
    Xjd                         d dl mZ d dlmZ d dlmZmZmZmZm	Z	 d dl
mZ d dlmZ  ee          Z G d d          ZdS )	    )Session)AppException)add_permission_for_rolecheck_permissionget_enforcerget_redis_clientremove_permission_for_role)Role)
get_loggerc                   z   e Zd Zg dZg dZedededee	e
e
f                  dedef
d            Zedededee	e
e
f                  fd	            Zedefd
            Zedee	e
ef                  fd            Zedededededef
d            Zedededededef
d            Zededededefd            ZdS )PermissionService)usersrolesknowledge_basesknowledge_categoriesknowledge_tagsagents	workflows	documents
audit_logsmenus	providersmodels)readcreateupdatedeleteexecutedbrole_idpermissions	tenant_idreturnc                    |                      t                                        t          j        |k                                              }|st          dd          |j        rt          dd          t                      }d|j         }t          |          }|
                    d||          }	 |                    d||           |D ]k}	|	                    d          }
|	                    d          }|
r|st          d	|	           t          |||
|          }|st          d
|
 d|           lt                               |           t$                              dt)          |           d|j                    dS # t          $ ry}t$                              d|            |                    d||           |D ]} |j        |  t          dt          |           dt          |                     d d }~ww xY w)N   角色不存在Role not foundu   系统角色权限不可修改z*System role permissions cannot be modifiedrole:r   resourceactionzInvalid permission: zFailed to add permission: :z	Assigned z permissions to role Tz,Permission assignment failed, rolling back: u   权限分配失败: zPermission assignment failed: )queryr
   filteridfirstr   	is_systemr   codestrget_filtered_policyremove_filtered_policyget
ValueErrorr   	Exceptionr   _invalidate_cacheloggerinfolenerror
add_policy)r   r    r!   r"   roleenforcer	role_codedomainold_policiespermr(   r)   successepolicys                  N/lsinfo/ai/hellotax_ai/base_platform/app/services/access/permission_service.pyassign_permissionsz$PermissionService.assign_permissions"   sT    xx~~$$TW%788>>@@ 	D02BCCC> 	o?Amnnn>>'DI''	Y33Ay&II	u++Ay&AAA# V V88J//(++ Dv D$%BD%B%BCCC1)YRXYY V#$T$T$TF$T$TUUUV//	:::KKVC$4$4VV49VVWWW4 	u 	u 	uLLKKKLLL++Ay&AAA& - -##V,,,>c!ff>>@iadefagag@i@ijjptt	us   6CF	 	
HA4HHc                    ddl m} |                     t                                        t          j        |k                                              }|sg S d|j         }t          |dd          pd} |||          }d |D             S )Nr   )get_permissions_for_roler'   r"   c                 0    g | ]}|d          |d         dS )      )r(   r)    ).0ps     rF   
<listcomp>z:PermissionService.get_role_permissions.<locals>.<listcomp>M   s(    EEEqQqTQqT22EEE    )	app.core.permissionsrI   r+   r
   r,   r-   r.   r0   getattr)r   r    rI   r=   r?   r"   policiess          rF   get_role_permissionsz&PermissionService.get_role_permissionsC   s    AAAAAAxx~~$$TW%788>>@@ 	I'DI''	D+q116Q	++IyAAEEHEEEErQ   c                 8   	 t                      }d|  d}d}	 |                    ||d          \  }}|r
 |j        |  |dk    rn/t                              d|             d S # t
          $ r(}t                              d|            Y d }~d S d }~ww xY w)	Nzperm:*:z:*:*r   Td   )matchcountz(Invalidated permission cache for tenant zFailed to invalidate cache: )r   scanr   r8   r9   r6   warning)r"   redis_clientpatterncursorkeysrD   s         rF   r7   z#PermissionService._invalidate_cacheO   s    	?+--L/	///GF+00wc0RR /'L'..Q;; KKN9NNOOOOO 	? 	? 	?NN=!==>>>>>>>>>	?s   A#A' '
B1BBc                  .    d t           j        D             S )Nc                 ,    g | ]}|t           j        d S ))r(   actions)r   ACTIONS)rN   r(   s     rF   rP   z=PermissionService.get_available_resources.<locals>.<listcomp>a   s4     
 
 
 ".?.GHH
 
 
rQ   )r   	RESOURCESrM   rQ   rF   get_available_resourcesz)PermissionService.get_available_resources_   s&    
 
-7
 
 
 	
rQ   menu_idc                 B   |                      t                                        t          j        |k                                              }|st          dd          d| }d}d|j         }t          ||||          }|rt          	                    |           |S Nr%   r&   menu:viewr'   )
r+   r
   r,   r-   r.   r   r0   r   r   r7   	r   r    rf   r"   r=   r(   r)   r?   rC   s	            rF   grant_menu_permissionz'PermissionService.grant_menu_permissionf   s    xx~~$$TW%788>>@@ 	D02BCCC$7$$'DI''	))Y&QQ 	;//	:::rQ   c                 B   |                      t                                        t          j        |k                                              }|st          dd          d| }d}d|j         }t          ||||          }|rt          	                    |           |S rh   )
r+   r
   r,   r-   r.   r   r0   r	   r   r7   rk   s	            rF   revoke_menu_permissionz(PermissionService.revoke_menu_permissions   s    xx~~$$TW%788>>@@ 	D02BCCC$7$$'DI''	,Y	8VTT 	;//	:::rQ   user_idc                 ~    d| }d}t          | |||          }t                              d|  d| d|            |S )Nri   rj   zMenu permission check: user=z, menu=z	, result=)r   r8   debug)ro   rf   r"   r(   r)   results         rF   check_menu_permissionz'PermissionService.check_menu_permission   sX    $7$$!'9hGG^G^^G^^V\^^___rQ   N)__name__
__module____qualname__rd   rc   staticmethodr   intlistdictr1   boolrG   rU   r7   anyre   rl   rn   rs   rM   rQ   rF   r   r      s         I @??Guu!u04T#s(^0DuQTu	u u u \u@ 	F 	F3 	F4S#X;O 	F 	F 	F \	F ?S ? ? ? \? 
T$sCx.%9 
 
 
 \
 
' 
C 
# 
RU 
Z^ 
 
 
 \
 
7 
S 
3 
SV 
[_ 
 
 
 \
 s S S T    \  rQ   r   N)sqlalchemy.ormr   app.core.exceptionsr   rR   r   r   r   r   r	   app.models.roler
   common_loggingr   rt   r8   r   rM   rQ   rF   <module>r      s    " " " " " " , , , , , ,              !           % % % % % %	H		u u u u u u u u u urQ   