Fix casbin async enforcer (#192)

wu-clan · web-flow · commit c1295dda8458 · 2023-07-31T17:12:07.000+08:00
* rename the file casbin_rbac to rbac

* omit

* fix casbin async enforcer

* update the group rule interface access permissions

* add menu permission validation

* update the init test data sql

* add the staff field to the user information query return
diff --git a/backend/app/api/v1/api.py b/backend/app/api/v1/api.py
@@ -4,7 +4,7 @@
 
 from fastapi import APIRouter, Query
 
-from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.rbac import DependsRBAC
 from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.pagination import PageDepends, paging_data
 from backend.app.common.response.response_schema import response_base
diff --git a/backend/app/api/v1/casbin.py b/backend/app/api/v1/casbin.py
@@ -4,7 +4,7 @@
 
 from fastapi import APIRouter, Query
 
-from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.rbac import DependsRBAC
 from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.pagination import PageDepends, paging_data
 from backend.app.common.response.response_schema import response_base
@@ -66,7 +66,7 @@ async def delete_policy(p: DeletePolicy):
     return await response_base.success(data=data)
 
 
-@router.get('/group', summary='获取所有组访问权限规则', dependencies=[DependsRBAC])
+@router.get('/group', summary='获取所有组访问权限规则', dependencies=[DependsJwtAuth])
 async def get_all_groups():
     data = await CasbinService.get_group_list()
     return await response_base.success(data=data)
diff --git a/backend/app/api/v1/dept.py b/backend/app/api/v1/dept.py
@@ -4,7 +4,7 @@
 
 from fastapi import APIRouter, Query
 
-from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.rbac import DependsRBAC
 from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.response.response_schema import response_base
 from backend.app.schemas.dept import CreateDept, GetAllDept, UpdateDept
diff --git a/backend/app/api/v1/dict_data.py b/backend/app/api/v1/dict_data.py
@@ -4,7 +4,7 @@
 
 from fastapi import APIRouter, Query
 
-from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.rbac import DependsRBAC
 from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.pagination import PageDepends, paging_data
 from backend.app.common.response.response_schema import response_base
diff --git a/backend/app/api/v1/dict_type.py b/backend/app/api/v1/dict_type.py
@@ -4,7 +4,7 @@
 
 from fastapi import APIRouter, Query
 
-from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.rbac import DependsRBAC
 from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.pagination import PageDepends, paging_data
 from backend.app.common.response.response_schema import response_base
diff --git a/backend/app/api/v1/log/login_log.py b/backend/app/api/v1/log/login_log.py
@@ -4,7 +4,7 @@
 
 from fastapi import APIRouter, Query
 
-from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.rbac import DependsRBAC
 from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.pagination import paging_data, PageDepends
 from backend.app.common.response.response_schema import response_base
diff --git a/backend/app/api/v1/log/opera_log.py b/backend/app/api/v1/log/opera_log.py
@@ -4,7 +4,7 @@
 
 from fastapi import APIRouter, Query
 
-from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.rbac import DependsRBAC
 from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.pagination import PageDepends, paging_data
 from backend.app.common.response.response_schema import response_base
diff --git a/backend/app/api/v1/menu.py b/backend/app/api/v1/menu.py
@@ -4,7 +4,7 @@
 
 from fastapi import APIRouter, Query, Request
 
-from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.rbac import DependsRBAC
 from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.response.response_schema import response_base
 from backend.app.schemas.menu import GetAllMenu, CreateMenu, UpdateMenu
diff --git a/backend/app/api/v1/mixed/config.py b/backend/app/api/v1/mixed/config.py
@@ -3,7 +3,7 @@
 from fastapi import APIRouter, Request
 from fastapi.routing import APIRoute
 
-from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.rbac import DependsRBAC
 from backend.app.common.response.response_schema import response_base
 from backend.app.core.conf import settings
 
diff --git a/backend/app/api/v1/role.py b/backend/app/api/v1/role.py
@@ -4,7 +4,7 @@
 
 from fastapi import APIRouter, Query
 
-from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.rbac import DependsRBAC
 from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.pagination import PageDepends, paging_data
 from backend.app.common.response.response_schema import response_base
diff --git a/backend/app/api/v1/task.py b/backend/app/api/v1/task.py
@@ -2,7 +2,7 @@
 # -*- coding: utf-8 -*-
 from fastapi import APIRouter
 
-from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.rbac import DependsRBAC
 from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.response.response_schema import response_base
 from backend.app.services.task_service import TaskService
diff --git a/backend/app/api/v1/user.py b/backend/app/api/v1/user.py
@@ -4,7 +4,7 @@
 
 from fastapi import APIRouter, Query, Request
 
-from backend.app.common.casbin_rbac import DependsRBAC
+from backend.app.common.rbac import DependsRBAC
 from backend.app.common.jwt import DependsJwtAuth
 from backend.app.common.pagination import paging_data, PageDepends
 from backend.app.common.response.response_schema import response_base
diff --git a/backend/app/common/rbac.py b/backend/app/common/rbac.py
@@ -15,16 +15,15 @@
 
 class RBAC:
     @staticmethod
-    def enforcer() -> casbin.Enforcer:
+    async def enforcer() -> casbin.Enforcer:
         """
         获取 casbin 执行器
 
         :return:
         """
         adapter = casbin_async_sqlalchemy_adapter.Adapter(async_engine, db_class=CasbinRule)
-
         enforcer = casbin.Enforcer(RBAC_MODEL_CONF, adapter)
-
+        await enforcer.load_policy()
         return enforcer
 
     async def rbac_verify(self, request: Request, _: dict = DependsJwtAuth) -> None:
@@ -46,6 +45,8 @@ async def rbac_verify(self, request: Request, _: dict = DependsJwtAuth) -> None:
         user_roles = request.user.roles
         if not user_roles:
             raise AuthorizationError(msg='用户未分配角色，授权失败')
+        if not any(len(role.menus) > 0 for role in user_roles):
+            raise AuthorizationError(msg='用户所属角色未分配菜单，授权失败')
         if not request.user.is_staff:
             raise AuthorizationError(msg='此用户已被禁止后台管理操作')
         data_scope = any(role.data_scope == 1 for role in user_roles)
@@ -79,12 +80,11 @@ async def rbac_verify(self, request: Request, _: dict = DependsJwtAuth) -> None:
             if (method, path) in settings.CASBIN_EXCLUDE:
                 return
             user_uuid = request.user.uuid
-            enforcer = self.enforcer()
+            enforcer = await self.enforcer()
             if not enforcer.enforce(user_uuid, path, method):
                 raise AuthorizationError
 
 
 RBAC = RBAC()
-RbacEnforcer = RBAC.enforcer()
 # RBAC 授权依赖注入
 DependsRBAC = Depends(RBAC.rbac_verify)
diff --git a/backend/app/schemas/user.py b/backend/app/schemas/user.py
@@ -90,6 +90,7 @@ class GetUserInfoNoRelation(_UserInfoBase):
     avatar: str | None = None
     status: StatusType = Field(default=StatusType.enable)
     is_superuser: bool
+    is_staff: bool
     is_multi_login: bool
     join_time: datetime = None
     last_login_time: datetime | None = None
diff --git a/backend/app/services/casbin_service.py b/backend/app/services/casbin_service.py
@@ -2,61 +2,69 @@
 # -*- coding: utf-8 -*-
 from sqlalchemy import Select
 
-from backend.app.common.casbin_rbac import RbacEnforcer
+from backend.app.common.rbac import RBAC
 from backend.app.common.exception import errors
 from backend.app.crud.crud_casbin import CasbinDao
 from backend.app.schemas.casbin_rule import CreatePolicy, UpdatePolicy, DeletePolicy, CreateUserRole, DeleteUserRole
 
 
 class CasbinService:
+
     @staticmethod
     async def get_casbin_list(*, ptype: str, sub: str) -> Select:
         return await CasbinDao.get_all_policy(ptype, sub)
 
     @staticmethod
     async def get_policy_list():
-        data = await RbacEnforcer.get_policy()
+        enforcer = await RBAC.enforcer()
+        data = enforcer.get_policy()
         return data
 
     @staticmethod
     async def create_policy(*, p: CreatePolicy):
-        data = await RbacEnforcer.add_policy(p.sub, p.path, p.method)
+        enforcer = await RBAC.enforcer()
+        data = await enforcer.add_policy(p.sub, p.path, p.method)
         if not data:
             raise errors.ForbiddenError(msg='权限已存在')
         return data
 
     @staticmethod
     async def update_policy(*, old: UpdatePolicy, new: UpdatePolicy):
-        _p = await RbacEnforcer.has_named_policy('p', old.sub, old.path, old.method)
+        enforcer = await RBAC.enforcer()
+        _p = await enforcer.has_named_policy('p', old.sub, old.path, old.method)
         if not _p:
             raise errors.NotFoundError(msg='权限不存在')
-        data = await RbacEnforcer.update_policy([old.sub, old.path, old.method], [new.sub, new.path, new.method])
+        data = await enforcer.update_policy([old.sub, old.path, old.method], [new.sub, new.path, new.method])
         return data
 
     @staticmethod
     async def delete_policy(*, p: DeletePolicy):
-        _p = await RbacEnforcer.has_named_policy('p', p.sub, p.path, p.method)
+        enforcer = await RBAC.enforcer()
+        _p = await enforcer.has_named_policy('p', p.sub, p.path, p.method)
         if not _p:
             raise errors.NotFoundError(msg='权限不存在')
-        data = await RbacEnforcer.remove_policy(p.sub, p.path, p.method)
+        data = await enforcer.remove_policy(p.sub, p.path, p.method)
         return data
 
     @staticmethod
     async def get_group_list():
-        data = await RbacEnforcer.get_grouping_policy()
+        enforcer = await RBAC.enforcer()
+        data = await enforcer.get_grouping_policy()
         return data
 
     @staticmethod
     async def create_group(*, g: CreateUserRole):
-        data = await RbacEnforcer.add_grouping_policy(g.uuid, g.role)
+        enforcer = await RBAC.enforcer()
+        data = await enforcer.add_grouping_policy(g.uuid, g.role)
         if not data:
             raise errors.ForbiddenError(msg='权限已存在')
         return data
 
     @staticmethod
     async def delete_group(*, g: DeleteUserRole):
-        _g = await RbacEnforcer.has_named_grouping_policy('g', g.uuid, g.role)
+        enforcer = await RBAC.enforcer()
+        _g = await enforcer.has_named_grouping_policy('g', g.uuid, g.role)
         if not _g:
             raise errors.NotFoundError(msg='权限不存在')
-        data = await RbacEnforcer.remove_grouping_policy(g.uuid, g.role)
+        data = await enforcer.remove_grouping_policy(g.uuid, g.role)
         return data
diff --git a/backend/sql/init_test_data.sql b/backend/sql/init_test_data.sql
@@ -4,7 +4,7 @@ VALUES (1, 'test', 0, 0, null, null, null, 1, 0, null, '2023-06-26 17:13:45', nu
 insert into fba.sys_menu (id, title, name, level, sort, icon, path, menu_type, component, perms, status, `show`, cache, remark, parent_id, created_time, updated_time)
 values  (1, '测试', 'test', 0, 0, '', null, 0, null, null, 0, 0, 1, null, null, '2023-07-27 19:14:10', '2023-07-27 19:14:52'),
         (2, '仪表盘', 'dashboard', 0, 0, 'IconDashboard', 'dashboard', 1, '/dashboard/workplace/index.vue', null, 1, 1, 1, null, null, '2023-07-27 19:15:45', null),
-        (3, '工作台', 'Workplace', 0, 0, null, 'workplace', 0, null, null, 1, 1, 1, null, null, '2023-07-27 19:17:59', null),
+        (3, '工作台', 'Workplace', 0, 0, null, 'workplace', 0, null, null, 1, 1, 1, null, 2, '2023-07-27 19:17:59', null),
         (4, 'arco官网', 'arcoWebsite', 0, 888, 'IconLink', 'https://arco.design', 1, null, null, 1, 1, 1, null, null, '2023-07-27 19:19:23', null),
         (5, '日志', 'log', 0, 66, 'IconBug', 'log', 0, null, null, 1, 1, 1, null, null, '2023-07-27 19:19:59', null),
         (6, '登录日志', 'Login', 0, 0, null, 'login', 1, '/log/login/index.vue', null, 1, 1, 1, null, 5, '2023-07-27 19:20:56', null),
@@ -17,8 +17,8 @@ values  (1, '测试', 'test', 0, 0, '', null, 0, null, null, 0, 0, 1, null, null
         (13, '角色管理', 'SysRole', 0, 2, null, 'sys-role', 1, '/admin/role/index.vue', null, 1, 1, 1, null, 9, '2023-07-27 19:25:45', null),
         (14, '菜单管理', 'SysMenu', 0, 2, null, 'sys-menu', 1, '/admin/menu/index.vue', null, 1, 1, 1, null, 9, '2023-07-27 19:45:29', null),
         (15, '系统监控', 'monitor', 0, 88, 'IconComputer', 'monitor', 0, null, null, 1, 1, 1, null, null, '2023-07-27 19:27:08', null),
-        (16, 'Redis监控', 'Redis', 0, 0, null, 'redis', 1, '/monitor/redis/index.vue', null, 1, 1, 1, null, 14, '2023-07-27 19:28:03', null),
-        (17, '服务器监控', 'Server', 0, 0, null, 'server', 1, '/monitor/server/index.vue', null, 1, 1, 1, null, 14, '2023-07-27 19:28:29', null);
+        (16, 'Redis监控', 'Redis', 0, 0, null, 'redis', 1, '/monitor/redis/index.vue', null, 1, 1, 1, null, 15, '2023-07-27 19:28:03', null),
+        (17, '服务器监控', 'Server', 0, 0, null, 'server', 1, '/monitor/server/index.vue', null, 1, 1, 1, null, 15, '2023-07-27 19:28:29', null);
 
 INSERT INTO fba.sys_role (id, name, data_scope, status, remark, created_time, updated_time)
 VALUES (1, 'test', 2, 1, null, '2023-06-26 17:13:45', null);
