129 lines
4.3 KiB
Python
129 lines
4.3 KiB
Python
from django.conf import settings
|
|
from django.contrib.auth import get_user_model
|
|
from django.contrib.auth.models import Group, Permission
|
|
from django.contrib.contenttypes.models import ContentType
|
|
|
|
from apps.accounts.menus import DEFAULT_MENUS
|
|
from apps.accounts.models import MenuItem, UserGroup
|
|
from apps.accounts.permissions import DEFAULT_GROUPS, PERMISSIONS
|
|
|
|
LEGACY_ROLE_RENAMES = {
|
|
"System Admin": "系统管理员",
|
|
"Knowledge Admin": "知识库管理员",
|
|
"Support Engineer": "技术支持",
|
|
"Requester": "普通建单人",
|
|
"Auditor": "只读审计员",
|
|
}
|
|
|
|
|
|
def seed_permissions() -> dict[str, Permission]:
|
|
content_type, _ = ContentType.objects.get_or_create(
|
|
app_label="system",
|
|
model="platformpermission",
|
|
)
|
|
|
|
permissions_by_codename: dict[str, Permission] = {}
|
|
for spec in PERMISSIONS:
|
|
permission, _ = Permission.objects.get_or_create(
|
|
content_type=content_type,
|
|
codename=spec.codename,
|
|
defaults={"name": spec.name},
|
|
)
|
|
if permission.name != spec.name:
|
|
permission.name = spec.name
|
|
permission.save(update_fields=["name"])
|
|
permissions_by_codename[spec.codename] = permission
|
|
return permissions_by_codename
|
|
|
|
|
|
def seed_roles(permissions_by_codename: dict[str, Permission]) -> None:
|
|
migrate_legacy_roles()
|
|
for group_name, codenames in DEFAULT_GROUPS.items():
|
|
group, _ = Group.objects.get_or_create(name=group_name)
|
|
group.permissions.set(permissions_by_codename[codename] for codename in codenames)
|
|
|
|
|
|
def migrate_legacy_roles() -> None:
|
|
for legacy_name, target_name in LEGACY_ROLE_RENAMES.items():
|
|
legacy_group = Group.objects.filter(name=legacy_name).first()
|
|
if legacy_group is None:
|
|
continue
|
|
target_group = Group.objects.filter(name=target_name).first()
|
|
if target_group is None:
|
|
legacy_group.name = target_name
|
|
legacy_group.save(update_fields=["name"])
|
|
continue
|
|
target_group.user_set.add(*legacy_group.user_set.all())
|
|
legacy_group.delete()
|
|
|
|
|
|
def seed_user_groups() -> None:
|
|
UserGroup.objects.update_or_create(
|
|
code="default",
|
|
defaults={
|
|
"name": "默认用户组",
|
|
"description": "系统初始化创建的默认业务用户组。",
|
|
"is_active": True,
|
|
},
|
|
)
|
|
|
|
|
|
def seed_menus() -> None:
|
|
menus_by_code: dict[str, MenuItem] = {}
|
|
for spec in DEFAULT_MENUS:
|
|
parent = menus_by_code.get(spec.parent_code) if spec.parent_code else None
|
|
menu, _ = MenuItem.objects.update_or_create(
|
|
code=spec.code,
|
|
defaults={
|
|
"title": spec.title,
|
|
"path": spec.path,
|
|
"icon": spec.icon,
|
|
"parent": parent,
|
|
"sort_order": spec.sort_order,
|
|
"permission_code": spec.permission_code,
|
|
"is_visible": spec.is_visible,
|
|
"is_enabled": spec.is_enabled,
|
|
},
|
|
)
|
|
menus_by_code[spec.code] = menu
|
|
|
|
|
|
def seed_admin_user() -> None:
|
|
username = getattr(settings, "DJANGO_SUPERUSER_USERNAME", None) or "admin"
|
|
password = getattr(settings, "DJANGO_SUPERUSER_PASSWORD", None) or "admin12345"
|
|
email = getattr(settings, "DJANGO_SUPERUSER_EMAIL", None) or "admin@example.com"
|
|
user_model = get_user_model()
|
|
user, created = user_model.objects.get_or_create(
|
|
username=username,
|
|
defaults={
|
|
"email": email,
|
|
"is_staff": True,
|
|
"is_superuser": True,
|
|
},
|
|
)
|
|
changed_fields: list[str] = []
|
|
if user.email != email:
|
|
user.email = email
|
|
changed_fields.append("email")
|
|
if not user.is_staff:
|
|
user.is_staff = True
|
|
changed_fields.append("is_staff")
|
|
if not user.is_superuser:
|
|
user.is_superuser = True
|
|
changed_fields.append("is_superuser")
|
|
if created or not user.check_password(password):
|
|
user.set_password(password)
|
|
changed_fields.append("password")
|
|
if changed_fields:
|
|
user.save(update_fields=changed_fields)
|
|
admin_role = Group.objects.get(name="系统管理员")
|
|
user.groups.add(admin_role)
|
|
|
|
|
|
def bootstrap_governance() -> None:
|
|
permissions_by_codename = seed_permissions()
|
|
seed_roles(permissions_by_codename)
|
|
seed_user_groups()
|
|
seed_menus()
|
|
seed_admin_user()
|