47 lines
1.6 KiB
Python
47 lines
1.6 KiB
Python
"""NL2SQL 请求级权限快照服务。"""
|
|
from __future__ import annotations
|
|
|
|
from nl2sql.permission import build_query_permission
|
|
from model.sys_user import SysUser
|
|
from repositories.nl2sql_permission import Nl2SqlPermissionRepo
|
|
from repositories.sys_user import SysUserRepo
|
|
|
|
|
|
def _denied_permission(user_id: int) -> dict:
|
|
"""构造默认拒绝快照，避免把不存在用户的信息暴露给调用方。"""
|
|
return build_query_permission(
|
|
SysUser(id=user_id, user_type="UNKNOWN", employee_role=None, status="异常"),
|
|
None,
|
|
[],
|
|
[],
|
|
[],
|
|
)
|
|
|
|
|
|
async def load_query_permission(
|
|
db,
|
|
user_id: int,
|
|
*,
|
|
user_repo_factory=SysUserRepo,
|
|
permission_repo_factory=Nl2SqlPermissionRepo,
|
|
) -> dict:
|
|
"""每次调用重新加载用户和 NL2SQL 权限，返回请求级权限快照。"""
|
|
user = await user_repo_factory(db).get(user_id)
|
|
if user is None or getattr(user, "status", None) != "正常":
|
|
return _denied_permission(user_id)
|
|
if getattr(user, "user_type", None) != "EMPLOYEE":
|
|
return _denied_permission(user_id)
|
|
|
|
repo = permission_repo_factory(db)
|
|
role = await repo.get_role_by_employee_role(user.employee_role)
|
|
table_permissions = await repo.list_table_permissions(role.id) if role else []
|
|
column_permissions = await repo.list_column_permissions(role.id) if role else []
|
|
sensitive_fields = await repo.list_sensitive_fields()
|
|
return build_query_permission(
|
|
user,
|
|
role,
|
|
table_permissions,
|
|
column_permissions,
|
|
sensitive_fields,
|
|
)
|