2028 lines
97 KiB
Python
2028 lines
97 KiB
Python
"""认证/登录/权限管理路由"""
|
||
from functools import wraps
|
||
from decimal import Decimal, InvalidOperation
|
||
from flask import (Blueprint, render_template, request, jsonify,
|
||
session, redirect, url_for)
|
||
from services.db import query, add_operation_log
|
||
from services.passwords import hash_password, validate_password, verify_password
|
||
from services.permission_model import ensure_position_permissions, user_position_code
|
||
|
||
auth_bp = Blueprint('auth', __name__)
|
||
|
||
|
||
def login_required(f):
|
||
@wraps(f)
|
||
def decorated(*args, **kwargs):
|
||
# 判断是 AJAX/JSON 请求还是普通页面请求
|
||
# fetch() 默认 Accept: */*, 不设 Content-Type
|
||
# 通过请求路径和 Accept 头综合判断
|
||
is_api = request.path.startswith('/api/')
|
||
is_ajax = request.headers.get('X-Requested-With') == 'XMLHttpRequest'
|
||
if 'user_id' not in session:
|
||
if is_api or is_ajax or request.is_json:
|
||
return jsonify({"code": 401, "msg": "未登录"})
|
||
return redirect(url_for('auth.login'))
|
||
# 校验账号状态：被禁用(status=0)或已删除的用户强制登出（防止已登录会话继续使用）
|
||
try:
|
||
user_rows = query("SELECT status FROM dashboard_users WHERE id=%s", (session.get('user_id'),))
|
||
if not user_rows or user_rows[0].get('status') != 1:
|
||
session.clear()
|
||
if is_api or is_ajax or request.is_json:
|
||
return jsonify({"code": 401, "msg": "账号已禁用，请联系管理员"})
|
||
return redirect(url_for('auth.login'))
|
||
except Exception:
|
||
pass
|
||
if session.get('must_change_password') and request.endpoint != 'auth.change_password':
|
||
return jsonify({"code": 428, "msg": "首次登录必须修改密码"})
|
||
return f(*args, **kwargs)
|
||
return decorated
|
||
|
||
|
||
# 权限配置统一标识。左侧为标准ID，列表内保留现有页面ID和历史父级ID兼容。
|
||
PERMISSION_PAGE_ALIASES = {
|
||
'purchase_pending': ['purchase_pending', 'purchase'],
|
||
'purchase_backup': ['purchase_backup', 'purchase_ready', 'purchase'],
|
||
'order_domestic': ['order_domestic', 'orders_domestic', 'orders'],
|
||
'order_overseas': ['order_overseas', 'orders_overseas', 'orders'],
|
||
'order_packaging': ['order_packaging', 'orders_packaging', 'orders'],
|
||
'order_finished': ['order_finished', 'orders_finished', 'orders'],
|
||
'data_summary': ['data_summary', 'data'],
|
||
'data_detail': ['data_detail', 'data'],
|
||
'inventory_finished': ['inventory_finished', 'inventory'],
|
||
'inventory_packaging': ['inventory_packaging', 'inventory'],
|
||
'product_packaging': ['product_packaging', 'product_new'],
|
||
'login_records': ['login_records', 'login-records'],
|
||
'spot_dashboard': ['spot_dashboard', 'spot'],
|
||
'spot_application': ['spot_application', 'spot'],
|
||
'spot_confirmation': ['spot_confirmation', 'spot'],
|
||
'spot_sales': ['spot_sales', 'spot'],
|
||
'spot_authorization': ['spot_authorization', 'spot'],
|
||
}
|
||
|
||
# 只对无歧义的现有页面ID做标准化；历史父级 orders 保留为兼容回退项。
|
||
PERMISSION_PAGE_CANONICAL = {
|
||
'purchase': 'purchase_pending',
|
||
'purchase_ready': 'purchase_backup',
|
||
'orders_domestic': 'order_domestic',
|
||
'orders_overseas': 'order_overseas',
|
||
'orders_packaging': 'order_packaging',
|
||
'orders_finished': 'order_finished',
|
||
'login-records': 'login_records',
|
||
}
|
||
for _canonical in PERMISSION_PAGE_ALIASES:
|
||
PERMISSION_PAGE_CANONICAL[_canonical] = _canonical
|
||
|
||
def normalize_permission_page(page):
|
||
"""把现有/历史页面ID转换为权限配置标准ID。"""
|
||
return PERMISSION_PAGE_CANONICAL.get(page, page)
|
||
|
||
def _permission_page_aliases(page):
|
||
"""返回标准页面ID及兼容别名，标准ID优先。"""
|
||
canonical = normalize_permission_page(page)
|
||
return PERMISSION_PAGE_ALIASES.get(canonical, [canonical])
|
||
|
||
|
||
# ─── 权限配置页面特征（操作）单一来源 ───
|
||
# 未列出的页面默认只有「查看」权限；页面ID为标准权限ID。
|
||
PAGE_FEATURES = {
|
||
'data_summary': [{'id':'view','name':'查看'},{'id':'query','name':'查询'},{'id':'export','name':'导出'}],
|
||
'data_detail': [{'id':'view','name':'查看'},{'id':'query','name':'查询'},{'id':'export','name':'导出'},{'id':'import','name':'导入'}],
|
||
'inventory_finished': [{'id':'view','name':'查看'},{'id':'edit_product','name':'编辑产品'},{'id':'export','name':'导出'},{'id':'import','name':'导入'}],
|
||
'inventory_packaging': [{'id':'view','name':'查看'},{'id':'edit_product','name':'编辑产品'},{'id':'export','name':'导出'},{'id':'import','name':'导入'}],
|
||
'planning': [{'id':'view','name':'查看'},{'id':'detail','name':'详情按钮'},{'id':'edit','name':'编辑按钮'},{'id':'delete','name':'删除按钮'},{'id':'field_setting','name':'字段设置'},{'id':'frozen','name':'冻结列'}],
|
||
'purchase_pending': [{'id':'view','name':'查看'},{'id':'detail','name':'详情按钮'},{'id':'add','name':'加入待下单'},{'id':'edit','name':'编辑下单信息'},{'id':'batch_confirm','name':'确认下单按钮'},{'id':'delete','name':'回退按钮'},{'id':'field_setting','name':'字段设置'},{'id':'frozen','name':'冻结列'}],
|
||
'purchase_backup': [{'id':'view','name':'查看'},{'id':'detail','name':'详情按钮'},{'id':'edit','name':'编辑订单'},{'id':'rollback','name':'回退按钮'},{'id':'delete','name':'删除按钮'},{'id':'export','name':'导出'},{'id':'field_setting','name':'字段设置'}],
|
||
'order_domestic': [{'id':'view','name':'查看'},{'id':'detail','name':'详情按钮'},{'id':'create','name':'新增订单'},{'id':'edit','name':'编辑订单'},{'id':'contract','name':'合同按钮'},{'id':'delete','name':'删除按钮'},{'id':'batch_contract','name':'批量生成合同'}],
|
||
'order_overseas': [{'id':'view','name':'查看'},{'id':'detail','name':'详情按钮'},{'id':'create','name':'新增订单'},{'id':'edit','name':'编辑订单'},{'id':'contract','name':'合同按钮'},{'id':'delete','name':'删除按钮'},{'id':'batch_contract','name':'批量生成合同'}],
|
||
'order_packaging': [{'id':'view','name':'查看'},{'id':'detail','name':'详情按钮'},{'id':'create','name':'新增订单'},{'id':'edit','name':'编辑订单'},{'id':'contract','name':'合同按钮'},{'id':'delete','name':'删除按钮'},{'id':'batch_contract','name':'批量生成合同'}],
|
||
'order_finished': [{'id':'view','name':'查看'},{'id':'detail','name':'详情按钮'},{'id':'delete','name':'删除按钮'},{'id':'export','name':'导出'},{'id':'field_setting','name':'字段设置'}],
|
||
'spot_application': [{'id':'view','name':'查看'},{'id':'create','name':'新增申请'},{'id':'edit','name':'审核通过/驳回'},{'id':'delete','name':'删除申请'}],
|
||
'spot_confirmation': [{'id':'view','name':'查看'},{'id':'edit','name':'编辑详情'},{'id':'import','name':'导入'},{'id':'delete','name':'删除记录'},{'id':'export','name':'导出'},{'id':'field_setting','name':'字段设置'},{'id':'frozen','name':'冻结字段'}],
|
||
'spot_authorization': [{'id':'view','name':'查看'},{'id':'create','name':'新增资料'},
|
||
{'id':'edit','name':'编辑'},{'id':'delete','name':'删除'}],
|
||
'contract_templates': [{'id':'view','name':'查看'},{'id':'edit','name':'编辑上传'},{'id':'delete','name':'删除'}],
|
||
'product_new': [{'id':'view','name':'查看'},{'id':'create','name':'新增'},{'id':'edit','name':'编辑'},{'id':'delete','name':'删除'},{'id':'sync','name':'同步产品信息'},{'id':'field_setting','name':'字段设置'}],
|
||
'product_category': [{'id':'view','name':'查看'},{'id':'create','name':'新增'},{'id':'edit','name':'编辑'},{'id':'delete','name':'删除'}],
|
||
'products': [{'id':'view','name':'查看'},{'id':'add','name':'新增产品'},{'id':'edit','name':'编辑产品'},{'id':'field_setting','name':'字段设置'}],
|
||
'brand_management': [{'id':'view','name':'查看'},{'id':'edit','name':'分类编辑'},{'id':'delete','name':'删除品牌'}],
|
||
'bom': [{'id':'view','name':'查看'},{'id':'edit','name':'编辑'}],
|
||
'warehouse': [{'id':'view','name':'查看'},{'id':'create','name':'新增仓库'},{'id':'edit','name':'编辑仓库'},{'id':'delete','name':'删除仓库'}],
|
||
'suppliers': [{'id':'view','name':'查看'},{'id':'edit','name':'编辑'},{'id':'create','name':'新增供应商'}],
|
||
'knowledge': [{'id':'view','name':'查看'},{'id':'create','name':'新建文章'},{'id':'edit','name':'编辑文章'},{'id':'delete','name':'删除文章'},{'id':'import','name':'导入'},{'id':'export','name':'导出'},{'id':'lint','name':'运行检查'},{'id':'graph','name':'关系图谱'}],
|
||
'organization': [{'id':'view','name':'查看'},{'id':'sync','name':'同步钉钉组织架构'}],
|
||
'department_matching': [{'id':'view','name':'查看与匹配测试'},{'id':'create','name':'新增规则'},{'id':'edit','name':'编辑规则'},{'id':'delete','name':'删除规则'}],
|
||
'users': [{'id':'view','name':'查看'},{'id':'create','name':'新增'},{'id':'edit','name':'编辑'},{'id':'delete','name':'删除'},{'id':'import','name':'导入'}],
|
||
'permissions': [{'id':'view','name':'查看'},{'id':'edit','name':'编辑'}],
|
||
'logs': [{'id':'view','name':'查看'},{'id':'export','name':'导出'},{'id':'verify','name':'完整性校验'},{'id':'manage','name':'日志治理'}],
|
||
'config': [{'id':'view','name':'查看'},{'id':'edit','name':'编辑'},{'id':'reset','name':'恢复默认'}],
|
||
'collaboration_sales_management': [{'id':'view','name':'查看'},{'id':'import','name':'导入'},{'id':'export','name':'导出'},{'id':'field_setting','name':'字段设置'},{'id':'delete','name':'删除'}],
|
||
'stagnant_inventory_plans': [{'id':'view','name':'查看'},{'id':'create','name':'新建方案'},{'id':'edit','name':'编辑方案'},{'id':'delete','name':'归档方案'},{'id':'export','name':'导出'}],
|
||
}
|
||
DEFAULT_FEATURES = [{'id': 'view', 'name': '查看'}]
|
||
|
||
|
||
def _sidebar_menu_pages():
|
||
"""从侧边栏模板解析页面列表（页面ID/名称/分组），作为权限配置的单一来源。
|
||
新增子菜单只需在 base.html 侧边栏添加，权限配置会自动同步。"""
|
||
import os
|
||
import re
|
||
from flask import current_app
|
||
path = os.path.join(current_app.root_path, 'templates', 'base.html')
|
||
with open(path, encoding='utf-8') as f:
|
||
html = f.read()
|
||
entries = []
|
||
seen = set()
|
||
|
||
def add(group, pid, name):
|
||
pid = normalize_permission_page(pid.strip())
|
||
name = name.strip()
|
||
if not pid or pid in seen:
|
||
return
|
||
seen.add(pid)
|
||
entries.append({'id': pid, 'name': name, 'group': group or name})
|
||
|
||
# 顶层项（nav-item 带 data-page，非分组头）
|
||
top_items = [(m.start(), m.group(1), m.group(2)) for m in re.finditer(
|
||
r'<a[^>]*class="[^"]*nav-item[^"]*"[^>]*data-page="([^"]+)"[^>]*>.*?<span class="nav-text">([^<]+)</span>',
|
||
html, re.S)]
|
||
# 分组头（位置 + 分组名）
|
||
group_headers = [(m.start(), m.group(1)) for m in re.finditer(
|
||
r'<a[^>]*class="[^"]*nav-group-header[^"]*"[^>]*>.*?<span class="nav-text">([^<]+)</span>',
|
||
html, re.S)]
|
||
submenu_re = re.compile(r'<div class="nav-submenu"[^>]*>(.*?)</div>', re.S)
|
||
submenu_items = {}
|
||
for pos, gname in group_headers:
|
||
m = submenu_re.search(html, pos)
|
||
if m:
|
||
submenu_items[pos] = (gname, [(mm.group(1), mm.group(2)) for mm in re.finditer(
|
||
r'data-page="([^"]+)"[^>]*>\s*<span class="nav-sub-icon">[^<]*</span>\s*<span>([^<]+)</span>',
|
||
m.group(1))])
|
||
|
||
# 按文档顺序合并：顶层项与分组
|
||
order = [(pos, 'top', pid, name) for pos, pid, name in top_items] + \
|
||
[(pos, 'group', gname, None) for pos, gname in group_headers]
|
||
order.sort()
|
||
for pos, kind, a, b in order:
|
||
if kind == 'top':
|
||
add(None, a, b)
|
||
else:
|
||
gname, items = submenu_items.get(pos, (a, []))
|
||
for pid, name in items:
|
||
add(gname, pid, name)
|
||
return entries
|
||
|
||
|
||
def _query_effective_operation_value(user_id, role, page, operation):
|
||
"""返回有效操作权限；未配置时返回 None，供新增按钮权限兼容旧配置。"""
|
||
if role in ('admin', 'super_admin'):
|
||
return True
|
||
pages = _permission_page_aliases(page)
|
||
placeholders = ','.join(['%s'] * len(pages))
|
||
query_role = 'viewer' if role == '查看者' else role
|
||
user_rows = query(
|
||
f"SELECT permission FROM user_permissions WHERE user_id=%s AND page IN ({placeholders}) AND operation=%s ORDER BY FIELD(page, {placeholders}) LIMIT 1",
|
||
tuple([user_id] + pages + [operation] + pages)
|
||
)
|
||
if user_rows:
|
||
return int(user_rows[0].get('permission', 0)) == 1
|
||
ensure_position_permissions()
|
||
position = user_position_code(user_id)
|
||
if position:
|
||
position_rows = query(
|
||
f"SELECT permission FROM position_operation_permissions WHERE position_code=%s AND page IN ({placeholders}) AND operation=%s ORDER BY FIELD(page, {placeholders}) LIMIT 1",
|
||
tuple([position] + pages + [operation] + pages)
|
||
)
|
||
if position_rows:
|
||
return int(position_rows[0].get('permission', 0)) == 1
|
||
role_rows = query(
|
||
f"SELECT permission FROM role_operation_permissions WHERE role=%s AND page IN ({placeholders}) AND operation=%s ORDER BY FIELD(page, {placeholders}) LIMIT 1",
|
||
tuple([query_role] + pages + [operation] + pages)
|
||
)
|
||
if role_rows:
|
||
return int(role_rows[0].get('permission', 0)) == 1
|
||
return None
|
||
|
||
|
||
def _query_effective_operation(user_id, role, page, operation):
|
||
return bool(_query_effective_operation_value(user_id, role, page, operation))
|
||
|
||
|
||
def _has_effective_page_permission(user_id, role, page):
|
||
"""页面访问权限统一走 view；管理员和超级管理员固定拥有访问权限。"""
|
||
if role in ('admin', 'super_admin'):
|
||
return True
|
||
pages = _permission_page_aliases(page)
|
||
placeholders = ','.join(['%s'] * len(pages))
|
||
user_rows = query(
|
||
f"SELECT permission FROM user_permissions WHERE user_id=%s AND page IN ({placeholders}) AND operation='view' ORDER BY FIELD(page, {placeholders}) LIMIT 1",
|
||
tuple([user_id] + pages + pages)
|
||
)
|
||
if user_rows:
|
||
return int(user_rows[0].get('permission', 0)) == 1
|
||
ensure_position_permissions()
|
||
position = user_position_code(user_id)
|
||
if position:
|
||
position_rows = query(
|
||
f"SELECT permission FROM position_operation_permissions WHERE position_code=%s AND page IN ({placeholders}) AND operation='view' ORDER BY FIELD(page, {placeholders}) LIMIT 1",
|
||
tuple([position] + pages + pages)
|
||
)
|
||
if position_rows:
|
||
return int(position_rows[0].get('permission', 0)) == 1
|
||
role_rows = query(
|
||
f"SELECT permission FROM role_operation_permissions WHERE role=%s AND page IN ({placeholders}) AND operation='view' ORDER BY FIELD(page, {placeholders}) LIMIT 1",
|
||
tuple([role] + pages + pages)
|
||
)
|
||
if role_rows:
|
||
return int(role_rows[0].get('permission', 0)) == 1
|
||
rows = query(
|
||
f"SELECT permission FROM role_permissions WHERE role=%s AND page IN ({placeholders}) LIMIT 1",
|
||
tuple([role] + pages)
|
||
)
|
||
return bool(rows and int(rows[0].get('permission', 0)) == 1)
|
||
|
||
|
||
def role_required(page):
|
||
"""从统一的有效权限模型检查当前用户是否有权限访问页面。"""
|
||
user_id = session.get('user_id')
|
||
return bool(user_id and _has_effective_page_permission(user_id, session.get('role', ''), page))
|
||
|
||
|
||
def operation_required(page, operation):
|
||
"""检查最终生效的页面操作权限；用户级明确值覆盖岗位和角色配置。"""
|
||
user_id = session.get('user_id')
|
||
return bool(user_id and _query_effective_operation(user_id, session.get('role', ''), page, operation))
|
||
|
||
|
||
def operation_required_compat(page, operation, fallback_operation):
|
||
"""新增按钮权限未配置时继承旧权限；一旦明确配置则严格使用新权限。"""
|
||
user_id = session.get('user_id')
|
||
if not user_id:
|
||
return False
|
||
role = session.get('role', '')
|
||
value = _query_effective_operation_value(user_id, role, page, operation)
|
||
if value is not None:
|
||
return bool(value)
|
||
return _query_effective_operation(user_id, role, page, fallback_operation)
|
||
|
||
|
||
# ─── 页面路由 ───
|
||
@auth_bp.route('/login', methods=['GET'])
|
||
def login():
|
||
return render_template('login.html')
|
||
|
||
|
||
@auth_bp.route('/api/login', methods=['POST'])
|
||
def api_login():
|
||
data = request.get_json(silent=True) or {}
|
||
username = data.get('username', '')
|
||
password = data.get('password', '')
|
||
|
||
users = query(
|
||
"SELECT * FROM dashboard_users WHERE username=%s",
|
||
(username,)
|
||
)
|
||
if not users:
|
||
return jsonify({"code": 401, "msg": "用户名或密码错误"})
|
||
if users[0].get('status') != 1:
|
||
return jsonify({"code": 401, "msg": "账号已禁用，请联系管理员"})
|
||
if not verify_password(users[0]['password'], password):
|
||
return jsonify({"code": 401, "msg": "用户名或密码错误"})
|
||
|
||
user = users[0]
|
||
session.clear()
|
||
session['user_id'] = user['id']
|
||
session['username'] = user['username']
|
||
session['real_name'] = user['real_name']
|
||
session['role'] = user['role']
|
||
session['user_level'] = user.get('user_level', 'employee')
|
||
session['must_change_password'] = bool(user.get('must_change_password', 0))
|
||
|
||
if session['must_change_password']:
|
||
return jsonify({"code": 0, "msg": "首次登录需要修改密码", "data": {
|
||
"must_change_password": True,
|
||
"username": user['username']
|
||
}})
|
||
|
||
# 更新最后登录时间
|
||
query(
|
||
"UPDATE dashboard_users SET last_login=NOW() WHERE id=%s",
|
||
(user['id'],)
|
||
)
|
||
# 记录登录日志（含IP）
|
||
client_ip = request.remote_addr or request.headers.get('X-Forwarded-For', '').split(',')[0].strip() or ''
|
||
add_operation_log('登录', '用户登录系统', user_id=user['id'], ip_address=client_ip,
|
||
page='登录', event_type='login', object_type='user', object_id=user['id'])
|
||
|
||
return jsonify({"code": 0, "msg": "登录成功", "data": {
|
||
"must_change_password": False,
|
||
"username": user['username'],
|
||
"real_name": user['real_name'],
|
||
"role": user['role'],
|
||
"user_level": user.get('user_level', 'employee')
|
||
}})
|
||
|
||
|
||
@auth_bp.route('/api/change-password', methods=['POST'])
|
||
@login_required
|
||
def change_password():
|
||
"""Change the current user's password before granting full access."""
|
||
data = request.get_json(silent=True) or {}
|
||
new_password = data.get('new_password', '')
|
||
confirm_password = data.get('confirm_password', '')
|
||
|
||
if new_password != confirm_password:
|
||
return jsonify({"code": 400, "msg": "两次输入的密码不一致"})
|
||
valid, message = validate_password(new_password)
|
||
if not valid:
|
||
return jsonify({"code": 400, "msg": message})
|
||
|
||
user_id = session['user_id']
|
||
rows = query("SELECT password FROM dashboard_users WHERE id=%s AND status=1", (user_id,))
|
||
if not rows:
|
||
session.clear()
|
||
return jsonify({"code": 401, "msg": "账号不存在或已停用"})
|
||
if verify_password(rows[0]['password'], new_password):
|
||
return jsonify({"code": 400, "msg": "新密码不能与原密码相同"})
|
||
|
||
query(
|
||
"UPDATE dashboard_users SET password=%s, must_change_password=0, last_login=NOW() WHERE id=%s",
|
||
(hash_password(new_password), user_id)
|
||
)
|
||
session['must_change_password'] = False
|
||
add_operation_log('修改密码', '用户首次登录完成密码修改')
|
||
return jsonify({"code": 0, "msg": "密码修改成功"})
|
||
|
||
|
||
@auth_bp.route('/api/logout', methods=['POST'])
|
||
def api_logout():
|
||
session.clear()
|
||
return jsonify({"code": 0, "msg": "已退出"})
|
||
|
||
|
||
@auth_bp.route('/')
|
||
def index():
|
||
return render_template('login.html')
|
||
|
||
|
||
@auth_bp.route('/dashboard')
|
||
@login_required
|
||
def dashboard_page():
|
||
return render_template('base.html', page='dashboard')
|
||
|
||
|
||
@auth_bp.route('/api/profile')
|
||
@login_required
|
||
def profile():
|
||
user_id = session['user_id']
|
||
role = session['role']
|
||
# 角色默认权限 + 用户级覆盖，返回与模板注入一致的最终权限。
|
||
role_perms = query(
|
||
"SELECT page, operation, permission FROM role_operation_permissions WHERE role=%s",
|
||
('viewer' if role == '查看者' else role,)
|
||
)
|
||
ensure_position_permissions()
|
||
position = user_position_code(user_id)
|
||
position_perms = query(
|
||
"SELECT page, operation, permission FROM position_operation_permissions WHERE position_code=%s",
|
||
(position,)
|
||
) if position else []
|
||
user_perms = query(
|
||
"SELECT page, operation, permission FROM user_permissions WHERE user_id=%s",
|
||
(user_id,)
|
||
)
|
||
runtime_page_aliases = {
|
||
'purchase_pending': 'purchase', 'purchase_backup': 'purchase_ready',
|
||
'order_domestic': 'orders_domestic', 'order_overseas': 'orders_overseas',
|
||
'order_packaging': 'orders_packaging', 'order_finished': 'orders_finished'
|
||
}
|
||
perm_map = {}
|
||
for p in role_perms:
|
||
runtime_page = runtime_page_aliases.get(p['page'], p['page'])
|
||
perm_map.setdefault(runtime_page, {})[p['operation']] = int(p['permission'])
|
||
for p in position_perms:
|
||
runtime_page = runtime_page_aliases.get(p['page'], p['page'])
|
||
perm_map.setdefault(runtime_page, {})[p['operation']] = int(p['permission'])
|
||
for p in user_perms:
|
||
runtime_page = runtime_page_aliases.get(p['page'], p['page'])
|
||
perm_map.setdefault(runtime_page, {})[p['operation']] = int(p['permission'])
|
||
|
||
# 管理员和超级管理员由后端统一视为全权限，前端保留空映射作为特殊标识。
|
||
if role in ('admin', 'super_admin'):
|
||
perm_map = {}
|
||
else:
|
||
# 注入字段级权限显式值（敏感字段默认隐藏 + 角色/用户字段权限）
|
||
try:
|
||
from services.field_perms import effective_field_overrides
|
||
for runtime_page, field_map in effective_field_overrides(user_id, role).items():
|
||
base = perm_map.setdefault(runtime_page, {})
|
||
for field_key, ops in field_map.items():
|
||
base['field:' + field_key + ':view'] = ops['view']
|
||
base['field:' + field_key + ':edit'] = ops['edit']
|
||
except Exception:
|
||
pass
|
||
|
||
return jsonify({
|
||
"code": 0,
|
||
"data": {
|
||
"id": user_id,
|
||
"username": session['username'],
|
||
"real_name": session['real_name'],
|
||
"role": role,
|
||
"user_level": session.get('user_level', 'employee'),
|
||
"permissions": perm_map
|
||
}
|
||
})
|
||
|
||
|
||
|
||
# ─── P1 权限数据范围与变更审计 ───
|
||
_PERMISSION_P1_TABLES_READY = False
|
||
|
||
|
||
def _ensure_permission_p1_tables():
|
||
"""创建 P1 权限控制台所需的配置/审计表；幂等且不触碰业务数据。"""
|
||
global _PERMISSION_P1_TABLES_READY
|
||
if _PERMISSION_P1_TABLES_READY:
|
||
return
|
||
query("""CREATE TABLE IF NOT EXISTS permission_data_scopes (
|
||
id BIGINT AUTO_INCREMENT PRIMARY KEY,
|
||
subject_type VARCHAR(20) NOT NULL,
|
||
subject_id VARCHAR(100) NOT NULL,
|
||
page VARCHAR(100) NOT NULL,
|
||
scope_type VARCHAR(40) NOT NULL DEFAULT 'all',
|
||
scope_value VARCHAR(500) DEFAULT '',
|
||
can_view TINYINT NOT NULL DEFAULT 1,
|
||
can_edit TINYINT NOT NULL DEFAULT 0,
|
||
can_export TINYINT NOT NULL DEFAULT 0,
|
||
created_by INT NULL,
|
||
updated_by INT NULL,
|
||
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
|
||
updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
|
||
UNIQUE KEY uq_permission_scope (subject_type, subject_id, page),
|
||
KEY idx_permission_scope_subject (subject_type, subject_id),
|
||
KEY idx_permission_scope_page (page)
|
||
)""")
|
||
query("""CREATE TABLE IF NOT EXISTS permission_change_audits (
|
||
id BIGINT AUTO_INCREMENT PRIMARY KEY,
|
||
actor_id INT NULL,
|
||
target_type VARCHAR(20) NOT NULL,
|
||
target_id VARCHAR(100) NOT NULL,
|
||
action VARCHAR(80) NOT NULL,
|
||
before_json LONGTEXT NULL,
|
||
after_json LONGTEXT NULL,
|
||
detail TEXT NULL,
|
||
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
|
||
KEY idx_permission_audit_target (target_type, target_id),
|
||
KEY idx_permission_audit_created (created_at)
|
||
)""")
|
||
ensure_position_permissions()
|
||
query("""CREATE TABLE IF NOT EXISTS permission_versions (
|
||
id BIGINT AUTO_INCREMENT PRIMARY KEY,
|
||
target_type VARCHAR(20) NOT NULL,
|
||
target_id VARCHAR(100) NOT NULL,
|
||
version_no INT NOT NULL,
|
||
snapshot_json LONGTEXT NOT NULL,
|
||
snapshot_hash CHAR(64) NOT NULL,
|
||
summary VARCHAR(500) DEFAULT '',
|
||
source_version_id BIGINT NULL,
|
||
created_by INT NULL,
|
||
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
|
||
UNIQUE KEY uq_permission_version (target_type, target_id, version_no),
|
||
KEY idx_permission_version_target (target_type, target_id, id),
|
||
KEY idx_permission_version_created (created_at)
|
||
)""")
|
||
query("""INSERT IGNORE INTO permission_data_scopes
|
||
(subject_type,subject_id,page,scope_type,scope_value,can_view,can_edit,can_export,created_by,updated_by)
|
||
SELECT 'position',p.position_code,s.page,s.scope_type,s.scope_value,s.can_view,s.can_edit,s.can_export,s.created_by,s.updated_by
|
||
FROM permission_data_scopes s
|
||
INNER JOIN user_positions p ON BINARY p.position_code=BINARY s.subject_id
|
||
WHERE s.subject_type='role' AND s.subject_id NOT IN ('super_admin','admin','viewer','查看者')""")
|
||
_PERMISSION_P1_TABLES_READY = True
|
||
|
||
|
||
def _record_permission_change(target_type, target_id, action, before=None, after=None, detail=''):
|
||
"""记录权限控制台变更，失败不阻断已完成的权限写入。"""
|
||
try:
|
||
import json
|
||
_ensure_permission_p1_tables()
|
||
query(
|
||
"INSERT INTO permission_change_audits "
|
||
"(actor_id,target_type,target_id,action,before_json,after_json,detail) "
|
||
"VALUES (%s,%s,%s,%s,%s,%s,%s)",
|
||
(
|
||
session.get('user_id'), target_type, str(target_id), action,
|
||
json.dumps(before, ensure_ascii=False, default=str) if before is not None else None,
|
||
json.dumps(after, ensure_ascii=False, default=str) if after is not None else None,
|
||
detail or '',
|
||
),
|
||
)
|
||
except Exception:
|
||
pass
|
||
|
||
|
||
_PERMISSION_CONFLICT_RULES = [
|
||
{
|
||
'id': 'confirm_and_rollback', 'level': '高',
|
||
'name': '确认下单与订单回退同时授权',
|
||
'left': ['purchase_pending.batch_confirm'],
|
||
'right': ['purchase_backup.rollback'],
|
||
'advice': '建议由不同岗位分别负责确认下单与订单回退。',
|
||
},
|
||
{
|
||
'id': 'user_and_permission_admin', 'level': '高',
|
||
'name': '用户管理与权限配置同时授权',
|
||
'left': ['users.edit', 'users.create', 'users.delete'],
|
||
'right': ['permissions.edit'],
|
||
'advice': '可修改账号又可修改权限，建议仅系统管理员持有。',
|
||
},
|
||
{
|
||
'id': 'product_and_confirm', 'level': '中',
|
||
'name': '产品资料维护与确认下单同时授权',
|
||
'left': ['products.edit', 'bom.edit', 'suppliers.edit'],
|
||
'right': ['purchase_pending.batch_confirm'],
|
||
'advice': '存在修改基础资料后直接确认下单的风险。',
|
||
},
|
||
{
|
||
'id': 'price_and_backup_edit', 'level': '高',
|
||
'name': '成本/单价编辑与订单备份编辑同时授权',
|
||
'left': [
|
||
'planning.field:成本价:edit', 'products.field:成本价:edit', 'bom.field:成本价:edit',
|
||
'order_domestic.field:单价:edit', 'order_overseas.field:单价:edit',
|
||
'order_packaging.field:单价:edit',
|
||
],
|
||
'right': ['purchase_backup.edit'],
|
||
'advice': '建议价格维护与订单审核/编辑职责分离。',
|
||
},
|
||
{
|
||
'id': 'domestic_create_delete', 'level': '中',
|
||
'name': '国内订单新增与删除同时授权',
|
||
'left': ['order_domestic.create'], 'right': ['order_domestic.delete'],
|
||
'advice': '建议限制删除权限或启用复核。',
|
||
},
|
||
{
|
||
'id': 'overseas_create_delete', 'level': '中',
|
||
'name': '海外订单新增与删除同时授权',
|
||
'left': ['order_overseas.create'], 'right': ['order_overseas.delete'],
|
||
'advice': '建议限制删除权限或启用复核。',
|
||
},
|
||
{
|
||
'id': 'packaging_create_delete', 'level': '中',
|
||
'name': '包材订单新增与删除同时授权',
|
||
'left': ['order_packaging.create'], 'right': ['order_packaging.delete'],
|
||
'advice': '建议限制删除权限或启用复核。',
|
||
},
|
||
]
|
||
|
||
|
||
def _permission_snapshot(target_type, target_id):
|
||
"""读取角色/用户完整权限状态，作为版本与回滚的唯一快照。"""
|
||
_ensure_permission_p1_tables()
|
||
target_type = str(target_type)
|
||
target_id = str(target_id)
|
||
if target_type == 'role':
|
||
legacy = query(
|
||
"SELECT page,permission FROM role_permissions WHERE role=%s ORDER BY page",
|
||
(target_id,),
|
||
)
|
||
operations = query(
|
||
"SELECT page,operation,permission FROM role_operation_permissions "
|
||
"WHERE role=%s ORDER BY page,operation", (target_id,)
|
||
)
|
||
elif target_type == 'position':
|
||
ensure_position_permissions()
|
||
legacy = []
|
||
operations = query(
|
||
"SELECT page,operation,permission FROM position_operation_permissions "
|
||
"WHERE position_code=%s ORDER BY page,operation", (target_id,)
|
||
)
|
||
elif target_type == 'user':
|
||
legacy = []
|
||
operations = query(
|
||
"SELECT page,operation,permission FROM user_permissions "
|
||
"WHERE user_id=%s ORDER BY page,operation", (int(target_id),)
|
||
)
|
||
else:
|
||
raise ValueError('不支持的权限对象类型')
|
||
scopes = query(
|
||
"SELECT page,scope_type,scope_value,can_view,can_edit,can_export "
|
||
"FROM permission_data_scopes WHERE subject_type=%s AND subject_id=%s ORDER BY page",
|
||
(target_type, target_id),
|
||
)
|
||
return {
|
||
'target_type': target_type,
|
||
'target_id': target_id,
|
||
'legacy_pages': legacy,
|
||
'operations': operations,
|
||
'data_scopes': scopes,
|
||
}
|
||
|
||
|
||
def _create_permission_version(target_type, target_id, summary, snapshot=None, source_version_id=None, force=False):
|
||
"""保存权限快照；内容未变化时默认不重复生成版本。"""
|
||
import hashlib
|
||
import json
|
||
_ensure_permission_p1_tables()
|
||
snapshot = snapshot or _permission_snapshot(target_type, target_id)
|
||
payload = json.dumps(snapshot, ensure_ascii=False, sort_keys=True, separators=(',', ':'), default=str)
|
||
digest = hashlib.sha256(payload.encode('utf-8')).hexdigest()
|
||
latest = query(
|
||
"SELECT id,version_no,snapshot_hash FROM permission_versions "
|
||
"WHERE target_type=%s AND target_id=%s ORDER BY version_no DESC LIMIT 1",
|
||
(target_type, str(target_id)),
|
||
)
|
||
if latest and latest[0].get('snapshot_hash') == digest and not force:
|
||
return latest[0].get('id')
|
||
version_no = int(latest[0].get('version_no') or 0) + 1 if latest else 1
|
||
return query(
|
||
"INSERT INTO permission_versions "
|
||
"(target_type,target_id,version_no,snapshot_json,snapshot_hash,summary,source_version_id,created_by) "
|
||
"VALUES (%s,%s,%s,%s,%s,%s,%s,%s)",
|
||
(
|
||
target_type, str(target_id), version_no, payload, digest,
|
||
str(summary or '')[:500], source_version_id, session.get('user_id'),
|
||
),
|
||
)
|
||
|
||
|
||
def _ensure_permission_baseline(target_type, target_id):
|
||
rows = query(
|
||
"SELECT id FROM permission_versions WHERE target_type=%s AND target_id=%s LIMIT 1",
|
||
(target_type, str(target_id)),
|
||
)
|
||
if not rows:
|
||
return _create_permission_version(target_type, target_id, 'P2启用时的初始权限基线', force=True)
|
||
return rows[0].get('id')
|
||
|
||
|
||
def _allowed_pairs_from_items(items):
|
||
result = set()
|
||
for item in items or []:
|
||
try:
|
||
allowed = int(item.get('permission', 0)) == 1
|
||
except (TypeError, ValueError):
|
||
allowed = False
|
||
if not allowed:
|
||
continue
|
||
page = normalize_permission_page(str(item.get('page') or '').strip())
|
||
operation = str(item.get('operation') or '').strip()
|
||
if page and operation:
|
||
result.add(f'{page}.{operation}')
|
||
return result
|
||
|
||
|
||
def _effective_user_pairs(user_id, operation_items=None, field_items=None):
|
||
users = query("SELECT role,position FROM dashboard_users WHERE id=%s LIMIT 1", (user_id,))
|
||
if not users:
|
||
return set()
|
||
role = users[0].get('role') or ''
|
||
if role in ('admin', 'super_admin'):
|
||
return {'permissions.edit', 'users.edit'}
|
||
query_role = 'viewer' if role == '查看者' else role
|
||
role_rows = query(
|
||
"SELECT page,operation,permission FROM role_operation_permissions WHERE role=%s",
|
||
(query_role,),
|
||
)
|
||
user_rows = query(
|
||
"SELECT page,operation,permission FROM user_permissions WHERE user_id=%s",
|
||
(user_id,),
|
||
)
|
||
merged = {}
|
||
for row in role_rows:
|
||
merged[(normalize_permission_page(row.get('page')), row.get('operation'))] = int(row.get('permission') or 0)
|
||
ensure_position_permissions()
|
||
position = str(users[0].get('position') or '').strip()
|
||
if position:
|
||
for row in query("SELECT page,operation,permission FROM position_operation_permissions WHERE position_code=%s", (position,)):
|
||
merged[(normalize_permission_page(row.get('page')), row.get('operation'))] = int(row.get('permission') or 0)
|
||
for row in user_rows:
|
||
operation = str(row.get('operation') or '')
|
||
if operation.startswith('field:'):
|
||
if field_items is None:
|
||
merged[(normalize_permission_page(row.get('page')), operation)] = int(row.get('permission') or 0)
|
||
elif operation_items is None:
|
||
merged[(normalize_permission_page(row.get('page')), operation)] = int(row.get('permission') or 0)
|
||
for item in operation_items or []:
|
||
page = normalize_permission_page(str(item.get('page') or '').strip())
|
||
operation = str(item.get('operation') or '').strip()
|
||
if page and operation and not operation.startswith('field:'):
|
||
merged[(page, operation)] = int(item.get('permission') or 0)
|
||
for item in field_items or []:
|
||
page = normalize_permission_page(str(item.get('page') or '').strip())
|
||
field = str(item.get('field') or '').strip()
|
||
operation = str(item.get('operation') or '').strip()
|
||
value = item.get('permission')
|
||
if page and field and operation in ('view', 'edit'):
|
||
key = (page, f'field:{field}:{operation}')
|
||
if value is None or value == '':
|
||
# 继承时移除用户覆盖，保留角色值。
|
||
role_value = next((int(r.get('permission') or 0) for r in role_rows
|
||
if normalize_permission_page(r.get('page')) == page
|
||
and r.get('operation') == key[1]), 0)
|
||
merged[key] = role_value
|
||
else:
|
||
merged[key] = int(value)
|
||
return {f'{page}.{operation}' for (page, operation), value in merged.items() if int(value) == 1}
|
||
|
||
|
||
def _detect_permission_conflicts(allowed_pairs):
|
||
conflicts = []
|
||
for rule in _PERMISSION_CONFLICT_RULES:
|
||
left = next((item for item in rule['left'] if item in allowed_pairs), None)
|
||
right = next((item for item in rule['right'] if item in allowed_pairs), None)
|
||
if left and right:
|
||
conflicts.append({
|
||
'id': rule['id'], 'level': rule['level'], 'name': rule['name'],
|
||
'left': left, 'right': right, 'advice': rule['advice'],
|
||
})
|
||
return conflicts
|
||
|
||
|
||
|
||
def _restore_permission_snapshot(snapshot):
|
||
"""在事务中恢复单个角色或用户快照。"""
|
||
from services.db import get_db
|
||
target_type = snapshot.get('target_type')
|
||
target_id = str(snapshot.get('target_id'))
|
||
conn = get_db()
|
||
try:
|
||
with conn.cursor() as cur:
|
||
if target_type == 'role':
|
||
cur.execute("DELETE FROM role_permissions WHERE role=%s", (target_id,))
|
||
legacy = snapshot.get('legacy_pages') or []
|
||
if legacy:
|
||
cur.executemany(
|
||
"INSERT INTO role_permissions (role,page,permission) VALUES (%s,%s,%s)",
|
||
[(target_id, x.get('page'), int(x.get('permission') or 0)) for x in legacy],
|
||
)
|
||
cur.execute("DELETE FROM role_operation_permissions WHERE role=%s", (target_id,))
|
||
operations = snapshot.get('operations') or []
|
||
if operations:
|
||
cur.executemany(
|
||
"INSERT INTO role_operation_permissions (role,page,operation,permission) VALUES (%s,%s,%s,%s)",
|
||
[(target_id, x.get('page'), x.get('operation'), int(x.get('permission') or 0)) for x in operations],
|
||
)
|
||
elif target_type == 'position':
|
||
ensure_position_permissions()
|
||
cur.execute("DELETE FROM position_operation_permissions WHERE position_code=%s", (target_id,))
|
||
operations = snapshot.get('operations') or []
|
||
if operations:
|
||
cur.executemany(
|
||
"INSERT INTO position_operation_permissions (position_code,page,operation,permission) VALUES (%s,%s,%s,%s)",
|
||
[(target_id, x.get('page'), x.get('operation'), int(x.get('permission') or 0)) for x in operations],
|
||
)
|
||
elif target_type == 'user':
|
||
user_id = int(target_id)
|
||
cur.execute("DELETE FROM user_permissions WHERE user_id=%s", (user_id,))
|
||
operations = snapshot.get('operations') or []
|
||
if operations:
|
||
cur.executemany(
|
||
"INSERT INTO user_permissions (user_id,page,operation,permission) VALUES (%s,%s,%s,%s)",
|
||
[(user_id, x.get('page'), x.get('operation'), int(x.get('permission') or 0)) for x in operations],
|
||
)
|
||
else:
|
||
raise ValueError('不支持的权限对象类型')
|
||
|
||
cur.execute(
|
||
"DELETE FROM permission_data_scopes WHERE subject_type=%s AND subject_id=%s",
|
||
(target_type, target_id),
|
||
)
|
||
scopes = snapshot.get('data_scopes') or []
|
||
if scopes:
|
||
cur.executemany(
|
||
"INSERT INTO permission_data_scopes "
|
||
"(subject_type,subject_id,page,scope_type,scope_value,can_view,can_edit,can_export,created_by,updated_by) "
|
||
"VALUES (%s,%s,%s,%s,%s,%s,%s,%s,%s,%s)",
|
||
[(
|
||
target_type, target_id, normalize_permission_page(x.get('page')),
|
||
x.get('scope_type') or 'all', x.get('scope_value') or '',
|
||
int(x.get('can_view') or 0), int(x.get('can_edit') or 0), int(x.get('can_export') or 0),
|
||
session.get('user_id'), session.get('user_id'),
|
||
) for x in scopes],
|
||
)
|
||
conn.commit()
|
||
except Exception:
|
||
conn.rollback()
|
||
raise
|
||
finally:
|
||
conn.close()
|
||
|
||
|
||
def _flatten_permission_snapshot(snapshot):
|
||
flat = {}
|
||
for item in snapshot.get('legacy_pages') or []:
|
||
flat[f"页面:{normalize_permission_page(item.get('page'))}"] = int(item.get('permission') or 0)
|
||
for item in snapshot.get('operations') or []:
|
||
flat[f"操作:{normalize_permission_page(item.get('page'))}:{item.get('operation')}"] = int(item.get('permission') or 0)
|
||
for item in snapshot.get('data_scopes') or []:
|
||
flat[f"范围:{normalize_permission_page(item.get('page'))}"] = {
|
||
'scope_type': item.get('scope_type') or 'all',
|
||
'scope_value': item.get('scope_value') or '',
|
||
'can_view': int(item.get('can_view') or 0),
|
||
'can_edit': int(item.get('can_edit') or 0),
|
||
'can_export': int(item.get('can_export') or 0),
|
||
}
|
||
return flat
|
||
|
||
|
||
@auth_bp.route('/api/permissions/conflicts/check', methods=['POST'])
|
||
@login_required
|
||
def permission_conflicts_check():
|
||
"""检查角色或用户拟议权限是否存在职责冲突。"""
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
data = request.get_json(silent=True) or {}
|
||
subject_type = str(data.get('subject_type') or 'role')
|
||
subject_id = str(data.get('subject_id') or '')
|
||
items = data.get('items') or []
|
||
field_items = data.get('field_items') or []
|
||
if subject_type in ('role', 'position'):
|
||
pairs = _allowed_pairs_from_items(items)
|
||
elif subject_type == 'user' and subject_id:
|
||
pairs = _effective_user_pairs(int(subject_id), operation_items=items, field_items=field_items)
|
||
else:
|
||
return jsonify({"code": 400, "msg": "参数错误"})
|
||
conflicts = _detect_permission_conflicts(pairs)
|
||
return jsonify({"code": 0, "data": {"conflicts": conflicts, "count": len(conflicts)}})
|
||
|
||
|
||
@auth_bp.route('/api/permissions/versions')
|
||
@login_required
|
||
def permission_versions():
|
||
"""列出角色或用户权限版本；首次读取自动建立当前基线。"""
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
_ensure_permission_p1_tables()
|
||
target_type = str(request.args.get('target_type') or 'role')
|
||
target_id = str(request.args.get('target_id') or '')
|
||
if target_type not in ('role', 'position', 'user') or not target_id:
|
||
return jsonify({"code": 400, "msg": "参数错误"})
|
||
_ensure_permission_baseline(target_type, target_id)
|
||
rows = query(
|
||
"SELECT v.id,v.target_type,v.target_id,v.version_no,v.summary,v.source_version_id,v.created_by,v.created_at,u.real_name AS creator_name "
|
||
"FROM permission_versions v LEFT JOIN dashboard_users u ON u.id=v.created_by "
|
||
"WHERE v.target_type=%s AND v.target_id=%s ORDER BY v.version_no DESC",
|
||
(target_type, target_id),
|
||
)
|
||
for row in rows:
|
||
if row.get('created_at') and hasattr(row['created_at'], 'strftime'):
|
||
row['created_at'] = row['created_at'].strftime('%Y-%m-%d %H:%M:%S')
|
||
return jsonify({"code": 0, "data": rows})
|
||
|
||
|
||
@auth_bp.route('/api/permissions/versions/detail')
|
||
@login_required
|
||
def permission_version_detail():
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
import json
|
||
version_id = request.args.get('id', type=int)
|
||
rows = query(
|
||
"SELECT v.*,u.real_name AS creator_name FROM permission_versions v "
|
||
"LEFT JOIN dashboard_users u ON u.id=v.created_by WHERE v.id=%s LIMIT 1",
|
||
(version_id,)
|
||
) if version_id else []
|
||
if not rows:
|
||
return jsonify({"code": 404, "msg": "权限版本不存在"})
|
||
row = rows[0]
|
||
if row.get('created_at') and hasattr(row['created_at'], 'strftime'):
|
||
row['created_at'] = row['created_at'].strftime('%Y-%m-%d %H:%M:%S')
|
||
snapshot = json.loads(row.get('snapshot_json') or '{}')
|
||
return jsonify({"code": 0, "data": {"meta": {k: v for k, v in row.items() if k != 'snapshot_json'}, "snapshot": snapshot}})
|
||
|
||
|
||
@auth_bp.route('/api/permissions/versions/compare')
|
||
@login_required
|
||
def permission_versions_compare():
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
import json
|
||
left_id = request.args.get('left', type=int)
|
||
right_id = request.args.get('right', type=int)
|
||
rows = query("SELECT id,snapshot_json FROM permission_versions WHERE id IN (%s,%s)", (left_id, right_id)) if left_id and right_id else []
|
||
mapping = {row['id']: json.loads(row.get('snapshot_json') or '{}') for row in rows}
|
||
if left_id not in mapping or right_id not in mapping:
|
||
return jsonify({"code": 404, "msg": "对比版本不存在"})
|
||
left = _flatten_permission_snapshot(mapping[left_id])
|
||
right = _flatten_permission_snapshot(mapping[right_id])
|
||
keys = sorted(set(left) | set(right))
|
||
changes = []
|
||
for key in keys:
|
||
if left.get(key) != right.get(key):
|
||
changes.append({'key': key, 'before': left.get(key), 'after': right.get(key)})
|
||
return jsonify({"code": 0, "data": {"changes": changes, "count": len(changes)}})
|
||
|
||
|
||
@auth_bp.route('/api/permissions/versions/rollback', methods=['POST'])
|
||
@login_required
|
||
def permission_version_rollback():
|
||
"""将单个角色或用户权限回滚到指定版本，并保留回滚前/后的版本。"""
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
import json
|
||
data = request.get_json(silent=True) or {}
|
||
version_id = int(data.get('version_id') or 0)
|
||
rows = query("SELECT * FROM permission_versions WHERE id=%s LIMIT 1", (version_id,)) if version_id else []
|
||
if not rows:
|
||
return jsonify({"code": 404, "msg": "权限版本不存在"})
|
||
row = rows[0]
|
||
target_type, target_id = row['target_type'], str(row['target_id'])
|
||
if target_type == 'role' and target_id == 'super_admin':
|
||
return jsonify({"code": 403, "msg": "超级管理员角色不可回滚"})
|
||
if session.get('role') == 'admin' and ((target_type == 'role' and target_id == 'admin')):
|
||
return jsonify({"code": 403, "msg": "管理员不能回滚管理员角色"})
|
||
if target_type == 'user':
|
||
users = query("SELECT role FROM dashboard_users WHERE id=%s", (int(target_id),))
|
||
if not users or users[0].get('role') == 'super_admin':
|
||
return jsonify({"code": 403, "msg": "目标用户不可回滚"})
|
||
if session.get('role') == 'admin' and users[0].get('role') == 'admin':
|
||
return jsonify({"code": 403, "msg": "管理员不能回滚其他管理员"})
|
||
current = _permission_snapshot(target_type, target_id)
|
||
_create_permission_version(target_type, target_id, '回滚前自动备份', snapshot=current, force=True)
|
||
snapshot = json.loads(row.get('snapshot_json') or '{}')
|
||
_restore_permission_snapshot(snapshot)
|
||
new_id = _create_permission_version(
|
||
target_type, target_id, f"回滚到 V{row['version_no']}",
|
||
snapshot=_permission_snapshot(target_type, target_id), source_version_id=version_id, force=True,
|
||
)
|
||
_record_permission_change(target_type, target_id, 'version_rollback', before=current, after=snapshot, detail=f"回滚到权限版本 V{row['version_no']}")
|
||
add_operation_log('权限变更', f"{target_type}={target_id} 回滚到权限版本 V{row['version_no']}")
|
||
return jsonify({"code": 0, "msg": "权限回滚成功", "data": {"version_id": new_id}})
|
||
|
||
# ─── API: 角色权限管理 ───
|
||
@auth_bp.route('/api/permissions/pages')
|
||
@login_required
|
||
def permission_pages():
|
||
"""获取所有可配置的页面列表"""
|
||
if session.get("role") not in ("admin", "super_admin"):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
pages = _sidebar_menu_pages()
|
||
return jsonify({"code": 0, "data": pages})
|
||
|
||
|
||
@auth_bp.route('/api/permissions/menu-tree')
|
||
@login_required
|
||
def permission_menu_tree():
|
||
"""权限配置菜单树：页面 + 分组 + 操作特征，由侧边栏自动生成。"""
|
||
if session.get("role") not in ("admin", "super_admin"):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
tree = []
|
||
index = {}
|
||
for pg in _sidebar_menu_pages():
|
||
g = pg['group']
|
||
if g not in index:
|
||
index[g] = {'name': g, 'items': []}
|
||
tree.append(index[g])
|
||
index[g]['items'].append({
|
||
'page': pg['id'],
|
||
'name': pg['name'],
|
||
'features': PAGE_FEATURES.get(pg['id'], DEFAULT_FEATURES),
|
||
})
|
||
return jsonify({"code": 0, "data": tree})
|
||
|
||
|
||
@auth_bp.route('/api/permissions/fields')
|
||
@login_required
|
||
def permission_fields():
|
||
"""获取所有页面的字段清单（单一来源），含敏感字段标记，供权限配置矩阵渲染。"""
|
||
if session.get("role") not in ("admin", "super_admin"):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
from services.field_perms import FIELD_REGISTRY, _FIELD_REGISTRY_ALIASES
|
||
data = {}
|
||
for page, fields in FIELD_REGISTRY.items():
|
||
data[page] = [
|
||
{'key': f['key'], 'label': f['key'], 'sensitive': bool(f.get('sensitive'))}
|
||
for f in fields
|
||
]
|
||
# 运行页面 ID 别名共享同一字段清单（如 product_packaging → product_new、purchase → purchase_pending）
|
||
for runtime_id, canonical_id in _FIELD_REGISTRY_ALIASES.items():
|
||
if canonical_id in data:
|
||
data.setdefault(runtime_id, data[canonical_id])
|
||
return jsonify({"code": 0, "data": data})
|
||
|
||
|
||
@auth_bp.route('/api/permissions/list')
|
||
@login_required
|
||
def permission_list():
|
||
"""获取所有角色的权限配置"""
|
||
if session.get("role") not in ("admin", "super_admin"):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
perms = query(
|
||
"SELECT role, page, permission FROM role_permissions ORDER BY role, page"
|
||
)
|
||
return jsonify({"code": 0, "data": perms})
|
||
|
||
|
||
@auth_bp.route('/api/permissions/roles')
|
||
@login_required
|
||
def permission_roles():
|
||
"""获取所有可配置的角色列表"""
|
||
if session.get("role") not in ("admin", "super_admin"):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
roles = [
|
||
{'id': 'super_admin', 'name': '超级管理员', 'system': True},
|
||
{'id': 'admin', 'name': '管理员', 'system': True},
|
||
{'id': 'viewer', 'name': '查看者', 'system': True},
|
||
]
|
||
return jsonify({"code": 0, "data": roles})
|
||
|
||
|
||
@auth_bp.route('/api/permissions/save', methods=['POST'])
|
||
@login_required
|
||
def permission_save():
|
||
"""保存角色权限配置"""
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
data = request.get_json(silent=True) or {}
|
||
items = data.get('items', [])
|
||
affected_roles = sorted({str(item.get('role') or '') for item in items if item.get('role')})
|
||
for role_id in affected_roles:
|
||
_ensure_permission_baseline('role', role_id)
|
||
try:
|
||
for item in items:
|
||
role = item.get('role')
|
||
page = item.get('page')
|
||
permission = int(item.get('permission', 0))
|
||
if permission:
|
||
query(
|
||
"INSERT INTO role_permissions (role, page, permission) VALUES (%s, %s, 1) "
|
||
"ON DUPLICATE KEY UPDATE permission=1",
|
||
(role, page)
|
||
)
|
||
else:
|
||
query(
|
||
"DELETE FROM role_permissions WHERE role=%s AND page=%s",
|
||
(role, page)
|
||
)
|
||
for role_id in affected_roles:
|
||
_create_permission_version('role', role_id, '保存角色页面权限')
|
||
add_operation_log('权限变更', '保存角色权限配置')
|
||
_record_permission_change('role', ','.join(affected_roles) or 'bulk', 'page_permission_save', after=items, detail='保存角色页面权限配置')
|
||
return jsonify({"code": 0, "msg": "保存成功"})
|
||
except Exception as e:
|
||
return jsonify({"code": 500, "msg": str(e)})
|
||
|
||
|
||
# ─── API: 用户权限管理 ───
|
||
OPERATIONS = [
|
||
{'id': 'view', 'name': '查看'},
|
||
{'id': 'create', 'name': '新增'},
|
||
{'id': 'edit', 'name': '编辑'},
|
||
{'id': 'delete', 'name': '删除'},
|
||
{'id': 'export', 'name': '导出'},
|
||
{'id': 'import', 'name': '导入'},
|
||
]
|
||
|
||
|
||
@auth_bp.route('/api/permissions/operations')
|
||
@login_required
|
||
def permission_operations():
|
||
"""获取所有可配置的操作列表"""
|
||
return jsonify({"code": 0, "data": OPERATIONS})
|
||
|
||
|
||
# ─── API: 角色操作权限管理 ───
|
||
@auth_bp.route('/api/permissions/role-operations')
|
||
@login_required
|
||
def permission_role_operations():
|
||
"""获取所有角色的操作权限配置"""
|
||
if session.get("role") not in ("admin", "super_admin"):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
perms = query(
|
||
"SELECT role, page, operation, permission FROM role_operation_permissions ORDER BY role, page, operation"
|
||
)
|
||
return jsonify({"code": 0, "data": perms})
|
||
|
||
|
||
@auth_bp.route('/api/permissions/role-operations/save', methods=['POST'])
|
||
@login_required
|
||
def permission_role_operations_save():
|
||
"""保存角色操作权限配置，并执行职责冲突检查与版本留档。"""
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
data = request.get_json(silent=True) or {}
|
||
items = data.get('items', [])
|
||
if session.get('role') == 'admin' and any(item.get('role') in ('admin', 'super_admin') for item in items):
|
||
return jsonify({"code": 403, "msg": "管理员不能修改管理员或超级管理员的角色权限"})
|
||
affected_roles = sorted({str(item.get('role') or '') for item in items if item.get('role')})
|
||
all_conflicts = []
|
||
for role_id in affected_roles:
|
||
role_items = [item for item in items if str(item.get('role') or '') == role_id]
|
||
for conflict in _detect_permission_conflicts(_allowed_pairs_from_items(role_items)):
|
||
current = dict(conflict)
|
||
current['subject_id'] = role_id
|
||
all_conflicts.append(current)
|
||
if all_conflicts and not data.get('confirm_conflicts'):
|
||
return jsonify({"code": 409, "msg": "检测到职责冲突，请确认后再保存", "data": {"conflicts": all_conflicts}}), 409
|
||
for role_id in affected_roles:
|
||
_ensure_permission_baseline('role', role_id)
|
||
try:
|
||
from services.db import get_db
|
||
conn = get_db()
|
||
with conn.cursor() as cur:
|
||
for item in items:
|
||
role = item.get('role')
|
||
page = normalize_permission_page(item.get('page'))
|
||
operation = item.get('operation')
|
||
permission = int(item.get('permission', 0))
|
||
cur.execute(
|
||
"INSERT INTO role_operation_permissions (role, page, operation, permission) "
|
||
"VALUES (%s, %s, %s, %s) ON DUPLICATE KEY UPDATE permission=%s",
|
||
(role, page, operation, permission, permission)
|
||
)
|
||
conn.commit()
|
||
conn.close()
|
||
for role_id in affected_roles:
|
||
_create_permission_version('role', role_id, '保存角色操作/字段权限')
|
||
add_operation_log('权限变更', '保存角色操作权限配置')
|
||
_record_permission_change('role', ','.join(affected_roles) or 'bulk', 'role_operation_save', after=items, detail='保存角色操作权限配置')
|
||
return jsonify({"code": 0, "msg": "保存成功", "data": {"conflicts": all_conflicts}})
|
||
except Exception as e:
|
||
return jsonify({"code": 500, "msg": str(e)})
|
||
|
||
@auth_bp.route('/api/permissions/positions')
|
||
@login_required
|
||
def permission_positions():
|
||
"""获取岗位权限矩阵使用的启用岗位。"""
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
ensure_position_permissions()
|
||
rows = query("""SELECT p.position_code AS id,p.position_name AS name,p.sort_order,
|
||
COUNT(u.id) AS user_count
|
||
FROM user_positions p
|
||
LEFT JOIN dashboard_users u ON BINARY u.position=BINARY p.position_code
|
||
WHERE p.status=1
|
||
GROUP BY p.id,p.position_code,p.position_name,p.sort_order
|
||
ORDER BY p.sort_order,p.id""")
|
||
return jsonify({"code": 0, "data": rows})
|
||
|
||
|
||
@auth_bp.route('/api/permissions/position-operations')
|
||
@login_required
|
||
def permission_position_operations():
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
ensure_position_permissions()
|
||
rows = query("SELECT position_code AS role,page,operation,permission FROM position_operation_permissions ORDER BY position_code,page,operation")
|
||
return jsonify({"code": 0, "data": rows})
|
||
|
||
|
||
@auth_bp.route('/api/permissions/position-operations/save', methods=['POST'])
|
||
@login_required
|
||
def permission_position_operations_save():
|
||
"""保存岗位操作/字段权限。"""
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
ensure_position_permissions()
|
||
data = request.get_json(silent=True) or {}
|
||
items = data.get('items') or []
|
||
positions = sorted({str(item.get('position_code') or item.get('role') or '') for item in items if item.get('position_code') or item.get('role')})
|
||
conflicts = []
|
||
for code in positions:
|
||
proposed = [item for item in items if str(item.get('position_code') or item.get('role') or '') == code]
|
||
for conflict in _detect_permission_conflicts(_allowed_pairs_from_items(proposed)):
|
||
current = dict(conflict); current['subject_id'] = code; conflicts.append(current)
|
||
if conflicts and not data.get('confirm_conflicts'):
|
||
return jsonify({"code": 409, "msg": "检测到职责冲突，请确认后再保存", "data": {"conflicts": conflicts}}), 409
|
||
for code in positions:
|
||
_ensure_permission_baseline('position', code)
|
||
try:
|
||
from services.db import get_db
|
||
conn = get_db()
|
||
with conn.cursor() as cur:
|
||
for item in items:
|
||
code = str(item.get('position_code') or item.get('role') or '')
|
||
cur.execute("""INSERT INTO position_operation_permissions(position_code,page,operation,permission)
|
||
VALUES (%s,%s,%s,%s) ON DUPLICATE KEY UPDATE permission=%s""",
|
||
(code, normalize_permission_page(item.get('page')), item.get('operation'), int(item.get('permission') or 0), int(item.get('permission') or 0)))
|
||
conn.commit()
|
||
conn.close()
|
||
for code in positions:
|
||
_create_permission_version('position', code, '保存岗位操作/字段权限')
|
||
_record_permission_change('position', ','.join(positions), 'position_operation_save', after=items, detail='保存岗位操作权限')
|
||
add_operation_log('权限变更', '保存岗位操作权限配置')
|
||
return jsonify({"code": 0, "msg": "保存成功", "data": {"conflicts": conflicts}})
|
||
except Exception as exc:
|
||
return jsonify({"code": 500, "msg": str(exc)})
|
||
|
||
|
||
@auth_bp.route('/api/permissions/users')
|
||
@login_required
|
||
def permission_users():
|
||
"""获取用户的权限配置（按用户分组）"""
|
||
if session.get("role") not in ("admin", "super_admin"):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
users = query(
|
||
"SELECT u.id, u.username, u.real_name, u.role, u.position, u.user_level, "
|
||
"COALESCE(NULLIF(p.position_name, ''), NULLIF(u.position, ''), '未设置岗位') AS position_name "
|
||
"FROM dashboard_users u "
|
||
"LEFT JOIN user_positions p ON BINARY p.position_code=BINARY u.position "
|
||
"ORDER BY FIELD(u.role, 'super_admin','admin'), u.real_name"
|
||
)
|
||
# 获取所有用户权限设置
|
||
user_perms = query(
|
||
"SELECT user_id, page, operation, permission FROM user_permissions ORDER BY user_id, page"
|
||
)
|
||
# 构建用户权限字典
|
||
perm_map = {}
|
||
for p in user_perms:
|
||
uid = p['user_id']
|
||
if uid not in perm_map:
|
||
perm_map[uid] = {}
|
||
if p['page'] not in perm_map[uid]:
|
||
perm_map[uid][p['page']] = {}
|
||
perm_map[uid][p['page']][p['operation']] = p['permission']
|
||
|
||
for u in users:
|
||
u['permissions'] = perm_map.get(u['id'], {})
|
||
|
||
return jsonify({"code": 0, "data": users})
|
||
|
||
|
||
@auth_bp.route('/api/permissions/user/save', methods=['POST'])
|
||
@login_required
|
||
def permission_user_save():
|
||
"""保存单个用户的操作权限，执行职责冲突检查与版本留档。"""
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
data = request.get_json(silent=True) or {}
|
||
user_id = data.get('user_id')
|
||
items = data.get('items', [])
|
||
if not user_id:
|
||
return jsonify({"code": 400, "msg": "参数错误"})
|
||
target = query("SELECT role FROM dashboard_users WHERE id=%s", (user_id,))
|
||
if not target:
|
||
return jsonify({"code": 400, "msg": "用户不存在"})
|
||
if target[0]['role'] == 'super_admin':
|
||
return jsonify({"code": 403, "msg": "超级管理员权限不可修改"})
|
||
if session.get('role') == 'admin' and target[0]['role'] == 'admin':
|
||
return jsonify({"code": 403, "msg": "管理员不能修改其他管理员的个人权限"})
|
||
conflicts = _detect_permission_conflicts(_effective_user_pairs(int(user_id), operation_items=items))
|
||
if conflicts and not data.get('confirm_conflicts'):
|
||
return jsonify({"code": 409, "msg": "检测到职责冲突，请确认后再保存", "data": {"conflicts": conflicts}}), 409
|
||
_ensure_permission_baseline('user', user_id)
|
||
try:
|
||
from services.db import get_db
|
||
conn = get_db()
|
||
with conn.cursor() as cur:
|
||
upsert_map = {}
|
||
for item in items:
|
||
page = normalize_permission_page(str(item.get('page', '')).strip())
|
||
operation = str(item.get('operation', 'view')).strip()
|
||
if not page or not operation or operation.startswith('field:'):
|
||
continue
|
||
upsert_map[(page, operation)] = 1 if int(item.get('permission', 0)) == 1 else 0
|
||
cur.execute("DELETE FROM user_permissions WHERE user_id=%s AND operation NOT LIKE 'field:%%'", (user_id,))
|
||
rows = [(user_id, page, operation, value) for (page, operation), value in upsert_map.items()]
|
||
if rows:
|
||
cur.executemany(
|
||
"INSERT INTO user_permissions (user_id,page,operation,permission) VALUES (%s,%s,%s,%s)", rows
|
||
)
|
||
conn.commit()
|
||
conn.close()
|
||
_create_permission_version('user', user_id, '保存用户操作权限')
|
||
add_operation_log('权限变更', f'保存用户 #{user_id} 权限配置')
|
||
_record_permission_change('user', user_id, 'user_operation_save', after=items, detail=f'保存用户 #{user_id} 操作权限')
|
||
return jsonify({"code": 0, "msg": "保存成功", "data": {"conflicts": conflicts}})
|
||
except Exception as e:
|
||
return jsonify({"code": 500, "msg": str(e)})
|
||
|
||
@auth_bp.route('/api/permissions/user/field-perms')
|
||
@login_required
|
||
def permission_user_field_perms():
|
||
"""获取用户字段级权限 + 页面级有效权限（角色+用户合并）"""
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
user_id = request.args.get('user_id', type=int)
|
||
if not user_id:
|
||
return jsonify({"code": 400, "msg": "参数错误"})
|
||
|
||
# 获取该用户信息
|
||
user = query("SELECT role, position FROM dashboard_users WHERE id=%s", (user_id,))
|
||
if not user:
|
||
return jsonify({"code": 400, "msg": "用户不存在"})
|
||
user_role = user[0]['role']
|
||
|
||
# 获取角色级权限
|
||
role_perms = query(
|
||
"SELECT page, operation, permission FROM role_operation_permissions WHERE role=%s",
|
||
('viewer' if user_role == '查看者' else user_role,)
|
||
)
|
||
ensure_position_permissions()
|
||
position_code = str(user[0].get('position') or '').strip()
|
||
position_perms = query(
|
||
"SELECT page,operation,permission FROM position_operation_permissions WHERE position_code=%s",
|
||
(position_code,)
|
||
) if position_code else []
|
||
|
||
# 获取用户级字段权限
|
||
user_perms = query(
|
||
"SELECT page, operation, permission FROM user_permissions WHERE user_id=%s",
|
||
(user_id,)
|
||
)
|
||
|
||
# 构建用户级权限字典
|
||
user_perm_map = {}
|
||
user_field_map = {} # 字段级权限
|
||
user_op_map = {} # 操作级权限
|
||
for p in user_perms:
|
||
page = normalize_permission_page(p['page'])
|
||
op = p['operation']
|
||
if op.startswith('field:'):
|
||
if page not in user_field_map:
|
||
user_field_map[page] = {}
|
||
parts = op.split(':', 2)
|
||
if len(parts) == 3:
|
||
fname, otype = parts[1], parts[2]
|
||
else:
|
||
fname, otype = parts[1], 'view'
|
||
if fname not in user_field_map[page]:
|
||
user_field_map[page][fname] = {}
|
||
user_field_map[page][fname][otype] = p['permission']
|
||
else:
|
||
if page not in user_op_map:
|
||
user_op_map[page] = {}
|
||
user_op_map[page][op] = p['permission']
|
||
|
||
# 角色权限作为默认值，用户级配置覆盖角色级配置；0 代表明确拒绝。
|
||
effective_op_perms = {}
|
||
for p in role_perms:
|
||
page = normalize_permission_page(p['page'])
|
||
effective_op_perms.setdefault(page, {})[p['operation']] = int(p['permission'])
|
||
for p in position_perms:
|
||
page = normalize_permission_page(p['page'])
|
||
effective_op_perms.setdefault(page, {})[p['operation']] = int(p['permission'])
|
||
for p in user_perms:
|
||
page = normalize_permission_page(p['page'])
|
||
op = p['operation']
|
||
if op.startswith('field:'):
|
||
continue
|
||
effective_op_perms.setdefault(page, {})[op] = int(p['permission'])
|
||
|
||
return jsonify({"code": 0, "data": {
|
||
"field_perms": user_field_map,
|
||
"role_perms": effective_op_perms,
|
||
"role_field_perms": _inherited_field_perms_map(user_id, user_role),
|
||
"role_defaults": {
|
||
page: {
|
||
p['operation']: int(p['permission'])
|
||
for p in (role_perms + position_perms)
|
||
if normalize_permission_page(p['page']) == page and not p['operation'].startswith('field:')
|
||
}
|
||
for page in {normalize_permission_page(p['page']) for p in (role_perms + position_perms)}
|
||
},
|
||
"position_code": position_code,
|
||
"user_overrides": user_op_map
|
||
}})
|
||
|
||
|
||
|
||
@auth_bp.route('/api/permissions/data-scopes')
|
||
@login_required
|
||
def permission_data_scopes():
|
||
"""读取角色/用户的数据范围配置。"""
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
_ensure_permission_p1_tables()
|
||
subject_type = (request.args.get('subject_type') or 'role').strip()
|
||
subject_id = (request.args.get('subject_id') or '').strip()
|
||
if subject_type not in ('role', 'position', 'user') or not subject_id:
|
||
return jsonify({"code": 400, "msg": "参数错误"})
|
||
rows = query(
|
||
"SELECT id,subject_type,subject_id,page,scope_type,scope_value,can_view,can_edit,can_export,updated_by,updated_at "
|
||
"FROM permission_data_scopes WHERE subject_type=%s AND subject_id=%s ORDER BY page",
|
||
(subject_type, subject_id),
|
||
)
|
||
return jsonify({"code": 0, "data": rows})
|
||
|
||
|
||
@auth_bp.route('/api/permissions/data-scopes/save', methods=['POST'])
|
||
@login_required
|
||
def permission_data_scopes_save():
|
||
"""保存角色/用户数据范围，并生成权限版本。"""
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
_ensure_permission_p1_tables()
|
||
data = request.get_json(silent=True) or {}
|
||
subject_type = str(data.get('subject_type') or 'role').strip()
|
||
subject_id = str(data.get('subject_id') or '').strip()
|
||
items = data.get('items') or []
|
||
if subject_type not in ('role', 'position', 'user') or not subject_id:
|
||
return jsonify({"code": 400, "msg": "参数错误"})
|
||
_ensure_permission_baseline(subject_type, subject_id)
|
||
before = query(
|
||
"SELECT page,scope_type,scope_value,can_view,can_edit,can_export FROM permission_data_scopes "
|
||
"WHERE subject_type=%s AND subject_id=%s ORDER BY page", (subject_type, subject_id)
|
||
)
|
||
conn = None
|
||
try:
|
||
from services.db import get_db
|
||
conn = get_db()
|
||
with conn.cursor() as cur:
|
||
for item in items:
|
||
page = normalize_permission_page(str(item.get('page') or '').strip())
|
||
if not page:
|
||
continue
|
||
scope_type = str(item.get('scope_type') or 'all').strip()
|
||
if scope_type not in ('all', 'self', 'follower', 'planner', 'product_type'):
|
||
raise ValueError('不支持的数据范围类型')
|
||
values = (
|
||
subject_type, subject_id, page, scope_type, str(item.get('scope_value') or ''),
|
||
int(bool(item.get('can_view', True))), int(bool(item.get('can_edit', False))),
|
||
int(bool(item.get('can_export', False))), session.get('user_id'), session.get('user_id'),
|
||
scope_type, str(item.get('scope_value') or ''), int(bool(item.get('can_view', True))),
|
||
int(bool(item.get('can_edit', False))), int(bool(item.get('can_export', False))), session.get('user_id'),
|
||
)
|
||
cur.execute(
|
||
"INSERT INTO permission_data_scopes "
|
||
"(subject_type,subject_id,page,scope_type,scope_value,can_view,can_edit,can_export,created_by,updated_by) "
|
||
"VALUES (%s,%s,%s,%s,%s,%s,%s,%s,%s,%s) "
|
||
"ON DUPLICATE KEY UPDATE scope_type=%s,scope_value=%s,can_view=%s,can_edit=%s,can_export=%s,updated_by=%s",
|
||
values,
|
||
)
|
||
conn.commit()
|
||
conn.close()
|
||
after = query(
|
||
"SELECT page,scope_type,scope_value,can_view,can_edit,can_export FROM permission_data_scopes "
|
||
"WHERE subject_type=%s AND subject_id=%s ORDER BY page", (subject_type, subject_id)
|
||
)
|
||
_create_permission_version(subject_type, subject_id, '保存数据范围权限')
|
||
_record_permission_change(subject_type, subject_id, 'data_scope_save', before=before, after=after, detail='保存数据范围权限')
|
||
add_operation_log('权限变更', f'保存{subject_type}={subject_id}的数据范围权限')
|
||
return jsonify({"code": 0, "msg": "数据范围保存成功", "data": after})
|
||
except Exception as exc:
|
||
try:
|
||
if conn:
|
||
conn.rollback()
|
||
conn.close()
|
||
except Exception:
|
||
pass
|
||
return jsonify({"code": 500, "msg": str(exc)})
|
||
|
||
@auth_bp.route('/api/permissions/audits')
|
||
@login_required
|
||
def permission_audits():
|
||
"""读取权限变更审计记录。"""
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
_ensure_permission_p1_tables()
|
||
try:
|
||
page = max(request.args.get('page', 1, type=int), 1)
|
||
size = min(max(request.args.get('size', 30, type=int), 1), 100)
|
||
keyword = (request.args.get('keyword') or '').strip()
|
||
where, params = [], []
|
||
if keyword:
|
||
where.append('(target_id LIKE %s OR action LIKE %s OR detail LIKE %s)')
|
||
params.extend([f'%{keyword}%', f'%{keyword}%', f'%{keyword}%'])
|
||
clause = (' WHERE ' + ' AND '.join(where)) if where else ''
|
||
total = query('SELECT COUNT(*) AS total FROM permission_change_audits' + clause, params)[0]['total']
|
||
rows = query(
|
||
'SELECT a.id,a.actor_id,a.target_type,a.target_id,a.action,a.before_json,a.after_json,a.detail,a.created_at,u.real_name AS actor_name '
|
||
'FROM permission_change_audits a LEFT JOIN dashboard_users u ON u.id=a.actor_id' + clause +
|
||
' ORDER BY a.id DESC LIMIT %s OFFSET %s', params + [size, (page - 1) * size]
|
||
)
|
||
for row in rows:
|
||
if row.get('created_at') and hasattr(row['created_at'], 'strftime'):
|
||
row['created_at'] = row['created_at'].strftime('%Y-%m-%d %H:%M:%S')
|
||
return jsonify({"code": 0, "data": {"rows": rows, "total": total, "page": page, "size": size}})
|
||
except Exception as exc:
|
||
return jsonify({"code": 500, "msg": str(exc)})
|
||
|
||
|
||
@auth_bp.route('/api/permissions/user/effective')
|
||
@login_required
|
||
def permission_user_effective():
|
||
"""返回用户最终生效权限及来源，供权限预览/排查使用。"""
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
user_id = request.args.get('user_id', type=int)
|
||
if not user_id:
|
||
return jsonify({"code": 400, "msg": "参数错误"})
|
||
users = query(
|
||
"SELECT id, username, real_name, role, position, user_level, status "
|
||
"FROM dashboard_users WHERE id=%s LIMIT 1", (user_id,)
|
||
)
|
||
if not users:
|
||
return jsonify({"code": 404, "msg": "用户不存在"})
|
||
user = users[0]
|
||
role = user.get('role') or ''
|
||
query_role = 'viewer' if role == '查看者' else role
|
||
|
||
role_rows = query(
|
||
"SELECT page, operation, permission FROM role_operation_permissions WHERE role=%s",
|
||
(query_role,)
|
||
)
|
||
ensure_position_permissions()
|
||
position_code = str(user.get('position') or '').strip()
|
||
position_rows = query(
|
||
"SELECT page,operation,permission FROM position_operation_permissions WHERE position_code=%s",
|
||
(position_code,)
|
||
) if position_code else []
|
||
user_rows = query(
|
||
"SELECT page, operation, permission FROM user_permissions WHERE user_id=%s",
|
||
(user_id,)
|
||
)
|
||
role_page_rows = query(
|
||
"SELECT page, permission FROM role_permissions WHERE role=%s",
|
||
(role,)
|
||
)
|
||
|
||
def _index(rows, include_field=False):
|
||
result = {}
|
||
for row in rows:
|
||
page = normalize_permission_page(row.get('page'))
|
||
operation = row.get('operation')
|
||
if not include_field and str(operation or '').startswith('field:'):
|
||
continue
|
||
result.setdefault(page, {})[operation] = int(row.get('permission') or 0)
|
||
return result
|
||
|
||
role_map = _index(role_rows)
|
||
position_map = _index(position_rows)
|
||
user_map = _index(user_rows)
|
||
role_page_map = {
|
||
normalize_permission_page(row.get('page')): int(row.get('permission') or 0)
|
||
for row in role_page_rows
|
||
}
|
||
|
||
def _lookup(mapping, page, operation):
|
||
for alias in _permission_page_aliases(page):
|
||
canonical = normalize_permission_page(alias)
|
||
if canonical in mapping and operation in mapping[canonical]:
|
||
return mapping[canonical][operation]
|
||
return None
|
||
|
||
pages = []
|
||
for menu_page in _sidebar_menu_pages():
|
||
page = normalize_permission_page(menu_page['id'])
|
||
features = PAGE_FEATURES.get(page, DEFAULT_FEATURES)
|
||
operations = []
|
||
for feature in features:
|
||
op = feature['id']
|
||
if role in ('admin', 'super_admin'):
|
||
allowed, source = True, '管理员全权限'
|
||
else:
|
||
user_value = _lookup(user_map, page, op)
|
||
position_value = _lookup(position_map, page, op)
|
||
role_value = _lookup(role_map, page, op)
|
||
legacy_value = role_page_map.get(page) if op == 'view' else None
|
||
if user_value is not None:
|
||
allowed, source = bool(user_value), '用户级覆盖'
|
||
elif position_value is not None:
|
||
allowed, source = bool(position_value), '岗位权限'
|
||
elif role_value is not None:
|
||
allowed, source = bool(role_value), '角色默认'
|
||
elif legacy_value is not None:
|
||
allowed, source = bool(legacy_value), '历史页面权限'
|
||
else:
|
||
allowed, source = False, '未配置'
|
||
operations.append({
|
||
'id': op, 'name': feature.get('name') or op,
|
||
'allowed': bool(allowed), 'source': source,
|
||
})
|
||
pages.append({
|
||
'page': page, 'name': menu_page.get('name') or page,
|
||
'group': menu_page.get('group') or '其他',
|
||
'operations': operations,
|
||
})
|
||
|
||
# 字段权限使用与运行时相同的优先级：用户覆盖 > 角色默认 > 页面权限继承。
|
||
from services.field_perms import FIELD_REGISTRY, _FIELD_REGISTRY_ALIASES
|
||
fields = {}
|
||
field_role_map = _index(role_rows, include_field=True)
|
||
field_position_map = _index(position_rows, include_field=True)
|
||
field_user_map = _index(user_rows, include_field=True)
|
||
field_pages = dict(FIELD_REGISTRY)
|
||
for runtime_id, canonical_id in _FIELD_REGISTRY_ALIASES.items():
|
||
if canonical_id in field_pages:
|
||
field_pages.setdefault(runtime_id, field_pages[canonical_id])
|
||
for raw_page, field_list in field_pages.items():
|
||
page = normalize_permission_page(raw_page)
|
||
page_view = next((x['allowed'] for x in next((p['operations'] for p in pages if p['page'] == page), []) if x['id'] == 'view'), False)
|
||
page_edit = next((x['allowed'] for x in next((p['operations'] for p in pages if p['page'] == page), []) if x['id'] == 'edit'), False)
|
||
page_fields = []
|
||
for field in field_list:
|
||
key = field['key']
|
||
item = {'key': key, 'label': key, 'sensitive': bool(field.get('sensitive')), 'view': {}, 'edit': {}}
|
||
for operation, default_value in (('view', page_view), ('edit', page_edit)):
|
||
field_operation = f'field:{key}:{operation}'
|
||
user_value = _lookup(field_user_map, page, field_operation)
|
||
position_value = _lookup(field_position_map, page, field_operation)
|
||
role_value = _lookup(field_role_map, page, field_operation)
|
||
if role in ('admin', 'super_admin'):
|
||
allowed, source = True, '管理员全权限'
|
||
elif user_value is not None:
|
||
allowed, source = bool(user_value), '用户级覆盖'
|
||
elif position_value is not None:
|
||
allowed, source = bool(position_value), '岗位权限'
|
||
elif role_value is not None:
|
||
allowed, source = bool(role_value), '角色默认'
|
||
else:
|
||
allowed, source = bool(default_value), '继承页面权限'
|
||
item[operation] = {'allowed': allowed, 'source': source}
|
||
page_fields.append(item)
|
||
if page_fields:
|
||
fields[page] = page_fields
|
||
|
||
return jsonify({
|
||
'code': 0,
|
||
'data': {'user': user, 'pages': pages, 'fields': fields},
|
||
})
|
||
|
||
|
||
def _inherited_field_perms_map(user_id, role):
|
||
"""返回角色+岗位字段继承值，供用户权限面板显示。"""
|
||
from services.field_perms import FIELD_REGISTRY, inherited_field_perms_for_page
|
||
result = {}
|
||
for page in FIELD_REGISTRY:
|
||
perms = inherited_field_perms_for_page(user_id, role, page)
|
||
result[page] = {
|
||
key: {'view': 1 if value['view'] else 0, 'edit': 1 if value['edit'] else 0}
|
||
for key, value in perms.items()
|
||
}
|
||
return result
|
||
|
||
|
||
@auth_bp.route('/api/permissions/user/field-perms/save', methods=['POST'])
|
||
@login_required
|
||
def permission_user_field_save():
|
||
"""保存用户字段三态权限，执行职责冲突检查与版本留档。"""
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
data = request.get_json(silent=True) or {}
|
||
user_id = data.get('user_id')
|
||
items = data.get('items', [])
|
||
if not user_id:
|
||
return jsonify({"code": 400, "msg": "参数错误"})
|
||
target = query("SELECT role FROM dashboard_users WHERE id=%s", (user_id,))
|
||
if not target:
|
||
return jsonify({"code": 400, "msg": "用户不存在"})
|
||
if target[0]['role'] == 'super_admin':
|
||
return jsonify({"code": 403, "msg": "超级管理员权限不可修改"})
|
||
if session.get('role') == 'admin' and target[0]['role'] == 'admin':
|
||
return jsonify({"code": 403, "msg": "管理员不能修改其他管理员的个人权限"})
|
||
conflicts = _detect_permission_conflicts(_effective_user_pairs(int(user_id), field_items=items))
|
||
if conflicts and not data.get('confirm_conflicts'):
|
||
return jsonify({"code": 409, "msg": "检测到职责冲突，请确认后再保存", "data": {"conflicts": conflicts}}), 409
|
||
_ensure_permission_baseline('user', user_id)
|
||
try:
|
||
from services.db import get_db
|
||
conn = get_db()
|
||
with conn.cursor() as cur:
|
||
for item in items:
|
||
page = normalize_permission_page(str(item.get('page', '')).strip())
|
||
field = str(item.get('field', '')).strip()
|
||
op = str(item.get('operation', 'view')).strip()
|
||
if not page or not field or op not in ('view', 'edit'):
|
||
continue
|
||
operation = f'field:{field}:{op}'
|
||
perm = item.get('permission')
|
||
if perm is None or perm == '':
|
||
cur.execute("DELETE FROM user_permissions WHERE user_id=%s AND page=%s AND operation=%s", (user_id, page, operation))
|
||
else:
|
||
value = 1 if int(perm) == 1 else 0
|
||
cur.execute(
|
||
"INSERT INTO user_permissions (user_id,page,operation,permission) VALUES (%s,%s,%s,%s) "
|
||
"ON DUPLICATE KEY UPDATE permission=%s", (user_id, page, operation, value, value)
|
||
)
|
||
conn.commit()
|
||
conn.close()
|
||
_create_permission_version('user', user_id, '保存用户字段权限')
|
||
add_operation_log('权限变更', f'保存用户 #{user_id} 字段级权限')
|
||
_record_permission_change('user', user_id, 'user_field_save', after=items, detail=f'保存用户 #{user_id} 字段级权限')
|
||
return jsonify({"code": 0, "msg": "保存成功", "data": {"conflicts": conflicts}})
|
||
except Exception as e:
|
||
return jsonify({"code": 500, "msg": str(e)})
|
||
|
||
# ─── 人员信息管理 ───
|
||
_DEFAULT_PERSONNEL_GROUPS = [
|
||
{'name': '跟单一组', 'leader': '方园霞', 'members': ['方园霞', '邝碧君', '余瑞霞', '卢浩然'], 'color': '#e6f4ff', 'tagColor': '#1677ff', 'icon': '👥'},
|
||
{'name': '跟单二组', 'leader': '王加飞', 'members': ['许晓珊', '刘伟', '王加飞', '邓文婷'], 'color': '#f0f5ff', 'tagColor': '#722ed1', 'icon': '👥'},
|
||
{'name': '跟单三组', 'leader': '蔡少铃', 'members': ['闫伟华', '蔡少铃', '颜于凯', '张文菁'], 'color': '#e6fffb', 'tagColor': '#13c2c2', 'icon': '👥'},
|
||
{'name': '现货小组', 'leader': '', 'members': ['莫碧霞', '范亚欢'], 'color': '#fff7e6', 'tagColor': '#fa8c16', 'icon': '👥'},
|
||
{'name': '计划小组', 'leader': '汤定毅', 'members': ['汤定毅', '李媛', '黄静', '胡孟怡', '张莹纯', '范世澄', '陈瑜'], 'color': '#f6ffed', 'tagColor': '#52c41a', 'icon': '📋'}
|
||
]
|
||
|
||
|
||
def _ensure_personnel_table():
|
||
query("""CREATE TABLE IF NOT EXISTS personnel_groups (
|
||
group_name VARCHAR(100) NOT NULL PRIMARY KEY,
|
||
group_order INT NOT NULL DEFAULT 0,
|
||
group_category VARCHAR(30) NOT NULL DEFAULT '采购跟单',
|
||
leader_name VARCHAR(100) NOT NULL DEFAULT '',
|
||
members_json TEXT NOT NULL,
|
||
color VARCHAR(20) NOT NULL DEFAULT '#fafafa',
|
||
tag_color VARCHAR(20) NOT NULL DEFAULT '#1677ff',
|
||
icon VARCHAR(20) NOT NULL DEFAULT '👥',
|
||
updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
|
||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4""")
|
||
category_col = query("""SELECT COLUMN_NAME FROM information_schema.COLUMNS
|
||
WHERE TABLE_SCHEMA=DATABASE() AND TABLE_NAME='personnel_groups'
|
||
AND COLUMN_NAME='group_category'""")
|
||
if not category_col:
|
||
query("ALTER TABLE personnel_groups ADD COLUMN group_category VARCHAR(30) NOT NULL DEFAULT '采购跟单' AFTER group_order")
|
||
query("UPDATE personnel_groups SET group_category='采购计划', icon='📋' WHERE group_name='计划小组'")
|
||
rows = query("SELECT group_name FROM personnel_groups")
|
||
if rows:
|
||
return
|
||
import json
|
||
for index, group in enumerate(_DEFAULT_PERSONNEL_GROUPS):
|
||
category = '采购计划' if group['name'] == '计划小组' else '采购跟单'
|
||
query("""INSERT INTO personnel_groups
|
||
(group_name, group_order, group_category, leader_name, members_json, color, tag_color, icon)
|
||
VALUES (%s,%s,%s,%s,%s,%s,%s,%s)""", (
|
||
group['name'], index, category, group['leader'], json.dumps(group['members'], ensure_ascii=False),
|
||
group['color'], group['tagColor'], group['icon']))
|
||
|
||
|
||
@auth_bp.route('/api/personnel/groups')
|
||
@login_required
|
||
def personnel_groups():
|
||
import json
|
||
_ensure_personnel_table()
|
||
rows = query("SELECT group_name, group_category, leader_name, members_json, color, tag_color, icon FROM personnel_groups ORDER BY group_order, group_name")
|
||
groups = []
|
||
for row in rows:
|
||
try:
|
||
members = json.loads(row['members_json'] or '[]')
|
||
except (TypeError, ValueError):
|
||
members = []
|
||
groups.append({
|
||
'name': row['group_name'], 'category': row['group_category'] or '采购跟单',
|
||
'leader': row['leader_name'] or '', 'members': members,
|
||
'color': row['color'], 'tagColor': row['tag_color'], 'icon': row['icon']
|
||
})
|
||
return jsonify({'code': 0, 'data': groups})
|
||
|
||
|
||
@auth_bp.route('/api/personnel/groups/create', methods=['POST'])
|
||
@login_required
|
||
def personnel_group_create():
|
||
import json
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({'code': 403, 'msg': '仅管理员可新增人员分组'})
|
||
data = request.get_json(silent=True) or {}
|
||
name = str(data.get('name') or '').strip()
|
||
category = str(data.get('category') or '').strip()
|
||
if not name:
|
||
return jsonify({'code': 400, 'msg': '组别名称不能为空'})
|
||
if category not in ('采购跟单', '采购计划'):
|
||
return jsonify({'code': 400, 'msg': '请选择正确的组别类型'})
|
||
_ensure_personnel_table()
|
||
if query("SELECT group_name FROM personnel_groups WHERE group_name=%s", (name,)):
|
||
return jsonify({'code': 400, 'msg': '该组别名称已存在'})
|
||
order_row = query("SELECT COALESCE(MAX(group_order), -1) + 1 AS next_order FROM personnel_groups")
|
||
next_order = int(order_row[0]['next_order']) if order_row else 0
|
||
icon = '📋' if category == '采购计划' else '👥'
|
||
query("""INSERT INTO personnel_groups
|
||
(group_name, group_order, group_category, leader_name, members_json, color, tag_color, icon)
|
||
VALUES (%s,%s,%s,'',%s,%s,%s,%s)""",
|
||
(name, next_order, category, json.dumps([], ensure_ascii=False), '#fafafa', '#1677ff', icon))
|
||
add_operation_log('人员信息管理', f'新增人员分组：{name}（{category}）')
|
||
return jsonify({'code': 0, 'msg': '新增成功'})
|
||
|
||
|
||
@auth_bp.route('/api/personnel/groups/save', methods=['POST'])
|
||
@login_required
|
||
def personnel_group_save():
|
||
import json
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({'code': 403, 'msg': '仅管理员可编辑人员分组'})
|
||
data = request.get_json(silent=True) or {}
|
||
name = str(data.get('name') or '').strip()
|
||
members = data.get('members') if isinstance(data.get('members'), list) else []
|
||
members = list(dict.fromkeys(str(member).strip() for member in members if str(member).strip()))
|
||
leader = str(data.get('leader') or '').strip()
|
||
if not name:
|
||
return jsonify({'code': 400, 'msg': '组别名称不能为空'})
|
||
if leader and leader not in members:
|
||
return jsonify({'code': 400, 'msg': '组长必须属于该组人员'})
|
||
_ensure_personnel_table()
|
||
existing = query("SELECT group_name FROM personnel_groups WHERE group_name=%s", (name,))
|
||
if not existing:
|
||
return jsonify({'code': 404, 'msg': '未找到该人员分组'})
|
||
other_rows = query("SELECT group_name, members_json FROM personnel_groups WHERE group_name<>%s", (name,))
|
||
for other in other_rows:
|
||
try:
|
||
other_members = json.loads(other['members_json'] or '[]')
|
||
except (TypeError, ValueError):
|
||
other_members = []
|
||
duplicated = next((member for member in members if member in other_members), '')
|
||
if duplicated:
|
||
return jsonify({'code': 400, 'msg': f'{duplicated} 已属于 {other["group_name"]}，不能重复加入'})
|
||
query("""UPDATE personnel_groups SET leader_name=%s, members_json=%s
|
||
WHERE group_name=%s""", (leader, json.dumps(members, ensure_ascii=False), name))
|
||
add_operation_log('人员信息管理', f'保存人员分组：{name}，共{len(members)}人')
|
||
return jsonify({'code': 0, 'msg': '保存成功'})
|
||
|
||
|
||
def _ensure_param_list_table():
|
||
"""确保云仓外仓权重列表存在并带有初始参数（幂等，部署后不会出现空表）。"""
|
||
query("""
|
||
CREATE TABLE IF NOT EXISTS param_list (
|
||
id INT AUTO_INCREMENT PRIMARY KEY,
|
||
param_name VARCHAR(50) NOT NULL COMMENT '参数名称',
|
||
param_logic VARCHAR(255) NOT NULL COMMENT '参数计算逻辑',
|
||
sort_order INT DEFAULT 0 COMMENT '排序',
|
||
updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
|
||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='云仓外仓权重列表'
|
||
""")
|
||
rows = query("SELECT COUNT(*) AS cnt FROM param_list")
|
||
if not rows or not rows[0]['cnt']:
|
||
query("INSERT INTO param_list (param_name, param_logic, sort_order) VALUES (%s, %s, %s)",
|
||
('X', '云仓销量/昨日销量', 1))
|
||
query("INSERT INTO param_list (param_name, param_logic, sort_order) VALUES (%s, %s, %s)",
|
||
('Y', '外仓销量/昨日销量', 2))
|
||
|
||
|
||
@auth_bp.route('/api/config/list')
|
||
@login_required
|
||
def config_list():
|
||
_ensure_param_list_table()
|
||
trend_rows = query("SELECT * FROM trend_config ORDER BY id")
|
||
sales_rows = query("SELECT * FROM sales_predict_config ORDER BY id")
|
||
global_rows = query("SELECT * FROM global_config ORDER BY config_key")
|
||
param_rows = query("SELECT id, param_name, param_logic FROM param_list ORDER BY sort_order, id")
|
||
return jsonify({
|
||
"code": 0,
|
||
"data": {
|
||
"trend_config": trend_rows,
|
||
"sales_predict_config": sales_rows,
|
||
"global_config": global_rows,
|
||
"param_list": param_rows
|
||
}
|
||
})
|
||
|
||
|
||
@auth_bp.route('/api/config/save_global', methods=['POST'])
|
||
@login_required
|
||
def config_save_global():
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
data = request.json
|
||
for item in data:
|
||
if 'config_key' in item and 'config_value' in item:
|
||
query("UPDATE global_config SET config_value=%s WHERE config_key=%s",
|
||
(item['config_value'], item['config_key']))
|
||
add_operation_log('系统配置', f'保存全局配置：{len(data)}项')
|
||
return jsonify({"code": 0, "msg": "保存成功"})
|
||
|
||
|
||
@auth_bp.route('/api/config/save_trend', methods=['POST'])
|
||
@login_required
|
||
def config_save_trend():
|
||
"""保存趋势判断配置"""
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
data = request.json
|
||
for item in data:
|
||
if 'id' in item:
|
||
query("UPDATE trend_config SET trend_type=%s, condition_expr=%s, notes=%s WHERE id=%s",
|
||
(item.get('trend_type', ''), item.get('condition_expr', ''),
|
||
item.get('notes', ''), item['id']))
|
||
add_operation_log('系统配置', f'保存趋势判断配置：{len(data)}项')
|
||
return jsonify({"code": 0, "msg": "保存成功"})
|
||
|
||
|
||
@auth_bp.route('/api/config/save_sales', methods=['POST'])
|
||
@login_required
|
||
def config_save_sales():
|
||
"""保存销量预测配置"""
|
||
if session.get('role') not in ('admin', 'super_admin'):
|
||
return jsonify({"code": 403, "msg": "仅管理员可操作"})
|
||
data = request.get_json(silent=True)
|
||
if not isinstance(data, list) or not data:
|
||
return jsonify({"code": 400, "msg": "参数格式错误"})
|
||
|
||
# 先完整校验本次提交，避免部分行已写入、后续行校验失败。
|
||
limits = {
|
||
'avg_3d': Decimal('999.99'),
|
||
'avg_7d': Decimal('999.99'),
|
||
'avg_14d': Decimal('999.99'),
|
||
'adjust_factor': Decimal('99.99'),
|
||
}
|
||
parsed = []
|
||
try:
|
||
for item in data:
|
||
if not isinstance(item, dict) or 'id' not in item:
|
||
raise ValueError('缺少配置行ID')
|
||
try:
|
||
row_id = int(item['id'])
|
||
except (TypeError, ValueError):
|
||
raise ValueError('配置行ID无效')
|
||
values = {}
|
||
for field, maximum in limits.items():
|
||
try:
|
||
number = Decimal(str(item.get(field, '')).strip())
|
||
except (AttributeError, InvalidOperation, ValueError):
|
||
raise ValueError(f'{field} 必须是数字')
|
||
if not number.is_finite() or number < 0 or number > maximum:
|
||
raise ValueError(f'{field} 必须在 0 至 {maximum} 之间')
|
||
values[field] = number
|
||
trend_type = str(item.get('trend_type') or '').strip()
|
||
if not trend_type:
|
||
raise ValueError('趋势类型不能为空')
|
||
parsed.append((values['avg_3d'], values['avg_7d'], values['avg_14d'],
|
||
values['adjust_factor'], trend_type, row_id))
|
||
except ValueError as exc:
|
||
return jsonify({"code": 400, "msg": str(exc)})
|
||
|
||
for avg_3d, avg_7d, avg_14d, adjust_factor, trend_type, row_id in parsed:
|
||
query("UPDATE sales_predict_config SET avg_3d=%s, avg_7d=%s, avg_14d=%s, adjust_factor=%s, trend_type=%s WHERE id=%s",
|
||
(avg_3d, avg_7d, avg_14d, adjust_factor, trend_type, row_id))
|
||
from services.forecast import refresh_sales_predict_config
|
||
refresh_sales_predict_config()
|
||
add_operation_log('系统配置', f'保存销量预测配置：{len(parsed)}项')
|
||
return jsonify({"code": 0, "msg": "保存成功"})
|
||
|
||
|
||
@auth_bp.route('/api/config/sandbox_save', methods=['POST'])
|
||
@login_required
|
||
def config_sandbox_save():
|
||
"""保存校准配置（沙箱）"""
|
||
data = request.json
|
||
items = data.get('items', [])
|
||
for item in items:
|
||
ct = item.get('config_table', '')
|
||
rid = item.get('row_id', 0)
|
||
fn = item.get('field_name', '')
|
||
sv = item.get('sandbox_value', '')
|
||
ov = item.get('original_value', '')
|
||
query("""INSERT INTO config_sandbox (config_table, row_id, field_name, original_value, sandbox_value)
|
||
VALUES (%s, %s, %s, %s, %s)
|
||
ON DUPLICATE KEY UPDATE sandbox_value=%s, original_value=%s""",
|
||
(ct, rid, fn, ov, sv, sv, ov))
|
||
add_operation_log('系统配置', f'保存校准配置（沙箱）：{len(items)}项')
|
||
return jsonify({"code": 0, "msg": "保存成功"})
|
||
|
||
|
||
@auth_bp.route('/api/config/sandbox_load')
|
||
@login_required
|
||
def config_sandbox_load():
|
||
"""加载校准配置"""
|
||
rows = query("SELECT * FROM config_sandbox ORDER BY config_table, row_id, field_name")
|
||
return jsonify({"code": 0, "data": rows})
|
||
|
||
|
||
@auth_bp.route('/api/config/sandbox_preview')
|
||
@login_required
|
||
def config_sandbox_preview():
|
||
"""预览校准效果：返回少量产品在校准参数下的预测结果vs原始结果"""
|
||
from services.forecast import compute_daily_forecast, get_global_config, sales_predict_config_cached
|
||
from services.inventory_calc import compute_product_inventory_cached, compute_product_inventory_15, compute_product_in_transit_cached, _determine_trend
|
||
from services.sales_calc import compute_product_sales_cached
|
||
from services.product_type import get_product_type_cached
|
||
from routes.planning import _enrich_row_with_planning_data
|
||
from services.forecast import is_new_product, get_product_grade
|
||
|
||
# 获取原始产品数据（取前10个有库存的产品）
|
||
sample = query("""
|
||
SELECT p.product_code, p.product_name, p.brand, p.product_type,
|
||
p.cost_price,
|
||
p.lead_time AS 生产货期, p.logistics_time AS 物流时间,
|
||
p.created_at AS 创建时间
|
||
FROM products p
|
||
WHERE p.product_type != '包材'
|
||
ORDER BY RAND() LIMIT 10
|
||
""")
|
||
|
||
sales = compute_product_sales_cached()
|
||
inv_map = compute_product_inventory_cached()
|
||
inv15_map = compute_product_inventory_15()
|
||
transit_map = compute_product_in_transit_cached()
|
||
|
||
# 原始配置
|
||
gc = get_global_config()
|
||
sp_map = {r['trend_type']: r for r in sales_predict_config_cached()}
|
||
|
||
# 沙箱配置（覆盖）
|
||
sandbox = query("SELECT * FROM config_sandbox")
|
||
sb_by_table = {}
|
||
for s in sandbox:
|
||
key = (s['config_table'], s['row_id'])
|
||
if key not in sb_by_table: sb_by_table[key] = {}
|
||
sb_by_table[key][s['field_name']] = s['sandbox_value']
|
||
|
||
original_rows = []
|
||
sandbox_rows = []
|
||
|
||
for row in sample:
|
||
if row.get('创建时间'):
|
||
row['创建时间'] = row['创建时间'].strftime('%Y-%m-%d') if hasattr(row['创建时间'], 'strftime') else str(row['创建时间'])[:10]
|
||
row['产品种类'] = get_product_type_cached(row.get('product_name', ''), row.get('brand', ''), row.get('product_type'))
|
||
|
||
# 原始
|
||
r1 = dict(row)
|
||
r1 = _enrich_row_with_planning_data(r1, sales, inv_map, inv15_map, transit_map, sp_map, gc)
|
||
original_rows.append(r1)
|
||
|
||
# 校准（待实现：用沙箱参数覆盖后再计算）
|
||
r2 = dict(row)
|
||
# 为简化，暂时用相同值
|
||
r2 = _enrich_row_with_planning_data(r2, sales, inv_map, inv15_map, transit_map, sp_map, gc)
|
||
sandbox_rows.append(r2)
|
||
|
||
return jsonify({"code": 0, "data": {
|
||
"original": original_rows,
|
||
"sandbox": sandbox_rows
|
||
}})
|