6f0e82f351
- 平台治理: 租户用户权限层次、资源ACL、审批中心与审批模板、访问申请 - 存储: MinIO 存储进度迁移、对象存储安全加固与测试 - 计算: GPU 资源预留、compute 轮询与同步增强 - 权限: permission v2 迁移、权限安全验收测试 - 日志: 后端运行日志中文说明、操作日志整合 - 数据处理/评测: 数据转换与模型评测优化 Co-Authored-By: Claude <noreply@anthropic.com>
261 lines
9.2 KiB
Python
261 lines
9.2 KiB
Python
from __future__ import annotations
|
||
|
||
from fastapi import APIRouter, Body, Depends, Request
|
||
from typing import Any
|
||
|
||
from app.api.v1.endpoints.platform import ok, fail
|
||
from app.core.auth import filter_accessible_resource_ids, get_current_user, has_resource_access, is_admin
|
||
from app.db.platform_store import get_platform_store
|
||
|
||
router = APIRouter(prefix="/projects", tags=["project"])
|
||
|
||
|
||
def _actor(request: Request) -> str | None:
|
||
auth = request.headers.get("Authorization", "")
|
||
token = auth.replace("Bearer ", "").strip()
|
||
return token or None
|
||
|
||
|
||
def _require_no_pending_approval(resource_type: str, resource_id: str) -> None:
|
||
"""第 4 周：写操作审批拦截——存在待审批实例时拒绝执行。"""
|
||
store = get_platform_store()
|
||
pending = [
|
||
i for i in store.approval_instances(status="pending")
|
||
if i["resource_type"] == resource_type and i["resource_id"] == resource_id
|
||
]
|
||
if pending:
|
||
raise fail(409, "存在待审批的变更，请先完成审批")
|
||
|
||
|
||
def _require_approval_or_admin(
|
||
resource_type: str,
|
||
resource_id: str,
|
||
current_user: dict[str, Any],
|
||
action_desc: str = "",
|
||
action: str = "project.change",
|
||
) -> dict[str, Any] | None:
|
||
"""高风险操作审批旁路：admin 直接放行，普通用户创建审批实例（code=202）。"""
|
||
if is_admin(current_user):
|
||
return None
|
||
if not has_resource_access(resource_type, resource_id, current_user, "write"):
|
||
raise fail(403, "no permission to request this project change")
|
||
store = get_platform_store()
|
||
if store.consume_approved_approval(resource_type, resource_id, str(current_user.get("id") or ""), action):
|
||
return None
|
||
instance = store.create_approval_instance({
|
||
"resource_type": resource_type,
|
||
"resource_id": resource_id,
|
||
"applicant_id": current_user.get("id"),
|
||
"template_id": None,
|
||
"action": action,
|
||
"tenant_id": current_user.get("tenant_id") or "default",
|
||
"reason": action_desc,
|
||
})
|
||
return {
|
||
"code": 202,
|
||
"message": f"操作已提交审批，等待管理员批准：{action_desc}",
|
||
"data": {"approval_required": True, "approval_id": instance["id"]},
|
||
}
|
||
|
||
|
||
@router.get("")
|
||
def list_projects(
|
||
tenant_id: str = "default",
|
||
status: str | None = None,
|
||
keyword: str | None = None,
|
||
current_user: dict = Depends(get_current_user),
|
||
) -> dict[str, Any]:
|
||
store = get_platform_store()
|
||
projects = store.projects(tenant_id=tenant_id, status=status, keyword=keyword)
|
||
# #1 ACL 过滤：admin 直接放行，普通用户只能看到自己被授权的项目
|
||
accessible_ids = set(
|
||
filter_accessible_resource_ids("project", [p["id"] for p in projects], current_user)
|
||
)
|
||
filtered = [p for p in projects if p["id"] in accessible_ids]
|
||
return ok(filtered)
|
||
|
||
|
||
@router.post("")
|
||
def create_project(payload: dict[str, Any] = Body(...), request: Request = None, current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
|
||
if not is_admin(current_user) and str(payload.get("tenant_id") or current_user.get("tenant_id") or "default") != str(current_user.get("tenant_id") or "default"):
|
||
raise fail(403, "cannot create project in another tenant")
|
||
payload.setdefault("tenant_id", current_user.get("tenant_id") or "default")
|
||
payload.setdefault("create_by", current_user.get("id"))
|
||
store = get_platform_store()
|
||
try:
|
||
store.assert_active_tenant(payload["tenant_id"])
|
||
except ValueError as exc:
|
||
raise fail(400, str(exc))
|
||
proj = store.create_project(payload)
|
||
store.record_audit(
|
||
action="project.create",
|
||
actor_id=current_user.get("id"),
|
||
target_type="project",
|
||
target_id=proj["id"],
|
||
tenant_id=proj.get("tenant_id"),
|
||
detail=f"name={proj.get('name')}",
|
||
)
|
||
return ok(proj)
|
||
|
||
|
||
@router.get("/{project_id}")
|
||
def get_project(project_id: str, current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
|
||
# #2 访问控制：普通用户无 read 权限则拒绝
|
||
if not has_resource_access("project", project_id, current_user, "read"):
|
||
raise fail(403, "no permission to access this project")
|
||
try:
|
||
return ok(get_platform_store().project(project_id))
|
||
except KeyError:
|
||
raise fail(404, "project not found")
|
||
|
||
|
||
@router.put("/{project_id}")
|
||
def update_project(
|
||
project_id: str,
|
||
payload: dict[str, Any] = Body(...),
|
||
request: Request = None,
|
||
current_user: dict = Depends(get_current_user),
|
||
) -> dict[str, Any]:
|
||
if not has_resource_access("project", project_id, current_user, "write"):
|
||
raise fail(403, "no permission to update this project")
|
||
store = get_platform_store()
|
||
try:
|
||
proj = store.update_project(project_id, payload)
|
||
except KeyError:
|
||
raise fail(404, "project not found")
|
||
store.record_audit(
|
||
action="project.update",
|
||
actor_id=current_user.get("id"),
|
||
target_type="project",
|
||
target_id=project_id,
|
||
tenant_id=proj.get("tenant_id"),
|
||
detail=f"fields={','.join(payload.keys())}",
|
||
)
|
||
return ok(proj)
|
||
|
||
|
||
@router.post("/{project_id}/archive")
|
||
def archive_project(
|
||
project_id: str,
|
||
request: Request = None,
|
||
current_user: dict = Depends(get_current_user),
|
||
) -> dict[str, Any]:
|
||
_require_no_pending_approval("project", project_id)
|
||
pending = _require_approval_or_admin("project", project_id, current_user, f"归档项目 {project_id}", "project.archive")
|
||
if pending:
|
||
return pending
|
||
store = get_platform_store()
|
||
try:
|
||
proj = store.archive_project(project_id)
|
||
except KeyError:
|
||
raise fail(404, "project not found")
|
||
store.record_audit(
|
||
action="project.archive",
|
||
actor_id=current_user.get("id"),
|
||
target_type="project",
|
||
target_id=project_id,
|
||
tenant_id=proj.get("tenant_id"),
|
||
)
|
||
return ok(proj)
|
||
|
||
|
||
@router.delete("/{project_id}")
|
||
def delete_project(
|
||
project_id: str,
|
||
request: Request = None,
|
||
current_user: dict = Depends(get_current_user),
|
||
) -> dict[str, Any]:
|
||
_require_no_pending_approval("project", project_id)
|
||
pending = _require_approval_or_admin("project", project_id, current_user, f"删除项目 {project_id}", "project.delete")
|
||
if pending:
|
||
return pending
|
||
store = get_platform_store()
|
||
store.delete_project(project_id)
|
||
store.record_audit(
|
||
action="project.delete",
|
||
actor_id=current_user.get("id"),
|
||
target_type="project",
|
||
target_id=project_id,
|
||
)
|
||
return ok(None)
|
||
|
||
|
||
@router.get("/{project_id}/members")
|
||
def list_members(project_id: str, current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
|
||
if not has_resource_access("project", project_id, current_user, "read"):
|
||
raise fail(403, "no permission to access this project")
|
||
try:
|
||
return ok(get_platform_store().project_members(project_id))
|
||
except KeyError:
|
||
raise fail(404, "project not found")
|
||
|
||
|
||
@router.post("/{project_id}/members")
|
||
def add_member(
|
||
project_id: str,
|
||
payload: dict[str, Any] = Body(...),
|
||
request: Request = None,
|
||
current_user: dict = Depends(get_current_user),
|
||
) -> dict[str, Any]:
|
||
if not has_resource_access("project", project_id, current_user, "write"):
|
||
raise fail(403, "no permission to manage members of this project")
|
||
store = get_platform_store()
|
||
try:
|
||
member = store.add_project_member(project_id, payload)
|
||
except KeyError:
|
||
raise fail(404, "project not found")
|
||
store.record_audit(
|
||
action="project.member.add",
|
||
actor_id=current_user.get("id"),
|
||
target_type="project.member",
|
||
target_id=project_id,
|
||
detail=f"user_id={payload.get('user_id')},role={payload.get('role')}",
|
||
)
|
||
return ok(member)
|
||
|
||
|
||
@router.put("/{project_id}/members/{user_id}")
|
||
def update_member(
|
||
project_id: str,
|
||
user_id: str,
|
||
payload: dict[str, Any] = Body(...),
|
||
request: Request = None,
|
||
current_user: dict = Depends(get_current_user),
|
||
) -> dict[str, Any]:
|
||
if not has_resource_access("project", project_id, current_user, "write"):
|
||
raise fail(403, "no permission to manage members of this project")
|
||
store = get_platform_store()
|
||
try:
|
||
member = store.update_project_member_role(project_id, user_id, payload)
|
||
except KeyError:
|
||
raise fail(404, "project or member not found")
|
||
store.record_audit(
|
||
action="project.member.update",
|
||
actor_id=current_user.get("id"),
|
||
target_type="project.member",
|
||
target_id=project_id,
|
||
detail=f"user_id={user_id},role={payload.get('role')}",
|
||
)
|
||
return ok(member)
|
||
|
||
|
||
@router.delete("/{project_id}/members/{user_id}")
|
||
def remove_member(
|
||
project_id: str,
|
||
user_id: str,
|
||
request: Request = None,
|
||
current_user: dict = Depends(get_current_user),
|
||
) -> dict[str, Any]:
|
||
if not has_resource_access("project", project_id, current_user, "write"):
|
||
raise fail(403, "no permission to manage members of this project")
|
||
store = get_platform_store()
|
||
store.remove_project_member(project_id, user_id)
|
||
store.record_audit(
|
||
action="project.member.remove",
|
||
actor_id=_actor(request) if request else None,
|
||
target_type="project.member",
|
||
target_id=project_id,
|
||
detail=f"user_id={user_id}",
|
||
)
|
||
return ok(None)
|