refactor(api-logging):暂时删除权限校验与日志记录

applications/api/rights/department.py

@@ -3,14 +3,12 @@ from flask_restful import Resource
 from flask_restful import marshal, reqparse
 
 from applications.common.utils.http import success_api, fail_api
-from applications.common.utils.rights import authorize
 from applications.extensions import db
 from applications.models import CompanyDepartment, CompanyUser
 
 
 class DepartmentsResource(Resource):
 
-    @authorize("admin:dept:main", log=True)
     def get(self):
         dept_data = CompanyDepartment.query.order_by(CompanyDepartment.sort).all()
         # TODO dtree 需要返回状态信息
@@ -21,7 +19,6 @@ class DepartmentsResource(Resource):
         print(dept_data)
         return jsonify(res)
 
-    @authorize("admin:dept:add", log=True)
     def post(self):
         parser = reqparse.RequestParser()
         parser.add_argument('address', type=str)
@@ -52,7 +49,6 @@ class DepartmentsResource(Resource):
 
 
 class DepartmentResource(Resource):
-    @authorize("admin:dept:edit", log=True)
     def get(self, dept_id):
         dept = CompanyDepartment.query.filter_by(id=dept_id).first()
         dept_data = {
@@ -65,10 +61,8 @@ class DepartmentResource(Resource):
             'sort': dept.sort,
             'address': dept.address,
         }
-        # return make_response(render_template('department/edit.html', dept=dept))
         return dict(success=True, message='ok', dept=dept_data)
 
-    @authorize("admin:dept:edit", log=True)
     def put(self, dept_id):
         parser = reqparse.RequestParser()
         parser.add_argument('address', type=str)
@@ -95,7 +89,6 @@ class DepartmentResource(Resource):
         db.session.commit()
         return success_api(message="更新成功")
 
-    @authorize("admin:dept:remove", log=True)
     def delete(self, dept_id):
         ret = CompanyDepartment.query.filter_by(id=dept_id).delete()
         CompanyUser.query.filter_by(dept_id=dept_id).update({"dept_id": None})
@@ -106,7 +99,6 @@ class DepartmentResource(Resource):
 
 
 class DeptEnableResource(Resource):
-    @authorize("admin:dept:edit", log=True)
     def put(self, dept_id):
         d = CompanyDepartment.query.get(dept_id)
         if d:

applications/api/rights/rights.py

@@ -2,11 +2,10 @@ import copy
 from collections import OrderedDict
 
 from flask import request, jsonify, current_app
-from flask_login import current_user, login_required
+from flask_login import current_user
 from flask_restful import Resource, reqparse, marshal
 
 from applications.common.utils.http import success_api, fail_api
-from applications.common.utils.rights import authorize
 from applications.extensions import db
 from applications.models import RightsPower, RightsRole
 
@@ -153,7 +152,6 @@ parser_power.add_argument('sort', type=int, dest='sort')
 
 
 class RightRightsResource(Resource):
-    @authorize("admin:power:main", log=True)
     def get(self):
         """获取选择父节点"""
 
@@ -167,7 +165,6 @@ class RightRightsResource(Resource):
         }
         return res
 
-    @authorize("admin:power:remove", log=True)
     def delete(self):
         ids = request.form.getlist('ids[]')
         batch_remove_power(ids)
@@ -176,7 +173,6 @@ class RightRightsResource(Resource):
 
 class RightPowerResource(Resource):
 
-    @authorize("admin:power:add", log=True)
     def post(self, power_id):
         res = parser_power.parse_args()
         power = RightsPower(
@@ -199,7 +195,6 @@ class RightPowerResource(Resource):
 
         return success_api(message="成功")
 
-    @authorize("admin:power:remove", log=True)
     def delete(self, power_id):
         # 删除权限（目前没有判断父节点自动删除子节点）
         power = RightsPower.query.filter_by(id=power_id).first()
@@ -218,7 +213,6 @@ class RightPowerResource(Resource):
         else:
             return fail_api(message="删除失败")
 
-    @authorize("admin:power:edit", log=True)
     def put(self, power_id):
 
         res = parser_power.parse_args()
@@ -241,7 +235,6 @@ class RightPowerResource(Resource):
 
 
 class RightPowerEnableResource(Resource):
-    @authorize("admin:power:edit", log=True)
     def put(self, right_id):
 
         power = RightsPower.query.get(right_id)
@@ -255,13 +248,11 @@ class RightPowerEnableResource(Resource):
 
 
 class AdminConfigsResource(Resource):
-    @login_required
     def get(self):
         return get_render_config()
 
 
 class AdminMenuResource(Resource):
-    @login_required
     def get(self):
         menu_tree = make_menu_tree()
         return jsonify(menu_tree)

applications/api/rights/roles.py

@@ -1,8 +1,6 @@
-from flask_login import login_required
 from flask_restful import Resource, reqparse, marshal
 
 from applications.common.utils.http import table_api, success_api, fail_api
-from applications.common.utils.rights import authorize
 from applications.extensions import db
 from applications.models import RightsPower, RightsRole, CompanyUser
 
@@ -37,7 +35,6 @@ def batch_remove_role(role_ids):
 
 class RoleRolesResource(Resource):
     # 表格数据
-    @authorize("admin:role:main", log=True)
     def get(self):
         parser = reqparse.RequestParser(bundle_errors=True)
         parser.add_argument('page', type=int, default=1)
@@ -66,8 +63,6 @@ class RoleRolesResource(Resource):
                                  'total': paginate.total}
                          , code=0)
 
-    @authorize("admin:role:remove", log=True)
-    @login_required
     def delete(self):
         parser = reqparse.RequestParser()
         parser.add_argument('ids[]', action='append', dest='ids')
@@ -80,7 +75,6 @@ class RoleRolesResource(Resource):
 
 class RoleRoleResource(Resource):
 
-    @authorize("admin:role:add", log=True)
     def post(self, role_id):
         parser = reqparse.RequestParser()
         parser.add_argument('details', type=str)
@@ -103,7 +97,6 @@ class RoleRoleResource(Resource):
         return success_api(message="成功")
 
     # 更新角色
-    @authorize("admin:role:edit", log=True)
     def put(self, role_id):
         parser = reqparse.RequestParser()
         parser.add_argument('roleId', dest='role_id', type=int)
@@ -133,7 +126,6 @@ class RoleRoleResource(Resource):
 class RoleEnableResource(Resource):
     """启用用户"""
 
-    @authorize("admin:role:edit", log=True)
     def put(self, role_id):
         ret = RightsRole.query.get(role_id)
         ret.enable = not ret.enable
@@ -147,7 +139,6 @@ class RoleEnableResource(Resource):
 
 class RolePowerResource(Resource):
 
-    @authorize("admin:role:main", log=True)
     def get(self, role_id):
         # 获取角色权限
         role = RightsRole.query.filter_by(id=role_id).first()
@@ -166,7 +157,6 @@ class RolePowerResource(Resource):
         }
 
     # 保存角色权限
-    @authorize("admin:role:edit", log=True)
     def put(self, role_id):
         parser = reqparse.RequestParser()
         parser.add_argument('powerIds', dest='power_ids')
@@ -190,7 +180,6 @@ class RolePowerResource(Resource):
         return success_api(message="授权成功")
 
     # 角色删除
-    @authorize("admin:role:remove", log=True)
     def delete(self, role_id):
         print(role_id)
         res = remove_role(role_id)

applications/api/system/file.py

@@ -5,7 +5,6 @@ from flask_restful import Resource, marshal
 from sqlalchemy import desc
 
 from applications.common.utils.http import fail_api, success_api, table_api
-from applications.common.utils.rights import authorize
 from applications.common.utils.upload import upload_one, delete_photo_by_id
 from applications.extensions import db
 from applications.models import FilePhoto
@@ -13,7 +12,6 @@ from applications.models import FilePhoto
 
 class FilePhotosResource(Resource):
 
-    @authorize("admin:file:main", log=True)
     def get(self):
         page = request.args.get('page', type=int)
         limit = request.args.get('limit', type=int)
@@ -26,7 +24,6 @@ class FilePhotosResource(Resource):
                                  'total': photo_paginate.total, },
                          code=0)
 
-    @authorize("admin:file:add", log=True)
     def post(self):
         if 'file' in request.files:
             photo = request.files['file']
@@ -43,7 +40,6 @@ class FilePhotosResource(Resource):
             return jsonify(res)
         return fail_api()
 
-    @authorize("admin:file:delete", log=True)
     def delete(self):
         """图片批量删除"""
         # TODO bugs 图片删除失败
@@ -63,7 +59,6 @@ class FilePhotosResource(Resource):
 class FilePhotoResource(Resource):
     """图片数据"""
 
-    @authorize("admin:file:delete", log=True)
     def delete(self, photo_id):
         res = delete_photo_by_id(photo_id)
         if res:

applications/api/system/passport.py

@@ -1,5 +1,5 @@
 from flask import render_template, make_response
-from flask import session, redirect, url_for, request
+from flask import session, redirect, url_for
 from flask_login import current_user, login_user
 from flask_restful import Resource, reqparse
 
@@ -10,10 +10,6 @@ from applications.models import CompanyUser
 
 
 class LoginResource(Resource):
-    login_req = reqparse.RequestParser(bundle_errors=True)
-    login_req.add_argument('username', type=str, help='请输入用户名', required=True)
-    login_req.add_argument('password', type=str, help='请输入密码', required=True)
-    login_req.add_argument('captcha', type=str, help='请输入验证码', required=True)
 
     def get(self):
         if current_user.is_authenticated:
@@ -21,8 +17,11 @@ class LoginResource(Resource):
         return make_response(render_template('index/login.html'))
 
     def post(self):
-
-        req = self.login_req.parse_args()
+        login_req = reqparse.RequestParser(bundle_errors=True)
+        login_req.add_argument('username', type=str, help='请输入用户名', required=True)
+        login_req.add_argument('password', type=str, help='请输入密码', required=True)
+        login_req.add_argument('captcha', type=str, help='请输入验证码', required=True)
+        req = login_req.parse_args()
 
         s_code = session.get("code", None)
 

applications/api/users/profile.py

@@ -47,7 +47,6 @@ class UserAvatarResource(Resource):
 
 class UserInfoResource(Resource):
 
-    @login_required
     def put(self, user_id):
         parser = reqparse.RequestParser()
         parser.add_argument('realName', type=str, dest='real_name')
@@ -70,7 +69,6 @@ class UserInfoResource(Resource):
 class UserPasswordResource(Resource):
     """前用户密码"""
 
-    @login_required
     def put(self, user_id):
         parser = reqparse.RequestParser()
         parser.add_argument('oldPassword', type=str, required=True, help='旧密码不得为空')

applications/api/users/user.py

@@ -4,10 +4,9 @@ from flask_restful import Resource, reqparse
 from sqlalchemy import desc
 
 from applications.common.utils.http import fail_api, success_api, table_api
-from applications.common.utils.rights import authorize
 from applications.extensions import db
-from applications.models import LoggingModel
 from applications.models import CompanyUser, RightsRole, CompanyDepartment
+from applications.models import LoggingModel
 
 
 def get_current_user_logs():
@@ -60,7 +59,6 @@ def update_user_role(_id, roles_list):
 class UserUsersResource(Resource):
     """用户列表数据操作"""
 
-    @authorize("admin:user:main", log=True)
     def get(self):
         parser = reqparse.RequestParser()
         parser.add_argument('page', type=int, default=1)
@@ -98,7 +96,6 @@ class UserUsersResource(Resource):
                                  'total': paginate.total}
                          , code=0)
 
-    @authorize("admin:user:add", log=True)
     def post(self):
         """新建单个用户"""
         parser = reqparse.RequestParser()
@@ -130,7 +127,6 @@ class UserUsersResource(Resource):
 
         return success_api(message="增加成功", code=0)
 
-    @authorize("admin:user:remove", log=True)
     def delete(self):
         """批量删除"""
         ids = request.form.getlist('ids[]')
@@ -141,7 +137,6 @@ class UserUsersResource(Resource):
 class UserUserResource(Resource):
     """修改用户数据"""
 
-    @authorize("admin:user:add", log=True)
     def post(self, user_id):
         """新建单个用户"""
         parser = reqparse.RequestParser()
@@ -173,7 +168,6 @@ class UserUserResource(Resource):
 
         return success_api(message="增加成功", code=0)
 
-    @authorize("admin:user:remove", log=True)
     def delete(self, user_id):
         # 删除用户
         res = delete_by_id(user_id)
@@ -183,7 +177,6 @@ class UserUserResource(Resource):
 
 
 class UserRoleResource(Resource):
-    @authorize("admin:user:edit", log=True)
     def put(self, user_id):
         parser = reqparse.RequestParser()
         parser.add_argument('roleIds', type=str, dest='role_ids')