Compare commits
No commits in common. "0ac6c83ead62e6bd897ac3efb27f41d86d830ebb" and "d168326f09146e5267776798b3720adef61201c0" have entirely different histories.
0ac6c83ead
...
d168326f09
42
rbac/init.py
42
rbac/init.py
@ -1,6 +1,5 @@
|
|||||||
from ahserver.auth_api import AuthAPI
|
from ahserver.auth_api import AuthAPI
|
||||||
from ahserver.serverenv import ServerEnv
|
from ahserver.serverenv import ServerEnv
|
||||||
from sqlor.dbpools import DBPools
|
|
||||||
from .orgs import (
|
from .orgs import (
|
||||||
get_platform_providers
|
get_platform_providers
|
||||||
)
|
)
|
||||||
@ -20,7 +19,6 @@ from rbac.set_role_perms import (
|
|||||||
set_role_perm,
|
set_role_perm,
|
||||||
set_role_perms
|
set_role_perms
|
||||||
)
|
)
|
||||||
from appPublic.log import debug
|
|
||||||
|
|
||||||
async def get_owner_orgid(*args, **kw):
|
async def get_owner_orgid(*args, **kw):
|
||||||
return '0'
|
return '0'
|
||||||
@ -28,37 +26,6 @@ async def get_owner_orgid(*args, **kw):
|
|||||||
async def sor_get_owner_orgid(sor, orgid):
|
async def sor_get_owner_orgid(sor, orgid):
|
||||||
return '0'
|
return '0'
|
||||||
|
|
||||||
def _bind_rbac_events(dbpools, dbname, up):
|
|
||||||
"""Bind database events to RBAC cache invalidation handlers.
|
|
||||||
|
|
||||||
Events are dispatched by sqlor after C/U/D operations.
|
|
||||||
Format: {dbname}:{tablename}:{c|u|d}:after
|
|
||||||
"""
|
|
||||||
bindings = [
|
|
||||||
# users table: invalidate specific user cache on C/U/D
|
|
||||||
(f'{dbname}.users:c:after', up.on_user_create),
|
|
||||||
(f'{dbname}.users:u:after', up.on_user_update),
|
|
||||||
(f'{dbname}.users:d:after', up.on_user_delete),
|
|
||||||
# rolepermission table: invalidate role-permission cache on any change
|
|
||||||
(f'{dbname}.rolepermission:c:after', up.on_rolepermission_change),
|
|
||||||
(f'{dbname}.rolepermission:u:after', up.on_rolepermission_change),
|
|
||||||
(f'{dbname}.rolepermission:d:after', up.on_rolepermission_change),
|
|
||||||
# permission table: invalidate role-permission cache on update
|
|
||||||
(f'{dbname}.permission:u:after', up.on_permission_change),
|
|
||||||
# role table: invalidate ALL caches (affects all users)
|
|
||||||
(f'{dbname}.role:c:after', up.on_role_change),
|
|
||||||
(f'{dbname}.role:u:after', up.on_role_change),
|
|
||||||
(f'{dbname}.role:d:after', up.on_role_change),
|
|
||||||
# userrole table: invalidate specific user cache based on userid
|
|
||||||
(f'{dbname}.userrole:c:after', up.on_userrole_change),
|
|
||||||
(f'{dbname}.userrole:u:after', up.on_userrole_change),
|
|
||||||
(f'{dbname}.userrole:d:after', up.on_userrole_change),
|
|
||||||
]
|
|
||||||
for event_name, handler in bindings:
|
|
||||||
dbpools.bind(event_name, handler)
|
|
||||||
debug(f'RBAC event bound: {event_name}')
|
|
||||||
|
|
||||||
|
|
||||||
def load_rbac():
|
def load_rbac():
|
||||||
AuthAPI.checkUserPermission = objcheckperm
|
AuthAPI.checkUserPermission = objcheckperm
|
||||||
env = ServerEnv()
|
env = ServerEnv()
|
||||||
@ -80,12 +47,3 @@ def load_rbac():
|
|||||||
env.invalidate_user_perm_cache = env.userpermissions.invalidate_user_cache
|
env.invalidate_user_perm_cache = env.userpermissions.invalidate_user_cache
|
||||||
env.invalidate_all_perm_caches = env.userpermissions.invalidate_all_user_caches
|
env.invalidate_all_perm_caches = env.userpermissions.invalidate_all_user_caches
|
||||||
env.invalidate_role_perm_cache = env.userpermissions.invalidate_rp_cache
|
env.invalidate_role_perm_cache = env.userpermissions.invalidate_rp_cache
|
||||||
|
|
||||||
# Bind database events for automatic cache invalidation
|
|
||||||
dbpools = DBPools()
|
|
||||||
dbname = env.get_module_dbname('rbac')
|
|
||||||
if dbname:
|
|
||||||
_bind_rbac_events(dbpools, dbname, env.userpermissions)
|
|
||||||
debug(f'RBAC event listeners bound for database: {dbname}')
|
|
||||||
else:
|
|
||||||
debug('RBAC event listeners skipped: no database configured for rbac module')
|
|
||||||
|
|||||||
@ -1,9 +1,9 @@
|
|||||||
import asyncio
|
import asyncio
|
||||||
from collections import OrderedDict
|
from collections import OrderedDict
|
||||||
from sqlor.dbpools import get_sor_context
|
from sqlor.dbpools import DBPools, get_sor_context
|
||||||
from ahserver.serverenv import ServerEnv
|
from ahserver.serverenv import ServerEnv
|
||||||
from appPublic.Singleton import SingletonDecorator
|
from appPublic.Singleton import SingletonDecorator
|
||||||
from appPublic.log import debug, error
|
from appPublic.log import debug, exception, error
|
||||||
|
|
||||||
class LRUCache:
|
class LRUCache:
|
||||||
"""Async-safe LRU cache with TTL support.
|
"""Async-safe LRU cache with TTL support.
|
||||||
@ -81,86 +81,6 @@ class UserPermissions:
|
|||||||
# Async lock for rp_caches initialization (lazy init)
|
# Async lock for rp_caches initialization (lazy init)
|
||||||
self._rp_lock = None
|
self._rp_lock = None
|
||||||
|
|
||||||
def on_user_update(self, data):
|
|
||||||
"""Event handler for users table update.
|
|
||||||
Clears the specific user's permission cache.
|
|
||||||
"""
|
|
||||||
try:
|
|
||||||
userid = getattr(data, 'id', None)
|
|
||||||
if userid:
|
|
||||||
self.invalidate_user_cache(userid)
|
|
||||||
debug(f'RBAC cache invalidated for user id={userid} (users update)')
|
|
||||||
except Exception as e:
|
|
||||||
error(f'RBAC on_user_update handler error: {e}')
|
|
||||||
|
|
||||||
def on_user_create(self, data):
|
|
||||||
"""Event handler for users table insert.
|
|
||||||
Clears the specific user's permission cache.
|
|
||||||
"""
|
|
||||||
try:
|
|
||||||
userid = getattr(data, 'id', None)
|
|
||||||
if userid:
|
|
||||||
self.invalidate_user_cache(userid)
|
|
||||||
debug(f'RBAC cache invalidated for user id={userid} (users create)')
|
|
||||||
except Exception as e:
|
|
||||||
error(f'RBAC on_user_create handler error: {e}')
|
|
||||||
|
|
||||||
def on_user_delete(self, data):
|
|
||||||
"""Event handler for users table delete.
|
|
||||||
Clears the specific user's permission cache.
|
|
||||||
"""
|
|
||||||
try:
|
|
||||||
userid = getattr(data, 'id', None)
|
|
||||||
if userid:
|
|
||||||
self.invalidate_user_cache(userid)
|
|
||||||
debug(f'RBAC cache invalidated for user id={userid} (users delete)')
|
|
||||||
except Exception as e:
|
|
||||||
error(f'RBAC on_user_delete handler error: {e}')
|
|
||||||
|
|
||||||
def on_rolepermission_change(self, data):
|
|
||||||
"""Event handler for rolepermission table C/U/D.
|
|
||||||
Clears the role-permission cache.
|
|
||||||
"""
|
|
||||||
try:
|
|
||||||
self.invalidate_rp_cache()
|
|
||||||
debug('RBAC role-permission cache invalidated (rolepermission change)')
|
|
||||||
except Exception as e:
|
|
||||||
error(f'RBAC on_rolepermission_change handler error: {e}')
|
|
||||||
|
|
||||||
def on_permission_change(self, data):
|
|
||||||
"""Event handler for permission table update.
|
|
||||||
Clears the role-permission cache.
|
|
||||||
"""
|
|
||||||
try:
|
|
||||||
self.invalidate_rp_cache()
|
|
||||||
debug('RBAC role-permission cache invalidated (permission change)')
|
|
||||||
except Exception as e:
|
|
||||||
error(f'RBAC on_permission_change handler error: {e}')
|
|
||||||
|
|
||||||
def on_role_change(self, data):
|
|
||||||
"""Event handler for role table C/U/D.
|
|
||||||
Clears all user caches and role-permission cache,
|
|
||||||
since role changes may affect any user.
|
|
||||||
"""
|
|
||||||
try:
|
|
||||||
self.invalidate_all_user_caches()
|
|
||||||
self.invalidate_rp_cache()
|
|
||||||
debug('RBAC all caches invalidated (role change)')
|
|
||||||
except Exception as e:
|
|
||||||
error(f'RBAC on_role_change handler error: {e}')
|
|
||||||
|
|
||||||
def on_userrole_change(self, data):
|
|
||||||
"""Event handler for userrole table C/U/D.
|
|
||||||
Clears the specific user's permission cache based on userid.
|
|
||||||
"""
|
|
||||||
try:
|
|
||||||
userid = getattr(data, 'userid', None)
|
|
||||||
if userid:
|
|
||||||
self.invalidate_user_cache(userid)
|
|
||||||
debug(f'RBAC cache invalidated for user id={userid} (userrole change)')
|
|
||||||
except Exception as e:
|
|
||||||
error(f'RBAC on_userrole_change handler error: {e}')
|
|
||||||
|
|
||||||
def _get_rp_lock(self):
|
def _get_rp_lock(self):
|
||||||
if self._rp_lock is None:
|
if self._rp_lock is None:
|
||||||
self._rp_lock = asyncio.Lock()
|
self._rp_lock = asyncio.Lock()
|
||||||
|
|||||||
@ -10,8 +10,7 @@
|
|||||||
"options": {
|
"options": {
|
||||||
"url": "${text}"
|
"url": "${text}"
|
||||||
}
|
}
|
||||||
},
|
}, {
|
||||||
{
|
|
||||||
"wid": "self",
|
"wid": "self",
|
||||||
"event": "recognized",
|
"event": "recognized",
|
||||||
"actiontype": "script",
|
"actiontype": "script",
|
||||||
|
|||||||
@ -71,13 +71,11 @@
|
|||||||
"name":"cell_no",
|
"name":"cell_no",
|
||||||
"label":"手机号",
|
"label":"手机号",
|
||||||
"uitype":"str"
|
"uitype":"str"
|
||||||
},
|
},{
|
||||||
{
|
|
||||||
"name":"codeid",
|
"name":"codeid",
|
||||||
"uitype":"hide",
|
"uitype":"hide",
|
||||||
"value":"{{uuid()}}"
|
"value":"{{uuid()}}"
|
||||||
},
|
},{
|
||||||
{
|
|
||||||
"name":"check_code",
|
"name":"check_code",
|
||||||
"uitype":"str"
|
"uitype":"str"
|
||||||
}
|
}
|
||||||
|
|||||||
@ -20,7 +20,7 @@
|
|||||||
"uitype": "password",
|
"uitype": "password",
|
||||||
"datatype": "str",
|
"datatype": "str",
|
||||||
"required":true,
|
"required":true,
|
||||||
"label": "密码"
|
"label": "\u5bc6\u7801"
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"name": "cfm_password",
|
"name": "cfm_password",
|
||||||
@ -29,7 +29,7 @@
|
|||||||
"uitype": "password",
|
"uitype": "password",
|
||||||
"datatype": "str",
|
"datatype": "str",
|
||||||
"required":true,
|
"required":true,
|
||||||
"label": "密码"
|
"label": "\u5bc6\u7801"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
|
|||||||
@ -1,4 +1,5 @@
|
|||||||
{
|
{
|
||||||
"widgettype":"VBox",
|
"widgettype":"VBox",
|
||||||
"options": {}
|
"options":{
|
||||||
|
}
|
||||||
}
|
}
|
||||||
@ -40,3 +40,4 @@
|
|||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user