From fca96b5a720d1750c9dd09fdd327a7f3fc2a1141 Mon Sep 17 00:00:00 2001 From: yumoqing Date: Wed, 12 Aug 2026 12:55:30 +0800 Subject: [PATCH] feat: add setup_rbac_perms.sh + set_role_perm.py (ref Sage pattern) --- build.sh | 23 +++--------- set_role_perm.py | 63 +++++++++++++++++++++++++++++++++ setup_rbac_perms.sh | 86 +++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 154 insertions(+), 18 deletions(-) create mode 100644 set_role_perm.py create mode 100644 setup_rbac_perms.sh diff --git a/build.sh b/build.sh index 57e6550..a96c430 100644 --- a/build.sh +++ b/build.sh @@ -179,25 +179,12 @@ fi green " OK" # ============================================================ -# 7b: 修复 RBAC 权限通配符 (bricks等静态资源目录需 /** 匹配子路径) +# 7b: RBAC 权限初始化（参考 Sage setup_rbac_perms.sh） # ============================================================ -blue "[7b/10] RBAC 权限通配符修复..." -mysql -u test -ptest123 pccs -e " -UPDATE permission SET path = CONCAT(path, '**') -WHERE path IN ('/pcpool/', '/pcc/', '/storage_mgr/', '/image_mgr/', '/pccs/', '/appbase/', '/imgs/', '/bricks/') -AND path NOT LIKE '%**'; -" 2>/dev/null -# 确保 /rbac/user/ 下所有文件有 any 角色权限 -mysql -u test -ptest123 pccs -e " -INSERT IGNORE INTO rolepermission (id, roleid, permid) -SELECT CONCAT('ANY_', p.id), 'any', p.id -FROM permission p -WHERE p.path LIKE '/rbac/user/%' -AND NOT EXISTS ( - SELECT 1 FROM rolepermission rp - WHERE rp.roleid = 'any' AND rp.permid = p.id -); -" 2>/dev/null +blue "[7b/10] RBAC 权限初始化..." +cp -f "${PKGDIR}/pccs/setup_rbac_perms.sh" "${CDIR}/setup_rbac_perms.sh" +cp -f "${PKGDIR}/pccs/set_role_perm.py" "${CDIR}/set_role_perm.py" +bash "${CDIR}/setup_rbac_perms.sh" 2>&1 | tail -5 green " OK" # ============================================================ diff --git a/set_role_perm.py b/set_role_perm.py new file mode 100644 index 0000000..3eb7bcd --- /dev/null +++ b/set_role_perm.py @@ -0,0 +1,63 @@ +""" +set_role_perm.py — 为指定角色添加路径权限（参考 Sage 同款脚本） +用法: python set_role_perm.py + role: any / logined / anonymous / orgtypeid.rolename + path: /rbac/user/login.ui 或 /bricks/** (支持 % 和 ** 通配符) +""" +import os, sys, asyncio +sys.path[:0] = [os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), 'pkgs', p) + for p in ['apppublic', 'sqlor', 'ahserver']] + +from sqlor.dbpools import DBPools +from appPublic.jsonConfig import getConfig +from appPublic.uniqueID import getID + + +async def add_roleperm(sor, roleid, permid): + ns = {'roleid': roleid, 'permid': permid} + recs = await sor.R('rolepermission', ns.copy()) + if recs: + print(f' {roleid}, {permid} — 已存在, 跳过') + return + ns['id'] = getID() + await sor.C('rolepermission', ns) + print(f' {roleid}, {permid} — 已添加') + + +async def main(): + config = getConfig('.') + db = DBPools(config.databases) + + if len(sys.argv) < 3: + print(f'用法: {sys.argv[0]} ') + sys.exit(1) + + role = sys.argv[1] + path = sys.argv[2] + + async with db.sqlorContext('pccs') as sor: + # 查询 permission: 支持通配符 ** 和 % + perms = None + if '%' in path or '**' in path: + like_path = path.replace('**', '%') + perms = await sor.sqlExe( + "SELECT * FROM permission WHERE path LIKE ${path}$", + {'path': like_path} + ) + else: + perms = await sor.R('permission', {'path': path}) + + # 如果 permission 不存在，自动创建 + if not perms: + from appPublic.dictObject import DictObject + perms = [DictObject(id=getID(), path=path)] + await sor.C('permission', perms[0].copy()) + print(f' permission 已创建: {path}') + + # 添加角色权限 + for p in perms: + await add_roleperm(sor, role, p.id) + + +if __name__ == '__main__': + asyncio.run(main()) diff --git a/setup_rbac_perms.sh b/setup_rbac_perms.sh new file mode 100644 index 0000000..4b09823 --- /dev/null +++ b/setup_rbac_perms.sh @@ -0,0 +1,86 @@ +#!/bin/bash +# setup_rbac_perms.sh — PCCS 权限初始化（参考 Sage 同款脚本） +# 运行: cd /d/pccs && bash setup_rbac_perms.sh + +set -e +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +cd "$SCRIPT_DIR" + +PYTHON="${SCRIPT_DIR}/py3/bin/python3" + +set_perm() { + local role="$1" + local path="$2" + "$PYTHON" set_role_perm.py "$role" "$path" +} + +echo "============================================" +echo " PCCS RBAC 权限初始化" +echo "============================================" + +# === 1. Public: 登录/注册/认证 (any) === +echo "" +echo ">>> [1/3] Public: 登录/注册/认证 (any)" + +PUBLIC_PATHS=( + "/rbac/user/login.ui" + "/rbac/userpassword_login.ui" + "/rbac/userpassword_login.dspy" + "/rbac/user/up_login.dspy" + "/rbac/phone_login.dspy" + "/rbac/user/register.ui" + "/rbac/user/register.dspy" + "/rbac/gen_sms_code.dspy" + "/rbac/qr_scan.ui" + "/rbac/user/logout.dspy" + "/rbac/user/code_login.dspy" + "/rbac/user/sms_register.dspy" + "/rbac/get_user_info.dspy" +) + +for path in "${PUBLIC_PATHS[@]}"; do + set_perm "any" "$path" +done +echo " OK (${#PUBLIC_PATHS[@]} paths)" + +# === 2. Logined: 已登录用户可访问 === +echo "" +echo ">>> [2/3] Logined: 用户功能 (logined)" + +LOGINED_PATHS=( + "/rbac/user/myrole.ui" + "/rbac/user/edit_profile.dspy" + "/rbac/user/save_profile.dspy" + "/rbac/usermenu.ui" + "/index.ui" +) + +for path in "${LOGINED_PATHS[@]}"; do + set_perm "logined" "$path" +done +echo " OK (${#LOGINED_PATHS[@]} paths)" + +# === 3. Static: 静态资源目录通配符 (any) === +echo "" +echo ">>> [3/3] Static: 静态资源目录 (any + /** 通配符)" + +STATIC_PATHS=( + "/bricks/**" + "/imgs/**" + "/appbase/**" + "/pcpool/**" + "/pcc/**" + "/storage_mgr/**" + "/image_mgr/**" + "/pccs/**" +) + +for path in "${STATIC_PATHS[@]}"; do + set_perm "any" "$path" +done +echo " OK (${#STATIC_PATHS[@]} paths)" + +echo "" +echo "============================================" +echo " 权限初始化完成" +echo "============================================"