修改目录结构

applications/view/admin/__init__.py

@@ -5,13 +5,13 @@ from applications.view.admin.dict import admin_dict
 from applications.view.admin.index import admin_bp
 from applications.view.admin.file import admin_file
 from applications.view.admin.role import admin_role
-from applications.view.admin.user import admin_user
+from applications.view.company.users import users_bp
 from applications.view.admin.monitor import admin_monitor_bp
 
 
 def register_admin_views(app: Flask):
     app.register_blueprint(admin_bp)
-    app.register_blueprint(admin_user)
+    app.register_blueprint(users_bp)
     app.register_blueprint(admin_file)
     app.register_blueprint(admin_monitor_bp)
     app.register_blueprint(admin_log)

applications/view/admin/dict.py

@@ -1,4 +1,4 @@
-from flask import Blueprint, render_template, request, jsonify, escape
+from flask import Blueprint, render_template, request, jsonify
 
 from applications.common.utils.http import table_api, success_api, fail_api
 from applications.common.utils.rights import authorize
@@ -20,7 +20,7 @@ def main():
 def dict_type_data():
     page = request.args.get('page', type=int)
     limit = request.args.get('limit', type=int)
-    type_name = escape(request.args.get('typeName', type=str))
+    type_name = request.args.get('typeName', type=str)
     data, count = dict_curd.get_dict_type(page=page, limit=limit, type_name=type_name)
     return table_api(data=data,count=count)
 
@@ -100,7 +100,7 @@ def dict_type_delete(_id):
 def dict_code_data():
     page = request.args.get('page', type=int)
     limit = request.args.get('limit', type=int)
-    type_code = escape(request.args.get('typeCode', type=str))
+    type_code = request.args.get('typeCode', type=str)
     data, count = dict_curd.get_dict_data(page=page, limit=limit, type_code=type_code)
     return table_api(data=data,count=count)
 

applications/view/admin/role.py

@@ -1,4 +1,4 @@
-from flask import Blueprint, render_template, request, jsonify, escape
+from flask import Blueprint, render_template, request, jsonify
 from flask_login import login_required
 from applications.common.admin import role_curd
 from applications.common.utils.http import table_api, success_api, fail_api
@@ -21,8 +21,8 @@ def main():
 def table():
     page = request.args.get('page', type=int)
     limit = request.args.get('limit', type=int)
-    role_name = escape(request.args.get('roleName', type=str))
-    role_code = escape(request.args.get('roleCode', type=str))
+    role_name = request.args.get('roleName', type=str)
+    role_code = request.args.get('roleCode', type=str)
     filters = {}
     if role_name:
         filters["name"] = ('%' + role_name + '%')

applications/view/admin/user.py

@@ -1,189 +0,0 @@
-from flask import Blueprint, render_template, request, escape
-from flask_login import login_required, current_user
-
-from applications.common.utils.http import table_api, fail_api, success_api
-from applications.common.utils.rights import authorize
-from applications.models import User
-from applications.models import Role
-from applications.common.admin import user_curd
-
-admin_user = Blueprint('adminUser', __name__, url_prefix='/admin/user')
-
-
-# 用户管理
-@admin_user.get('/')
-@authorize("admin:user:main", log=True)
-def main():
-    return render_template('admin/user/main.html')
-
-
-#   用户分页查询
-@admin_user.get('/data')
-@authorize("admin:user:main", log=True)
-def data():
-    page = request.args.get('page', type=int)
-    limit = request.args.get('limit', type=int)
-    real_name = escape(request.args.get('realName', type=str))
-    username = escape(request.args.get('username', type=str))
-    dept_id = request.args.get('deptId', type=int)
-    filters = {}
-    if real_name:
-        filters["realname"] = ('%' + real_name + '%')
-    if username:
-        filters["username"] = ('%' + username + '%')
-    user_data, count = user_curd.get_user_data_dict(page=page, limit=limit, filters=filters, deptId=dept_id)
-    return table_api(data=user_data, count=count)
-
-
-# 用户增加
-@admin_user.get('/add')
-@authorize("admin:user:add", log=True)
-def add():
-    roles = Role.query.all()
-    return render_template('admin/user/add.html', roles=roles)
-
-
-@admin_user.post('/save')
-@authorize("admin:user:add", log=True)
-def save():
-    req_json = request.json
-    a = req_json.get("roleIds")
-    username = escape(req_json.get('username'))
-    real_name = escape(req_json.get('realName'))
-    password = escape(req_json.get('password'))
-    role_ids = a.split(',')
-
-    if not username or not real_name or not password:
-        return fail_api(msg="账号姓名密码不得为空")
-
-    if user_curd.is_user_exists(username):
-        return fail_api(msg="用户已经存在")
-
-    _id = user_curd.add_user(username, real_name, password)
-    user_curd.add_user_role(_id, role_ids)
-
-    return success_api(msg="增加成功")
-
-
-# 删除用户
-@admin_user.delete('/remove/<int:_id>')
-@authorize("admin:user:remove", log=True)
-def delete(_id):
-    res = user_curd.delete_by_id(_id)
-    if not res:
-        return fail_api(msg="删除失败")
-    return success_api(msg="删除成功")
-
-
-#  编辑用户
-@admin_user.get('/edit/<int:_id>')
-@authorize("admin:user:edit", log=True)
-def edit(_id):
-    user = User.query.filter_by(id=_id).first()
-    roles = Role.query.all()
-    checked_roles = []
-    for r in user.role:
-        checked_roles.append(r.id)
-    return render_template('admin/user/edit.html', user=user, roles=roles, checked_roles=checked_roles)
-
-
-#  编辑用户
-@admin_user.put('/update')
-@authorize("admin:user:edit", log=True)
-def update():
-    req_json = request.json
-    a = escape(req_json.get("roleIds"))
-    _id = escape(req_json.get("userId"))
-    username = escape(req_json.get('username'))
-    real_name = escape(req_json.get('realName'))
-    dept_id = escape(req_json.get('deptId'))
-    role_ids = a.split(',')
-    user_curd.update_user(id, username, real_name, dept_id)
-    user_curd.update_user_role(_id, role_ids)
-    return success_api(msg="更新成功")
-
-
-# 个人中心
-@admin_user.get('/center')
-@login_required
-def center():
-    user_info = current_user
-    user_logs = user_curd.get_current_user_logs()
-    return render_template('admin/user/center.html', user_info=user_info, user_logs=user_logs)
-
-
-# 修改头像
-@admin_user.get('/profile')
-@login_required
-def profile():
-    return render_template('admin/user/profile.html')
-
-
-# 修改头像
-@admin_user.put('/updateAvatar')
-@login_required
-def update_avatar():
-    url = request.json.get("avatar").get("src")
-    if not user_curd.update_avatar(url):
-        return fail_api(msg="出错啦")
-    return success_api(msg="修改成功")
-
-
-# 修改当前用户信息
-@admin_user.put('/updateInfo')
-@login_required
-def update_info():
-    res_json = request.json
-    if not user_curd.update_current_user_info(req_json=res_json):
-        return fail_api(msg="出错啦")
-    return success_api(msg="更新成功")
-
-
-# 修改当前用户密码
-@admin_user.get('/editPassword')
-@login_required
-def edit_password():
-    return render_template('admin/user/edit_password.html')
-
-
-# 修改当前用户密码
-@admin_user.put('/editPassword')
-@login_required
-def edit_password_put():
-    res_json = request.json
-    return user_curd.edit_password(res_json=res_json)
-
-
-# 启用用户
-@admin_user.put('/enable')
-@authorize("admin:user:edit", log=True)
-def enable():
-    _id = request.json.get('userId')
-    if _id:
-        res = user_curd.enable_status(_id)
-        if not res:
-            return fail_api(msg="出错啦")
-        return success_api(msg="启动成功")
-    return fail_api(msg="数据错误")
-
-
-# 禁用用户
-@admin_user.put('/disable')
-@authorize("admin:user:edit", log=True)
-def dis_enable():
-    _id = request.json.get('userId')
-    if _id:
-        res = user_curd.disable_status(_id)
-        if not res:
-            return fail_api(msg="出错啦")
-        return success_api(msg="禁用成功")
-    return fail_api(msg="数据错误")
-
-
-# 批量删除
-@admin_user.delete('/batchRemove')
-@authorize("admin:user:remove", log=True)
-def batch_remove():
-    ids = request.form.getlist('ids[]')
-    user_curd.batch_remove(ids)
-    return success_api(msg="批量删除成功")

applications/view/company/users/__init__.py

@@ -0,0 +1,40 @@
+from flask import Blueprint, request, render_template
+from flask_restful import Api
+
+from applications.common.admin import user_curd
+from applications.common.utils.http import table_api
+from applications.common.utils.rights import authorize
+from applications.models import Role
+
+users_bp = Blueprint('users', __name__, url_prefix='/users')
+user_api = Api(users_bp)
+
+
+#   用户分页查询
+@users_bp.get('/data')
+@authorize("admin:user:main", log=True)
+def data():
+    page = request.args.get('page', type=int)
+    limit = request.args.get('limit', type=int)
+    real_name = request.args.get('realName', type=str)
+    username = request.args.get('username', type=str)
+    dept_id = request.args.get('deptId', type=int)
+    filters = {}
+    if real_name:
+        filters["realname"] = ('%' + real_name + '%')
+    if username:
+        filters["username"] = ('%' + username + '%')
+    user_data, count = user_curd.get_user_data_dict(page=page, limit=limit, filters=filters, deptId=dept_id)
+    return table_api(data=user_data, count=count)
+
+
+# 用户增加
+@users_bp.get('/add')
+@authorize("admin:user:add", log=True)
+def add():
+    roles = Role.query.all()
+    return render_template('admin/user/add.html', roles=roles)
+
+
+from . import profile
+from . import user_view

applications/view/company/users/profile.py

@@ -0,0 +1,56 @@
+# 个人中心
+from flask import render_template, request, make_response
+from flask_login import login_required, current_user
+from flask_restful import Resource, reqparse
+from applications.common.admin import user_curd
+from applications.common.utils.http import fail_api, success_api
+from applications.view.company.users import users_bp, user_api
+
+
+@users_bp.get('/center')
+@login_required
+def center():
+    user_info = current_user
+    user_logs = user_curd.get_current_user_logs()
+    return render_template('admin/user/profile.html', user_info=user_info, user_logs=user_logs)
+
+
+# 修改头像
+@users_bp.get('/avatar')
+@login_required
+def profile():
+    return render_template('admin/user/avatar.html')
+
+
+# 修改头像
+@users_bp.put('/updateAvatar')
+@login_required
+def update_avatar():
+    url = request.json.get("avatar").get("src")
+    if not user_curd.update_avatar(url):
+        return fail_api(msg="出错啦")
+    return success_api(msg="修改成功")
+
+
+# 修改当前用户信息
+@users_bp.put('/updateInfo')
+@login_required
+def update_info():
+    res_json = request.json
+    if not user_curd.update_current_user_info(req_json=res_json):
+        return fail_api(msg="出错啦")
+    return success_api(msg="更新成功")
+
+
+@user_api.resource('/editPassword')
+class EditPassword(Resource):
+    """前用户密码"""
+
+    @login_required
+    def get(self):
+        return make_response(render_template('admin/user/edit_password.html'))
+
+    @login_required
+    def put(self):
+        res_json = request.json
+        return user_curd.edit_password(res_json=res_json)

applications/view/company/users/user_view.py

@@ -0,0 +1,108 @@
+from flask import render_template, request, make_response
+from flask_restful import Resource
+from applications.extensions import db
+
+from applications.common.admin import user_curd
+from applications.common.utils.http import fail_api, success_api
+from applications.common.utils.rights import authorize
+from applications.models import User, Role
+from applications.view.company.users import user_api, users_bp
+
+
+@user_api.resource('/')
+class Users(Resource):
+    """用户列表数据操作"""
+
+    @authorize("admin:user:main", log=True)
+    def get(self):
+        return make_response(render_template('admin/user/main.html'))
+
+    @authorize("admin:user:add", log=True)
+    def post(self):
+        """新建单个用户"""
+        req_json = request.json
+        a = req_json.get("roleIds")
+        username = req_json.get('username')
+        real_name = req_json.get('realName')
+        password = req_json.get('password')
+        role_ids = a.split(',')
+
+        if not username or not real_name or not password:
+            return fail_api(msg="账号姓名密码不得为空")
+
+        if user_curd.is_user_exists(username):
+            return fail_api(msg="用户已经存在")
+
+        _id = user_curd.add_user(username, real_name, password)
+        user_curd.add_user_role(_id, role_ids)
+
+        return success_api(msg="增加成功")
+
+
+@user_api.resource('/<user_id>')
+class CURDUser(Resource):
+    """修改用户数据"""
+
+    @authorize("admin:user:edit", log=True)
+    def get(self, user_id):
+        #  获取编辑用户信息
+        user = User.query.filter_by(id=user_id).first()
+        roles = Role.query.all()
+        checked_roles = []
+        for r in user.role:
+            checked_roles.append(r.id)
+        return make_response(
+            render_template('admin/user/edit_users.html', user=user, roles=roles, checked_roles=checked_roles))
+
+    @authorize("admin:user:remove", log=True)
+    def delete(self, user_id):
+        # 删除用户
+        res = user_curd.delete_by_id(user_id)
+        if not res:
+            return fail_api(msg="删除失败")
+        return success_api(msg="删除成功")
+
+    @authorize("admin:user:edit", log=True)
+    def put(self, user_id):
+        # 更新用户数据
+        req_json = request.json
+        a = req_json.get("roleIds")
+        _id = req_json.get("userId")
+        username = req_json.get('username')
+        real_name = req_json.get('realName')
+        dept_id = req_json.get('deptId')
+        role_ids = a.split(',')
+        user_curd.update_user(id, username, real_name, dept_id)
+        user_curd.update_user_role(_id, role_ids)
+        return success_api(msg="更新成功")
+
+
+# 批量删除
+@users_bp.delete('/batchRemove')
+@authorize("admin:user:remove", log=True)
+def batch_remove():
+    ids = request.form.getlist('ids[]')
+    user_curd.batch_remove(ids)
+    return success_api(msg="批量删除成功")
+
+
+@users_bp.put('/enable')
+def user_enable():
+    # 启用或者禁用用户 enable disable
+    user_id = request.json.get('userId')
+    operate = request.json.get('operate')
+    user_id = int(user_id)
+    operate = int(operate)
+    if user_id:
+        if operate == 1:
+            user = User.query.filter_by(id=user_id).update({"enable": operate})
+            message = success_api(msg="启动成功")
+        else:
+            user = User.query.filter_by(id=user_id).update({"enable": operate})
+            message = success_api(msg="禁用成功")
+        if user:
+            db.session.commit()
+        else:
+            return fail_api(msg="出错啦")
+        return message
+    return fail_api(msg="数据错误")

applications/view/passport/__init__.py

@@ -1,12 +1,13 @@
-from flask import Blueprint, session, redirect, url_for, render_template, request
+from flask import Blueprint, session, redirect, url_for, render_template, request, make_response
 from flask_login import current_user, login_user, login_required, logout_user
-
+from flask_restful import Resource, Api, reqparse
 from applications.common.admin import index_curd
 from applications.common.admin_log import login_log
 from applications.common.utils.http import fail_api, success_api
 from applications.models import User
 
 passport_bp = Blueprint('passport', __name__, url_prefix='/passport')
+passport_api = Api(passport_bp)
 
 
 def register_passport_views(app):
@@ -21,49 +22,45 @@ def get_captcha():
     return resp
 
 
-# 登录
-@passport_bp.get('/login')
-def login():
-    if current_user.is_authenticated:
-        return redirect(url_for('admin.index'))
-    return render_template('admin/login.html')
+@passport_api.resource('/login')
+class Login(Resource):
+    login_req = reqparse.RequestParser(bundle_errors=True)
+    login_req.add_argument('username', type=str, help='请输入用户名', required=True)
+    login_req.add_argument('password', type=str, help='请输入密码', required=True)
+    login_req.add_argument('captcha', type=str, help='请输入验证码', required=True)
 
+    def get(self):
+        if current_user.is_authenticated:
+            return redirect(url_for('admin.index'))
 
-# 登录
-@passport_bp.post('/login')
-def login_post():
-    req = request.form
-    username = req.get('username')
-    password = req.get('password')
-    code = req.get('captcha')
+        return make_response(render_template('admin/login.html'))
 
-    if not username or not password or not code:
-        return fail_api(msg="用户名或密码没有输入")
-    s_code = session.get("code", None)
+    def post(self):
 
-    if not all([code, s_code]):
-        return fail_api(msg="参数错误")
+        req = self.login_req.parse_args()
 
-    if code != s_code:
-        return fail_api(msg="验证码错误")
-    user = User.query.filter_by(username=username).first()
+        s_code = session.get("code", None)
 
-    if user is None:
-        return fail_api(msg="不存在的用户")
+        if req.captcha != s_code:
+            return fail_api(msg="验证码错误")
+        user = User.query.filter_by(username=req.username).first()
 
-    if user.enable is 0:
-        return fail_api(msg="用户被暂停使用")
+        if user is None:
+            return fail_api(msg="不存在的用户")
 
-    if username == user.username and user.validate_password(password):
-        # 登录
-        login_user(user)
-        # 记录登录日志
-        login_log(request, uid=user.id, is_access=True)
-        # 存入权限
-        index_curd.add_auth_session()
-        return success_api(msg="登录成功")
-    login_log(request, uid=user.id, is_access=False)
-    return fail_api(msg="用户名或密码错误")
+        if user.enable is 0:
+            return fail_api(msg="用户被暂停使用")
+
+        if user.validate_password(req.password):
+            # 登录
+            login_user(user)
+            # 记录登录日志
+            login_log(request, uid=user.id, is_access=True)
+            # 存入权限
+            index_curd.add_auth_session()
+            return success_api(msg="登录成功")
+        login_log(request, uid=user.id, is_access=False)
+        return fail_api(msg="用户名或密码错误")
 
 
 # 退出登录