refactor(api):调整后端逻辑-下

applications/api/__init__.py

@@ -5,6 +5,10 @@ api_bp = Blueprint('api', __name__, url_prefix='/api/v1')
 from . import department
 from . import file
 from . import roles
+from . import rights
+from . import passport
+from . import users
+
 
 def init_api(app: Flask):
     app.register_blueprint(api_bp)

applications/api/passport.py

@@ -0,0 +1,54 @@
+from flask import session, redirect, url_for, request
+from flask_login import current_user, login_user
+from flask_restful import Resource, reqparse, Api
+
+from applications.api import api_bp
+from applications.common.admin_log import login_log
+from applications.common.gen_captcha import add_auth_session
+from applications.common.utils.http import fail_api, success_api
+from applications.models import User
+
+from flask import render_template, make_response
+
+passport_api = Api(api_bp, prefix='/passport')
+
+
+@passport_api.resource('/login')
+class Login(Resource):
+    login_req = reqparse.RequestParser(bundle_errors=True)
+    login_req.add_argument('username', type=str, help='请输入用户名', required=True)
+    login_req.add_argument('password', type=str, help='请输入密码', required=True)
+    login_req.add_argument('captcha', type=str, help='请输入验证码', required=True)
+
+    def get(self):
+        if current_user.is_authenticated:
+            return redirect(url_for('admin.index'))
+        # TODO 分离视图操作 最终实现接口登录与视图登录两套逻辑
+        return make_response(render_template('index/login.html'))
+
+    def post(self):
+
+        req = self.login_req.parse_args()
+
+        s_code = session.get("code", None)
+
+        if req.captcha != s_code:
+            return fail_api(msg="验证码错误")
+        user = User.query.filter_by(username=req.username).first()
+
+        if user is None:
+            return fail_api(msg="不存在的用户")
+
+        if user.enable == 0:
+            return fail_api(msg="用户被暂停使用")
+
+        if user.validate_password(req.password):
+            # 登录
+            login_user(user)
+            # 记录登录日志
+            login_log(request, uid=user.id, is_access=True)
+            # 存入权限
+            add_auth_session()
+            return success_api(msg="登录成功")
+        login_log(request, uid=user.id, is_access=False)
+        return fail_api(msg="用户名或密码错误")

applications/api/rights.py

@@ -0,0 +1,321 @@
+import copy
+from collections import OrderedDict
+
+from flask import request, jsonify, current_app
+from flask_login import current_user, login_required
+from flask_restful import Resource, reqparse, Api, marshal
+
+from applications.api import api_bp
+from applications.common.serialization import power2_fields, power_fields
+from applications.common.utils.http import success_api, fail_api
+from applications.common.utils.rights import authorize
+from applications.extensions import db
+from applications.models import Power, Role
+
+
+def get_render_config():
+    # 网站配置
+    config = dict(logo={
+        # 网站名称
+        "title": current_app.config.get("SYSTEM_NAME"),
+        # 网站图标
+        "image": "/static/admin/admin/images/logo.png"
+        # 菜单配置
+    }, menu={
+        # 菜单数据来源
+        "data": "/api/v1/rights/menu",
+        "collaspe": True,
+        # 是否同时只打开一个菜单目录
+        "accordion": True,
+        "method": "GET",
+        # 是否开启多系统菜单模式
+        "control": False,
+        # 默认选中的菜单项
+        "select": "0",
+        # 是否开启异步菜单，false 时 data 属性设置为菜单数据，false 时为 json 文件或后端接口
+        "async": True
+    }, tab={
+        # 是否开启多选项卡
+        "muiltTab": True,
+        # 切换选项卡时，是否刷新页面状态
+        "keepState": True,
+        # 是否开启 Tab 记忆
+        "session": True,
+        # 最大可打开的选项卡数量
+        "tabMax": 30,
+        "index": {
+            # 标识 ID , 建议与菜单项中的 ID 一致
+            "id": "10",
+            # 页面地址
+            "href": "/admin/welcome",
+            # 标题
+            "title": "首页"
+        }
+    }, theme={
+        # 默认主题色，对应 colors 配置中的 ID 标识
+        "defaultColor": "2",
+        # 默认的菜单主题 dark-theme 黑 / light-theme 白
+        "defaultMenu": "dark-theme",
+        # 是否允许用户切换主题，false 时关闭自定义主题面板
+        "allowCustom": True
+    }, colors=[{
+        "id": "1",
+        "color": "#2d8cf0"
+    },
+        {
+            "id": "2",
+            "color": "#5FB878"
+        },
+        {
+            "id": "3",
+            "color": "#1E9FFF"
+        }, {
+            "id": "4",
+            "color": "#FFB800"
+        }, {
+            "id": "5",
+            "color": "darkgray"
+        }
+    ], links=current_app.config.get("SYSTEM_PANEL_LINKS"), other={
+        # 主页动画时长
+        "keepLoad": 1200,
+        # 布局顶部主题
+        "autoHead": False
+    }, header=False)
+    return config
+
+
+# 生成菜单树
+def make_menu_tree():
+    role = current_user.role
+    powers = []
+    for i in role:
+        # 如果角色没有被启用就直接跳过
+        if i.enable == 0:
+            continue
+        # 变量角色用户的权限
+        for p in i.power:
+            # 如果权限关闭了就直接跳过
+            if p.enable == 0:
+                continue
+            # 一二级菜单
+            if p.type == 0 or p.type == 1:
+                powers.append(p)
+
+    power_dict = marshal(powers, power2_fields)  # 生成可序列化对象
+    power_dict.sort(key=lambda x: x['id'], reverse=True)
+
+    menu_dict = OrderedDict()
+    for _dict in power_dict:
+        if _dict['id'] in menu_dict:
+            # 当前节点添加子节点
+            _dict['children'] = copy.deepcopy(menu_dict[_dict['id']])
+            # 删除子节点
+            del menu_dict[_dict['id']]
+
+        if _dict['parent_id'] not in menu_dict:
+            menu_dict[_dict['parent_id']] = [_dict]
+        else:
+            menu_dict[_dict['parent_id']].append(_dict)
+    return menu_dict.get(0)
+
+
+# 选择父节点
+def select_power_dict():
+    power = Power.query.all()
+    res = marshal(power, power_fields)
+    res.append({"powerId": 0, "powerName": "顶级权限", "parentId": -1})
+    return res
+
+
+def get_power_dict():
+    power = Power.query.all()
+    res = marshal(power, power_fields)
+    return res
+
+
+# 删除权限（目前没有判断父节点自动删除子节点）
+def remove_power(power_id):
+    power = Power.query.filter_by(id=power_id).first()
+    role_id_list = []
+    roles = power.role
+    for role in roles:
+        role_id_list.append(role.id)
+    roles = Role.query.filter(Role.id.in_(role_id_list)).all()
+    for p in roles:
+        power.role.remove(p)
+    r = Power.query.filter_by(id=power_id).delete()
+    db.session.commit()
+    return r
+
+
+# 批量删除权限
+def batch_remove_power(ids):
+    for _id in ids:
+        remove_power(_id)
+
+
+rights_api = Api(api_bp, prefix='/rights')
+
+parser_power = reqparse.RequestParser(bundle_errors=True)
+parser_power.add_argument('icon', type=str)
+parser_power.add_argument('openType', type=str, dest='open_type')
+parser_power.add_argument('parentId', type=str, dest='parent_id')
+parser_power.add_argument('powerCode', type=str, dest='power_code')
+parser_power.add_argument('powerName', type=str, dest='power_name')
+parser_power.add_argument('powerType', type=str, dest='power_type')
+parser_power.add_argument('powerUrl', type=str, dest='power_url')
+parser_power.add_argument('sort', type=int, dest='sort')
+
+
+@rights_api.resource('/data')
+class RightsData(Resource):
+    @authorize("admin:power:main", log=True)
+    def get(self):
+        power_data = get_power_dict()
+
+        res = {
+            "data": power_data
+        }
+        return jsonify(res)
+
+
+@rights_api.resource('/select_parent')
+class RightsSelectParent(Resource):
+    @authorize("admin:power:main", log=True)
+    def get(self):
+        """获取选择父节点"""
+        power_data = select_power_dict()
+        res = {
+            "status": {"code": 200, "message": "默认"},
+            "data": power_data
+
+        }
+        return jsonify(res)
+
+
+@rights_api.resource('/enable')
+class RightsEnable(Resource):
+    @authorize("admin:power:edit", log=True)
+    def put(self):
+        parser = reqparse.RequestParser(bundle_errors=True)
+        parser.add_argument('powerId', dest='power_id', type=int, required=True)
+        parser.add_argument('operate', type=int, required=True, choices=[0, 1])
+
+        res = parser.parse_args()
+
+        power = Power.query.filter_by(id=res.power_id).update({"enable": res.operate})
+        if power:
+            db.session.commit()
+            message = "启用成功" if res.operate else '禁用成功'
+            return success_api(msg=message)
+        else:
+            return fail_api(msg="出错啦")
+
+
+@rights_api.resource('/batch_remove')
+class RightsBatchRemove(Resource):
+    @authorize("admin:power:remove", log=True)
+    def delete(self):
+        ids = request.form.getlist('ids[]')
+        batch_remove_power(ids)
+        return success_api(msg="批量删除成功")
+
+
+@rights_api.resource('/power')
+class AddRight(Resource):
+    # @authorize("admin:power:add", log=True)
+    # def get(self):
+    #     """获取增加视图"""
+    #     return make_response(render_template('rights/add.html'))
+
+    @authorize("admin:power:add", log=True)
+    def post(self):
+        res = parser_power.parse_args()
+        power = Power(
+            icon=res.icon,
+            open_type=res.open_type,
+            parent_id=res.parent_id,
+            code=res.power_code,
+            name=res.power_name,
+            type=res.power_type,
+            url=res.power_url,
+            sort=res.sort,
+            enable=1
+        )
+        try:
+            db.session.add(power)
+            db.session.commit()
+        except Exception as e:
+            print(e)
+            return fail_api(msg='数据提交失败')
+
+        return success_api(msg="成功")
+
+
+@rights_api.resource('/power/<int:power_id>')
+class RightsURD(Resource):
+    # @authorize("admin:power:edit", log=True)
+    # def get(self, power_id):
+    #     power = Power.query.filter_by(id=power_id).first()
+    #     icon = str(power.icon).split()
+    #     if len(icon) == 2:
+    #         icon = icon[1]
+    #     else:
+    #         icon = None
+    #     return make_response(render_template('rights/edit.html', power=power, icon=icon))
+
+    @authorize("admin:power:remove", log=True)
+    def delete(self, power_id):
+        # 删除权限（目前没有判断父节点自动删除子节点）
+        power = Power.query.filter_by(id=power_id).first()
+        role_id_list = []
+        roles = power.role
+        for role in roles:
+            role_id_list.append(role.id)
+        roles = Role.query.filter(Role.id.in_(role_id_list)).all()
+        for p in roles:
+            power.role.remove(p)
+        r = Power.query.filter_by(id=power_id).delete()
+        db.session.commit()
+
+        if r:
+            return success_api(msg="删除成功")
+        else:
+            return fail_api(msg="删除失败")
+
+    @authorize("admin:power:edit", log=True)
+    def put(self, power_id):
+
+        res = parser_power.parse_args()
+        data = {
+            "icon": res.icon,
+            "open_type": res.open_type,
+            "parent_id": res.parent_id,
+            "code": res.power_code,
+            "name": res.power_name,
+            "type": res.power_type,
+            "url": res.power_url,
+            "sort": res.sort
+        }
+        power = Power.query.filter_by(id=power_id).update(data)
+        db.session.commit()
+
+        if not power:
+            return fail_api(msg="更新权限失败")
+        return success_api(msg="更新权限成功")
+
+
+@rights_api.resource('/configs')
+class AdminConfigs(Resource):
+    @login_required
+    def get(self):
+        return get_render_config()
+
+
+@rights_api.resource('/menu')
+class AdminMenu(Resource):
+    @login_required
+    def get(self):
+        menu_tree = make_menu_tree()
+        return jsonify(menu_tree)

applications/api/users/__init__.py

@@ -0,0 +1,7 @@
+from flask_restful import Api
+
+from applications.api import api_bp
+
+users_api = Api(api_bp, prefix='/users')
+
+from . import user, profile

applications/api/users/profile.py

@@ -0,0 +1,70 @@
+# 个人中心
+from flask import request, jsonify
+from flask_login import login_required, current_user
+from flask_restful import Resource, reqparse
+
+from applications.common.utils.http import fail_api, success_api
+from applications.extensions import db
+from applications.models import User
+
+from . import users_api
+
+
+@users_api.resource('/avatar')
+class Avatar(Resource):
+    """修改头像"""
+
+    def put(self):
+        url = request.json.get("avatar").get("src")
+        ret = User.query.filter_by(id=current_user.id).update({"avatar": url})
+        db.session.commit()
+        if not ret:
+            return fail_api(msg="出错啦")
+        return success_api(msg="修改成功")
+
+
+@users_api.resource('/updateInfo')
+class ProfileInfo(Resource):
+
+    @login_required
+    def put(self):
+        parser = reqparse.RequestParser()
+        parser.add_argument('realname', type=str, dest='real_name')
+        parser.add_argument('remark', type=str)
+        parser.add_argument('details', type=str)
+
+        res = parser.parse_args()
+
+        ret = User.query.filter_by(
+            id=current_user.id).update({"realname": res.real_name,
+                                        "remark": res.details})
+        if not ret:
+            return fail_api(msg="出错啦")
+        return success_api(msg="更新成功")
+
+
+@users_api.resource('/editPassword')
+class EditPassword(Resource):
+    """前用户密码"""
+
+    @login_required
+    def put(self):
+        parser = reqparse.RequestParser()
+        parser.add_argument('oldPassword', type=str, required=True, help='旧密码不得为空')
+        parser.add_argument('newPassword', type=str, required=True, help='新密码不得为空')
+        parser.add_argument('confirmPassword', type=str, required=True, help='确认密码不能为空')
+
+        res = parser.parse_args()
+
+        if res.newPassword != res.confirmPassword:
+            return fail_api(msg='确认密码不一致')
+
+        """ 修改当前用户密码 """
+        is_right = current_user.validate_password(res.oldPassword)
+        if not is_right:
+            return jsonify(success=False, msg="旧密码错误")
+        current_user.set_password(res.newPassword)
+        db.session.add(current_user)
+        db.session.commit()
+
+        return jsonify(success=True, msg="更改成功")

applications/api/users/user.py

@@ -0,0 +1,222 @@
+from flask import request
+
+from flask_restful import Resource, reqparse
+from flask_login import current_user
+from sqlalchemy import desc
+
+from applications.extensions import db
+from applications.common.utils.http import fail_api, success_api, table_api
+from applications.common.utils.rights import authorize
+from applications.models import User, Role, Dept
+from applications.models import AdminLog
+from . import users_api
+
+
+def get_current_user_logs():
+    """ 获取当前用户日志 """
+    log = AdminLog.query.filter_by(url='/passport/login').filter_by(uid=current_user.id).order_by(
+        desc(AdminLog.create_time)).limit(10)
+    return log
+
+
+def is_user_exists(username):
+    """ 判断用户是否存在 """
+    res = User.query.filter_by(username=username).count()
+    return bool(res)
+
+
+def delete_by_id(_id):
+    """ 删除用户 """
+    user = User.query.filter_by(id=_id).first()
+    roles_id = []
+    for role in user.role:
+        roles_id.append(role.id)
+    roles = Role.query.filter(Role.id.in_(roles_id)).all()
+    for r in roles:
+        user.role.remove(r)
+    res = User.query.filter_by(id=_id).delete()
+    db.session.commit()
+    return res
+
+
+def batch_remove(ids):
+    """ 批量删除 """
+    for _id in ids:
+        delete_by_id(_id)
+
+
+def update_user_role(_id, roles_list):
+    user = User.query.filter_by(id=_id).first()
+    roles_id = []
+    for role in user.role:
+        roles_id.append(role.id)
+    roles = Role.query.filter(Role.id.in_(roles_id)).all()
+    for r in roles:
+        user.role.remove(r)
+    roles = Role.query.filter(Role.id.in_(roles_list)).all()
+    for r in roles:
+        user.role.append(r)
+    db.session.commit()
+
+
+@users_api.resource('/add')
+class Users(Resource):
+    """用户列表数据操作"""
+
+    # @authorize("admin:user:add", log=True)
+    # def get(self):
+    #     roles = Role.query.all()
+    #     return make_response(render_template('users/add.html', roles=roles))
+
+    @authorize("admin:user:add", log=True)
+    def post(self):
+        """新建单个用户"""
+        parser = reqparse.RequestParser()
+        parser.add_argument("roleIds", type=str, dest='role_ids')
+        parser.add_argument("username", type=str, required=True, help="用户名不能为空")
+        parser.add_argument("realName", type=str, required=True, help="真实姓名不能为空", dest='real_name')
+        parser.add_argument("password", type=str, required=True, help="密码不得为空")
+
+        res = parser.parse_args()
+
+        role_ids = res.role_ids.split(',')
+
+        if is_user_exists(res.username):
+            return fail_api(msg="用户已经存在")
+
+        user = User()
+        user.username = res.username
+        user.realname = res.real_name
+        user.set_password(res.password)
+        db.session.add(user)
+        db.session.commit()
+
+        """ 增加用户角色 """
+        user = User.query.filter_by(id=user.id).first()
+        roles = Role.query.filter(Role.id.in_(role_ids)).all()
+        for r in roles:
+            user.role.append(r)
+        db.session.commit()
+
+        return success_api(msg="增加成功", code=0)
+
+
+@users_api.resource('/<user_id>')
+class CURDUser(Resource):
+    """修改用户数据"""
+
+    # @authorize("admin:user:edit", log=True)
+    # def get(self, user_id):
+    #     #  获取编辑用户信息
+    #     user = User.query.filter_by(id=user_id).first()
+    #     roles = Role.query.all()
+    #     checked_roles = []
+    #     for r in user.role:
+    #         checked_roles.append(r.id)
+    #     return make_response(
+    #         render_template('users/edit_users.html', user=user, roles=roles, checked_roles=checked_roles))
+
+    @authorize("admin:user:remove", log=True)
+    def delete(self, user_id):
+        # 删除用户
+        res = delete_by_id(user_id)
+        if not res:
+            return fail_api(msg="删除失败")
+        return success_api(msg="删除成功")
+
+    @authorize("admin:user:edit", log=True)
+    def put(self, user_id):
+        parser = reqparse.RequestParser()
+        parser.add_argument('roleIds', type=str, dest='role_ids')
+        parser.add_argument('userId', type=str, dest='user_id')
+        parser.add_argument('username', type=str)
+        parser.add_argument('realName', type=str, dest='real_name')
+        parser.add_argument('deptId', type=str, dest='dept_id')
+
+        res = parser.parse_args()
+        role_ids = res.role_ids.split(',')
+
+        # 更新用户数据
+        User.query.filter_by(id=user_id).update({'username': res.username,
+                                                 'realname': res.real_name,
+                                                 'dept_id': res.dept_id})
+        db.session.commit()
+
+        update_user_role(user_id, role_ids)
+
+        return success_api(msg="更新成功")
+
+
+@users_api.resource('/batchRemove')
+class UserBatchRemove(Resource):
+    """批量删除"""
+
+    @authorize("admin:user:remove", log=True)
+    def delete(self):
+        ids = request.form.getlist('ids[]')
+        batch_remove(ids)
+        return success_api(msg="批量删除成功")
+
+
+@users_api.resource('/enable')
+class UserEnable(Resource):
+    def put(self):
+        # 启用或者禁用用户 enable disable
+
+        parser = reqparse.RequestParser()
+        parser.add_argument('userId', type=int, required=True, dest='user_id')
+        parser.add_argument('operate', type=int, required=True, dest='operate', choices=[0, 1])
+
+        res = parser.parse_args()
+
+        if res.operate == 1:
+            user = User.query.filter_by(id=res.user_id).update({"enable": res.operate})
+            message = success_api(msg="启动成功")
+        else:
+            user = User.query.filter_by(id=res.user_id).update({"enable": res.operate})
+            message = success_api(msg="禁用成功")
+        if user:
+            db.session.commit()
+        else:
+            return fail_api(msg="出错啦")
+        return message
+
+
+@users_api.resource('/data')
+class UsersData(Resource):
+    @authorize("admin:user:main", log=True)
+    def get(self):
+        parser = reqparse.RequestParser()
+        parser.add_argument('page', type=int, default=1)
+        parser.add_argument('limit', type=int, default=10)
+        parser.add_argument('realName', type=str, dest='real_name')
+        parser.add_argument('username', type=str)
+        parser.add_argument('deptId', type=int, dest='dept_id', default=0)
+
+        res = parser.parse_args()
+
+        filters = []
+
+        if res.real_name:
+            filters.append(User.realname.like('%' + res.real_name + '%'))
+        if res.username:
+            filters.append(User.username.like('%' + res.username + '%'))
+        if res.dept_id:
+            filters.append(User.dept_id == res.dept_id)
+
+        paginate = User.query.filter(*filters).paginate(page=res.page,
+                                                        per_page=res.limit,
+                                                        error_out=False)
+
+        dept_name = lambda dept_id: Dept.query.filter_by(id=dept_id).first().dept_name if dept_id else ""
+        user_data = [{
+            'id': item.id,
+            'username': item.username,
+            'realname': item.realname,
+            'enable': item.enable,
+            'create_at': item.create_at,
+            'update_at': item.update_at,
+            'dept': dept_name(item.dept_id),
+        } for item in paginate.items]
+
+        return table_api(data=user_data, count=paginate.total, code=0)