(module_key: str, action: str = "view"):
"""FastAPI dependency factory — 403s unless the current user's role has
`can_<action>` on `module_key`. Mirrors require_min_role's call shape."""
def _dependency(
user: User = Depends(current_dda_user),
db: Session = Depends(get_db),
) -> User:
if not user_can(user, db, module_key, action):
raise HTTPException(
status_code=403,
detail=f"Missing '{action}' permission on '{module_key}'.",
)
return user
return _dependency
def resolve_user_menu(user: User, db: Session) -> List[MenuItem]:
"""Top-level menu items the user's role can view, in display order, each
with a `.visible_children` list attached (set as a plain transient
attribute, not persisted) for items that have sub-items — the navbar
renders those as a collapsible group like "Configuration" > Roles &
Users / App Modules / Menu Management.
Items with no linked module (module_id is None) are always shown, except
a group item ("Configuration") which is only shown once it has at least
one visible child — otherwise a role with no admin access would see an
empty, dead group header."""
def _visible(item: MenuItem) -> bool:
if item.module_id is None:
return True
module = db.query(Module).filter(Module.id == item.module_id).first()
return bool(module and user_can(user, db, module.key, "view"))
top_level = (
db.query(MenuItem)
.filter(MenuItem.is_active.is_(True), MenuItem.parent_id.is_(None))
.order_by(MenuItem.sort_order)
.all()
)
visible = []
for item in top_level:
children = (
db.query(MenuItem)
.filter(MenuItem.is_active.is_(True), MenuItem.parent_id == item.id)
.order_by(MenuItem.sort_order)
.all()
)
item.visible_children = [c for c in children if _visible(c)]
is_group = bool(children)
if (item.visible_children if is_group else _visible(item)):
visible.append(item)
return visible
|