yumoqing/pipeline-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(perm): set_role_perm resolves role name to real role.id before insert

Browse Source 
Passing 'admin' as literal roleid was wrong - rolepermission.roleid must
reference role.id. Special roles (any/anonymous/logined) keep literal id
(hardcoded in rbac userperm.py); other names resolve via role table with
default orgtypeid='*', support 'orgtypeid.name' form.
This commit is contained in:
yumoqing 2026-09-09 16:49:55 +08:00
parent c702566e61
commit 35258f3b9c
1 changed files with 20 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
set_role_perm.py
View File

@ -32,6 +32,23 @@ async def main(role, path):
# pipeline RBAC schema: permission (id, path) + rolepermission (roleid, permid)
async with DBPools().sqlorContext('pipeline') as sor:
# role 解析：特殊角色(any/anonymous/logined)用字面 id（rbac userperm 硬编码）；
# 其余按 [orgtypeid.]name 查 role 表取真实 id（缺省 orgtypeid='*'）。
# 直接把 'admin' 当 roleid 写库是错的——roleid 必须是 role.id（2026-09-09）。
SPECIAL_ROLES = ('any', 'anonymous', 'logined')
if role in SPECIAL_ROLES:
role_id = role
else:
if '.' in role:
orgtypeid, role_name = role.split('.', 1)
else:
orgtypeid, role_name = '*', role
role_recs = await sor.R('role', {'orgtypeid': orgtypeid, 'name': role_name})
if not role_recs:
print(f'ERROR: role not found: {orgtypeid}.{role_name}')
sys.exit(1)
role_id = role_recs[0].id
recs = await sor.R('permission', {'path': path})
if not recs:
permid = getID()
@ -39,13 +56,13 @@ async def main(role, path):
else:
permid = recs[0].id
rp = await sor.R('rolepermission', {'roleid': role, 'permid': permid})
rp = await sor.R('rolepermission', {'roleid': role_id, 'permid': permid})
if rp:
print(f'Permission exists: {role} {path}')
return
await sor.C('rolepermission', {'id': getID(), 'roleid': role, 'permid': permid})
print(f'Registered: {role} -> {path}')
await sor.C('rolepermission', {'id': getID(), 'roleid': role_id, 'permid': permid})
print(f'Registered: {role}({role_id}) -> {path}')
if __name__ == '__main__':