Skip to content

Commit 7ea9f14

Browse files
wxg0103wxg0103
committed
feat: add user group resource permission management and related SQL queries
1 parent 8323676 commit 7ea9f14

12 files changed

Lines changed: 933 additions & 2 deletions

‎apps/system_manage/models/__init__.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
@desc:
88
"""
99
from .workspace_user_permission import *
10+
from .workspace_user_group_permission import *
1011
from .system_setting import *
1112
from .log_management import *
1213
from .chat_user import *

‎apps/system_manage/models/workspace_user_group_permission.py‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# coding=utf-8
2+
"""
3+
@project: MaxKB
4+
@Author：虎虎
5+
@file： workspace_permission.py
6+
@date：2025/4/16 18:25
7+
@desc:
8+
"""
9+
10+
import uuid_utils.compat as uuid
11+
from django.contrib.postgres.fields import ArrayField
12+
from django.db import models
13+
14+
from common.constants.permission_constants import ResourceAuthType, ResourcePermissionRole, ResourcePermission
15+
from users.models.user_group import SystemUserGroup
16+
17+
from .workspace_user_permission import AuthTargetType
18+
19+
20+
class WorkspaceUserGroupResourcePermission(models.Model):
21+
"""
22+
工作空间用户组资源权限表
23+
用于管理当前工作空间下用户组对某一个应用或者知识库的操作权限
24+
"""
25+
id = models.UUIDField(primary_key=True, max_length=128, default=uuid.uuid7, editable=False, verbose_name="主键id")
26+
27+
workspace_id = models.CharField(max_length=128, verbose_name="工作空间id", default="default", db_index=True)
28+
29+
user_group = models.ForeignKey(SystemUserGroup, on_delete=models.CASCADE, verbose_name="用户组id", db_index=True)
30+
31+
auth_target_type = models.CharField(verbose_name='授权目标', max_length=128, choices=AuthTargetType.choices,
32+
default=AuthTargetType.KNOWLEDGE, db_index=True)
33+
# 授权的知识库或者应用的id
34+
target = models.CharField(max_length=128, verbose_name="知识库/应用id", db_index=True)
35+
36+
# 授权类型 如果是Role那么就是角色的权限 如果是PERMISSION
37+
auth_type = models.CharField(default=False, verbose_name="授权类型", choices=ResourceAuthType.choices,
38+
db_default=ResourceAuthType.ROLE, db_index=True)
39+
# 资源权限列表
40+
permission_list = ArrayField(verbose_name="权限列表",
41+
default=list,
42+
base_field=models.CharField(max_length=256,
43+
blank=True,
44+
choices=ResourcePermission.choices + ResourcePermissionRole.choices,
45+
default=ResourcePermission.VIEW))
46+
47+
create_time = models.DateTimeField(verbose_name="创建时间", auto_now_add=True, db_index=True)
48+
49+
update_time = models.DateTimeField(verbose_name="修改时间", auto_now=True, db_index=True)
50+
51+
class Meta:
52+
db_table = "workspace_user_group_resource_permission"
53+
unique_together = ('workspace_id', 'user_group', 'auth_target_type', 'target')

‎apps/system_manage/models/workspace_user_permission.py‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,7 @@
1111
from django.contrib.postgres.fields import ArrayField
1212
from django.db import models
1313

14-
from common.constants.permission_constants import Group, ResourcePermissionGroup, ResourceAuthType, \
15-
ResourcePermissionRole, ResourcePermission
14+
from common.constants.permission_constants import Group, ResourceAuthType, ResourcePermissionRole, ResourcePermission
1615
from users.models import User
1716

1817

‎apps/system_manage/serializers/user_group_resource_permission.py‎

Lines changed: 439 additions & 0 deletions
Large diffs are not rendered by default.

‎apps/system_manage/sql/get_application_user_group_resource_permission.sql‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
SELECT resource_or_folder.*,
2+
CASE
3+
WHEN wurp.permission IS NULL THEN 'NOT_AUTH'
4+
ELSE wurp.permission
5+
END
6+
FROM (
7+
SELECT id::text,
8+
"name",
9+
'APPLICATION' AS "auth_target_type",
10+
'application' AS "resource_type",
11+
user_group_id,
12+
workspace_id,
13+
icon,
14+
folder_id,
15+
create_time
16+
FROM application
17+
${query_set}
18+
UNION
19+
SELECT application_folder."id"::text,
20+
application_folder."name",
21+
'APPLICATION' AS "auth_target_type",
22+
'folder' AS "resource_type",
23+
application_folder."user_group_id",
24+
application_folder."workspace_id",
25+
NULL AS "icon",
26+
application_folder."parent_id" AS "folder_id",
27+
application_folder."create_time"
28+
FROM application_folder
29+
${folder_query_set}
30+
) resource_or_folder
31+
LEFT JOIN (
32+
SELECT target,
33+
CASE
34+
WHEN auth_type = 'ROLE'
35+
AND 'ROLE' = ANY (permission_list) THEN 'ROLE'
36+
WHEN auth_type = 'RESOURCE_PERMISSION_GROUP'
37+
AND 'MANAGE' = ANY (permission_list) THEN 'MANAGE'
38+
WHEN auth_type = 'RESOURCE_PERMISSION_GROUP'
39+
AND 'VIEW' = ANY (permission_list) THEN 'VIEW'
40+
ELSE NULL
41+
END AS permission
42+
FROM workspace_user_group_resource_permission
43+
${workspace_user_group_resource_permission_query_set}
44+
) wurp
45+
ON wurp.target::text = resource_or_folder.id
46+
${resource_query_set}
47+
ORDER BY resource_or_folder.create_time DESC

‎apps/system_manage/sql/get_knowledge_user_group_resource_permission.sql‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
SELECT resource_or_folder.*,
2+
CASE
3+
WHEN wurp.permission IS NULL THEN 'NOT_AUTH'
4+
ELSE wurp.permission
5+
END
6+
FROM (
7+
SELECT
8+
id::text,
9+
"name",
10+
'KNOWLEDGE' AS "auth_target_type",
11+
'knowledge' AS "resource_type",
12+
user_group_id,
13+
workspace_id,
14+
"type"::varchar AS "icon",
15+
folder_id,
16+
create_time
17+
FROM knowledge
18+
${query_set}
19+
UNION
20+
SELECT knowledge_folder."id"::text,
21+
knowledge_folder."name",
22+
'KNOWLEDGE' AS "auth_target_type",
23+
'folder' AS "resource_type",
24+
knowledge_folder."user_group_id",
25+
knowledge_folder."workspace_id",
26+
NULL AS "icon",
27+
knowledge_folder."parent_id" AS "folder_id",
28+
knowledge_folder."create_time"
29+
FROM knowledge_folder
30+
${folder_query_set}
31+
) resource_or_folder
32+
LEFT JOIN (
33+
SELECT
34+
target,
35+
CASE
36+
WHEN auth_type = 'ROLE'
37+
AND 'ROLE' = ANY(permission_list) THEN 'ROLE'
38+
WHEN auth_type = 'RESOURCE_PERMISSION_GROUP'
39+
AND 'MANAGE' = ANY(permission_list) THEN 'MANAGE'
40+
WHEN auth_type = 'RESOURCE_PERMISSION_GROUP'
41+
AND 'VIEW' = ANY(permission_list) THEN 'VIEW'
42+
ELSE null
43+
END AS permission
44+
FROM
45+
workspace_user_group_resource_permission
46+
${workspace_user_group_resource_permission_query_set}
47+
) wurp
48+
ON wurp.target::text = resource_or_folder.id
49+
${resource_query_set}
50+
ORDER BY resource_or_folder.create_time DESC

‎apps/system_manage/sql/get_model_user_group_resource_permission.sql‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
SELECT
2+
resource_or_folder.*,
3+
CASE
4+
WHEN
5+
wurp."permission" is null then 'NOT_AUTH'
6+
ELSE wurp."permission"
7+
END
8+
FROM (
9+
SELECT
10+
"id"::text,
11+
"name",
12+
'MODEL' AS "auth_target_type",
13+
'model' AS "resource_type",
14+
user_group_id,
15+
workspace_id,
16+
provider as icon,
17+
'default' as folder_id,
18+
create_time
19+
FROM
20+
model
21+
${query_set}
22+
UNION
23+
SELECT
24+
"id"::text,
25+
"name",
26+
'MODEL' AS "auth_target_type",
27+
'folder' AS "resource_type",
28+
user_group_id,
29+
workspace_id,
30+
provider as icon,
31+
'default' as folder_id,
32+
create_time
33+
FROM model
34+
${folder_query_set}
35+
AND 1=0
36+
) resource_or_folder
37+
LEFT JOIN (
38+
SELECT
39+
target,
40+
CASE
41+
WHEN auth_type = 'ROLE'
42+
AND 'ROLE' = ANY(permission_list) THEN 'ROLE'
43+
WHEN auth_type = 'RESOURCE_PERMISSION_GROUP'
44+
AND 'MANAGE' = ANY(permission_list) THEN 'MANAGE'
45+
WHEN auth_type = 'RESOURCE_PERMISSION_GROUP'
46+
AND 'VIEW' = ANY(permission_list) THEN 'VIEW'
47+
ELSE null
48+
END AS permission
49+
FROM
50+
workspace_user_group_resource_permission
51+
${workspace_user_group_resource_permission_query_set}
52+
) wurp
53+
ON wurp.target = resource_or_folder."id"
54+
${resource_query_set}
55+
ORDER BY resource_or_folder.create_time DESC

‎apps/system_manage/sql/get_resource_user_group_permission_detail.sql‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
SELECT
2+
u.id,
3+
u.name,
4+
case
5+
when
6+
wurp."permission" is null then 'NOT_AUTH'
7+
else wurp."permission"
8+
end
9+
FROM
10+
public."system_user_group" u
11+
LEFT JOIN (
12+
SELECT
13+
user_group_id ,
14+
(case
15+
when auth_type = 'ROLE'
16+
and 'ROLE' = any( permission_list) then 'ROLE'
17+
when auth_type = 'RESOURCE_PERMISSION_GROUP'
18+
and 'MANAGE'= any(permission_list) then 'MANAGE'
19+
when auth_type = 'RESOURCE_PERMISSION_GROUP'
20+
and 'VIEW' = any( permission_list) then 'VIEW'
21+
else null
22+
end) as "permission"
23+
FROM
24+
workspace_user_group_resource_permission
25+
${workspace_user_group_resource_permission_query_set}
26+
) wurp
27+
ON
28+
u.id = wurp.user_group_id
29+
${user_query_set}

‎apps/system_manage/sql/get_tool_user_group_resource_permission.sql‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
SELECT resource_or_folder.*,
2+
CASE
3+
WHEN wurp."permission" IS NULL THEN 'NOT_AUTH'
4+
ELSE wurp."permission"
5+
END
6+
FROM (
7+
SELECT "id"::text,
8+
"name",
9+
'TOOL' AS "auth_target_type",
10+
'tool' AS "resource_type",
11+
user_group_id,
12+
workspace_id,
13+
icon,
14+
folder_id,
15+
tool_type,
16+
create_time
17+
FROM tool
18+
${query_set}
19+
UNION
20+
SELECT tool_folder."id"::text,
21+
tool_folder."name",
22+
'TOOL' AS "auth_target_type",
23+
'folder' AS "resource_type",
24+
tool_folder."user_group_id",
25+
tool_folder."workspace_id",
26+
NULL AS "icon",
27+
tool_folder."parent_id" AS "folder_id",
28+
NULL AS "tool_type",
29+
tool_folder."create_time"
30+
FROM tool_folder
31+
${folder_query_set}
32+
) resource_or_folder
33+
LEFT JOIN (
34+
SELECT target,
35+
CASE
36+
WHEN auth_type = 'ROLE'
37+
AND 'ROLE' = ANY(permission_list) THEN 'ROLE'
38+
WHEN auth_type = 'RESOURCE_PERMISSION_GROUP'
39+
AND 'MANAGE' = ANY(permission_list) THEN 'MANAGE'
40+
WHEN auth_type = 'RESOURCE_PERMISSION_GROUP'
41+
AND 'VIEW' = ANY(permission_list) THEN 'VIEW'
42+
ELSE null
43+
END AS permission
44+
FROM
45+
workspace_user_group_resource_permission
46+
${workspace_user_group_resource_permission_query_set}
47+
) wurp
48+
ON wurp.target::text = resource_or_folder."id"
49+
${resource_query_set}
50+
ORDER BY resource_or_folder.create_time DESC
51+

‎apps/system_manage/urls.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,12 @@
88
urlpatterns = [
99
path('workspace/<str:workspace_id>/user_resource_permission/user/<str:user_id>/resource/<str:resource>', views.WorkSpaceUserResourcePermissionView.as_view()),
1010
path('workspace/<str:workspace_id>/user_resource_permission/user/<str:user_id>/resource/<str:resource>/<int:current_page>/<int:page_size>', views.WorkSpaceUserResourcePermissionView.Page.as_view()),
11+
path('workspace/<str:workspace_id>/user_group_resource_permission/user_group/<str:user_group_id>/resource/<str:resource>', views.WorkSpaceUserGroupResourcePermissionView.as_view()),
12+
path('workspace/<str:workspace_id>/user_group_resource_permission/user_group/<str:user_group_id>/resource/<str:resource>/<int:current_page>/<int:page_size>', views.WorkSpaceUserGroupResourcePermissionView.Page.as_view()),
1113
path('workspace/<str:workspace_id>/resource_user_permission/resource/<str:target>/resource/<str:resource>', views.WorkspaceResourceUserPermissionView.as_view()),
1214
path('workspace/<str:workspace_id>/resource_user_permission/resource/<str:target>/resource/<str:resource>/<int:current_page>/<int:page_size>', views.WorkspaceResourceUserPermissionView.Page.as_view()),
15+
path('workspace/<str:workspace_id>/resource_user_group_permission/resource/<str:target>/resource/<str:resource>', views.WorkspaceResourceUserGroupPermissionView.as_view()),
16+
path('workspace/<str:workspace_id>/resource_user_group_permission/resource/<str:target>/resource/<str:resource>/<int:current_page>/<int:page_size>', views.WorkspaceResourceUserGroupPermissionView.Page.as_view()),
1317
path('workspace/<str:workspace_id>/resource_mapping/<str:resource>/<str:resource_id>/<int:current_page>/<int:page_size>', views.ResourceMappingView.as_view()),
1418
path('workspace/<str:workspace_id>/mapping_resource/<str:resource>/<str:resource_id>/<int:current_page>/<int:page_size>', views.MappingResourceView.as_view()),
1519
path('email_setting', views.SystemSetting.Email.as_view()),

0 commit comments

Comments
 (0)