yumoqing/ragserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: rewrite init_rbac.py with correct DB schema and sqlorContext API

Browse Source
This commit is contained in:
yumoqing 2026-07-21 18:36:39 +08:00
parent 1fedd68a52
commit 19dbfea058
1 changed files with 25 additions and 71 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

96
scripts/init_rbac.py
View File

@ -1,84 +1,38 @@
# -*- coding:utf-8 -*- #!/usr/bin/env python3
"""RAG Server RBAC 权限初始化""" """RAG Server RBAC 权限初始化 — 直接 SQL"""
import sys, os import sys, os, asyncio
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), 'pkgs', 'rag-pipeline')) sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), '..'))
from ahserver.serverenv import ServerEnv
from appPublic.jsonConfig import getConfig
from sqlor.dbpools import DBPools from sqlor.dbpools import DBPools
import asyncio from appPublic.jsonConfig import getConfig
config = getConfig('.') config = getConfig('.')
DBPools(config.databases) DBPools(config.databases)
from rbac.userperm import UserPerm PUBLIC = ['/api/status', '/api/engines', '/api/kb/list', '/', '/index.ui']
LOGINED = ['/api/search', '/api/ingest',
PUBLIC_PATHS = [ '/knowledge_bases_list/', '/documents_list/',
'/api/status', '/engine_configs_list/', '/subscriptions_list/']
'/api/engines',
'/api/kb/list',
'/',
'/index.ui',
]
LOGINED_PATHS = [
'/api/search',
'/api/ingest',
'/knowledge_bases_list/',
'/documents_list/',
'/engine_configs_list/',
'/subscriptions_list/',
]
async def init_perms(): async def main():
sor = await DBPools().get_sor_context('rag') db = DBPools()
up = UserPerm() async with db.sqlorContext('rag') as sor:
await up.init(sor) for rid, rname in [('any', 'any'), ('logined', 'logined')]:
await sor.sqlExe(
f"INSERT IGNORE INTO role (id, orgtypeid, name) VALUES ('{rid}', '', '{rname}')", {})
# Create 'any' role for public access for paths, role in [(PUBLIC, 'any'), (LOGINED, 'logined')]:
recs = await sor.sqlExe("SELECT id FROM role WHERE id='any'", {}) for path in paths:
if not recs: pid = f"perm_{path.replace('/', '_')}"
await sor.sqlExe( await sor.sqlExe(
"INSERT INTO role (id, rolename, orgtypeid, roletype, del_flg) " f"INSERT IGNORE INTO permission (id, path, name) VALUES ('{pid}', '{path}', 'RAG')", {})
"VALUES ('any', 'any', '', 'any', '0')", {} await sor.sqlExe(
) f"INSERT IGNORE INTO rolepermission (id, roleid, permid) VALUES ('rp_{pid}', '{role}', '{pid}')", {})
# Create 'logined' role print(f"OK: {len(PUBLIC)} public + {len(LOGINED)} logined paths")
recs = await sor.sqlExe("SELECT id FROM role WHERE id='logined'", {})
if not recs:
await sor.sqlExe(
"INSERT INTO role (id, rolename, orgtypeid, roletype, del_flg) "
"VALUES ('logined', 'logined', '', 'logined', '0')", {}
)
# Register public paths
for path in PUBLIC_PATHS:
perm_id = f"perm_{path.replace('/', '_')}"
await sor.sqlExe(
f"INSERT IGNORE INTO permission (id, path, name) VALUES ('{perm_id}', '{path}', 'RAG {path}')",
{}
)
await sor.sqlExe(
f"INSERT IGNORE INTO rolepermission (role_id, permission_id) VALUES ('any', '{perm_id}')",
{}
)
# Register logined paths
for path in LOGINED_PATHS:
perm_id = f"perm_{path.replace('/', '_')}"
await sor.sqlExe(
f"INSERT IGNORE INTO permission (id, path, name) VALUES ('{perm_id}', '{path}', 'RAG {path}')",
{}
)
await sor.sqlExe(
f"INSERT IGNORE INTO rolepermission (role_id, permission_id) VALUES ('logined', '{perm_id}')",
{}
)
print(f"RBAC initialized: {len(PUBLIC_PATHS)} public + {len(LOGINED_PATHS)} logined paths")
if __name__ == '__main__': if __name__ == '__main__':
asyncio.run(init_perms()) asyncio.run(main())