rbac基本完成

applications/views/admin/user.py

@@ -1,33 +1,33 @@
 from flask import Blueprint, render_template, request, jsonify
-from flask_login import login_required, current_user
-from applications.models import db
+from flask_login import login_required
 from applications.models.admin import User, Role
-from applications.service.admin.user import get_user_data_dict, get_user_by_name, add_user, delete_by_id, update_status, \
-    batch_remove, update_user, update_user_role, is_user_exists
+from applications.service.admin.user import get_user_data_dict, add_user, delete_by_id, update_status, \
+    batch_remove, update_user, update_user_role, is_user_exists, add_user_role
+from applications.service.route_auth import authorize_and_log
 
 admin_user = Blueprint('adminUser', __name__, url_prefix='/admin/user')
 
 
 # 用户管理
 @admin_user.route('/')
-@login_required
-def index():
+@authorize_and_log("admin:user:main")
+def main():
     return render_template('admin/user/main.html')
 
 
-#   用户 分页查询
+#   用户分页查询
 @admin_user.route('/data')
-@login_required
+@authorize_and_log("admin:user:main")
 def data():
     page = request.args.get('page', type=int)
     limit = request.args.get('limit', type=int)
     realName = request.args.get('realName', type=str)
-    username = request.args.get('username',type=str)
+    username = request.args.get('username', type=str)
     filters = {}
     if realName:
-        filters["realname"]=('%'+realName+'%')
+        filters["realname"] = ('%' + realName + '%')
     if username:
-        filters["username"]=('%'+username+'%')
+        filters["username"] = ('%' + username + '%')
     data, count = get_user_data_dict(page=page, limit=limit, filters=filters)
     res = {
         'msg': "",
@@ -41,14 +41,15 @@ def data():
 
 
 # 用户增加
-
 @admin_user.route('/add')
+@authorize_and_log("admin:user:add")
 def add():
     roles = Role.query.all()
     return render_template('admin/user/add.html', roles=roles)
 
 
 @admin_user.route('/save', methods=['POST'])
+@authorize_and_log("admin:user:add")
 def save():
     req_json = request.json
     a = req_json.get("roleIds")
@@ -63,50 +64,25 @@ def save():
     if is_user_exists(username):
         return jsonify(success=False, msg="用户已经存在")
 
-    add_user(username, realName, password)
+    id = add_user(username, realName, password)
+    add_user_role(id, role_ids)
+
     return jsonify(success=True, msg="增加成功")
 
 
-# @admin_user.route('/add', methods=['GET', 'POST'])
-# @login_required
-# def insert():
-#     if request.method == 'POST':
-#         username = request.form.get('username')
-#         password = request.form.get('password')
-#         role = request.form.get('role')
-#         if username and password and role:
-#             if get_user_by_name(username=username) is None:
-#                 add_user(username=username, password=password)
-#                 return jsonify(msg="添加成功", code=200)
-#             else:
-#                 return jsonify(msg="用户已经存在", code=999)
-#         else:
-#             return jsonify(msg="用户名密码角色不能为空", code=999)
-#
-#     else:
-#         role = ['管理员', '普通用户']
-#         return render_template('admin/user_add.html', role=role)
-
-
-#                               ==========================================================
-#                                                            删除用户
-#                               ==========================================================
-
-
+# 删除用户
 @admin_user.route('/remove/<int:id>', methods=['DELETE'])
-@login_required
+@authorize_and_log("admin:user:remove")
 def delete(id):
-    user = delete_by_id(id)
-    db.session.commit()
-    if user:
-        return jsonify(msg="删除成功", success=True)
-    else:
+    res = delete_by_id(id)
+    if not res:
         return jsonify(msg="删除失败", success=False)
+    return jsonify(msg="删除成功", success=True)
 
 
 #  编辑用户
 @admin_user.route('/edit/<int:id>', methods=['GET', 'POST'])
-@login_required
+@authorize_and_log("admin:user:edit")
 def edit(id):
     user = User.query.filter_by(id=id).first()
     roles = Role.query.all()
@@ -114,43 +90,10 @@ def edit(id):
     for r in user.role:
         checked_roles.append(r.id)
     return render_template('admin/user/edit.html', user=user, roles=roles, checked_roles=checked_roles)
-    #
-    # if request.method == 'POST':
-    #     username = request.form.get('username')
-    #     password = request.form.get('password')
-    #     role = request.form.get('role')
-    #     if username and role:
-    #         if password is None:
-    #             if User.query.filter_by(id=id).first() is not None:
-    #                 update_user(id, username)
-    #                 return jsonify(msg="修改成功", code=200)
-    #
-    #             else:
-    #                 res = {"msg": "用户已经存在", "code": 200}
-    #                 return jsonify(res)
-    #         else:
-    #             user = User.query.filter_by(id=id).first()
-    #             if user is not None:
-    #                 User.query.filter_by(id=id).update({'username': username, 'role': role})
-    #                 user.set_password(password)
-    #                 db.session.commit()
-    #                 return jsonify(msg="修改成功", code=200)
-    #             else:
-    #                 return jsonify(msg="用户不存在", code=200)
-    #
-    #     else:
-    #
-    #         return jsonify(msg="用户名密码角色不能为空", code=999)
-    # else:
-    #     user = User.query.filter_by(id=id).first()
-    #     roles = Role.query.all()
-    #     checked_roles = []
-    #     for r in user.role:
-    #         checked_roles.append(r.id)
-    #     return render_template('admin/user/edit.html', user=user, roles=roles, checked_roles=checked_roles)
 
 
 @admin_user.route('/update', methods=['PUT'])
+@authorize_and_log("admin:user:edit")
 def update():
     req_json = request.json
     a = req_json.get("roleIds")
@@ -176,9 +119,9 @@ def update():
 
 
 # 批量删除
-@admin_user.route('/batchRemove', methods=['GET', 'POST'])
-@login_required
+@admin_user.route('/batchRemove', methods=['DELETE'])
+@authorize_and_log("admin:user:remove")
 def batchRemove():
     ids = request.form.getlist('ids[]')
-    res = batch_remove(ids)
-    return res
+    batch_remove(ids)
+    return jsonify(success=True, msg="批量删除成功")