125 lines
5.0 KiB
YAML
125 lines
5.0 KiB
YAML
apiVersion: v1
|
|
data:
|
|
permissions.py: |
|
|
import re
|
|
|
|
from rest_framework.permissions import BasePermission
|
|
from rest_framework.request import Request
|
|
|
|
class CompanyIdTokenBasedPermission(BasePermission):
|
|
|
|
def has_permission_to_retrieve(self, request: Request, view) -> bool:
|
|
validated_token = request.auth
|
|
user_company_ids = validated_token.get('company_ids', [])
|
|
company_id = request.query_params.get('company_id')
|
|
|
|
if company_id is None:
|
|
company_id = request.query_params.get('tenant_id')
|
|
if company_id is None:
|
|
company_id = request.query_params.get('tenant_identifier')
|
|
if not company_id:
|
|
return True
|
|
|
|
return True
|
|
|
|
|
|
class CompanyAttributeIdTokenBasedPermission(CompanyIdTokenBasedPermission):
|
|
|
|
def has_permission_to_update(self, request: Request, view) -> bool:
|
|
validated_token = request.auth
|
|
user_company_ids = set(validated_token.get('company_ids', []))
|
|
|
|
if isinstance(request.data, list):
|
|
objects_ids = [obj.get("id") for obj in request.data]
|
|
else:
|
|
objects_ids = [request.data.get("id")]
|
|
|
|
# Проверка, что множество компаний Пользователя включает множество затрагиваемых в БД
|
|
objects = view.queryset.filter(id__in=objects_ids)
|
|
affected_tenants = set(int(obj.tenant_identifier) for obj in objects)
|
|
return affected_tenants.issubset(user_company_ids)
|
|
|
|
|
|
|
|
class CompanyIdTokenBasedPermission(BasePermission):
|
|
|
|
def has_permission_to_retrieve(self, request: Request, view) -> bool:
|
|
validated_token = request.auth
|
|
print(request.auth, "########################")
|
|
user_company_ids = validated_token.get('company_ids', [])
|
|
company_id = request.query_params.get('company_id')
|
|
|
|
if company_id is None:
|
|
company_id = request.query_params.get('tenant_id')
|
|
if company_id is None:
|
|
company_id = request.query_params.get('tenant_identifier')
|
|
if not company_id:
|
|
return True
|
|
|
|
return int(company_id) in user_company_ids
|
|
|
|
def has_permission_to_create(self, request: Request, view) -> bool:
|
|
validated_token = request.auth
|
|
affected_tenants = set()
|
|
user_company_ids = set(validated_token.get('company_ids', []))
|
|
|
|
if isinstance(request.data, list):
|
|
for obj in request.data:
|
|
affected_tenants.add(obj.get("tenant_id"))
|
|
else:
|
|
affected_tenants.add(request.data.get("tenant_id"))
|
|
# Проверка, что множество компаний Пользователя включает множество затрагиваемых полностью
|
|
return affected_tenants.issubset(user_company_ids)
|
|
|
|
def has_permission_to_update(self, request: Request, view) -> bool:
|
|
validated_token = request.auth
|
|
user_company_ids = set(validated_token.get('company_ids', []))
|
|
|
|
if isinstance(request.data, list):
|
|
objects_ids = [obj.get("id") for obj in request.data]
|
|
else:
|
|
objects_ids = [request.data.get("id")]
|
|
|
|
# Проверка, что множество компаний Пользователя включает множество затрагиваемых в БД
|
|
objects = view.queryset.filter(id__in=objects_ids)
|
|
affected_tenants = set(int(obj.tenant_id) for obj in objects)
|
|
return affected_tenants.issubset(user_company_ids)
|
|
|
|
def has_object_permission(self, request, view, obj):
|
|
validated_token = request.auth
|
|
|
|
user_company_ids = {
|
|
int(value)
|
|
for value in
|
|
validated_token.get("company_ids", [])
|
|
}
|
|
|
|
if hasattr(obj, "tenant_id"):
|
|
tenant_id = int(getattr(obj, "tenant_id"))
|
|
return tenant_id in user_company_ids
|
|
|
|
return True
|
|
|
|
def has_permission(self, request, view) -> bool:
|
|
if request.auth is None:
|
|
if request.user is None:
|
|
return False
|
|
elif request.user.is_superuser:
|
|
return True
|
|
|
|
if request.method == "GET":
|
|
#return self.has_permission_to_retrieve(request, view)
|
|
return True
|
|
elif request.method == "POST":
|
|
if re.fullmatch(".*/*/copy/", request.path):
|
|
return True # Проверка прав перекладывается на has_object_permission()
|
|
if re.fullmatch(".*/*/search/", request.path):
|
|
return True
|
|
return self.has_permission_to_create(request, view)
|
|
else:
|
|
return self.has_permission_to_update(request, view)
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: permissions
|
|
namespace: eav
|