e1e515ecae
后端新增预算本体解析模块和风险规则评分回填服务，优化规则 生成本体对齐和提示词构建，增强费用类型关键词和本体验证， 完善报销查询和审计接口，前端预算中心页面增加对话框和本 体工具函数，重构审计页面元数据和视图模型，补充单元测试。
119 lines
3.7 KiB
Python
119 lines
3.7 KiB
Python
from collections.abc import Generator
|
|
from dataclasses import dataclass
|
|
from typing import Annotated
|
|
|
|
from fastapi import Depends, Header, HTTPException, status
|
|
from sqlalchemy.orm import Session
|
|
|
|
from app.db.session import get_session_factory
|
|
|
|
|
|
def get_db() -> Generator[Session, None, None]:
|
|
db = get_session_factory()()
|
|
try:
|
|
yield db
|
|
finally:
|
|
db.close()
|
|
|
|
|
|
@dataclass(slots=True)
|
|
class CurrentUserContext:
|
|
username: str
|
|
name: str
|
|
role_codes: list[str]
|
|
is_admin: bool
|
|
department_name: str = ""
|
|
|
|
|
|
def get_current_user(
|
|
x_auth_username: Annotated[
|
|
str | None,
|
|
Header(description="当前登录用户名。知识库接口至少需要提供用户名或姓名。"),
|
|
] = None,
|
|
x_auth_name: Annotated[
|
|
str | None,
|
|
Header(description="当前登录人展示姓名。未传时默认回退到用户名。"),
|
|
] = None,
|
|
x_auth_role_codes: Annotated[
|
|
str | None,
|
|
Header(description="角色编码列表，多个角色使用英文逗号分隔，例如 `manager,finance`。"),
|
|
] = None,
|
|
x_auth_is_admin: Annotated[
|
|
str | None,
|
|
Header(description="是否管理员，支持 `true/false/1/0`。"),
|
|
] = None,
|
|
x_auth_department: Annotated[
|
|
str | None,
|
|
Header(description="当前登录人的所属部门。"),
|
|
] = None,
|
|
) -> CurrentUserContext:
|
|
role_codes = [item.strip() for item in (x_auth_role_codes or "").split(",") if item.strip()]
|
|
is_admin = str(x_auth_is_admin or "").strip().lower() in {"1", "true", "yes", "on"}
|
|
|
|
username = (x_auth_username or "").strip()
|
|
name = (x_auth_name or username).strip()
|
|
|
|
if not username and not name:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="请先登录后再访问知识库。",
|
|
)
|
|
|
|
return CurrentUserContext(
|
|
username=username or name,
|
|
name=name or username,
|
|
role_codes=role_codes,
|
|
is_admin=is_admin,
|
|
department_name=(x_auth_department or "").strip(),
|
|
)
|
|
|
|
|
|
def require_admin_user(
|
|
current_user: Annotated[CurrentUserContext, Depends(get_current_user)],
|
|
) -> CurrentUserContext:
|
|
if current_user.is_admin or "manager" in current_user.role_codes:
|
|
return current_user
|
|
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="只有管理员可以上传、删除或修改知识库文件。",
|
|
)
|
|
|
|
|
|
def require_platform_admin_user(
|
|
current_user: Annotated[CurrentUserContext, Depends(get_current_user)],
|
|
) -> CurrentUserContext:
|
|
if current_user.is_admin:
|
|
return current_user
|
|
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="只有 admin 管理员可以执行该操作。",
|
|
)
|
|
|
|
|
|
def require_rule_editor_user(
|
|
current_user: Annotated[CurrentUserContext, Depends(get_current_user)],
|
|
) -> CurrentUserContext:
|
|
role_codes = {item.strip() for item in current_user.role_codes}
|
|
if current_user.is_admin or "manager" in role_codes or "finance" in role_codes:
|
|
return current_user
|
|
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="只有财务人员或高级管理人员可以编辑规则草稿。",
|
|
)
|
|
|
|
|
|
def require_rule_reviewer_user(
|
|
current_user: Annotated[CurrentUserContext, Depends(get_current_user)],
|
|
) -> CurrentUserContext:
|
|
role_codes = {item.strip() for item in current_user.role_codes}
|
|
if current_user.is_admin or "manager" in role_codes:
|
|
return current_user
|
|
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="只有高级管理人员或 admin 管理员可以执行该操作。",
|
|
)
|