122 lines
3.7 KiB
Python
122 lines
3.7 KiB
Python
from django.contrib.auth import authenticate, login, logout
|
|
from django.middleware.csrf import get_token
|
|
from ninja import Router
|
|
from ninja.errors import HttpError
|
|
|
|
from apps.accounts.models import MenuItem
|
|
from apps.accounts.permissions import PERMISSIONS
|
|
from apps.accounts.schemas import CurrentUserOut, LoginIn
|
|
|
|
router = Router(tags=["accounts"])
|
|
|
|
|
|
def permission_codes_for_user(user) -> list[str]:
|
|
if user.is_superuser:
|
|
return sorted(permission.codename for permission in PERMISSIONS)
|
|
codes = set()
|
|
for permission in user.get_all_permissions():
|
|
if permission.startswith("system."):
|
|
codes.add(permission.removeprefix("system."))
|
|
return sorted(codes)
|
|
|
|
|
|
def serialize_menu(menu: MenuItem, children: list[dict]) -> dict:
|
|
return {
|
|
"id": menu.id,
|
|
"code": menu.code,
|
|
"title": menu.title,
|
|
"path": menu.path,
|
|
"icon": menu.icon,
|
|
"permission_code": menu.permission_code,
|
|
"is_visible": menu.is_visible,
|
|
"is_enabled": menu.is_enabled,
|
|
"children": children,
|
|
}
|
|
|
|
|
|
def menu_tree_for_permissions(permission_codes: list[str]) -> list[dict]:
|
|
allowed = set(permission_codes)
|
|
menus = list(
|
|
MenuItem.objects.filter(is_visible=True, is_enabled=True)
|
|
.select_related("parent")
|
|
.order_by("sort_order", "id")
|
|
)
|
|
children_by_parent: dict[int | None, list[MenuItem]] = {}
|
|
for menu in menus:
|
|
if menu.permission_code and menu.permission_code not in allowed:
|
|
continue
|
|
children_by_parent.setdefault(menu.parent_id, []).append(menu)
|
|
|
|
def build(parent_id: int | None) -> list[dict]:
|
|
result = []
|
|
for menu in children_by_parent.get(parent_id, []):
|
|
result.append(serialize_menu(menu, build(menu.id)))
|
|
return result
|
|
|
|
return build(None)
|
|
|
|
|
|
def serialize_current_user(user) -> dict:
|
|
permission_codes = permission_codes_for_user(user)
|
|
return {
|
|
"id": user.id,
|
|
"username": user.username,
|
|
"display_name": user.get_full_name() or user.username,
|
|
"email": user.email,
|
|
"is_superuser": user.is_superuser,
|
|
"roles": [{"id": group.id, "name": group.name} for group in user.groups.all()],
|
|
"user_groups": [
|
|
{
|
|
"id": group.id,
|
|
"name": group.name,
|
|
"code": group.code,
|
|
"description": group.description,
|
|
"is_active": group.is_active,
|
|
"created_at": group.created_at,
|
|
"updated_at": group.updated_at,
|
|
}
|
|
for group in user.business_groups.all()
|
|
],
|
|
"permissions": permission_codes,
|
|
"menus": menu_tree_for_permissions(permission_codes),
|
|
}
|
|
|
|
|
|
def require_login(request):
|
|
if not request.user.is_authenticated:
|
|
raise HttpError(401, "Authentication required")
|
|
return request.user
|
|
|
|
|
|
def require_permission(request, codename: str):
|
|
user = require_login(request)
|
|
if user.is_superuser or user.has_perm(f"system.{codename}"):
|
|
return user
|
|
raise HttpError(403, "Permission denied")
|
|
|
|
|
|
@router.get("/auth/csrf")
|
|
def csrf(request):
|
|
return {"csrfToken": get_token(request)}
|
|
|
|
|
|
@router.post("/auth/login", response=CurrentUserOut)
|
|
def login_user(request, payload: LoginIn):
|
|
user = authenticate(request, username=payload.username, password=payload.password)
|
|
if user is None or not user.is_active:
|
|
raise HttpError(401, "Invalid username or password")
|
|
login(request, user)
|
|
return serialize_current_user(user)
|
|
|
|
|
|
@router.post("/auth/logout")
|
|
def logout_user(request):
|
|
logout(request)
|
|
return {"status": "ok"}
|
|
|
|
|
|
@router.get("/auth/me", response=CurrentUserOut)
|
|
def current_user(request):
|
|
user = require_login(request)
|
|
return serialize_current_user(user)
|