v6ole
3ee8846011
修复: - 环路检测正则 \s+(Onu\S+)\s+ → \s+(Onu\S+) (splitlines移除换行后尾随\s无法匹配) - 权限中间件 Header(...) → Header(None) 避免缺失Auth头返回422而非401 - 环路检测请求超时30s→120s (SSH连接30+台OLT实测需58秒) 重构 (ssh_service.py): - 提取 _send_and_wait 为私有方法,消除3处重复内部函数 - 添加 __enter__/__exit__ 上下文管理器支持 - 加固 execute_command prompt检测 (按行匹配<DEVICE_NAME>) - 移除未使用的settings import - olt.py/devices.py 调用方改用 with 语法 新功能: - 侧边栏退出登录上方显示当前用户名和角色 - 版本号从VERSION文件自动读取 (后端/health返回,前端动态显示) - 基于广西南宁经纬度计算日落时间,自动切换深色/浅色主题 - /api/olt/loopback-detection 响应增加raw字段便于排查 基础设施: - CLAUDE.md 加入 .gitignore - 新增 .claude/rules/07-remote-operations.md (远程部署操作) - 新增 .claude/rules/08-frp-notes.md (frp隧道注意事项) - 新增 VERSION 文件 (版本号 0.10.0) - 新增环路检测解析测试用例 (5个) Co-Authored-By: Claude <noreply@anthropic.com>
105 lines
3.6 KiB
Python
105 lines
3.6 KiB
Python
"""权限检查中间件（数据库驱动 + Redis 缓存）"""
|
||
import json
|
||
import logging
|
||
from fastapi import HTTPException, Depends, Header
|
||
from sqlalchemy.orm import Session
|
||
from sqlalchemy import text
|
||
|
||
logger = logging.getLogger(__name__)
|
||
import redis
|
||
|
||
from app.core.database import get_db
|
||
from app.core.security import verify_token
|
||
from app.core.config import settings
|
||
|
||
_redis_client = None
|
||
|
||
|
||
def get_redis() -> redis.Redis:
|
||
global _redis_client
|
||
if _redis_client is None:
|
||
_redis_client = redis.from_url(settings.REDIS_URL, decode_responses=True)
|
||
return _redis_client
|
||
|
||
|
||
def get_role_permissions(role: str, db: Session) -> list:
|
||
"""从数据库加载角色权限，结果缓存到 Redis（TTL 5分钟）"""
|
||
if role == 'admin':
|
||
return ['*']
|
||
|
||
r = get_redis()
|
||
cache_key = f"permissions:role:{role}"
|
||
cached = r.get(cache_key)
|
||
if cached:
|
||
return json.loads(cached)
|
||
|
||
rows = db.execute(
|
||
text("""
|
||
SELECT p.code FROM permissions p
|
||
JOIN role_permissions rp ON rp.permission_id = p.id
|
||
WHERE rp.role = :role
|
||
"""),
|
||
{"role": role}
|
||
).fetchall()
|
||
perms = [row[0] for row in rows]
|
||
|
||
r.setex(cache_key, 300, json.dumps(perms))
|
||
return perms
|
||
|
||
|
||
def invalidate_role_cache(role: str) -> None:
|
||
"""修改角色权限后清除缓存"""
|
||
get_redis().delete(f"permissions:role:{role}")
|
||
|
||
|
||
def require_permission(permission: str):
|
||
"""FastAPI Depends 工厂，检查 Bearer token 中的角色是否拥有指定权限"""
|
||
def dependency(
|
||
authorization: str = Header(None, alias="Authorization"),
|
||
db: Session = Depends(get_db),
|
||
) -> dict:
|
||
if not authorization:
|
||
logger.warning("auth rejected: 缺少 Authorization 头 (permission=%s)", permission)
|
||
raise HTTPException(status_code=401, detail="未授权")
|
||
if not authorization.startswith("Bearer "):
|
||
logger.warning("auth rejected: Authorization 格式错误 (permission=%s): %.50s", permission, authorization)
|
||
raise HTTPException(status_code=401, detail="未授权")
|
||
token = authorization[7:]
|
||
payload = verify_token(token)
|
||
if not payload:
|
||
logger.warning("auth rejected: token 验证失败 (permission=%s): token前20字符=%.20s...", permission, token[:20])
|
||
raise HTTPException(status_code=401, detail="令牌无效或已过期")
|
||
|
||
role = payload.get('role', 'user')
|
||
perms = get_role_permissions(role, db)
|
||
|
||
if '*' not in perms and permission not in perms:
|
||
raise HTTPException(status_code=403, detail="权限不足")
|
||
|
||
# 附加用户的区域/学校分配信息，供数据范围过滤使用
|
||
user_id = payload.get('sub')
|
||
if user_id and role in ('area_admin', 'school_admin'):
|
||
from app.models.user import User
|
||
user = db.query(User).filter(User.id == int(user_id)).first()
|
||
if user:
|
||
payload['assigned_area'] = user.assigned_area
|
||
payload['assigned_school'] = user.assigned_school
|
||
|
||
return payload
|
||
|
||
return dependency
|
||
|
||
|
||
def get_current_user(
|
||
authorization: str = Header(None, alias="Authorization"),
|
||
db: Session = Depends(get_db),
|
||
) -> dict:
|
||
"""仅验证登录状态，不检查具体权限"""
|
||
if not authorization or not authorization.startswith("Bearer "):
|
||
raise HTTPException(status_code=401, detail="未授权")
|
||
token = authorization[7:]
|
||
payload = verify_token(token)
|
||
if not payload:
|
||
raise HTTPException(status_code=401, detail="令牌无效或已过期")
|
||
return payload
|