From 1c4a98a77441b386390a0b2e6759e1397bac28cc Mon Sep 17 00:00:00 2001 From: nannan00 <17491932+nannan00@users.noreply.github.com> Date: Tue, 10 Aug 2021 16:25:27 +0800 Subject: [PATCH 01/33] update readme and some annotation (#3) * update readme and some annotation --- docs/ISSUE_TEMPLATE.md | 2 +- frontend/build/dev-server.js | 2 +- frontend/build/paas-server.js | 2 +- readme.md | 2 +- readme_en.md | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/ISSUE_TEMPLATE.md b/docs/ISSUE_TEMPLATE.md index 981d0cec2..7ba6cf1bd 100644 --- a/docs/ISSUE_TEMPLATE.md +++ b/docs/ISSUE_TEMPLATE.md @@ -21,7 +21,7 @@ If this is a FEATURE REQUEST, please: **是`BUG反馈`还是`需求提交`(Is this a BUG REPORT or FEATURE REQUEST)?** (choose one): -**bk-iam-app SaaS/bk-iam后台版本(The versions used):** +**bk-iam-saas SaaS版本/bk-iam后台版本(The versions used):** **发生了什么(What happened):** diff --git a/frontend/build/dev-server.js b/frontend/build/dev-server.js index 57d28f9b8..d266ce9b0 100644 --- a/frontend/build/dev-server.js +++ b/frontend/build/dev-server.js @@ -76,7 +76,7 @@ app.use(history({ rewrites: [ { // connect-history-api-fallback 默认会对 url 中有 . 的 url 当成静态资源处理而不是当成页面地址来处理 - // 兼容 /router/10.121.23.12 这样以 IP 结尾的 url + // 兼容 /router/127.0.0.1 这样以 IP 结尾的 url from: /(\d+\.)*\d+$/, to: '/' }, diff --git a/frontend/build/paas-server.js b/frontend/build/paas-server.js index e041b2251..28eb1cc8c 100644 --- a/frontend/build/paas-server.js +++ b/frontend/build/paas-server.js @@ -69,7 +69,7 @@ app.use(history({ rewrites: [ { // connect-history-api-fallback 默认会对 url 中有 . 的 url 当成静态资源处理而不是当成页面地址来处理 - // 兼容 /cs/28aa9eda67644a6eb254d694d944307e/cluster/BCS-MESOS-10001/node/10.121.23.12 这样以 IP 结尾的 url + // 兼容 /cs/28aa9eda67644a6eb254d694d944307e/cluster/BCS-MESOS-10001/node/127.0.0.1 这样以 IP 结尾的 url // from: /\d+\.\d+\.\d+\.\d+$/, from: /\/(\d+\.)*\d+$/, to: '/' diff --git a/readme.md b/readme.md index 93502307a..1c149e1c7 100644 --- a/readme.md +++ b/readme.md @@ -7,7 +7,7 @@ ## Overview -蓝鲸权限中心 SaaS（bk-iam-app）对接[蓝鲸权限中心后台](https://github.com/TencentBlueKing/bk-iam), 为蓝鲸智云提供了统一的权限管控服务，支持细粒度的权限管理。 +蓝鲸权限中心 SaaS（bk-iam-saas）对接[蓝鲸权限中心后台](https://github.com/TencentBlueKing/bk-iam), 为蓝鲸智云提供了统一的权限管控服务，支持细粒度的权限管理。 - [架构设计](./docs/overview/architecture.md) - [代码目录](./docs/overview/project_codes.md) diff --git a/readme_en.md b/readme_en.md index 03b3e2954..f19af1b31 100644 --- a/readme_en.md +++ b/readme_en.md @@ -5,7 +5,7 @@ ## Overview -BK-IAM SaaS (bk-iam-app) is docked to [BK-IAM](https://github.com/TencentBlueKing/bk-iam), which provides a unified permission control service for BlueKing and supports fine-grained permission management. +BK-IAM SaaS (bk-iam-saas) is docked to [BK-IAM](https://github.com/TencentBlueKing/bk-iam), which provides a unified permission control service for BlueKing and supports fine-grained permission management. - [Architecture(In Chinese)](./docs/overview/architecture.md) - [Code directory(In Chinese)](./docs/overview/project_codes.md) From a06b1bee21fa441badaf6e44bb36c9dbcca43923 Mon Sep 17 00:00:00 2001 From: wklken Date: Tue, 10 Aug 2021 20:05:07 +0800 Subject: [PATCH 02/33] bugfix: modeling migrate fail because the system.clients not required, missing in json --- saas/backend/apps/model_builder/serializers.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/saas/backend/apps/model_builder/serializers.py b/saas/backend/apps/model_builder/serializers.py index b1e2f3f46..f9588cc55 100644 --- a/saas/backend/apps/model_builder/serializers.py +++ b/saas/backend/apps/model_builder/serializers.py @@ -96,7 +96,7 @@ class ModelSystemSLZ(serializers.Serializer): description_en = serializers.CharField(label="英文描述(description_en)", required=False) # required=False, 什么都不配置, 注册时会将发起注册的app_code加入 - clients = serializers.CharField(label="合法CLIENTS(clients)", required=False) + clients = serializers.CharField(label="合法CLIENTS(clients)", required=False, default="") provider_config = SystemProviderConfigSLZ(label="回调配置(provider_config)", required=True) From 0f855ebf8c65c72e35c6e58c1cfe3a501c951b5c Mon Sep 17 00:00:00 2001 From: IuzreO <77032081+IuzreO@users.noreply.github.com> Date: Wed, 11 Aug 2021 10:21:17 +0800 Subject: [PATCH 03/33] =?UTF-8?q?=E5=8B=BE=E9=80=89bug=EF=BC=8C=E8=B5=84?= =?UTF-8?q?=E6=BA=90=E7=B1=BB=E5=9E=8B=E4=BF=9D=E5=AD=98=E9=97=AE=E9=A2=98?= =?UTF-8?q?=E8=A7=A3=E5=86=B3=20(#4)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: v_hexihe(何喜) --- frontend/src/views/system-access/registry/index.vue | 2 +- .../views/system-access/registry/resource-type-sideslider.vue | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/frontend/src/views/system-access/registry/index.vue b/frontend/src/views/system-access/registry/index.vue index 54f1d8608..b50aef900 100644 --- a/frontend/src/views/system-access/registry/index.vue +++ b/frontend/src/views/system-access/registry/index.vue @@ -75,7 +75,7 @@
{{$t(`m.access['通过拓扑选择']`)}} diff --git a/frontend/src/views/system-access/registry/resource-type-sideslider.vue b/frontend/src/views/system-access/registry/resource-type-sideslider.vue index 6dfb8a12e..a8bdf681f 100644 --- a/frontend/src/views/system-access/registry/resource-type-sideslider.vue +++ b/frontend/src/views/system-access/registry/resource-type-sideslider.vue @@ -334,7 +334,7 @@ * 隐藏侧边栏 */ hideSideslider () { - const invalidItemList = this.resourceTypeList.filter(item => item.isEdit && !item.isNewAdd) + const invalidItemList = this.resourceTypeList.filter(item => item.isEdit || item.isNewAdd) if (invalidItemList.length) { this.$bkInfo({ title: this.$t(`m.access['请先保存下列资源类型']`), From 724fc2a5683422052881e1047cb17b5fb019490c Mon Sep 17 00:00:00 2001 From: tianyizhu Date: Thu, 12 Aug 2021 11:31:21 +0800 Subject: [PATCH 04/33] fix(backend/apps/group/tasks.py): group auth ignore path --- saas/backend/apps/group/tasks.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/saas/backend/apps/group/tasks.py b/saas/backend/apps/group/tasks.py index 7d31e9d4d..cd553a11f 100644 --- a/saas/backend/apps/group/tasks.py +++ b/saas/backend/apps/group/tasks.py @@ -17,7 +17,7 @@ from backend.apps.group.models import Group, GroupAuthorizeLock from backend.biz.group import GroupBiz -from backend.biz.policy import PolicyBean, PolicyOperationBiz +from backend.biz.policy import PolicyBean, PolicyBeanList, PolicyOperationBiz from backend.biz.template import TemplateBiz from backend.common.time import db_time from backend.long_task.constants import TaskType @@ -85,11 +85,12 @@ def run(self, item: Any): template_id = lock.template_id system_id = lock.system_id policies = parse_obj_as(List[PolicyBean], lock.data["actions"]) + policy_list = PolicyBeanList(system_id, policies, need_ignore_path=True) # 处理忽略路径 # 授权 if template_id != 0: - self.template_biz.grant_subject(system_id, template_id, self.subject, policies) + self.template_biz.grant_subject(system_id, template_id, self.subject, policy_list.policies) else: - self.policy_biz.alter(system_id, self.subject, policies) + self.policy_biz.alter(system_id, self.subject, policy_list.policies) lock.delete() From d8a19861d157886bbc82cf74b614d6ac805f0568 Mon Sep 17 00:00:00 2001 From: zhu327 Date: Thu, 12 Aug 2021 11:44:32 +0800 Subject: [PATCH 05/33] perf(config/default.py): update expired remind email task to 11am --- saas/config/default.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/saas/config/default.py b/saas/config/default.py index b4c47dab9..6cd88b91b 100644 --- a/saas/config/default.py +++ b/saas/config/default.py @@ -182,11 +182,11 @@ }, "periodic_user_group_policy_expire_remind": { "task": "backend.apps.user.tasks.user_group_policy_expire_remind", - "schedule": crontab(minute=0, hour=2), # 每天凌晨2时执行 + "schedule": crontab(minute=0, hour=11), # 每天凌晨11时执行 }, "periodic_role_group_expire_remind": { "task": "backend.apps.role.tasks.role_group_expire_remind", - "schedule": crontab(minute=0, hour=2), # 每天凌晨2时执行 + "schedule": crontab(minute=0, hour=11), # 每天凌晨11时执行 }, "periodic_user_expired_policy_cleanup": { "task": "backend.apps.user.tasks.user_cleanup_expired_policy", From 83735aa2ada4e87643255e10435b7afe707b2b98 Mon Sep 17 00:00:00 2001 From: zhu327 Date: Thu, 12 Aug 2021 12:06:19 +0800 Subject: [PATCH 06/33] chore(requirements.txt): update requirements version for security --- saas/poetry.lock | 20 ++++++++++++++++---- saas/pyproject.toml | 11 ++++++----- saas/requirements.txt | 9 ++------- saas/requirements_dev.txt | 9 ++------- 4 files changed, 26 insertions(+), 23 deletions(-) diff --git a/saas/poetry.lock b/saas/poetry.lock index 58e06c762..c4f731a59 100644 --- a/saas/poetry.lock +++ b/saas/poetry.lock @@ -236,7 +236,7 @@ python-versions = ">=3.5" [[package]] name = "django" -version = "2.2.14" +version = "2.2.24" description = "A high-level Python Web framework that encourages rapid development and clean, pragmatic design." category = "main" optional = false @@ -977,7 +977,7 @@ testing = ["pytest (>=4.6)", "pytest-checkdocs (>=1.2.3)", "pytest-flake8", "pyt [metadata] lock-version = "1.1" python-versions = "3.6.6" -content-hash = "a9a9bf00cdf7b9ae51f0186491e17ea1447bc9136294c242999f2e6cb3330c78" +content-hash = "fd40130e669cde7d5c25e41227f6b2d064c1c1e4c157060a4dfdac9011dff04c" [metadata.files] aenum = [ @@ -1043,24 +1043,36 @@ cffi = [ {file = "cffi-1.14.5-cp36-cp36m-manylinux1_i686.whl", hash = "sha256:48e1c69bbacfc3d932221851b39d49e81567a4d4aac3b21258d9c24578280058"}, {file = "cffi-1.14.5-cp36-cp36m-manylinux1_x86_64.whl", hash = "sha256:69e395c24fc60aad6bb4fa7e583698ea6cc684648e1ffb7fe85e3c1ca131a7d5"}, {file = "cffi-1.14.5-cp36-cp36m-manylinux2014_aarch64.whl", hash = "sha256:9e93e79c2551ff263400e1e4be085a1210e12073a31c2011dbbda14bda0c6132"}, + {file = "cffi-1.14.5-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:24ec4ff2c5c0c8f9c6b87d5bb53555bf267e1e6f70e52e5a9740d32861d36b6f"}, + {file = "cffi-1.14.5-cp36-cp36m-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3c3f39fa737542161d8b0d680df2ec249334cd70a8f420f71c9304bd83c3cbed"}, + {file = "cffi-1.14.5-cp36-cp36m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:681d07b0d1e3c462dd15585ef5e33cb021321588bebd910124ef4f4fb71aef55"}, {file = "cffi-1.14.5-cp36-cp36m-win32.whl", hash = "sha256:58e3f59d583d413809d60779492342801d6e82fefb89c86a38e040c16883be53"}, {file = "cffi-1.14.5-cp36-cp36m-win_amd64.whl", hash = "sha256:005a36f41773e148deac64b08f233873a4d0c18b053d37da83f6af4d9087b813"}, {file = "cffi-1.14.5-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:2894f2df484ff56d717bead0a5c2abb6b9d2bf26d6960c4604d5c48bbc30ee73"}, {file = "cffi-1.14.5-cp37-cp37m-manylinux1_i686.whl", hash = "sha256:0857f0ae312d855239a55c81ef453ee8fd24136eaba8e87a2eceba644c0d4c06"}, {file = "cffi-1.14.5-cp37-cp37m-manylinux1_x86_64.whl", hash = "sha256:cd2868886d547469123fadc46eac7ea5253ea7fcb139f12e1dfc2bbd406427d1"}, {file = "cffi-1.14.5-cp37-cp37m-manylinux2014_aarch64.whl", hash = "sha256:35f27e6eb43380fa080dccf676dece30bef72e4a67617ffda586641cd4508d49"}, + {file = "cffi-1.14.5-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:06d7cd1abac2ffd92e65c0609661866709b4b2d82dd15f611e602b9b188b0b69"}, + {file = "cffi-1.14.5-cp37-cp37m-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:0f861a89e0043afec2a51fd177a567005847973be86f709bbb044d7f42fc4e05"}, + {file = "cffi-1.14.5-cp37-cp37m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:cc5a8e069b9ebfa22e26d0e6b97d6f9781302fe7f4f2b8776c3e1daea35f1adc"}, {file = "cffi-1.14.5-cp37-cp37m-win32.whl", hash = "sha256:9ff227395193126d82e60319a673a037d5de84633f11279e336f9c0f189ecc62"}, {file = "cffi-1.14.5-cp37-cp37m-win_amd64.whl", hash = "sha256:9cf8022fb8d07a97c178b02327b284521c7708d7c71a9c9c355c178ac4bbd3d4"}, {file = "cffi-1.14.5-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:8b198cec6c72df5289c05b05b8b0969819783f9418e0409865dac47288d2a053"}, {file = "cffi-1.14.5-cp38-cp38-manylinux1_i686.whl", hash = "sha256:ad17025d226ee5beec591b52800c11680fca3df50b8b29fe51d882576e039ee0"}, {file = "cffi-1.14.5-cp38-cp38-manylinux1_x86_64.whl", hash = "sha256:6c97d7350133666fbb5cf4abdc1178c812cb205dc6f41d174a7b0f18fb93337e"}, {file = "cffi-1.14.5-cp38-cp38-manylinux2014_aarch64.whl", hash = "sha256:8ae6299f6c68de06f136f1f9e69458eae58f1dacf10af5c17353eae03aa0d827"}, + {file = "cffi-1.14.5-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:04c468b622ed31d408fea2346bec5bbffba2cc44226302a0de1ade9f5ea3d373"}, + {file = "cffi-1.14.5-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:06db6321b7a68b2bd6df96d08a5adadc1fa0e8f419226e25b2a5fbf6ccc7350f"}, + {file = "cffi-1.14.5-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:293e7ea41280cb28c6fcaaa0b1aa1f533b8ce060b9e701d78511e1e6c4a1de76"}, {file = "cffi-1.14.5-cp38-cp38-win32.whl", hash = "sha256:b85eb46a81787c50650f2392b9b4ef23e1f126313b9e0e9013b35c15e4288e2e"}, {file = "cffi-1.14.5-cp38-cp38-win_amd64.whl", hash = "sha256:1f436816fc868b098b0d63b8920de7d208c90a67212546d02f84fe78a9c26396"}, {file = "cffi-1.14.5-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:1071534bbbf8cbb31b498d5d9db0f274f2f7a865adca4ae429e147ba40f73dea"}, {file = "cffi-1.14.5-cp39-cp39-manylinux1_i686.whl", hash = "sha256:9de2e279153a443c656f2defd67769e6d1e4163952b3c622dcea5b08a6405322"}, {file = "cffi-1.14.5-cp39-cp39-manylinux1_x86_64.whl", hash = "sha256:6e4714cc64f474e4d6e37cfff31a814b509a35cb17de4fb1999907575684479c"}, {file = "cffi-1.14.5-cp39-cp39-manylinux2014_aarch64.whl", hash = "sha256:158d0d15119b4b7ff6b926536763dc0714313aa59e320ddf787502c70c4d4bee"}, + {file = "cffi-1.14.5-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1bf1ac1984eaa7675ca8d5745a8cb87ef7abecb5592178406e55858d411eadc0"}, + {file = "cffi-1.14.5-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:df5052c5d867c1ea0b311fb7c3cd28b19df469c056f7fdcfe88c7473aa63e333"}, + {file = "cffi-1.14.5-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:24a570cd11895b60829e941f2613a4f79df1a27344cbbb82164ef2e0116f09c7"}, {file = "cffi-1.14.5-cp39-cp39-win32.whl", hash = "sha256:afb29c1ba2e5a3736f1c301d9d0abe3ec8b86957d04ddfa9d7a6a42b9367e396"}, {file = "cffi-1.14.5-cp39-cp39-win_amd64.whl", hash = "sha256:f2d45f97ab6bb54753eab54fffe75aaf3de4ff2341c9daee1987ee1837636f1d"}, {file = "cffi-1.14.5.tar.gz", hash = "sha256:fd78e5fee591709f32ef6edb9a015b4aa1a5022598e36227500c8f4e02328d9c"}, @@ -1118,8 +1130,8 @@ decorator = [ {file = "decorator-5.0.5.tar.gz", hash = "sha256:acda948ffcfe4bd0c4a57834b74ad968b91925b8201b740ca9d46fb8c5c618ce"}, ] django = [ - {file = "Django-2.2.14-py3-none-any.whl", hash = "sha256:f2250bd35d0f6c23e930c544629934144e5dd39a4c06092e1050c731c1712ba8"}, - {file = "Django-2.2.14.tar.gz", hash = "sha256:edf0ecf6657713b0435b6757e6069466925cae70d634a3283c96b80c01e06191"}, + {file = "Django-2.2.24-py3-none-any.whl", hash = "sha256:f2084ceecff86b1e631c2cd4107d435daf4e12f1efcdf11061a73bf0b5e95f92"}, + {file = "Django-2.2.24.tar.gz", hash = "sha256:3339ff0e03dee13045aef6ae7b523edff75b6d726adf7a7a48f53d5a501f7db7"}, ] django-celery = [ {file = "django-celery-3.2.1.tar.gz", hash = "sha256:926a65bcee6bf2d192a80239f1ec591e1834ff19a547f61762e57fc0dcc5975f"}, diff --git a/saas/pyproject.toml b/saas/pyproject.toml index b9bb7ff75..823505b95 100644 --- a/saas/pyproject.toml +++ b/saas/pyproject.toml @@ -69,7 +69,7 @@ license = "MIT License" [tool.poetry.dependencies] python = "3.6.6" # blueapps requirement -Django = "2.2.14" +Django = "2.2.24" mysqlclient = "2.0.1" MarkupSafe = "1.0" Mako = "1.0.6" @@ -80,17 +80,17 @@ python-json-logger = "0.1.7" whitenoise = "5.1.0" six = "1.15.0" #v2 requirement -httplib2 = "0.18.1" +httplib2 = "0.19.0" # framework -djangorestframework = "3.11.0" +djangorestframework = "3.11.2" django-filter = "2.3.0" django-cors-headers = "3.4.0" Werkzeug = "1.0.1" drf-yasg = "1.17.1" dataclasses = "0.7" -pydantic = "1.5.1" +pydantic = "1.6.2" PyJWT = "1.7.1" -cryptography = "2.9.2" +cryptography = "3.2" django-prometheus = "2.0.0" pytz = "2020.1" aenum = "2.2.6" @@ -102,6 +102,7 @@ django-redis = "4.12.1" django-mptt = "0.11.0" # profile record pyinstrument = "3.1.3" +urllib3 = "1.26.5" [tool.poetry.dev-dependencies] # For flake8 support pyproject.toml diff --git a/saas/requirements.txt b/saas/requirements.txt index cfb61a391..68c543f24 100644 --- a/saas/requirements.txt +++ b/saas/requirements.txt @@ -4,11 +4,9 @@ anyjson==0.3.3 billiard==3.3.0.23 celery==3.1.25 certifi==2020.12.5; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" -cffi==1.14.5; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" chardet==3.0.4; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" coreapi==2.3.3; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" coreschema==0.0.4; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" -cryptography==2.9.2; (python_version >= "2.7" and python_full_version < "3.0.0") or (python_full_version >= "3.5.0") dataclasses==0.7; python_version >= "3.6" and python_version < "3.7" decorator==5.0.5; python_version >= "3.5" django-celery==3.2.1 @@ -18,11 +16,10 @@ django-js-asset==1.2.2; python_version >= "3.5" django-mptt==0.11.0; python_version >= "3.5" django-prometheus==2.0.0 django-redis==4.12.1; python_version >= "3.5" -django==2.2.14; python_version >= "3.5" -djangorestframework==3.11.0; python_version >= "3.5" +django==2.2.24; python_version >= "3.5" +djangorestframework==3.11.0; python_version >= "3.5" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3.5" dogpile.cache==0.9.2 drf-yasg==1.17.1; (python_version >= "2.7" and python_full_version < "3.0.0") or (python_full_version >= "3.5.0") -httplib2==0.18.1 idna==2.10; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" inflection==0.5.1; python_version >= "3.5" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3.5" itypes==1.2.0; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" @@ -33,8 +30,6 @@ markupsafe==1.0 mysqlclient==2.0.1; python_version >= "3.5" packaging==20.9; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" prometheus-client==0.10.0; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.4.0" -pycparser==2.20; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" -pydantic==1.5.1; python_version >= "3.6" pyinstrument-cext==0.2.4 pyinstrument==3.1.3 pyjwt==1.7.1 diff --git a/saas/requirements_dev.txt b/saas/requirements_dev.txt index 3623ad9f3..47926bfc4 100644 --- a/saas/requirements_dev.txt +++ b/saas/requirements_dev.txt @@ -8,14 +8,12 @@ billiard==3.3.0.23 black==21.7b0; python_full_version >= "3.6.2" celery==3.1.25 certifi==2020.12.5; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" -cffi==1.14.5; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" chardet==3.0.4; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" click==8.0.0; python_version >= "3.6" and python_full_version >= "3.6.2" colorama==0.4.4; sys_platform == "win32" and python_version >= "3.6" and python_full_version >= "3.6.2" and platform_system == "Windows" converge==0.9.8 coreapi==2.3.3; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" coreschema==0.0.4; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" -cryptography==2.9.2; (python_version >= "2.7" and python_full_version < "3.0.0") or (python_full_version >= "3.5.0") dataclasses==0.7; python_version >= "3.6" and python_version < "3.7" decorator==5.0.5; python_version >= "3.5" django-celery==3.2.1 @@ -26,13 +24,12 @@ django-js-asset==1.2.2; python_version >= "3.5" django-mptt==0.11.0; python_version >= "3.5" django-prometheus==2.0.0 django-redis==4.12.1; python_version >= "3.5" -django==2.2.14; python_version >= "3.5" -djangorestframework==3.11.0; python_version >= "3.5" +django==2.2.24; python_version >= "3.5" +djangorestframework==3.11.0; python_version >= "3.5" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3.5" dogpile.cache==0.9.2 drf-yasg==1.17.1; (python_version >= "2.7" and python_full_version < "3.0.0") or (python_full_version >= "3.5.0") flake8-comprehensions==3.5.0; python_version >= "3.6" flake8==3.9.2; python_version >= "3.6" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3.6" -httplib2==0.18.1 idna==2.10; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" importlib-metadata==3.10.0; python_version < "3.8" and python_version >= "3.6" and (python_version >= "3.6" and python_full_version < "3.0.0" and python_version < "3.8" or python_full_version >= "3.5.0" and python_version < "3.8" and python_version >= "3.6") and (python_version >= "3.6" and python_full_version < "3.0.0" and python_version < "3.8" or python_full_version >= "3.4.0" and python_version >= "3.6" and python_version < "3.8") inflection==0.5.1; python_version >= "3.5" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3.5" @@ -54,8 +51,6 @@ pluggy==0.13.1; python_version >= "3.6" and python_full_version < "3.0.0" or pyt prometheus-client==0.10.0; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.4.0" py==1.10.0; python_version >= "3.6" and python_full_version < "3.0.0" or python_full_version >= "3.4.0" and python_version >= "3.6" pycodestyle==2.7.0; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" -pycparser==2.20; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" -pydantic==1.5.1; python_version >= "3.6" pyflakes==2.3.1; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" pyinstrument-cext==0.2.4 pyinstrument==3.1.3 From e34021a9ca4e947c06107996f7eca12308d118f6 Mon Sep 17 00:00:00 2001 From: zhu327 Date: Thu, 12 Aug 2021 12:16:17 +0800 Subject: [PATCH 07/33] chore(requirements.txt): update requirements for security --- saas/poetry.lock | 495 +++++++++++++++++++------------------- saas/pyproject.toml | 3 +- saas/requirements.txt | 29 ++- saas/requirements_dev.txt | 57 +++-- 4 files changed, 291 insertions(+), 293 deletions(-) diff --git a/saas/poetry.lock b/saas/poetry.lock index c4f731a59..04927eee6 100644 --- a/saas/poetry.lock +++ b/saas/poetry.lock @@ -40,17 +40,17 @@ python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*" [[package]] name = "attrs" -version = "20.3.0" +version = "21.2.0" description = "Classes Without Boilerplate" category = "dev" optional = false -python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*" +python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*" [package.extras] -dev = ["coverage[toml] (>=5.0.2)", "hypothesis", "pympler", "pytest (>=4.3.0)", "six", "zope.interface", "furo", "sphinx", "pre-commit"] -docs = ["furo", "sphinx", "zope.interface"] -tests = ["coverage[toml] (>=5.0.2)", "hypothesis", "pympler", "pytest (>=4.3.0)", "six", "zope.interface"] -tests_no_zope = ["coverage[toml] (>=5.0.2)", "hypothesis", "pympler", "pytest (>=4.3.0)", "six"] +dev = ["coverage[toml] (>=5.0.2)", "hypothesis", "pympler", "pytest (>=4.3.0)", "six", "mypy", "pytest-mypy-plugins", "zope.interface", "furo", "sphinx", "sphinx-notfound-page", "pre-commit"] +docs = ["furo", "sphinx", "zope.interface", "sphinx-notfound-page"] +tests = ["coverage[toml] (>=5.0.2)", "hypothesis", "pympler", "pytest (>=4.3.0)", "six", "mypy", "pytest-mypy-plugins", "zope.interface"] +tests_no_zope = ["coverage[toml] (>=5.0.2)", "hypothesis", "pympler", "pytest (>=4.3.0)", "six", "mypy", "pytest-mypy-plugins"] [[package]] name = "billiard" @@ -122,7 +122,7 @@ zookeeper = ["kazoo (>=1.3.1)"] [[package]] name = "certifi" -version = "2020.12.5" +version = "2021.5.30" description = "Python package for providing Mozilla's CA Bundle." category = "main" optional = false @@ -130,7 +130,7 @@ python-versions = "*" [[package]] name = "cffi" -version = "1.14.5" +version = "1.14.6" description = "Foreign Function Interface for Python calling C code." category = "main" optional = false @@ -140,16 +140,19 @@ python-versions = "*" pycparser = "*" [[package]] -name = "chardet" -version = "3.0.4" -description = "Universal encoding detector for Python 2 and 3" +name = "charset-normalizer" +version = "2.0.4" +description = "The Real First Universal Charset Detector. Open, modern and actively maintained alternative to Chardet." category = "main" optional = false -python-versions = "*" +python-versions = ">=3.5.0" + +[package.extras] +unicode_backport = ["unicodedata2"] [[package]] name = "click" -version = "8.0.0" +version = "8.0.1" description = "Composable command line interface toolkit" category = "dev" optional = false @@ -157,6 +160,7 @@ python-versions = ">=3.6" [package.dependencies] colorama = {version = "*", markers = "platform_system == \"Windows\""} +importlib-metadata = {version = "*", markers = "python_version < \"3.8\""} [[package]] name = "colorama" @@ -201,7 +205,7 @@ jinja2 = "*" [[package]] name = "cryptography" -version = "2.9.2" +version = "3.2" description = "cryptography is a package which provides cryptographic recipes and primitives to Python developers." category = "main" optional = false @@ -212,10 +216,10 @@ cffi = ">=1.8,<1.11.3 || >1.11.3" six = ">=1.4.1" [package.extras] -docs = ["sphinx (>=1.6.5,!=1.8.0)", "sphinx-rtd-theme"] +docs = ["sphinx (>=1.6.5,!=1.8.0,!=3.1.0,!=3.1.1)", "sphinx-rtd-theme"] docstest = ["doc8", "pyenchant (>=1.6.11)", "twine (>=1.12.0)", "sphinxcontrib-spelling (>=4.0.1)"] -idna = ["idna (>=2.1)"] -pep8test = ["flake8", "flake8-import-order", "pep8-naming"] +pep8test = ["black", "flake8", "flake8-import-order", "pep8-naming"] +ssh = ["bcrypt (>=3.1.5)"] test = ["pytest (>=3.6.0,!=3.9.0,!=3.9.1,!=3.9.2)", "pretend", "iso8601", "pytz", "hypothesis (>=1.11.4,!=3.79.2)"] [[package]] @@ -228,7 +232,7 @@ python-versions = ">=3.6, <3.7" [[package]] name = "decorator" -version = "5.0.5" +version = "5.0.9" description = "Decorators for Humans" category = "main" optional = false @@ -340,7 +344,7 @@ redis = ">=3.0.0" [[package]] name = "djangorestframework" -version = "3.11.0" +version = "3.11.2" description = "Web APIs for Django, made easy." category = "main" optional = false @@ -410,12 +414,15 @@ importlib-metadata = {version = "*", markers = "python_version < \"3.8\""} [[package]] name = "httplib2" -version = "0.18.1" +version = "0.19.0" description = "A comprehensive HTTP client library." category = "main" optional = false python-versions = "*" +[package.dependencies] +pyparsing = ">=2.4.2,<3" + [[package]] name = "idna" version = "2.10" @@ -426,7 +433,7 @@ python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*" [[package]] name = "importlib-metadata" -version = "3.10.0" +version = "4.6.3" description = "Read metadata from Python packages" category = "dev" optional = false @@ -438,7 +445,8 @@ zipp = ">=0.5" [package.extras] docs = ["sphinx", "jaraco.packaging (>=8.2)", "rst.linker (>=1.9)"] -testing = ["pytest (>=4.6)", "pytest-checkdocs (>=2.4)", "pytest-flake8", "pytest-cov", "pytest-enabler (>=1.0.1)", "packaging", "pep517", "pyfakefs", "flufl.flake8", "pytest-black (>=0.3.7)", "pytest-mypy", "importlib-resources (>=1.3)"] +perf = ["ipython"] +testing = ["pytest (>=4.6)", "pytest-checkdocs (>=2.4)", "pytest-flake8", "pytest-cov", "pytest-enabler (>=1.0.1)", "packaging", "pep517", "pyfakefs", "flufl.flake8", "pytest-perf (>=0.9.2)", "pytest-black (>=0.3.7)", "pytest-mypy", "importlib-resources (>=1.3)"] [[package]] name = "inflection" @@ -458,7 +466,7 @@ python-versions = "*" [[package]] name = "isort" -version = "5.9.2" +version = "5.9.3" description = "A Python utility / library to sort Python imports." category = "dev" optional = false @@ -575,22 +583,22 @@ python-versions = ">=3.5" [[package]] name = "packaging" -version = "20.9" +version = "21.0" description = "Core utilities for Python packages" category = "main" optional = false -python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*" +python-versions = ">=3.6" [package.dependencies] pyparsing = ">=2.0.2" [[package]] name = "pathspec" -version = "0.8.1" +version = "0.9.0" description = "Utility library for gitignore style pattern matching of file paths." category = "dev" optional = false -python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*" +python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,>=2.7" [[package]] name = "pluggy" @@ -608,7 +616,7 @@ dev = ["pre-commit", "tox"] [[package]] name = "prometheus-client" -version = "0.10.0" +version = "0.11.0" description = "Python client for the Prometheus monitoring system." category = "main" optional = false @@ -643,7 +651,7 @@ python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*" [[package]] name = "pydantic" -version = "1.5.1" +version = "1.6.2" description = "Data validation and settings management using python 3.6 type hinting" category = "main" optional = false @@ -783,7 +791,7 @@ hiredis = ["hiredis (>=0.1.3)"] [[package]] name = "regex" -version = "2021.4.4" +version = "2021.8.3" description = "Alternative regular expression module, to replace re." category = "dev" optional = false @@ -791,25 +799,25 @@ python-versions = "*" [[package]] name = "requests" -version = "2.24.0" +version = "2.26.0" description = "Python HTTP for Humans." category = "main" optional = false -python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*" +python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*, !=3.5.*" [package.dependencies] certifi = ">=2017.4.17" -chardet = ">=3.0.2,<4" -idna = ">=2.5,<3" -urllib3 = ">=1.21.1,<1.25.0 || >1.25.0,<1.25.1 || >1.25.1,<1.26" +charset-normalizer = {version = ">=2.0.0,<2.1.0", markers = "python_version >= \"3\""} +idna = {version = ">=2.5,<4", markers = "python_version >= \"3\""} +urllib3 = ">=1.21.1,<1.27" [package.extras] -security = ["pyOpenSSL (>=0.14)", "cryptography (>=1.3.4)"] socks = ["PySocks (>=1.5.6,!=1.5.7)", "win-inet-pton"] +use_chardet_on_py3 = ["chardet (>=3.0.2,<5)"] [[package]] name = "ruamel.yaml" -version = "0.17.2" +version = "0.17.10" description = "ruamel.yaml is a YAML parser/emitter that supports roundtrip preservation of comments, seq/map flow style, and map key order" category = "main" optional = false @@ -824,11 +832,11 @@ jinja2 = ["ruamel.yaml.jinja2 (>=0.2)"] [[package]] name = "ruamel.yaml.clib" -version = "0.2.2" +version = "0.2.6" description = "C version of reader, parser and emitter for ruamel.yaml derived from libyaml" category = "main" optional = false -python-versions = "*" +python-versions = ">=3.5" [[package]] name = "six" @@ -856,7 +864,7 @@ python-versions = "*" [[package]] name = "tomli" -version = "1.0.4" +version = "1.2.1" description = "A lil' TOML parser" category = "dev" optional = false @@ -872,7 +880,7 @@ python-versions = "*" [[package]] name = "types-mock" -version = "0.1.3" +version = "0.1.5" description = "Typing stubs for mock" category = "dev" optional = false @@ -880,7 +888,7 @@ python-versions = "*" [[package]] name = "types-pytz" -version = "2021.1.0" +version = "2021.1.2" description = "Typing stubs for pytz" category = "dev" optional = false @@ -888,7 +896,7 @@ python-versions = "*" [[package]] name = "types-redis" -version = "3.5.4" +version = "3.5.6" description = "Typing stubs for redis" category = "dev" optional = false @@ -896,7 +904,7 @@ python-versions = "*" [[package]] name = "types-requests" -version = "2.25.0" +version = "2.25.6" description = "Typing stubs for requests" category = "dev" optional = false @@ -904,7 +912,7 @@ python-versions = "*" [[package]] name = "types-six" -version = "0.1.7" +version = "0.1.9" description = "Typing stubs for six" category = "dev" optional = false @@ -912,7 +920,7 @@ python-versions = "*" [[package]] name = "typing-extensions" -version = "3.7.4.3" +version = "3.10.0.0" description = "Backported and Experimental Type Hints for Python 3.5+" category = "dev" optional = false @@ -964,7 +972,7 @@ brotli = ["brotli"] [[package]] name = "zipp" -version = "3.4.1" +version = "3.5.0" description = "Backport of pathlib-compatible object wrapper for zip files" category = "dev" optional = false @@ -972,12 +980,12 @@ python-versions = ">=3.6" [package.extras] docs = ["sphinx", "jaraco.packaging (>=8.2)", "rst.linker (>=1.9)"] -testing = ["pytest (>=4.6)", "pytest-checkdocs (>=1.2.3)", "pytest-flake8", "pytest-cov", "pytest-enabler", "jaraco.itertools", "func-timeout", "pytest-black (>=0.3.7)", "pytest-mypy"] +testing = ["pytest (>=4.6)", "pytest-checkdocs (>=2.4)", "pytest-flake8", "pytest-cov", "pytest-enabler (>=1.0.1)", "jaraco.itertools", "func-timeout", "pytest-black (>=0.3.7)", "pytest-mypy"] [metadata] lock-version = "1.1" python-versions = "3.6.6" -content-hash = "fd40130e669cde7d5c25e41227f6b2d064c1c1e4c157060a4dfdac9011dff04c" +content-hash = "7dd28a7b16f57e8c5bac7c55c6da9e80dff95cf8d43233676f7539a6903441ae" [metadata.files] aenum = [ @@ -1001,8 +1009,8 @@ atomicwrites = [ {file = "atomicwrites-1.4.0.tar.gz", hash = "sha256:ae70396ad1a434f9c7046fd2dd196fc04b12f9e91ffb859164193be8b6168a7a"}, ] attrs = [ - {file = "attrs-20.3.0-py2.py3-none-any.whl", hash = "sha256:31b2eced602aa8423c2aea9c76a724617ed67cf9513173fd3a4f03e3a929c7e6"}, - {file = "attrs-20.3.0.tar.gz", hash = "sha256:832aa3cde19744e49938b91fea06d69ecb9e649c93ba974535d08ad92164f700"}, + {file = "attrs-21.2.0-py2.py3-none-any.whl", hash = "sha256:149e90d6d8ac20db7a955ad60cf0e6881a3f20d37096140088356da6c716b0b1"}, + {file = "attrs-21.2.0.tar.gz", hash = "sha256:ef6aaac3ca6cd92904cdd0d83f629a15f18053ec84e6432106f7a4d04ae4f5fb"}, ] billiard = [ {file = "billiard-3.3.0.23-cp27-none-macosx_10_6_intel.whl", hash = "sha256:c0cbe8d45ba8d8213ad68ef9a1881002a151569c9424d551634195a18c3a4160"}, @@ -1023,67 +1031,63 @@ celery = [ {file = "celery-3.1.25.tar.gz", hash = "sha256:6ced63033bc663e60c992564954dbb5c84c43899f7f1a04b739957350f6b55f3"}, ] certifi = [ - {file = "certifi-2020.12.5-py2.py3-none-any.whl", hash = "sha256:719a74fb9e33b9bd44cc7f3a8d94bc35e4049deebe19ba7d8e108280cfd59830"}, - {file = "certifi-2020.12.5.tar.gz", hash = "sha256:1a4995114262bffbc2413b159f2a1a480c969de6e6eb13ee966d470af86af59c"}, + {file = "certifi-2021.5.30-py2.py3-none-any.whl", hash = "sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"}, + {file = "certifi-2021.5.30.tar.gz", hash = "sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"}, ] cffi = [ - {file = "cffi-1.14.5-cp27-cp27m-macosx_10_9_x86_64.whl", hash = "sha256:bb89f306e5da99f4d922728ddcd6f7fcebb3241fc40edebcb7284d7514741991"}, - {file = "cffi-1.14.5-cp27-cp27m-manylinux1_i686.whl", hash = "sha256:34eff4b97f3d982fb93e2831e6750127d1355a923ebaeeb565407b3d2f8d41a1"}, - {file = "cffi-1.14.5-cp27-cp27m-manylinux1_x86_64.whl", hash = "sha256:99cd03ae7988a93dd00bcd9d0b75e1f6c426063d6f03d2f90b89e29b25b82dfa"}, - {file = "cffi-1.14.5-cp27-cp27m-win32.whl", hash = "sha256:65fa59693c62cf06e45ddbb822165394a288edce9e276647f0046e1ec26920f3"}, - {file = "cffi-1.14.5-cp27-cp27m-win_amd64.whl", hash = "sha256:51182f8927c5af975fece87b1b369f722c570fe169f9880764b1ee3bca8347b5"}, - {file = "cffi-1.14.5-cp27-cp27mu-manylinux1_i686.whl", hash = "sha256:43e0b9d9e2c9e5d152946b9c5fe062c151614b262fda2e7b201204de0b99e482"}, - {file = "cffi-1.14.5-cp27-cp27mu-manylinux1_x86_64.whl", hash = "sha256:cbde590d4faaa07c72bf979734738f328d239913ba3e043b1e98fe9a39f8b2b6"}, - {file = "cffi-1.14.5-cp35-cp35m-macosx_10_9_x86_64.whl", hash = "sha256:5de7970188bb46b7bf9858eb6890aad302577a5f6f75091fd7cdd3ef13ef3045"}, - {file = "cffi-1.14.5-cp35-cp35m-manylinux1_i686.whl", hash = "sha256:a465da611f6fa124963b91bf432d960a555563efe4ed1cc403ba5077b15370aa"}, - {file = "cffi-1.14.5-cp35-cp35m-manylinux1_x86_64.whl", hash = "sha256:d42b11d692e11b6634f7613ad8df5d6d5f8875f5d48939520d351007b3c13406"}, - {file = "cffi-1.14.5-cp35-cp35m-win32.whl", hash = "sha256:72d8d3ef52c208ee1c7b2e341f7d71c6fd3157138abf1a95166e6165dd5d4369"}, - {file = "cffi-1.14.5-cp35-cp35m-win_amd64.whl", hash = "sha256:29314480e958fd8aab22e4a58b355b629c59bf5f2ac2492b61e3dc06d8c7a315"}, - {file = "cffi-1.14.5-cp36-cp36m-macosx_10_9_x86_64.whl", hash = "sha256:3d3dd4c9e559eb172ecf00a2a7517e97d1e96de2a5e610bd9b68cea3925b4892"}, - {file = "cffi-1.14.5-cp36-cp36m-manylinux1_i686.whl", hash = "sha256:48e1c69bbacfc3d932221851b39d49e81567a4d4aac3b21258d9c24578280058"}, - {file = "cffi-1.14.5-cp36-cp36m-manylinux1_x86_64.whl", hash = "sha256:69e395c24fc60aad6bb4fa7e583698ea6cc684648e1ffb7fe85e3c1ca131a7d5"}, - {file = "cffi-1.14.5-cp36-cp36m-manylinux2014_aarch64.whl", hash = "sha256:9e93e79c2551ff263400e1e4be085a1210e12073a31c2011dbbda14bda0c6132"}, - {file = "cffi-1.14.5-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:24ec4ff2c5c0c8f9c6b87d5bb53555bf267e1e6f70e52e5a9740d32861d36b6f"}, - {file = "cffi-1.14.5-cp36-cp36m-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3c3f39fa737542161d8b0d680df2ec249334cd70a8f420f71c9304bd83c3cbed"}, - {file = "cffi-1.14.5-cp36-cp36m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:681d07b0d1e3c462dd15585ef5e33cb021321588bebd910124ef4f4fb71aef55"}, - {file = "cffi-1.14.5-cp36-cp36m-win32.whl", hash = "sha256:58e3f59d583d413809d60779492342801d6e82fefb89c86a38e040c16883be53"}, - {file = "cffi-1.14.5-cp36-cp36m-win_amd64.whl", hash = "sha256:005a36f41773e148deac64b08f233873a4d0c18b053d37da83f6af4d9087b813"}, - {file = "cffi-1.14.5-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:2894f2df484ff56d717bead0a5c2abb6b9d2bf26d6960c4604d5c48bbc30ee73"}, - {file = "cffi-1.14.5-cp37-cp37m-manylinux1_i686.whl", hash = "sha256:0857f0ae312d855239a55c81ef453ee8fd24136eaba8e87a2eceba644c0d4c06"}, - {file = "cffi-1.14.5-cp37-cp37m-manylinux1_x86_64.whl", hash = "sha256:cd2868886d547469123fadc46eac7ea5253ea7fcb139f12e1dfc2bbd406427d1"}, - {file = "cffi-1.14.5-cp37-cp37m-manylinux2014_aarch64.whl", hash = "sha256:35f27e6eb43380fa080dccf676dece30bef72e4a67617ffda586641cd4508d49"}, - {file = "cffi-1.14.5-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:06d7cd1abac2ffd92e65c0609661866709b4b2d82dd15f611e602b9b188b0b69"}, - {file = "cffi-1.14.5-cp37-cp37m-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:0f861a89e0043afec2a51fd177a567005847973be86f709bbb044d7f42fc4e05"}, - {file = "cffi-1.14.5-cp37-cp37m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:cc5a8e069b9ebfa22e26d0e6b97d6f9781302fe7f4f2b8776c3e1daea35f1adc"}, - {file = "cffi-1.14.5-cp37-cp37m-win32.whl", hash = "sha256:9ff227395193126d82e60319a673a037d5de84633f11279e336f9c0f189ecc62"}, - {file = "cffi-1.14.5-cp37-cp37m-win_amd64.whl", hash = "sha256:9cf8022fb8d07a97c178b02327b284521c7708d7c71a9c9c355c178ac4bbd3d4"}, - {file = "cffi-1.14.5-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:8b198cec6c72df5289c05b05b8b0969819783f9418e0409865dac47288d2a053"}, - {file = "cffi-1.14.5-cp38-cp38-manylinux1_i686.whl", hash = "sha256:ad17025d226ee5beec591b52800c11680fca3df50b8b29fe51d882576e039ee0"}, - {file = "cffi-1.14.5-cp38-cp38-manylinux1_x86_64.whl", hash = "sha256:6c97d7350133666fbb5cf4abdc1178c812cb205dc6f41d174a7b0f18fb93337e"}, - {file = "cffi-1.14.5-cp38-cp38-manylinux2014_aarch64.whl", hash = "sha256:8ae6299f6c68de06f136f1f9e69458eae58f1dacf10af5c17353eae03aa0d827"}, - {file = "cffi-1.14.5-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:04c468b622ed31d408fea2346bec5bbffba2cc44226302a0de1ade9f5ea3d373"}, - {file = "cffi-1.14.5-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:06db6321b7a68b2bd6df96d08a5adadc1fa0e8f419226e25b2a5fbf6ccc7350f"}, - {file = "cffi-1.14.5-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:293e7ea41280cb28c6fcaaa0b1aa1f533b8ce060b9e701d78511e1e6c4a1de76"}, - {file = "cffi-1.14.5-cp38-cp38-win32.whl", hash = "sha256:b85eb46a81787c50650f2392b9b4ef23e1f126313b9e0e9013b35c15e4288e2e"}, - {file = "cffi-1.14.5-cp38-cp38-win_amd64.whl", hash = "sha256:1f436816fc868b098b0d63b8920de7d208c90a67212546d02f84fe78a9c26396"}, - {file = "cffi-1.14.5-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:1071534bbbf8cbb31b498d5d9db0f274f2f7a865adca4ae429e147ba40f73dea"}, - {file = "cffi-1.14.5-cp39-cp39-manylinux1_i686.whl", hash = "sha256:9de2e279153a443c656f2defd67769e6d1e4163952b3c622dcea5b08a6405322"}, - {file = "cffi-1.14.5-cp39-cp39-manylinux1_x86_64.whl", hash = "sha256:6e4714cc64f474e4d6e37cfff31a814b509a35cb17de4fb1999907575684479c"}, - {file = "cffi-1.14.5-cp39-cp39-manylinux2014_aarch64.whl", hash = "sha256:158d0d15119b4b7ff6b926536763dc0714313aa59e320ddf787502c70c4d4bee"}, - {file = "cffi-1.14.5-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1bf1ac1984eaa7675ca8d5745a8cb87ef7abecb5592178406e55858d411eadc0"}, - {file = "cffi-1.14.5-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:df5052c5d867c1ea0b311fb7c3cd28b19df469c056f7fdcfe88c7473aa63e333"}, - {file = "cffi-1.14.5-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:24a570cd11895b60829e941f2613a4f79df1a27344cbbb82164ef2e0116f09c7"}, - {file = "cffi-1.14.5-cp39-cp39-win32.whl", hash = "sha256:afb29c1ba2e5a3736f1c301d9d0abe3ec8b86957d04ddfa9d7a6a42b9367e396"}, - {file = "cffi-1.14.5-cp39-cp39-win_amd64.whl", hash = "sha256:f2d45f97ab6bb54753eab54fffe75aaf3de4ff2341c9daee1987ee1837636f1d"}, - {file = "cffi-1.14.5.tar.gz", hash = "sha256:fd78e5fee591709f32ef6edb9a015b4aa1a5022598e36227500c8f4e02328d9c"}, -] -chardet = [ - {file = "chardet-3.0.4-py2.py3-none-any.whl", hash = "sha256:fc323ffcaeaed0e0a02bf4d117757b98aed530d9ed4531e3e15460124c106691"}, - {file = "chardet-3.0.4.tar.gz", hash = "sha256:84ab92ed1c4d4f16916e05906b6b75a6c0fb5db821cc65e70cbd64a3e2a5eaae"}, + {file = "cffi-1.14.6-cp27-cp27m-macosx_10_9_x86_64.whl", hash = "sha256:22b9c3c320171c108e903d61a3723b51e37aaa8c81255b5e7ce102775bd01e2c"}, + {file = "cffi-1.14.6-cp27-cp27m-manylinux1_i686.whl", hash = "sha256:f0c5d1acbfca6ebdd6b1e3eded8d261affb6ddcf2186205518f1428b8569bb99"}, + {file = "cffi-1.14.6-cp27-cp27m-manylinux1_x86_64.whl", hash = "sha256:99f27fefe34c37ba9875f224a8f36e31d744d8083e00f520f133cab79ad5e819"}, + {file = "cffi-1.14.6-cp27-cp27m-win32.whl", hash = "sha256:55af55e32ae468e9946f741a5d51f9896da6b9bf0bbdd326843fec05c730eb20"}, + {file = "cffi-1.14.6-cp27-cp27m-win_amd64.whl", hash = "sha256:7bcac9a2b4fdbed2c16fa5681356d7121ecabf041f18d97ed5b8e0dd38a80224"}, + {file = "cffi-1.14.6-cp27-cp27mu-manylinux1_i686.whl", hash = "sha256:ed38b924ce794e505647f7c331b22a693bee1538fdf46b0222c4717b42f744e7"}, + {file = "cffi-1.14.6-cp27-cp27mu-manylinux1_x86_64.whl", hash = "sha256:e22dcb48709fc51a7b58a927391b23ab37eb3737a98ac4338e2448bef8559b33"}, + {file = "cffi-1.14.6-cp35-cp35m-macosx_10_9_x86_64.whl", hash = "sha256:aedb15f0a5a5949ecb129a82b72b19df97bbbca024081ed2ef88bd5c0a610534"}, + {file = "cffi-1.14.6-cp35-cp35m-manylinux1_i686.whl", hash = "sha256:48916e459c54c4a70e52745639f1db524542140433599e13911b2f329834276a"}, + {file = "cffi-1.14.6-cp35-cp35m-manylinux1_x86_64.whl", hash = "sha256:f627688813d0a4140153ff532537fbe4afea5a3dffce1f9deb7f91f848a832b5"}, + {file = "cffi-1.14.6-cp35-cp35m-win32.whl", hash = "sha256:f0010c6f9d1a4011e429109fda55a225921e3206e7f62a0c22a35344bfd13cca"}, + {file = "cffi-1.14.6-cp35-cp35m-win_amd64.whl", hash = "sha256:57e555a9feb4a8460415f1aac331a2dc833b1115284f7ded7278b54afc5bd218"}, + {file = "cffi-1.14.6-cp36-cp36m-macosx_10_9_x86_64.whl", hash = "sha256:e8c6a99be100371dbb046880e7a282152aa5d6127ae01783e37662ef73850d8f"}, + {file = "cffi-1.14.6-cp36-cp36m-manylinux1_i686.whl", hash = "sha256:19ca0dbdeda3b2615421d54bef8985f72af6e0c47082a8d26122adac81a95872"}, + {file = "cffi-1.14.6-cp36-cp36m-manylinux1_x86_64.whl", hash = "sha256:d950695ae4381ecd856bcaf2b1e866720e4ab9a1498cba61c602e56630ca7195"}, + {file = "cffi-1.14.6-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e9dc245e3ac69c92ee4c167fbdd7428ec1956d4e754223124991ef29eb57a09d"}, + {file = "cffi-1.14.6-cp36-cp36m-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:a8661b2ce9694ca01c529bfa204dbb144b275a31685a075ce123f12331be790b"}, + {file = "cffi-1.14.6-cp36-cp36m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:b315d709717a99f4b27b59b021e6207c64620790ca3e0bde636a6c7f14618abb"}, + {file = "cffi-1.14.6-cp36-cp36m-win32.whl", hash = "sha256:80b06212075346b5546b0417b9f2bf467fea3bfe7352f781ffc05a8ab24ba14a"}, + {file = "cffi-1.14.6-cp36-cp36m-win_amd64.whl", hash = "sha256:a9da7010cec5a12193d1af9872a00888f396aba3dc79186604a09ea3ee7c029e"}, + {file = "cffi-1.14.6-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:4373612d59c404baeb7cbd788a18b2b2a8331abcc84c3ba40051fcd18b17a4d5"}, + {file = "cffi-1.14.6-cp37-cp37m-manylinux1_i686.whl", hash = "sha256:f10afb1004f102c7868ebfe91c28f4a712227fe4cb24974350ace1f90e1febbf"}, + {file = "cffi-1.14.6-cp37-cp37m-manylinux1_x86_64.whl", hash = "sha256:fd4305f86f53dfd8cd3522269ed7fc34856a8ee3709a5e28b2836b2db9d4cd69"}, + {file = "cffi-1.14.6-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:6d6169cb3c6c2ad50db5b868db6491a790300ade1ed5d1da29289d73bbe40b56"}, + {file = "cffi-1.14.6-cp37-cp37m-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:5d4b68e216fc65e9fe4f524c177b54964af043dde734807586cf5435af84045c"}, + {file = "cffi-1.14.6-cp37-cp37m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:33791e8a2dc2953f28b8d8d300dde42dd929ac28f974c4b4c6272cb2955cb762"}, + {file = "cffi-1.14.6-cp37-cp37m-win32.whl", hash = "sha256:0c0591bee64e438883b0c92a7bed78f6290d40bf02e54c5bf0978eaf36061771"}, + {file = "cffi-1.14.6-cp37-cp37m-win_amd64.whl", hash = "sha256:8eb687582ed7cd8c4bdbff3df6c0da443eb89c3c72e6e5dcdd9c81729712791a"}, + {file = "cffi-1.14.6-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:ba6f2b3f452e150945d58f4badd92310449876c4c954836cfb1803bdd7b422f0"}, + {file = "cffi-1.14.6-cp38-cp38-manylinux1_i686.whl", hash = "sha256:64fda793737bc4037521d4899be780534b9aea552eb673b9833b01f945904c2e"}, + {file = "cffi-1.14.6-cp38-cp38-manylinux1_x86_64.whl", hash = "sha256:9f3e33c28cd39d1b655ed1ba7247133b6f7fc16fa16887b120c0c670e35ce346"}, + {file = "cffi-1.14.6-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:26bb2549b72708c833f5abe62b756176022a7b9a7f689b571e74c8478ead51dc"}, + {file = "cffi-1.14.6-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:eb687a11f0a7a1839719edd80f41e459cc5366857ecbed383ff376c4e3cc6afd"}, + {file = "cffi-1.14.6-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:d2ad4d668a5c0645d281dcd17aff2be3212bc109b33814bbb15c4939f44181cc"}, + {file = "cffi-1.14.6-cp38-cp38-win32.whl", hash = "sha256:487d63e1454627c8e47dd230025780e91869cfba4c753a74fda196a1f6ad6548"}, + {file = "cffi-1.14.6-cp38-cp38-win_amd64.whl", hash = "sha256:c33d18eb6e6bc36f09d793c0dc58b0211fccc6ae5149b808da4a62660678b156"}, + {file = "cffi-1.14.6-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:06c54a68935738d206570b20da5ef2b6b6d92b38ef3ec45c5422c0ebaf338d4d"}, + {file = "cffi-1.14.6-cp39-cp39-manylinux1_i686.whl", hash = "sha256:f174135f5609428cc6e1b9090f9268f5c8935fddb1b25ccb8255a2d50de6789e"}, + {file = "cffi-1.14.6-cp39-cp39-manylinux1_x86_64.whl", hash = "sha256:f3ebe6e73c319340830a9b2825d32eb6d8475c1dac020b4f0aa774ee3b898d1c"}, + {file = "cffi-1.14.6-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3c8d896becff2fa653dc4438b54a5a25a971d1f4110b32bd3068db3722c80202"}, + {file = "cffi-1.14.6-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:4922cd707b25e623b902c86188aca466d3620892db76c0bdd7b99a3d5e61d35f"}, + {file = "cffi-1.14.6-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:c9e005e9bd57bc987764c32a1bee4364c44fdc11a3cc20a40b93b444984f2b87"}, + {file = "cffi-1.14.6-cp39-cp39-win32.whl", hash = "sha256:eb9e2a346c5238a30a746893f23a9535e700f8192a68c07c0258e7ece6ff3728"}, + {file = "cffi-1.14.6-cp39-cp39-win_amd64.whl", hash = "sha256:818014c754cd3dba7229c0f5884396264d51ffb87ec86e927ef0be140bfdb0d2"}, + {file = "cffi-1.14.6.tar.gz", hash = "sha256:c9a875ce9d7fe32887784274dd533c57909b7b1dcadcc128a2ac21331a9765dd"}, +] +charset-normalizer = [ + {file = "charset-normalizer-2.0.4.tar.gz", hash = "sha256:f23667ebe1084be45f6ae0538e4a5a865206544097e4e8bbcacf42cd02a348f3"}, + {file = "charset_normalizer-2.0.4-py3-none-any.whl", hash = "sha256:0c8911edd15d19223366a194a513099a302055a962bca2cec0f54b8b63175d8b"}, ] click = [ - {file = "click-8.0.0-py3-none-any.whl", hash = "sha256:e90e62ced43dc8105fb9a26d62f0d9340b5c8db053a814e25d95c19873ae87db"}, - {file = "click-8.0.0.tar.gz", hash = "sha256:7d8c289ee437bcb0316820ccee14aefcb056e58d31830ecab8e47eda6540e136"}, + {file = "click-8.0.1-py3-none-any.whl", hash = "sha256:fba402a4a47334742d782209a7c79bc448911afe1149d07bdabdf480b3e2f4b6"}, + {file = "click-8.0.1.tar.gz", hash = "sha256:8c04c11192119b1ef78ea049e0a6f0463e4c48ef00a30160c704337586f3ad7a"}, ] colorama = [ {file = "colorama-0.4.4-py2.py3-none-any.whl", hash = "sha256:9f47eda37229f68eee03b24b9748937c7dc3868f906e8ba69fbcbdd3bc5dc3e2"}, @@ -1101,33 +1105,36 @@ coreschema = [ {file = "coreschema-0.0.4.tar.gz", hash = "sha256:9503506007d482ab0867ba14724b93c18a33b22b6d19fb419ef2d239dd4a1607"}, ] cryptography = [ - {file = "cryptography-2.9.2-cp27-cp27m-macosx_10_9_x86_64.whl", hash = "sha256:daf54a4b07d67ad437ff239c8a4080cfd1cc7213df57d33c97de7b4738048d5e"}, - {file = "cryptography-2.9.2-cp27-cp27m-manylinux1_x86_64.whl", hash = "sha256:3b3eba865ea2754738616f87292b7f29448aec342a7c720956f8083d252bf28b"}, - {file = "cryptography-2.9.2-cp27-cp27m-manylinux2010_x86_64.whl", hash = "sha256:c447cf087cf2dbddc1add6987bbe2f767ed5317adb2d08af940db517dd704365"}, - {file = "cryptography-2.9.2-cp27-cp27m-win32.whl", hash = "sha256:f118a95c7480f5be0df8afeb9a11bd199aa20afab7a96bcf20409b411a3a85f0"}, - {file = "cryptography-2.9.2-cp27-cp27m-win_amd64.whl", hash = "sha256:c4fd17d92e9d55b84707f4fd09992081ba872d1a0c610c109c18e062e06a2e55"}, - {file = "cryptography-2.9.2-cp27-cp27mu-manylinux1_x86_64.whl", hash = "sha256:d0d5aeaedd29be304848f1c5059074a740fa9f6f26b84c5b63e8b29e73dfc270"}, - {file = "cryptography-2.9.2-cp27-cp27mu-manylinux2010_x86_64.whl", hash = "sha256:1e4014639d3d73fbc5ceff206049c5a9a849cefd106a49fa7aaaa25cc0ce35cf"}, - {file = "cryptography-2.9.2-cp35-abi3-macosx_10_9_x86_64.whl", hash = "sha256:96c080ae7118c10fcbe6229ab43eb8b090fccd31a09ef55f83f690d1ef619a1d"}, - {file = "cryptography-2.9.2-cp35-abi3-manylinux1_x86_64.whl", hash = "sha256:e993468c859d084d5579e2ebee101de8f5a27ce8e2159959b6673b418fd8c785"}, - {file = "cryptography-2.9.2-cp35-abi3-manylinux2010_x86_64.whl", hash = "sha256:88c881dd5a147e08d1bdcf2315c04972381d026cdb803325c03fe2b4a8ed858b"}, - {file = "cryptography-2.9.2-cp35-cp35m-win32.whl", hash = "sha256:651448cd2e3a6bc2bb76c3663785133c40d5e1a8c1a9c5429e4354201c6024ae"}, - {file = "cryptography-2.9.2-cp35-cp35m-win_amd64.whl", hash = "sha256:726086c17f94747cedbee6efa77e99ae170caebeb1116353c6cf0ab67ea6829b"}, - {file = "cryptography-2.9.2-cp36-cp36m-win32.whl", hash = "sha256:091d31c42f444c6f519485ed528d8b451d1a0c7bf30e8ca583a0cac44b8a0df6"}, - {file = "cryptography-2.9.2-cp36-cp36m-win_amd64.whl", hash = "sha256:bb1f0281887d89617b4c68e8db9a2c42b9efebf2702a3c5bf70599421a8623e3"}, - {file = "cryptography-2.9.2-cp37-cp37m-win32.whl", hash = "sha256:18452582a3c85b96014b45686af264563e3e5d99d226589f057ace56196ec78b"}, - {file = "cryptography-2.9.2-cp37-cp37m-win_amd64.whl", hash = "sha256:22e91636a51170df0ae4dcbd250d318fd28c9f491c4e50b625a49964b24fe46e"}, - {file = "cryptography-2.9.2-cp38-cp38-win32.whl", hash = "sha256:844a76bc04472e5135b909da6aed84360f522ff5dfa47f93e3dd2a0b84a89fa0"}, - {file = "cryptography-2.9.2-cp38-cp38-win_amd64.whl", hash = "sha256:1dfa985f62b137909496e7fc182dac687206d8d089dd03eaeb28ae16eec8e7d5"}, - {file = "cryptography-2.9.2.tar.gz", hash = "sha256:a0c30272fb4ddda5f5ffc1089d7405b7a71b0b0f51993cb4e5dbb4590b2fc229"}, + {file = "cryptography-3.2-cp27-cp27m-macosx_10_10_x86_64.whl", hash = "sha256:9a8580c9afcdcddabbd064c0a74f337af74ff4529cdf3a12fa2e9782d677a2e5"}, + {file = "cryptography-3.2-cp27-cp27m-manylinux1_x86_64.whl", hash = "sha256:7ef41304bf978f33cfb6f43ca13bb0faac0c99cda33693aa20ad4f5e34e8cb8f"}, + {file = "cryptography-3.2-cp27-cp27m-manylinux2010_x86_64.whl", hash = "sha256:87c2fffd61e934bc0e2c927c3764c20b22d7f5f7f812ee1a477de4c89b044ca6"}, + {file = "cryptography-3.2-cp27-cp27m-win32.whl", hash = "sha256:6e8a3c7c45101a7eeee93102500e1b08f2307c717ff553fcb3c1127efc9b6917"}, + {file = "cryptography-3.2-cp27-cp27m-win_amd64.whl", hash = "sha256:52a47e60953679eea0b4d490ca3c241fb1b166a7b161847ef4667dfd49e7699d"}, + {file = "cryptography-3.2-cp27-cp27mu-manylinux1_x86_64.whl", hash = "sha256:6a8f64ed096d13f92d1f601a92d9fd1f1025dc73a2ca1ced46dcf5e0d4930943"}, + {file = "cryptography-3.2-cp27-cp27mu-manylinux2010_x86_64.whl", hash = "sha256:3e17d02941c0f169c5b877597ca8be895fca0e5e3eb882526a74aa4804380a98"}, + {file = "cryptography-3.2-cp35-abi3-macosx_10_10_x86_64.whl", hash = "sha256:d1cbc3426e6150583b22b517ef3720036d7e3152d428c864ff0f3fcad2b97591"}, + {file = "cryptography-3.2-cp35-abi3-manylinux1_x86_64.whl", hash = "sha256:22f8251f68953553af4f9c11ec5f191198bc96cff9f0ac5dd5ff94daede0ee6d"}, + {file = "cryptography-3.2-cp35-abi3-manylinux2010_x86_64.whl", hash = "sha256:f2aa3f8ba9e2e3fd49bd3de743b976ab192fbf0eb0348cebde5d2a9de0090a9f"}, + {file = "cryptography-3.2-cp35-abi3-manylinux2014_aarch64.whl", hash = "sha256:9a07e6d255053674506091d63ab4270a119e9fc83462c7ab1dbcb495b76307af"}, + {file = "cryptography-3.2-cp35-cp35m-win32.whl", hash = "sha256:f0e3986f6cce007216b23c490f093f35ce2068f3c244051e559f647f6731b7ae"}, + {file = "cryptography-3.2-cp35-cp35m-win_amd64.whl", hash = "sha256:284e275e3c099a80831f9898fb5c9559120d27675c3521278faba54e584a7832"}, + {file = "cryptography-3.2-cp36-abi3-win32.whl", hash = "sha256:f01c9116bfb3ad2831e125a73dcd957d173d6ddca7701528eff1e7d97972872c"}, + {file = "cryptography-3.2-cp36-abi3-win_amd64.whl", hash = "sha256:bd80bc156d3729b38cb227a5a76532aef693b7ac9e395eea8063ee50ceed46a5"}, + {file = "cryptography-3.2-cp36-cp36m-win32.whl", hash = "sha256:8f0fd8b0751d75c4483c534b209e39e918f0d14232c0d8a2a76e687f64ced831"}, + {file = "cryptography-3.2-cp36-cp36m-win_amd64.whl", hash = "sha256:8a0866891326d3badb17c5fd3e02c926b635e8923fa271b4813cd4d972a57ff3"}, + {file = "cryptography-3.2-cp37-cp37m-win32.whl", hash = "sha256:57b8c1ed13b8aa386cabbfde3be175d7b155682470b0e259fecfe53850967f8a"}, + {file = "cryptography-3.2-cp37-cp37m-win_amd64.whl", hash = "sha256:88069392cd9a1e68d2cfd5c3a2b0d72a44ef3b24b8977a4f7956e9e3c4c9477a"}, + {file = "cryptography-3.2-cp38-cp38-win32.whl", hash = "sha256:fb70a4cedd69dc52396ee114416a3656e011fb0311fca55eb55c7be6ed9c8aef"}, + {file = "cryptography-3.2-cp38-cp38-win_amd64.whl", hash = "sha256:e15ac84dcdb89f92424cbaca4b0b34e211e7ce3ee7b0ec0e4f3c55cee65fae5a"}, + {file = "cryptography-3.2.tar.gz", hash = "sha256:e4789b84f8dedf190148441f7c5bfe7244782d9cbb194a36e17b91e7d3e1cca9"}, ] dataclasses = [ {file = "dataclasses-0.7-py3-none-any.whl", hash = "sha256:3459118f7ede7c8bea0fe795bff7c6c2ce287d01dd226202f7c9ebc0610a7836"}, {file = "dataclasses-0.7.tar.gz", hash = "sha256:494a6dcae3b8bcf80848eea2ef64c0cc5cd307ffc263e17cdf42f3e5420808e6"}, ] decorator = [ - {file = "decorator-5.0.5-py3-none-any.whl", hash = "sha256:b7157d62ea3c2c0c57b81a05e4569853e976a3dda5dd7a1cb86be78978c3c5f8"}, - {file = "decorator-5.0.5.tar.gz", hash = "sha256:acda948ffcfe4bd0c4a57834b74ad968b91925b8201b740ca9d46fb8c5c618ce"}, + {file = "decorator-5.0.9-py3-none-any.whl", hash = "sha256:6e5c199c16f7a9f0e3a61a4a54b3d27e7dad0dbdde92b944426cb20914376323"}, + {file = "decorator-5.0.9.tar.gz", hash = "sha256:72ecfba4320a893c53f9706bebb2d55c270c1e51a28789361aa93e4a21319ed5"}, ] django = [ {file = "Django-2.2.24-py3-none-any.whl", hash = "sha256:f2084ceecff86b1e631c2cd4107d435daf4e12f1efcdf11061a73bf0b5e95f92"}, @@ -1165,8 +1172,8 @@ django-redis = [ {file = "django_redis-4.12.1-py3-none-any.whl", hash = "sha256:1133b26b75baa3664164c3f44b9d5d133d1b8de45d94d79f38d1adc5b1d502e5"}, ] djangorestframework = [ - {file = "djangorestframework-3.11.0-py3-none-any.whl", hash = "sha256:05809fc66e1c997fd9a32ea5730d9f4ba28b109b9da71fccfa5ff241201fd0a4"}, - {file = "djangorestframework-3.11.0.tar.gz", hash = "sha256:e782087823c47a26826ee5b6fa0c542968219263fb3976ec3c31edab23a4001f"}, + {file = "djangorestframework-3.11.2-py3-none-any.whl", hash = "sha256:5cc724dc4b076463497837269107e1995b1fbc917468d1b92d188fd1af9ea789"}, + {file = "djangorestframework-3.11.2.tar.gz", hash = "sha256:a5967b68a04e0d97d10f4df228e30f5a2d82ba63b9d03e1759f84993b7bf1b53"}, ] "dogpile.cache" = [ {file = "dogpile.cache-0.9.2.tar.gz", hash = "sha256:bc9dde1ffa5de0179efbcdc73773ef0553921130ad01955422f2932be35c059e"}, @@ -1184,16 +1191,16 @@ flake8-comprehensions = [ {file = "flake8_comprehensions-3.5.0-py3-none-any.whl", hash = "sha256:b07aef3277623db32310aa241a1cec67212b53c1d18e767d7e26d4d83aa05bf7"}, ] httplib2 = [ - {file = "httplib2-0.18.1-py3-none-any.whl", hash = "sha256:ca2914b015b6247791c4866782fa6042f495b94401a0f0bd3e1d6e0ba2236782"}, - {file = "httplib2-0.18.1.tar.gz", hash = "sha256:8af66c1c52c7ffe1aa5dc4bcd7c769885254b0756e6e69f953c7f0ab49a70ba3"}, + {file = "httplib2-0.19.0-py3-none-any.whl", hash = "sha256:749c32603f9bf16c1277f59531d502e8f1c2ca19901ae653b49c4ed698f0820e"}, + {file = "httplib2-0.19.0.tar.gz", hash = "sha256:e0d428dad43c72dbce7d163b7753ffc7a39c097e6788ef10f4198db69b92f08e"}, ] idna = [ {file = "idna-2.10-py2.py3-none-any.whl", hash = "sha256:b97d804b1e9b523befed77c48dacec60e6dcb0b5391d57af6a65a312a90648c0"}, {file = "idna-2.10.tar.gz", hash = "sha256:b307872f855b18632ce0c21c5e45be78c0ea7ae4c15c828c20788b26921eb3f6"}, ] importlib-metadata = [ - {file = "importlib_metadata-3.10.0-py3-none-any.whl", hash = "sha256:d2d46ef77ffc85cbf7dac7e81dd663fde71c45326131bea8033b9bad42268ebe"}, - {file = "importlib_metadata-3.10.0.tar.gz", hash = "sha256:c9db46394197244adf2f0b08ec5bc3cf16757e9590b02af1fca085c16c0d600a"}, + {file = "importlib_metadata-4.6.3-py3-none-any.whl", hash = "sha256:51c6635429c77cf1ae634c997ff9e53ca3438b495f10a55ba28594dd69764a8b"}, + {file = "importlib_metadata-4.6.3.tar.gz", hash = "sha256:0645585859e9a6689c523927a5032f2ba5919f1f7d0e84bd4533312320de1ff9"}, ] inflection = [ {file = "inflection-0.5.1-py2.py3-none-any.whl", hash = "sha256:f38b2b640938a4f35ade69ac3d053042959b62a0f1076a5bbaa1b9526605a8a2"}, @@ -1204,8 +1211,8 @@ iniconfig = [ {file = "iniconfig-1.1.1.tar.gz", hash = "sha256:bc3af051d7d14b2ee5ef9969666def0cd1a000e121eaea580d4a313df4b37f32"}, ] isort = [ - {file = "isort-5.9.2-py3-none-any.whl", hash = "sha256:eed17b53c3e7912425579853d078a0832820f023191561fcee9d7cae424e0813"}, - {file = "isort-5.9.2.tar.gz", hash = "sha256:f65ce5bd4cbc6abdfbe29afc2f0245538ab358c14590912df638033f157d555e"}, + {file = "isort-5.9.3-py3-none-any.whl", hash = "sha256:e17d6e2b81095c9db0a03a8025a957f334d6ea30b26f9ec70805411e5c7c81f2"}, + {file = "isort-5.9.3.tar.gz", hash = "sha256:9c2ea1e62d871267b78307fe511c0838ba0da28698c5732d54e2790bf3ba9899"}, ] itypes = [ {file = "itypes-1.2.0-py2.py3-none-any.whl", hash = "sha256:03da6872ca89d29aef62773672b2d408f490f80db48b23079a4b194c86dd04c6"}, @@ -1269,20 +1276,20 @@ mysqlclient = [ {file = "mysqlclient-2.0.1.tar.gz", hash = "sha256:fb2f75aea14722390d2d8ddf384ad99da708c707a96656210a7be8af20a2c5e5"}, ] packaging = [ - {file = "packaging-20.9-py2.py3-none-any.whl", hash = "sha256:67714da7f7bc052e064859c05c595155bd1ee9f69f76557e21f051443c20947a"}, - {file = "packaging-20.9.tar.gz", hash = "sha256:5b327ac1320dc863dca72f4514ecc086f31186744b84a230374cc1fd776feae5"}, + {file = "packaging-21.0-py3-none-any.whl", hash = "sha256:c86254f9220d55e31cc94d69bade760f0847da8000def4dfe1c6b872fd14ff14"}, + {file = "packaging-21.0.tar.gz", hash = "sha256:7dc96269f53a4ccec5c0670940a4281106dd0bb343f47b7471f779df49c2fbe7"}, ] pathspec = [ - {file = "pathspec-0.8.1-py2.py3-none-any.whl", hash = "sha256:aa0cb481c4041bf52ffa7b0d8fa6cd3e88a2ca4879c533c9153882ee2556790d"}, - {file = "pathspec-0.8.1.tar.gz", hash = "sha256:86379d6b86d75816baba717e64b1a3a3469deb93bb76d613c9ce79edc5cb68fd"}, + {file = "pathspec-0.9.0-py2.py3-none-any.whl", hash = "sha256:7d15c4ddb0b5c802d161efc417ec1a2558ea2653c2e8ad9c19098201dc1c993a"}, + {file = "pathspec-0.9.0.tar.gz", hash = "sha256:e564499435a2673d586f6b2130bb5b95f04a3ba06f81b8f895b651a3c76aabb1"}, ] pluggy = [ {file = "pluggy-0.13.1-py2.py3-none-any.whl", hash = "sha256:966c145cd83c96502c3c3868f50408687b38434af77734af1e9ca461a4081d2d"}, {file = "pluggy-0.13.1.tar.gz", hash = "sha256:15b2acde666561e1298d71b523007ed7364de07029219b604cf808bfa1c765b0"}, ] prometheus-client = [ - {file = "prometheus_client-0.10.0-py2.py3-none-any.whl", hash = "sha256:c5843b3e1b4689a3599a2463e5b5850d110d1a7e28a94bdc2c6f5bb6585cfb18"}, - {file = "prometheus_client-0.10.0.tar.gz", hash = "sha256:1e7bc14fd6ca9c3fc07309b73a7a3469920dfe88ca9f331c02258cc62736cbc2"}, + {file = "prometheus_client-0.11.0-py2.py3-none-any.whl", hash = "sha256:b014bc76815eb1399da8ce5fc84b7717a3e63652b0c0f8804092c9363acab1b2"}, + {file = "prometheus_client-0.11.0.tar.gz", hash = "sha256:3a8baade6cb80bcfe43297e33e7623f3118d660d41387593758e2fb1ea173a86"}, ] py = [ {file = "py-1.10.0-py2.py3-none-any.whl", hash = "sha256:3b80836aa6d1feeaa108e046da6423ab8f6ceda6468545ae8d02d9d58d18818a"}, @@ -1297,23 +1304,23 @@ pycparser = [ {file = "pycparser-2.20.tar.gz", hash = "sha256:2d475327684562c3a96cc71adf7dc8c4f0565175cf86b6d7a404ff4c771f15f0"}, ] pydantic = [ - {file = "pydantic-1.5.1-cp36-cp36m-macosx_10_9_x86_64.whl", hash = "sha256:2a6904e9f18dea58f76f16b95cba6a2f20b72d787abd84ecd67ebc526e61dce6"}, - {file = "pydantic-1.5.1-cp36-cp36m-manylinux1_i686.whl", hash = "sha256:da8099fca5ee339d5572cfa8af12cf0856ae993406f0b1eb9bb38c8a660e7416"}, - {file = "pydantic-1.5.1-cp36-cp36m-manylinux2014_i686.whl", hash = "sha256:68dece67bff2b3a5cc188258e46b49f676a722304f1c6148ae08e9291e284d98"}, - {file = "pydantic-1.5.1-cp36-cp36m-manylinux2014_x86_64.whl", hash = "sha256:ab863853cb502480b118187d670f753be65ec144e1654924bec33d63bc8b3ce2"}, - {file = "pydantic-1.5.1-cp36-cp36m-win_amd64.whl", hash = "sha256:2007eb062ed0e57875ce8ead12760a6e44bf5836e6a1a7ea81d71eeecf3ede0f"}, - {file = "pydantic-1.5.1-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:20a15a303ce1e4d831b4e79c17a4a29cb6740b12524f5bba3ea363bff65732bc"}, - {file = "pydantic-1.5.1-cp37-cp37m-manylinux1_i686.whl", hash = "sha256:473101121b1bd454c8effc9fe66d54812fdc128184d9015c5aaa0d4e58a6d338"}, - {file = "pydantic-1.5.1-cp37-cp37m-manylinux2014_i686.whl", hash = "sha256:9be755919258d5d168aeffbe913ed6e8bd562e018df7724b68cabdee3371e331"}, - {file = "pydantic-1.5.1-cp37-cp37m-manylinux2014_x86_64.whl", hash = "sha256:b96ce81c4b5ca62ab81181212edfd057beaa41411cd9700fbcb48a6ba6564b4e"}, - {file = "pydantic-1.5.1-cp37-cp37m-win_amd64.whl", hash = "sha256:93b9f265329d9827f39f0fca68f5d72cc8321881cdc519a1304fa73b9f8a75bd"}, - {file = "pydantic-1.5.1-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:e2c753d355126ddd1eefeb167fa61c7037ecd30b98e7ebecdc0d1da463b4ea09"}, - {file = "pydantic-1.5.1-cp38-cp38-manylinux1_i686.whl", hash = "sha256:8433dbb87246c0f562af75d00fa80155b74e4f6924b0db6a2078a3cd2f11c6c4"}, - {file = "pydantic-1.5.1-cp38-cp38-manylinux2014_i686.whl", hash = "sha256:0a1cdf24e567d42dc762d3fed399bd211a13db2e8462af9dfa93b34c41648efb"}, - {file = "pydantic-1.5.1-cp38-cp38-manylinux2014_x86_64.whl", hash = "sha256:8be325fc9da897029ee48d1b5e40df817d97fe969f3ac3fd2434ba7e198c55d5"}, - {file = "pydantic-1.5.1-cp38-cp38-win_amd64.whl", hash = "sha256:3714a4056f5bdbecf3a41e0706ec9b228c9513eee2ad884dc2c568c4dfa540e9"}, - {file = "pydantic-1.5.1-py36.py37.py38-none-any.whl", hash = "sha256:70f27d2f0268f490fe3de0a9b6fca7b7492b8fd6623f9fecd25b221ebee385e3"}, - {file = "pydantic-1.5.1.tar.gz", hash = "sha256:f0018613c7a0d19df3240c2a913849786f21b6539b9f23d85ce4067489dfacfa"}, + {file = "pydantic-1.6.2-cp36-cp36m-macosx_10_9_x86_64.whl", hash = "sha256:be4e0263ef515ae14f06e9fb372843f00bdb218ec4f2f04beb3480ac1538a9a9"}, + {file = "pydantic-1.6.2-cp36-cp36m-manylinux1_i686.whl", hash = "sha256:14e598055b65d2e6cedf10dc3de6ad1bb04ca3eec348e4af1cf5e5e496deab55"}, + {file = "pydantic-1.6.2-cp36-cp36m-manylinux2014_i686.whl", hash = "sha256:d09adff1c70351a8750941dd39fda25447eab2e3cdb5b2aade340f69f6f53e84"}, + {file = "pydantic-1.6.2-cp36-cp36m-manylinux2014_x86_64.whl", hash = "sha256:cd777c102ba31bc9992093c2e9f778c21b3965566d1fa5ac9f9b7cea2e67fe2a"}, + {file = "pydantic-1.6.2-cp36-cp36m-win_amd64.whl", hash = "sha256:548c284237b0c61e0e785ad03167c75723f22000f82e8104d8981fdf50ce14e8"}, + {file = "pydantic-1.6.2-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:1d42c7408cde8a224c2bb969bfb9dca21f3b1eec37a92044be8bcd7d35ea5826"}, + {file = "pydantic-1.6.2-cp37-cp37m-manylinux1_i686.whl", hash = "sha256:90310c1c5945b4fe2ff7bd69e306e54d192e55d22480657ddd6d2519cf2f12ba"}, + {file = "pydantic-1.6.2-cp37-cp37m-manylinux2014_i686.whl", hash = "sha256:bf9e5dd5e0e7e64541508f657c63bf6ab869109cb39f017f935acfeb64ea9be8"}, + {file = "pydantic-1.6.2-cp37-cp37m-manylinux2014_x86_64.whl", hash = "sha256:6eea211e8b427841a16f43fa739ac06059db6af0d167476b928dbb237d870b77"}, + {file = "pydantic-1.6.2-cp37-cp37m-win_amd64.whl", hash = "sha256:60b8956b57045224294691b78a6a4be0f321271a9f1c2a7fef25248e4c4f20df"}, + {file = "pydantic-1.6.2-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:76b241172d6e22403e116e1d3b7305b6a9479323f8168f2fcb300ffe698443b9"}, + {file = "pydantic-1.6.2-cp38-cp38-manylinux1_i686.whl", hash = "sha256:433dda6200104d7aa38c27a6ea52485e69931042556065402281cc73a57fd680"}, + {file = "pydantic-1.6.2-cp38-cp38-manylinux2014_i686.whl", hash = "sha256:51dec047b44f0de4dbfa301b73df605918088348b951b8b4616127249febfe30"}, + {file = "pydantic-1.6.2-cp38-cp38-manylinux2014_x86_64.whl", hash = "sha256:f6a1a465dd72aff0462486588a2bf905f9169e575deec1e6f6d00240fe1b4e00"}, + {file = "pydantic-1.6.2-cp38-cp38-win_amd64.whl", hash = "sha256:ae48129396bd5acfaef1cdaaa959ac8ab5d02c026b1fdffb421dc6fa81d7861d"}, + {file = "pydantic-1.6.2-py36.py37.py38-none-any.whl", hash = "sha256:93f7f510fc366b99dace4a3d1f036aafcfe908092c5f2572ad4a96be24da199c"}, + {file = "pydantic-1.6.2.tar.gz", hash = "sha256:e77e5f640f1093bf417b841d9b4148bd4212bb0dbb2cbb9024aa07f2b3b260eb"}, ] pyflakes = [ {file = "pyflakes-2.3.1-py2.py3-none-any.whl", hash = "sha256:7893783d01b8a89811dd72d7dfd4d84ff098e5eed95cfa8905b22bbffe52efc3"}, @@ -1405,88 +1412,70 @@ redis = [ {file = "redis-3.5.3.tar.gz", hash = "sha256:0e7e0cfca8660dea8b7d5cd8c4f6c5e29e11f31158c0b0ae91a397f00e5a05a2"}, ] regex = [ - {file = "regex-2021.4.4-cp36-cp36m-macosx_10_9_x86_64.whl", hash = "sha256:619d71c59a78b84d7f18891fe914446d07edd48dc8328c8e149cbe0929b4e000"}, - {file = "regex-2021.4.4-cp36-cp36m-manylinux1_i686.whl", hash = "sha256:47bf5bf60cf04d72bf6055ae5927a0bd9016096bf3d742fa50d9bf9f45aa0711"}, - {file = "regex-2021.4.4-cp36-cp36m-manylinux1_x86_64.whl", hash = "sha256:281d2fd05555079448537fe108d79eb031b403dac622621c78944c235f3fcf11"}, - {file = "regex-2021.4.4-cp36-cp36m-manylinux2010_i686.whl", hash = "sha256:bd28bc2e3a772acbb07787c6308e00d9626ff89e3bfcdebe87fa5afbfdedf968"}, - {file = "regex-2021.4.4-cp36-cp36m-manylinux2010_x86_64.whl", hash = "sha256:7c2a1af393fcc09e898beba5dd59196edaa3116191cc7257f9224beaed3e1aa0"}, - {file = "regex-2021.4.4-cp36-cp36m-manylinux2014_aarch64.whl", hash = "sha256:c38c71df845e2aabb7fb0b920d11a1b5ac8526005e533a8920aea97efb8ec6a4"}, - {file = "regex-2021.4.4-cp36-cp36m-manylinux2014_i686.whl", hash = "sha256:96fcd1888ab4d03adfc9303a7b3c0bd78c5412b2bfbe76db5b56d9eae004907a"}, - {file = "regex-2021.4.4-cp36-cp36m-manylinux2014_x86_64.whl", hash = "sha256:ade17eb5d643b7fead300a1641e9f45401c98eee23763e9ed66a43f92f20b4a7"}, - {file = "regex-2021.4.4-cp36-cp36m-win32.whl", hash = "sha256:e8e5b509d5c2ff12f8418006d5a90e9436766133b564db0abaec92fd27fcee29"}, - {file = "regex-2021.4.4-cp36-cp36m-win_amd64.whl", hash = "sha256:11d773d75fa650cd36f68d7ca936e3c7afaae41b863b8c387a22aaa78d3c5c79"}, - {file = "regex-2021.4.4-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:d3029c340cfbb3ac0a71798100ccc13b97dddf373a4ae56b6a72cf70dfd53bc8"}, - {file = "regex-2021.4.4-cp37-cp37m-manylinux1_i686.whl", hash = "sha256:18c071c3eb09c30a264879f0d310d37fe5d3a3111662438889ae2eb6fc570c31"}, - {file = "regex-2021.4.4-cp37-cp37m-manylinux1_x86_64.whl", hash = "sha256:4c557a7b470908b1712fe27fb1ef20772b78079808c87d20a90d051660b1d69a"}, - {file = "regex-2021.4.4-cp37-cp37m-manylinux2010_i686.whl", hash = "sha256:01afaf2ec48e196ba91b37451aa353cb7eda77efe518e481707e0515025f0cd5"}, - {file = "regex-2021.4.4-cp37-cp37m-manylinux2010_x86_64.whl", hash = "sha256:3a9cd17e6e5c7eb328517969e0cb0c3d31fd329298dd0c04af99ebf42e904f82"}, - {file = "regex-2021.4.4-cp37-cp37m-manylinux2014_aarch64.whl", hash = "sha256:90f11ff637fe8798933fb29f5ae1148c978cccb0452005bf4c69e13db951e765"}, - {file = "regex-2021.4.4-cp37-cp37m-manylinux2014_i686.whl", hash = "sha256:919859aa909429fb5aa9cf8807f6045592c85ef56fdd30a9a3747e513db2536e"}, - {file = "regex-2021.4.4-cp37-cp37m-manylinux2014_x86_64.whl", hash = "sha256:339456e7d8c06dd36a22e451d58ef72cef293112b559010db3d054d5560ef439"}, - {file = "regex-2021.4.4-cp37-cp37m-win32.whl", hash = "sha256:67bdb9702427ceddc6ef3dc382455e90f785af4c13d495f9626861763ee13f9d"}, - {file = "regex-2021.4.4-cp37-cp37m-win_amd64.whl", hash = "sha256:32e65442138b7b76dd8173ffa2cf67356b7bc1768851dded39a7a13bf9223da3"}, - {file = "regex-2021.4.4-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:1e1c20e29358165242928c2de1482fb2cf4ea54a6a6dea2bd7a0e0d8ee321500"}, - {file = "regex-2021.4.4-cp38-cp38-manylinux1_i686.whl", hash = "sha256:314d66636c494ed9c148a42731b3834496cc9a2c4251b1661e40936814542b14"}, - {file = "regex-2021.4.4-cp38-cp38-manylinux1_x86_64.whl", hash = "sha256:6d1b01031dedf2503631d0903cb563743f397ccaf6607a5e3b19a3d76fc10480"}, - {file = "regex-2021.4.4-cp38-cp38-manylinux2010_i686.whl", hash = "sha256:741a9647fcf2e45f3a1cf0e24f5e17febf3efe8d4ba1281dcc3aa0459ef424dc"}, - {file = "regex-2021.4.4-cp38-cp38-manylinux2010_x86_64.whl", hash = "sha256:4c46e22a0933dd783467cf32b3516299fb98cfebd895817d685130cc50cd1093"}, - {file = "regex-2021.4.4-cp38-cp38-manylinux2014_aarch64.whl", hash = "sha256:e512d8ef5ad7b898cdb2d8ee1cb09a8339e4f8be706d27eaa180c2f177248a10"}, - {file = "regex-2021.4.4-cp38-cp38-manylinux2014_i686.whl", hash = "sha256:980d7be47c84979d9136328d882f67ec5e50008681d94ecc8afa8a65ed1f4a6f"}, - {file = "regex-2021.4.4-cp38-cp38-manylinux2014_x86_64.whl", hash = "sha256:ce15b6d103daff8e9fee13cf7f0add05245a05d866e73926c358e871221eae87"}, - {file = "regex-2021.4.4-cp38-cp38-win32.whl", hash = "sha256:a91aa8619b23b79bcbeb37abe286f2f408d2f2d6f29a17237afda55bb54e7aac"}, - {file = "regex-2021.4.4-cp38-cp38-win_amd64.whl", hash = "sha256:c0502c0fadef0d23b128605d69b58edb2c681c25d44574fc673b0e52dce71ee2"}, - {file = "regex-2021.4.4-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:598585c9f0af8374c28edd609eb291b5726d7cbce16be6a8b95aa074d252ee17"}, - {file = "regex-2021.4.4-cp39-cp39-manylinux1_i686.whl", hash = "sha256:ee54ff27bf0afaf4c3b3a62bcd016c12c3fdb4ec4f413391a90bd38bc3624605"}, - {file = "regex-2021.4.4-cp39-cp39-manylinux1_x86_64.whl", hash = "sha256:7d9884d86dd4dd489e981d94a65cd30d6f07203d90e98f6f657f05170f6324c9"}, - {file = "regex-2021.4.4-cp39-cp39-manylinux2010_i686.whl", hash = "sha256:bf5824bfac591ddb2c1f0a5f4ab72da28994548c708d2191e3b87dd207eb3ad7"}, - {file = "regex-2021.4.4-cp39-cp39-manylinux2010_x86_64.whl", hash = "sha256:563085e55b0d4fb8f746f6a335893bda5c2cef43b2f0258fe1020ab1dd874df8"}, - {file = "regex-2021.4.4-cp39-cp39-manylinux2014_aarch64.whl", hash = "sha256:b9c3db21af35e3b3c05764461b262d6f05bbca08a71a7849fd79d47ba7bc33ed"}, - {file = "regex-2021.4.4-cp39-cp39-manylinux2014_i686.whl", hash = "sha256:3916d08be28a1149fb97f7728fca1f7c15d309a9f9682d89d79db75d5e52091c"}, - {file = "regex-2021.4.4-cp39-cp39-manylinux2014_x86_64.whl", hash = "sha256:fd45ff9293d9274c5008a2054ecef86a9bfe819a67c7be1afb65e69b405b3042"}, - {file = "regex-2021.4.4-cp39-cp39-win32.whl", hash = "sha256:fa4537fb4a98fe8fde99626e4681cc644bdcf2a795038533f9f711513a862ae6"}, - {file = "regex-2021.4.4-cp39-cp39-win_amd64.whl", hash = "sha256:97f29f57d5b84e73fbaf99ab3e26134e6687348e95ef6b48cfd2c06807005a07"}, - {file = "regex-2021.4.4.tar.gz", hash = "sha256:52ba3d3f9b942c49d7e4bc105bb28551c44065f139a65062ab7912bef10c9afb"}, + {file = "regex-2021.8.3-cp36-cp36m-macosx_10_9_x86_64.whl", hash = "sha256:8764a78c5464ac6bde91a8c87dd718c27c1cabb7ed2b4beaf36d3e8e390567f9"}, + {file = "regex-2021.8.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4551728b767f35f86b8e5ec19a363df87450c7376d7419c3cac5b9ceb4bce576"}, + {file = "regex-2021.8.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:577737ec3d4c195c4aef01b757905779a9e9aee608fa1cf0aec16b5576c893d3"}, + {file = "regex-2021.8.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:c856ec9b42e5af4fe2d8e75970fcc3a2c15925cbcc6e7a9bcb44583b10b95e80"}, + {file = "regex-2021.8.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:3835de96524a7b6869a6c710b26c90e94558c31006e96ca3cf6af6751b27dca1"}, + {file = "regex-2021.8.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:cea56288eeda8b7511d507bbe7790d89ae7049daa5f51ae31a35ae3c05408531"}, + {file = "regex-2021.8.3-cp36-cp36m-win32.whl", hash = "sha256:a4eddbe2a715b2dd3849afbdeacf1cc283160b24e09baf64fa5675f51940419d"}, + {file = "regex-2021.8.3-cp36-cp36m-win_amd64.whl", hash = "sha256:57fece29f7cc55d882fe282d9de52f2f522bb85290555b49394102f3621751ee"}, + {file = "regex-2021.8.3-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:a5c6dbe09aff091adfa8c7cfc1a0e83fdb8021ddb2c183512775a14f1435fe16"}, + {file = "regex-2021.8.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ff4a8ad9638b7ca52313d8732f37ecd5fd3c8e3aff10a8ccb93176fd5b3812f6"}, + {file = "regex-2021.8.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b63e3571b24a7959017573b6455e05b675050bbbea69408f35f3cb984ec54363"}, + {file = "regex-2021.8.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:fbc20975eee093efa2071de80df7f972b7b35e560b213aafabcec7c0bd00bd8c"}, + {file = "regex-2021.8.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:14caacd1853e40103f59571f169704367e79fb78fac3d6d09ac84d9197cadd16"}, + {file = "regex-2021.8.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:bb350eb1060591d8e89d6bac4713d41006cd4d479f5e11db334a48ff8999512f"}, + {file = "regex-2021.8.3-cp37-cp37m-win32.whl", hash = "sha256:18fdc51458abc0a974822333bd3a932d4e06ba2a3243e9a1da305668bd62ec6d"}, + {file = "regex-2021.8.3-cp37-cp37m-win_amd64.whl", hash = "sha256:026beb631097a4a3def7299aa5825e05e057de3c6d72b139c37813bfa351274b"}, + {file = "regex-2021.8.3-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:16d9eaa8c7e91537516c20da37db975f09ac2e7772a0694b245076c6d68f85da"}, + {file = "regex-2021.8.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3905c86cc4ab6d71635d6419a6f8d972cab7c634539bba6053c47354fd04452c"}, + {file = "regex-2021.8.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:937b20955806381e08e54bd9d71f83276d1f883264808521b70b33d98e4dec5d"}, + {file = "regex-2021.8.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:28e8af338240b6f39713a34e337c3813047896ace09d51593d6907c66c0708ba"}, + {file = "regex-2021.8.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:3c09d88a07483231119f5017904db8f60ad67906efac3f1baa31b9b7f7cca281"}, + {file = "regex-2021.8.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:85f568892422a0e96235eb8ea6c5a41c8ccbf55576a2260c0160800dbd7c4f20"}, + {file = "regex-2021.8.3-cp38-cp38-win32.whl", hash = "sha256:bf6d987edd4a44dd2fa2723fca2790f9442ae4de2c8438e53fcb1befdf5d823a"}, + {file = "regex-2021.8.3-cp38-cp38-win_amd64.whl", hash = "sha256:8fe58d9f6e3d1abf690174fd75800fda9bdc23d2a287e77758dc0e8567e38ce6"}, + {file = "regex-2021.8.3-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:7976d410e42be9ae7458c1816a416218364e06e162b82e42f7060737e711d9ce"}, + {file = "regex-2021.8.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9569da9e78f0947b249370cb8fadf1015a193c359e7e442ac9ecc585d937f08d"}, + {file = "regex-2021.8.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:459bbe342c5b2dec5c5223e7c363f291558bc27982ef39ffd6569e8c082bdc83"}, + {file = "regex-2021.8.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:4f421e3cdd3a273bace013751c345f4ebeef08f05e8c10757533ada360b51a39"}, + {file = "regex-2021.8.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ea212df6e5d3f60341aef46401d32fcfded85593af1d82b8b4a7a68cd67fdd6b"}, + {file = "regex-2021.8.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:a3b73390511edd2db2d34ff09aa0b2c08be974c71b4c0505b4a048d5dc128c2b"}, + {file = "regex-2021.8.3-cp39-cp39-win32.whl", hash = "sha256:f35567470ee6dbfb946f069ed5f5615b40edcbb5f1e6e1d3d2b114468d505fc6"}, + {file = "regex-2021.8.3-cp39-cp39-win_amd64.whl", hash = "sha256:bfa6a679410b394600eafd16336b2ce8de43e9b13f7fb9247d84ef5ad2b45e91"}, + {file = "regex-2021.8.3.tar.gz", hash = "sha256:8935937dad2c9b369c3d932b0edbc52a62647c2afb2fafc0c280f14a8bf56a6a"}, ] requests = [ - {file = "requests-2.24.0-py2.py3-none-any.whl", hash = "sha256:fe75cc94a9443b9246fc7049224f75604b113c36acb93f87b80ed42c44cbb898"}, - {file = "requests-2.24.0.tar.gz", hash = "sha256:b3559a131db72c33ee969480840fff4bb6dd111de7dd27c8ee1f820f4f00231b"}, + {file = "requests-2.26.0-py2.py3-none-any.whl", hash = "sha256:6c1246513ecd5ecd4528a0906f910e8f0f9c6b8ec72030dc9fd154dc1a6efd24"}, + {file = "requests-2.26.0.tar.gz", hash = "sha256:b8aa58f8cf793ffd8782d3d8cb19e66ef36f7aba4353eec859e74678b01b07a7"}, ] "ruamel.yaml" = [ - {file = "ruamel.yaml-0.17.2-py3-none-any.whl", hash = "sha256:0850def9ebca23b3a8c64c4b4115ebb6b364a10d49f89d289a26ee965e1e7d9d"}, - {file = "ruamel.yaml-0.17.2.tar.gz", hash = "sha256:8f1e15421668b9edf30ed02899f5f81aff9808a4271935776f61a99a569a13da"}, + {file = "ruamel.yaml-0.17.10-py3-none-any.whl", hash = "sha256:ffb9b703853e9e8b7861606dfdab1026cf02505bade0653d1880f4b2db47f815"}, + {file = "ruamel.yaml-0.17.10.tar.gz", hash = "sha256:106bc8d6dc6a0ff7c9196a47570432036f41d556b779c6b4e618085f57e39e67"}, ] "ruamel.yaml.clib" = [ - {file = "ruamel.yaml.clib-0.2.2-cp27-cp27m-macosx_10_9_x86_64.whl", hash = "sha256:28116f204103cb3a108dfd37668f20abe6e3cafd0d3fd40dba126c732457b3cc"}, - {file = "ruamel.yaml.clib-0.2.2-cp27-cp27m-manylinux1_x86_64.whl", hash = "sha256:daf21aa33ee9b351f66deed30a3d450ab55c14242cfdfcd377798e2c0d25c9f1"}, - {file = "ruamel.yaml.clib-0.2.2-cp27-cp27m-win32.whl", hash = "sha256:30dca9bbcbb1cc858717438218d11eafb78666759e5094dd767468c0d577a7e7"}, - {file = "ruamel.yaml.clib-0.2.2-cp27-cp27m-win_amd64.whl", hash = "sha256:f6061a31880c1ed6b6ce341215336e2f3d0c1deccd84957b6fa8ca474b41e89f"}, - {file = "ruamel.yaml.clib-0.2.2-cp27-cp27mu-manylinux1_x86_64.whl", hash = "sha256:73b3d43e04cc4b228fa6fa5d796409ece6fcb53a6c270eb2048109cbcbc3b9c2"}, - {file = "ruamel.yaml.clib-0.2.2-cp35-cp35m-macosx_10_6_intel.whl", hash = "sha256:53b9dd1abd70e257a6e32f934ebc482dac5edb8c93e23deb663eac724c30b026"}, - {file = "ruamel.yaml.clib-0.2.2-cp35-cp35m-manylinux1_x86_64.whl", hash = "sha256:839dd72545ef7ba78fd2aa1a5dd07b33696adf3e68fae7f31327161c1093001b"}, - {file = "ruamel.yaml.clib-0.2.2-cp35-cp35m-manylinux2014_aarch64.whl", hash = "sha256:1236df55e0f73cd138c0eca074ee086136c3f16a97c2ac719032c050f7e0622f"}, - {file = "ruamel.yaml.clib-0.2.2-cp35-cp35m-win32.whl", hash = "sha256:b1e981fe1aff1fd11627f531524826a4dcc1f26c726235a52fcb62ded27d150f"}, - {file = "ruamel.yaml.clib-0.2.2-cp35-cp35m-win_amd64.whl", hash = "sha256:4e52c96ca66de04be42ea2278012a2342d89f5e82b4512fb6fb7134e377e2e62"}, - {file = "ruamel.yaml.clib-0.2.2-cp36-cp36m-macosx_10_9_x86_64.whl", hash = "sha256:a873e4d4954f865dcb60bdc4914af7eaae48fb56b60ed6daa1d6251c72f5337c"}, - {file = "ruamel.yaml.clib-0.2.2-cp36-cp36m-manylinux1_x86_64.whl", hash = "sha256:ab845f1f51f7eb750a78937be9f79baea4a42c7960f5a94dde34e69f3cce1988"}, - {file = "ruamel.yaml.clib-0.2.2-cp36-cp36m-manylinux2014_aarch64.whl", hash = "sha256:2fd336a5c6415c82e2deb40d08c222087febe0aebe520f4d21910629018ab0f3"}, - {file = "ruamel.yaml.clib-0.2.2-cp36-cp36m-win32.whl", hash = "sha256:e9f7d1d8c26a6a12c23421061f9022bb62704e38211fe375c645485f38df34a2"}, - {file = "ruamel.yaml.clib-0.2.2-cp36-cp36m-win_amd64.whl", hash = "sha256:2602e91bd5c1b874d6f93d3086f9830f3e907c543c7672cf293a97c3fabdcd91"}, - {file = "ruamel.yaml.clib-0.2.2-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:44c7b0498c39f27795224438f1a6be6c5352f82cb887bc33d962c3a3acc00df6"}, - {file = "ruamel.yaml.clib-0.2.2-cp37-cp37m-manylinux1_x86_64.whl", hash = "sha256:8e8fd0a22c9d92af3a34f91e8a2594eeb35cba90ab643c5e0e643567dc8be43e"}, - {file = "ruamel.yaml.clib-0.2.2-cp37-cp37m-manylinux2014_aarch64.whl", hash = "sha256:75f0ee6839532e52a3a53f80ce64925ed4aed697dd3fa890c4c918f3304bd4f4"}, - {file = "ruamel.yaml.clib-0.2.2-cp37-cp37m-win32.whl", hash = "sha256:464e66a04e740d754170be5e740657a3b3b6d2bcc567f0c3437879a6e6087ff6"}, - {file = "ruamel.yaml.clib-0.2.2-cp37-cp37m-win_amd64.whl", hash = "sha256:52ae5739e4b5d6317b52f5b040b1b6639e8af68a5b8fd606a8b08658fbd0cab5"}, - {file = "ruamel.yaml.clib-0.2.2-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:4df5019e7783d14b79217ad9c56edf1ba7485d614ad5a385d1b3c768635c81c0"}, - {file = "ruamel.yaml.clib-0.2.2-cp38-cp38-manylinux1_x86_64.whl", hash = "sha256:5254af7d8bdf4d5484c089f929cb7f5bafa59b4f01d4f48adda4be41e6d29f99"}, - {file = "ruamel.yaml.clib-0.2.2-cp38-cp38-manylinux2014_aarch64.whl", hash = "sha256:8be05be57dc5c7b4a0b24edcaa2f7275866d9c907725226cdde46da09367d923"}, - {file = "ruamel.yaml.clib-0.2.2-cp38-cp38-win32.whl", hash = "sha256:74161d827407f4db9072011adcfb825b5258a5ccb3d2cd518dd6c9edea9e30f1"}, - {file = "ruamel.yaml.clib-0.2.2-cp38-cp38-win_amd64.whl", hash = "sha256:058a1cc3df2a8aecc12f983a48bda99315cebf55a3b3a5463e37bb599b05727b"}, - {file = "ruamel.yaml.clib-0.2.2-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:c6ac7e45367b1317e56f1461719c853fd6825226f45b835df7436bb04031fd8a"}, - {file = "ruamel.yaml.clib-0.2.2-cp39-cp39-manylinux1_x86_64.whl", hash = "sha256:b4b0d31f2052b3f9f9b5327024dc629a253a83d8649d4734ca7f35b60ec3e9e5"}, - {file = "ruamel.yaml.clib-0.2.2-cp39-cp39-manylinux2014_aarch64.whl", hash = "sha256:1f8c0a4577c0e6c99d208de5c4d3fd8aceed9574bb154d7a2b21c16bb924154c"}, - {file = "ruamel.yaml.clib-0.2.2-cp39-cp39-win32.whl", hash = "sha256:46d6d20815064e8bb023ea8628cfb7402c0f0e83de2c2227a88097e239a7dffd"}, - {file = "ruamel.yaml.clib-0.2.2-cp39-cp39-win_amd64.whl", hash = "sha256:6c0a5dc52fc74eb87c67374a4e554d4761fd42a4d01390b7e868b30d21f4b8bb"}, - {file = "ruamel.yaml.clib-0.2.2.tar.gz", hash = "sha256:2d24bd98af676f4990c4d715bcdc2a60b19c56a3fb3a763164d2d8ca0e806ba7"}, + {file = "ruamel.yaml.clib-0.2.6-cp35-cp35m-macosx_10_6_intel.whl", hash = "sha256:cfdb9389d888c5b74af297e51ce357b800dd844898af9d4a547ffc143fa56751"}, + {file = "ruamel.yaml.clib-0.2.6-cp35-cp35m-manylinux1_x86_64.whl", hash = "sha256:7b2927e92feb51d830f531de4ccb11b320255ee95e791022555971c466af4527"}, + {file = "ruamel.yaml.clib-0.2.6-cp35-cp35m-win32.whl", hash = "sha256:ada3f400d9923a190ea8b59c8f60680c4ef8a4b0dfae134d2f2ff68429adfab5"}, + {file = "ruamel.yaml.clib-0.2.6-cp35-cp35m-win_amd64.whl", hash = "sha256:de9c6b8a1ba52919ae919f3ae96abb72b994dd0350226e28f3686cb4f142165c"}, + {file = "ruamel.yaml.clib-0.2.6-cp36-cp36m-macosx_10_9_x86_64.whl", hash = "sha256:d67f273097c368265a7b81e152e07fb90ed395df6e552b9fa858c6d2c9f42502"}, + {file = "ruamel.yaml.clib-0.2.6-cp36-cp36m-manylinux1_x86_64.whl", hash = "sha256:72a2b8b2ff0a627496aad76f37a652bcef400fd861721744201ef1b45199ab78"}, + {file = "ruamel.yaml.clib-0.2.6-cp36-cp36m-win32.whl", hash = "sha256:9efef4aab5353387b07f6b22ace0867032b900d8e91674b5d8ea9150db5cae94"}, + {file = "ruamel.yaml.clib-0.2.6-cp36-cp36m-win_amd64.whl", hash = "sha256:846fc8336443106fe23f9b6d6b8c14a53d38cef9a375149d61f99d78782ea468"}, + {file = "ruamel.yaml.clib-0.2.6-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:0847201b767447fc33b9c235780d3aa90357d20dd6108b92be544427bea197dd"}, + {file = "ruamel.yaml.clib-0.2.6-cp37-cp37m-manylinux1_x86_64.whl", hash = "sha256:78988ed190206672da0f5d50c61afef8f67daa718d614377dcd5e3ed85ab4a99"}, + {file = "ruamel.yaml.clib-0.2.6-cp37-cp37m-win32.whl", hash = "sha256:a49e0161897901d1ac9c4a79984b8410f450565bbad64dbfcbf76152743a0cdb"}, + {file = "ruamel.yaml.clib-0.2.6-cp37-cp37m-win_amd64.whl", hash = "sha256:bf75d28fa071645c529b5474a550a44686821decebdd00e21127ef1fd566eabe"}, + {file = "ruamel.yaml.clib-0.2.6-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:a32f8d81ea0c6173ab1b3da956869114cae53ba1e9f72374032e33ba3118c233"}, + {file = "ruamel.yaml.clib-0.2.6-cp38-cp38-manylinux1_x86_64.whl", hash = "sha256:7f7ecb53ae6848f959db6ae93bdff1740e651809780822270eab111500842a84"}, + {file = "ruamel.yaml.clib-0.2.6-cp38-cp38-win32.whl", hash = "sha256:89221ec6d6026f8ae859c09b9718799fea22c0e8da8b766b0b2c9a9ba2db326b"}, + {file = "ruamel.yaml.clib-0.2.6-cp38-cp38-win_amd64.whl", hash = "sha256:31ea73e564a7b5fbbe8188ab8b334393e06d997914a4e184975348f204790277"}, + {file = "ruamel.yaml.clib-0.2.6-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:dc6a613d6c74eef5a14a214d433d06291526145431c3b964f5e16529b1842bed"}, + {file = "ruamel.yaml.clib-0.2.6-cp39-cp39-manylinux1_x86_64.whl", hash = "sha256:1866cf2c284a03b9524a5cc00daca56d80057c5ce3cdc86a52020f4c720856f0"}, + {file = "ruamel.yaml.clib-0.2.6-cp39-cp39-win32.whl", hash = "sha256:3fb9575a5acd13031c57a62cc7823e5d2ff8bc3835ba4d94b921b4e6ee664104"}, + {file = "ruamel.yaml.clib-0.2.6-cp39-cp39-win_amd64.whl", hash = "sha256:825d5fccef6da42f3c8eccd4281af399f21c02b32d98e113dbc631ea6a6ecbc7"}, + {file = "ruamel.yaml.clib-0.2.6.tar.gz", hash = "sha256:4ff604ce439abb20794f05613c374759ce10e3595d1867764dd1ae675b85acbd"}, ] six = [ {file = "six-1.15.0-py2.py3-none-any.whl", hash = "sha256:8b74bedcbbbaca38ff6d7491d76f2b06b3592611af620f8426e82dddb04a5ced"}, @@ -1501,8 +1490,8 @@ toml = [ {file = "toml-0.10.1.tar.gz", hash = "sha256:926b612be1e5ce0634a2ca03470f95169cf16f939018233a670519cb4ac58b0f"}, ] tomli = [ - {file = "tomli-1.0.4-py3-none-any.whl", hash = "sha256:0713b16ff91df8638a6a694e295c8159ab35ba93e3424a626dd5226d386057be"}, - {file = "tomli-1.0.4.tar.gz", hash = "sha256:be670d0d8d7570fd0ea0113bd7bb1ba3ac6706b4de062cc4c952769355c9c268"}, + {file = "tomli-1.2.1-py3-none-any.whl", hash = "sha256:8dd0e9524d6f386271a36b41dbf6c57d8e32fd96fd22b6584679dc569d20899f"}, + {file = "tomli-1.2.1.tar.gz", hash = "sha256:a5b75cb6f3968abb47af1b40c1819dc519ea82bcc065776a866e8d74c5ca9442"}, ] typed-ast = [ {file = "typed_ast-1.4.3-cp35-cp35m-manylinux1_i686.whl", hash = "sha256:2068531575a125b87a41802130fa7e29f26c09a2833fea68d9a40cf33902eba6"}, @@ -1537,29 +1526,29 @@ typed-ast = [ {file = "typed_ast-1.4.3.tar.gz", hash = "sha256:fb1bbeac803adea29cedd70781399c99138358c26d05fcbd23c13016b7f5ec65"}, ] types-mock = [ - {file = "types-mock-0.1.3.tar.gz", hash = "sha256:9bdafab236c0530fed36dbf18bc942633b2033bfda16551b2e4eb767341a8b8c"}, - {file = "types_mock-0.1.3-py2.py3-none-any.whl", hash = "sha256:e052879bb0a7d78547cce3342ffdf4ec3e8d2eff8f237911c3c8e31ac7ea8c86"}, + {file = "types-mock-0.1.5.tar.gz", hash = "sha256:5a658d21068487af0eac0e207a51f9df8b03ba9dbfdb3a19d679fef3d49578a5"}, + {file = "types_mock-0.1.5-py3-none-any.whl", hash = "sha256:117be0fcbcc8dddc49b966999e8126f67a7a83904627d5cf2d1c3fb4fb620527"}, ] types-pytz = [ - {file = "types-pytz-2021.1.0.tar.gz", hash = "sha256:addfa2a1a27b324b6beb422faa4737962532bbab3793481d5bdebbffb8f9f243"}, - {file = "types_pytz-2021.1.0-py3-none-any.whl", hash = "sha256:ec9555397f91518b2cf028ed837a69e388763c6a5e58abffaf37732f9c581a46"}, + {file = "types-pytz-2021.1.2.tar.gz", hash = "sha256:448828a06f2aaa840e57364d866c661645a045e532f817e4f10c8c3ab2b66651"}, + {file = "types_pytz-2021.1.2-py3-none-any.whl", hash = "sha256:28fb1c0f77f59aebe9b792d073ebfbbbf7b329f9d4af6a6079713a618a1c0f31"}, ] types-redis = [ - {file = "types-redis-3.5.4.tar.gz", hash = "sha256:936e98f9090c11610f4f5171d2ca8fa5c5eab842422b3cc2f9355f57d01e1a6b"}, - {file = "types_redis-3.5.4-py3-none-any.whl", hash = "sha256:954feb1f573216b215c1d564c1b27091a7ce8b7fd3af9474d9e88d4081881aff"}, + {file = "types-redis-3.5.6.tar.gz", hash = "sha256:5a1e59462ec596f8e9a2388907d26a0270b8c968be0645e7cc2d29df1003837b"}, + {file = "types_redis-3.5.6-py3-none-any.whl", hash = "sha256:9b01c5b693e770cd31905d50c01a4c9cb8413cb7716ec36e4a3e20f7c878bd18"}, ] types-requests = [ - {file = "types-requests-2.25.0.tar.gz", hash = "sha256:ee0d0c507210141b7d5b8639cc43eaa726084178775db2a5fb06fbf85c185808"}, - {file = "types_requests-2.25.0-py3-none-any.whl", hash = "sha256:fa5c1e5e832ff6193507d8da7e1159281383908ee193a2f4b37bc08140b51844"}, + {file = "types-requests-2.25.6.tar.gz", hash = "sha256:e21541c0f55c066c491a639309159556dd8c5833e49fcde929c4c47bdb0002ee"}, + {file = "types_requests-2.25.6-py3-none-any.whl", hash = "sha256:a5a305b43ea57bf64d6731f89816946a405b591eff6de28d4c0fd58422cee779"}, ] types-six = [ - {file = "types-six-0.1.7.tar.gz", hash = "sha256:254484e024fbef5aafd6eee80642d713e3c240e12103dbd0f41e1f602402ff35"}, - {file = "types_six-0.1.7-py2.py3-none-any.whl", hash = "sha256:ec2b7b1bcc521b3741f9317eca8fb3bfd0e39efe427231d57b37ad40af418a5e"}, + {file = "types-six-0.1.9.tar.gz", hash = "sha256:860d4ce7e24d14e7441a1118428964ccd2d100c654ef69e7ee1d137f9aaa82d6"}, + {file = "types_six-0.1.9-py2.py3-none-any.whl", hash = "sha256:659efd70c88c750d33f83857bbe83c4686e437dcdd542816825ba64f01a999f3"}, ] typing-extensions = [ - {file = "typing_extensions-3.7.4.3-py2-none-any.whl", hash = "sha256:dafc7639cde7f1b6e1acc0f457842a83e722ccca8eef5270af2d74792619a89f"}, - {file = "typing_extensions-3.7.4.3-py3-none-any.whl", hash = "sha256:7cb407020f00f7bfc3cb3e7881628838e69d8f3fcab2f64742a5e76b2f841918"}, - {file = "typing_extensions-3.7.4.3.tar.gz", hash = "sha256:99d4073b617d30288f569d3f13d2bd7548c3a7e4c8de87db09a9d29bb3a4a60c"}, + {file = "typing_extensions-3.10.0.0-py2-none-any.whl", hash = "sha256:0ac0f89795dd19de6b97debb0c6af1c70987fd80a2d62d1958f7e56fcc31b497"}, + {file = "typing_extensions-3.10.0.0-py3-none-any.whl", hash = "sha256:779383f6086d90c99ae41cf0ff39aac8a7937a9283ce0a414e5dd782f4c94a84"}, + {file = "typing_extensions-3.10.0.0.tar.gz", hash = "sha256:50b6f157849174217d0656f99dc82fe932884fb250826c18350e159ec6cdf342"}, ] uritemplate = [ {file = "uritemplate-3.0.1-py2.py3-none-any.whl", hash = "sha256:07620c3f3f8eed1f12600845892b0e036a2420acf513c53f7de0abd911a5894f"}, @@ -1578,6 +1567,6 @@ whitenoise = [ {file = "whitenoise-5.1.0.tar.gz", hash = "sha256:60154b976a13901414a25b0273a841145f77eb34a141f9ae032a0ace3e4d5b27"}, ] zipp = [ - {file = "zipp-3.4.1-py3-none-any.whl", hash = "sha256:51cb66cc54621609dd593d1787f286ee42a5c0adbb4b29abea5a63edc3e03098"}, - {file = "zipp-3.4.1.tar.gz", hash = "sha256:3607921face881ba3e026887d8150cca609d517579abe052ac81fc5aeffdbd76"}, + {file = "zipp-3.5.0-py3-none-any.whl", hash = "sha256:957cfda87797e389580cb8b9e3870841ca991e2125350677b2ca83a0e99390a3"}, + {file = "zipp-3.5.0.tar.gz", hash = "sha256:f5812b1e007e48cff63449a5e9f4e7ebea716b4111f9c4f9a645f91d579bf0c4"}, ] diff --git a/saas/pyproject.toml b/saas/pyproject.toml index 823505b95..453ca9f5b 100644 --- a/saas/pyproject.toml +++ b/saas/pyproject.toml @@ -73,7 +73,7 @@ Django = "2.2.24" mysqlclient = "2.0.1" MarkupSafe = "1.0" Mako = "1.0.6" -requests = "2.24.0" +requests = "2.26.0" celery = "3.1.25" django-celery = "3.2.1" python-json-logger = "0.1.7" @@ -102,7 +102,6 @@ django-redis = "4.12.1" django-mptt = "0.11.0" # profile record pyinstrument = "3.1.3" -urllib3 = "1.26.5" [tool.poetry.dev-dependencies] # For flake8 support pyproject.toml diff --git a/saas/requirements.txt b/saas/requirements.txt index 68c543f24..65a5c1ec7 100644 --- a/saas/requirements.txt +++ b/saas/requirements.txt @@ -3,12 +3,14 @@ amqp==1.4.9 anyjson==0.3.3 billiard==3.3.0.23 celery==3.1.25 -certifi==2020.12.5; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" -chardet==3.0.4; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" +certifi==2021.5.30; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.6.0" +cffi==1.14.6; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" +charset-normalizer==2.0.4; python_full_version >= "3.6.0" and python_version >= "3" coreapi==2.3.3; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" coreschema==0.0.4; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" +cryptography==3.2; (python_version >= "2.7" and python_full_version < "3.0.0") or (python_full_version >= "3.5.0") dataclasses==0.7; python_version >= "3.6" and python_version < "3.7" -decorator==5.0.5; python_version >= "3.5" +decorator==5.0.9; python_version >= "3.5" django-celery==3.2.1 django-cors-headers==3.4.0; python_version >= "3.5" django-filter==2.3.0; python_version >= "3.5" @@ -17,10 +19,11 @@ django-mptt==0.11.0; python_version >= "3.5" django-prometheus==2.0.0 django-redis==4.12.1; python_version >= "3.5" django==2.2.24; python_version >= "3.5" -djangorestframework==3.11.0; python_version >= "3.5" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3.5" +djangorestframework==3.11.2; python_version >= "3.5" dogpile.cache==0.9.2 drf-yasg==1.17.1; (python_version >= "2.7" and python_full_version < "3.0.0") or (python_full_version >= "3.5.0") -idna==2.10; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" +httplib2==0.19.0 +idna==2.10; python_version >= "3" and python_full_version < "3.0.0" or python_full_version >= "3.6.0" and python_version >= "3" inflection==0.5.1; python_version >= "3.5" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3.5" itypes==1.2.0; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" jinja2==2.11.3; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" @@ -28,21 +31,23 @@ kombu==3.0.37 mako==1.0.6 markupsafe==1.0 mysqlclient==2.0.1; python_version >= "3.5" -packaging==20.9; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" -prometheus-client==0.10.0; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.4.0" +packaging==21.0; python_version >= "3.6" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3.6" +prometheus-client==0.11.0; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.4.0" +pycparser==2.20; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" +pydantic==1.6.2; python_version >= "3.6" pyinstrument-cext==0.2.4 pyinstrument==3.1.3 pyjwt==1.7.1 -pyparsing==2.4.7; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" +pyparsing==2.4.7; python_version >= "3.6" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3.6" python-json-logger==0.1.7 pytz==2020.1 redis==3.5.3; (python_version >= "2.7" and python_full_version < "3.0.0") or (python_full_version >= "3.5.0") -requests==2.24.0; (python_version >= "2.7" and python_full_version < "3.0.0") or (python_full_version >= "3.5.0") -ruamel.yaml.clib==0.2.2; platform_python_implementation == "CPython" and python_version < "3.10" and (python_version >= "3" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3") -ruamel.yaml==0.17.2; python_version >= "3" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3" +requests==2.26.0; (python_version >= "2.7" and python_full_version < "3.0.0") or (python_full_version >= "3.6.0") +ruamel.yaml.clib==0.2.6; platform_python_implementation == "CPython" and python_version < "3.10" and (python_version >= "3" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3") and python_version >= "3.5" +ruamel.yaml==0.17.10; python_version >= "3" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3" six==1.15.0; (python_version >= "2.7" and python_full_version < "3.0.0") or (python_full_version >= "3.3.0") sqlparse==0.4.1; python_version >= "3.5" uritemplate==3.0.1; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" -urllib3==1.25.11; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version < "4" +urllib3==1.25.11; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.6.0" and python_version < "4" werkzeug==1.0.1; (python_version >= "2.7" and python_full_version < "3.0.0") or (python_full_version >= "3.5.0") whitenoise==5.1.0; python_version >= "3.5" and python_version < "4" diff --git a/saas/requirements_dev.txt b/saas/requirements_dev.txt index 47926bfc4..eaf8a88e4 100644 --- a/saas/requirements_dev.txt +++ b/saas/requirements_dev.txt @@ -3,19 +3,21 @@ amqp==1.4.9 anyjson==0.3.3 appdirs==1.4.4; python_full_version >= "3.6.2" atomicwrites==1.4.0; python_version >= "3.6" and python_full_version < "3.0.0" and sys_platform == "win32" or sys_platform == "win32" and python_version >= "3.6" and python_full_version >= "3.4.0" -attrs==20.3.0; python_version >= "3.6" and python_full_version < "3.0.0" or python_full_version >= "3.4.0" and python_version >= "3.6" +attrs==21.2.0; python_version >= "3.6" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3.6" billiard==3.3.0.23 black==21.7b0; python_full_version >= "3.6.2" celery==3.1.25 -certifi==2020.12.5; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" -chardet==3.0.4; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" -click==8.0.0; python_version >= "3.6" and python_full_version >= "3.6.2" +certifi==2021.5.30; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.6.0" +cffi==1.14.6; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" +charset-normalizer==2.0.4; python_full_version >= "3.6.0" and python_version >= "3" +click==8.0.1; python_version >= "3.6" and python_full_version >= "3.6.2" colorama==0.4.4; sys_platform == "win32" and python_version >= "3.6" and python_full_version >= "3.6.2" and platform_system == "Windows" converge==0.9.8 coreapi==2.3.3; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" coreschema==0.0.4; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" +cryptography==3.2; (python_version >= "2.7" and python_full_version < "3.0.0") or (python_full_version >= "3.5.0") dataclasses==0.7; python_version >= "3.6" and python_version < "3.7" -decorator==5.0.5; python_version >= "3.5" +decorator==5.0.9; python_version >= "3.5" django-celery==3.2.1 django-cors-headers==3.4.0; python_version >= "3.5" django-dynamic-fixture==3.1.1 @@ -25,16 +27,17 @@ django-mptt==0.11.0; python_version >= "3.5" django-prometheus==2.0.0 django-redis==4.12.1; python_version >= "3.5" django==2.2.24; python_version >= "3.5" -djangorestframework==3.11.0; python_version >= "3.5" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3.5" +djangorestframework==3.11.2; python_version >= "3.5" dogpile.cache==0.9.2 drf-yasg==1.17.1; (python_version >= "2.7" and python_full_version < "3.0.0") or (python_full_version >= "3.5.0") flake8-comprehensions==3.5.0; python_version >= "3.6" flake8==3.9.2; python_version >= "3.6" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3.6" -idna==2.10; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" -importlib-metadata==3.10.0; python_version < "3.8" and python_version >= "3.6" and (python_version >= "3.6" and python_full_version < "3.0.0" and python_version < "3.8" or python_full_version >= "3.5.0" and python_version < "3.8" and python_version >= "3.6") and (python_version >= "3.6" and python_full_version < "3.0.0" and python_version < "3.8" or python_full_version >= "3.4.0" and python_version >= "3.6" and python_version < "3.8") +httplib2==0.19.0 +idna==2.10; python_version >= "3" and python_full_version < "3.0.0" or python_full_version >= "3.6.0" and python_version >= "3" +importlib-metadata==4.6.3; python_version < "3.8" and python_version >= "3.6" and (python_version >= "3.6" and python_full_version < "3.0.0" and python_version < "3.8" or python_full_version >= "3.5.0" and python_version < "3.8" and python_version >= "3.6") and (python_version >= "3.6" and python_full_version < "3.0.0" and python_version < "3.8" or python_full_version >= "3.4.0" and python_version >= "3.6" and python_version < "3.8") and python_full_version >= "3.6.2" inflection==0.5.1; python_version >= "3.5" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3.5" iniconfig==1.1.1; python_version >= "3.6" -isort==5.9.2; python_full_version >= "3.6.1" and python_version < "4.0" +isort==5.9.3; python_full_version >= "3.6.1" and python_version < "4.0" itypes==1.2.0; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" jinja2==2.11.3; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" kombu==3.0.37 @@ -45,40 +48,42 @@ mock==1.0.1 mypy-extensions==0.4.3; python_full_version >= "3.6.2" and python_version >= "3.5" mypy==0.910; python_version >= "3.5" mysqlclient==2.0.1; python_version >= "3.5" -packaging==20.9; python_version >= "3.6" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3.6" -pathspec==0.8.1; python_full_version >= "3.6.2" +packaging==21.0; python_version >= "3.6" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3.6" +pathspec==0.9.0; python_full_version >= "3.6.2" pluggy==0.13.1; python_version >= "3.6" and python_full_version < "3.0.0" or python_full_version >= "3.4.0" and python_version >= "3.6" -prometheus-client==0.10.0; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.4.0" +prometheus-client==0.11.0; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.4.0" py==1.10.0; python_version >= "3.6" and python_full_version < "3.0.0" or python_full_version >= "3.4.0" and python_version >= "3.6" pycodestyle==2.7.0; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" +pycparser==2.20; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" +pydantic==1.6.2; python_version >= "3.6" pyflakes==2.3.1; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" pyinstrument-cext==0.2.4 pyinstrument==3.1.3 pyjwt==1.7.1 -pyparsing==2.4.7; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" +pyparsing==2.4.7; python_version >= "3.6" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3.6" pyproject-flake8==0.0.1a2 pytest-django==4.1.0; python_version >= "3.5" pytest==6.2.2; python_version >= "3.6" python-json-logger==0.1.7 pytz==2020.1 redis==3.5.3; (python_version >= "2.7" and python_full_version < "3.0.0") or (python_full_version >= "3.5.0") -regex==2021.4.4; python_full_version >= "3.6.2" -requests==2.24.0; (python_version >= "2.7" and python_full_version < "3.0.0") or (python_full_version >= "3.5.0") -ruamel.yaml.clib==0.2.2; platform_python_implementation == "CPython" and python_version < "3.10" and (python_version >= "3" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3") -ruamel.yaml==0.17.2; python_version >= "3" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3" +regex==2021.8.3; python_full_version >= "3.6.2" +requests==2.26.0; (python_version >= "2.7" and python_full_version < "3.0.0") or (python_full_version >= "3.6.0") +ruamel.yaml.clib==0.2.6; platform_python_implementation == "CPython" and python_version < "3.10" and (python_version >= "3" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3") and python_version >= "3.5" +ruamel.yaml==0.17.10; python_version >= "3" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3" six==1.15.0; (python_version >= "2.7" and python_full_version < "3.0.0") or (python_full_version >= "3.3.0") sqlparse==0.4.1; python_version >= "3.5" toml==0.10.1 -tomli==1.0.4; python_version >= "3.6" and python_full_version >= "3.6.2" +tomli==1.2.1; python_version >= "3.6" and python_full_version >= "3.6.2" typed-ast==1.4.3; python_version < "3.8" and python_full_version >= "3.6.2" and python_version >= "3.5" -types-mock==0.1.3 -types-pytz==2021.1.0 -types-redis==3.5.4 -types-requests==2.25.0 -types-six==0.1.7 -typing-extensions==3.7.4.3; python_version < "3.8" and python_full_version >= "3.6.2" and python_version >= "3.6" +types-mock==0.1.5 +types-pytz==2021.1.2 +types-redis==3.5.6 +types-requests==2.25.6 +types-six==0.1.9 +typing-extensions==3.10.0.0; python_version < "3.8" and python_full_version >= "3.6.2" and python_version >= "3.6" uritemplate==3.0.1; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" -urllib3==1.25.11; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version < "4" +urllib3==1.25.11; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.6.0" and python_version < "4" werkzeug==1.0.1; (python_version >= "2.7" and python_full_version < "3.0.0") or (python_full_version >= "3.5.0") whitenoise==5.1.0; python_version >= "3.5" and python_version < "4" -zipp==3.4.1; python_version < "3.8" and python_version >= "3.6" +zipp==3.5.0; python_version < "3.8" and python_version >= "3.6" From 84824960195e21fd669453b3caabe9d91bbe18ea Mon Sep 17 00:00:00 2001 From: zhu327 Date: Mon, 16 Aug 2021 10:50:35 +0800 Subject: [PATCH 08/33] mod comment --- saas/config/default.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/saas/config/default.py b/saas/config/default.py index 6cd88b91b..732af6937 100644 --- a/saas/config/default.py +++ b/saas/config/default.py @@ -182,11 +182,11 @@ }, "periodic_user_group_policy_expire_remind": { "task": "backend.apps.user.tasks.user_group_policy_expire_remind", - "schedule": crontab(minute=0, hour=11), # 每天凌晨11时执行 + "schedule": crontab(minute=0, hour=11), # 每天早上11时执行 }, "periodic_role_group_expire_remind": { "task": "backend.apps.role.tasks.role_group_expire_remind", - "schedule": crontab(minute=0, hour=11), # 每天凌晨11时执行 + "schedule": crontab(minute=0, hour=11), # 每天早上11时执行 }, "periodic_user_expired_policy_cleanup": { "task": "backend.apps.user.tasks.user_cleanup_expired_policy", From 3a36afb1b5b037c6d374e5667505fc3e628f1f0f Mon Sep 17 00:00:00 2001 From: ielgnaw Date: Tue, 17 Aug 2021 11:19:55 +0800 Subject: [PATCH 09/33] fix: remove useless code --- frontend/package.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/frontend/package.json b/frontend/package.json index 49bf76979..ffb9b47c0 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -47,14 +47,14 @@ } }, "build:ce": { - "command": "npm run clean:ce && npm run dll && babel-node build/build.js && babel-node build/replace-internal-info.js", + "command": "npm run clean:ce && npm run dll && babel-node build/build.js", "env": { "NODE_ENV": "production", "VERSION": "ce" } }, "build:ee": { - "command": "npm run clean:ee && npm run dll && babel-node build/build.js && babel-node build/replace-internal-info.js", + "command": "npm run clean:ee && npm run dll && babel-node build/build.js", "env": { "NODE_ENV": "production", "VERSION": "ee" From 3f4c46b6d7d44df3732776000bb84d59d169eeac Mon Sep 17 00:00:00 2001 From: wklken Date: Tue, 17 Aug 2021 16:57:04 +0800 Subject: [PATCH 10/33] fix(modeling_builder): bugfix: action_id check in common_actions; update the validator message --- saas/backend/apps/model_builder/validators.py | 35 +++++++++++++++---- saas/backend/apps/model_builder/views.py | 4 +-- 2 files changed, 31 insertions(+), 8 deletions(-) diff --git a/saas/backend/apps/model_builder/validators.py b/saas/backend/apps/model_builder/validators.py index 841b31f25..753d23067 100644 --- a/saas/backend/apps/model_builder/validators.py +++ b/saas/backend/apps/model_builder/validators.py @@ -11,6 +11,8 @@ from collections import defaultdict from typing import Dict, List, Tuple +from django.utils.translation import gettext as _ + from backend.apps.model_builder.constants import ModelSectionEnum from backend.apps.model_builder.models import MockSystemModel from backend.common.error_codes import error_codes @@ -173,7 +175,8 @@ def _get_actions_from_common_actions(data: Dict) -> List[str]: actions = [] for d in common_actions: actions.extend(d.get("actions", [])) - return actions + + return [a["id"] for a in actions] def _get_actions_from_action_groups(data: Dict) -> List[str]: @@ -245,17 +248,37 @@ def validate_delete_part(_id: str, _type: str, _type_id: str): if _type == ModelSectionEnum.ACTION.value: # common_actions if _type_id in _get_actions_from_common_actions(data): - raise error_codes.VALIDATE_ERROR.format(f"the id={_type_id} is referenced in common_actions") + raise error_codes.VALIDATE_ERROR.format( + _("操作(action) id={_type_id} 在常用操作(common_actions)中被引用").format( + _type_id=_type_id, + ) + ) if _type_id in _get_actions_from_action_groups(data): - raise error_codes.VALIDATE_ERROR.format(f"the id={_type_id} is referenced in action_groups") + raise error_codes.VALIDATE_ERROR.format( + _("操作(action) id={_type_id} 在操作组(action_groups)中被引用").format( + _type_id=_type_id, + ) + ) elif _type == ModelSectionEnum.INSTANCE_SELECTION.value: if (model.system_id, _type_id) in _get_instance_selections_from_action(data): - raise error_codes.VALIDATE_ERROR.format(f"the id={_type_id} is referenced in action") + raise error_codes.VALIDATE_ERROR.format( + _("实例视图(instance_selection) id={_type_id} 在操作(action)中被引用").format( + _type_id=_type_id, + ) + ) elif _type == ModelSectionEnum.RESOURCE_TYPE.value: if (model.system_id, _type_id) in _get_resource_type_from_instance_selection(data): - raise error_codes.VALIDATE_ERROR.format(f"the id={_type_id} is referenced in instance_selection") + raise error_codes.VALIDATE_ERROR.format( + _("资源类型(resource_type) id={_type_id} 在实例视图(instance_selection)中被引用").format( + _type_id=_type_id, + ) + ) if (model.system_id, _type_id) in _get_resource_types_from_action(data): - raise error_codes.VALIDATE_ERROR.format(f"the id={_type_id} is referenced in action") + raise error_codes.VALIDATE_ERROR.format( + _("资源类型(resource_type) id={_type_id} 在操作(action)中被引用").format( + _type_id=_type_id, + ) + ) diff --git a/saas/backend/apps/model_builder/views.py b/saas/backend/apps/model_builder/views.py index 4e303f780..909a178e2 100644 --- a/saas/backend/apps/model_builder/views.py +++ b/saas/backend/apps/model_builder/views.py @@ -220,7 +220,7 @@ def delete_part(self, request, *args, **kwargs): _type = body["type"] if _type == ModelSectionEnum.SYSTEM.value: - raise error_codes.VALIDATE_ERROR.format(_("system can't be delete")) + raise error_codes.VALIDATE_ERROR.format(_("系统不能被删除")) # 需要检查引用, 被引用不能删除 validate_delete_part(kwargs["id"], _type, body.get("id")) @@ -259,7 +259,7 @@ def update_part(self, request, *args, **kwargs): _type = body["type"] if _type not in type_slzs: - raise error_codes.VALIDATE_ERROR.format(_("the type not supported yet")) + raise error_codes.VALIDATE_ERROR.format(_("暂时不支持这种type")) slz_class, many = type_slzs[_type] ds = slz_class(data=body["data"], many=many) From 22880b7ab0254443d00b1a0869db06e8a5b53afc Mon Sep 17 00:00:00 2001 From: zhu327 Date: Thu, 19 Aug 2021 16:12:18 +0800 Subject: [PATCH 11/33] feat(backend/apps/role/views.py): remove role permission check when mod part role info re #58 --- saas/backend/apps/role/views.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/saas/backend/apps/role/views.py b/saas/backend/apps/role/views.py index 5bafa86a1..ff08ee4cf 100644 --- a/saas/backend/apps/role/views.py +++ b/saas/backend/apps/role/views.py @@ -95,7 +95,6 @@ class GradeManagerViewSet(mixins.ListModelMixin, GenericViewSet): action_permission = { "create": PermissionCodeEnum.CREATE_RATING_MANAGER.value, "update": PermissionCodeEnum.MANAGE_RATING_MANAGER.value, - "partial_update": PermissionCodeEnum.MANAGE_RATING_MANAGER.value, } lookup_field = "id" @@ -215,6 +214,9 @@ def partial_update(self, request, *args, **kwargs): user_id = request.user.username data = serializer.validated_data + # 名称唯一性检查 + self.role_check_biz.check_unique_name(data["name"], role.name) + # 非超级管理员 且 并非分级管理员成员，则无法更新基本信息 if ( request.role.type != RoleType.SUPER_MANAGER.value From 521b65206cbb62ac0b45908b8a1c4c50c9cba425 Mon Sep 17 00:00:00 2001 From: nannan00 <17491932+nannan00@users.noreply.github.com> Date: Tue, 24 Aug 2021 12:15:29 +0800 Subject: [PATCH 12/33] refactor(api/subject): refactor api & subject etc. and delete some uesless files (#74) --- saas/backend/api/application/views.py | 4 +- saas/backend/api/authentication.py | 28 +- saas/backend/api/authorization/audit.py | 6 +- saas/backend/api/authorization/constants.py | 28 +- saas/backend/api/authorization/mixins.py | 112 +- saas/backend/api/authorization/permissions.py | 98 ++ saas/backend/api/authorization/serializers.py | 81 +- saas/backend/api/authorization/urls.py | 23 +- saas/backend/api/authorization/utils.py | 147 -- saas/backend/api/authorization/views.py | 529 -------- .../api/authorization/views/__init__.py | 26 + .../api/authorization/views/resource.py | 207 +++ .../views/resource_creator_action.py | 185 +++ saas/backend/api/initialization/views.py | 2 +- saas/backend/api/management/permissions.py | 14 +- saas/backend/api/management/serializers.py | 2 +- .../api/management/views/application.py | 2 +- .../api/management/views/grade_manager.py | 53 +- saas/backend/api/management/views/group.py | 49 +- saas/backend/api/mixins.py | 15 +- saas/backend/apps/action/tasks.py | 4 +- .../backend/apps/action/views/action_group.py | 4 +- saas/backend/apps/application/serializers.py | 6 +- saas/backend/apps/application/views.py | 4 +- saas/backend/apps/group/constants.py | 52 - saas/backend/apps/group/serializers.py | 13 +- saas/backend/apps/group/views.py | 2 +- saas/backend/apps/model_builder/views.py | 8 +- saas/backend/apps/policy/views.py | 5 +- saas/backend/apps/role/serializers.py | 17 +- saas/backend/apps/role/tasks.py | 5 +- saas/backend/apps/role/views.py | 2 +- saas/backend/apps/subject/serializers.py | 8 +- saas/backend/apps/subject/urls.py | 3 - saas/backend/apps/subject/views.py | 74 +- saas/backend/apps/template/managers.py | 2 +- saas/backend/apps/template/serializers.py | 4 +- saas/backend/apps/user/tasks.py | 13 +- saas/backend/apps/user/views.py | 12 +- saas/backend/audit/detail.py | 18 +- saas/backend/audit/serializers.py | 6 +- saas/backend/biz/action.py | 14 +- saas/backend/biz/constants.py | 6 + saas/backend/biz/group.py | 5 +- saas/backend/biz/policy.py | 103 +- saas/backend/biz/policy_tag.py | 2 +- saas/backend/biz/resource_creator_action.py | 68 + saas/backend/biz/role.py | 66 +- saas/backend/biz/subject.py | 5 - saas/backend/biz/system.py | 25 + saas/backend/biz/template.py | 3 +- saas/backend/biz/trans/open.py | 316 ----- .../biz/trans/policy_related_resources.py | 47 - saas/backend/common/authentication.py | 40 + saas/backend/debug/views.py | 2 +- saas/backend/service/action_group.py | 3 +- saas/backend/service/aggregate_action.py | 3 +- saas/backend/service/constants.py | 69 +- saas/backend/service/engine.py | 10 +- saas/backend/service/group_saas_attribute.py | 10 +- saas/backend/service/instance_selection.py | 3 +- saas/backend/service/models/__init__.py | 49 +- saas/backend/service/models/action.py | 6 + saas/backend/service/models/open.py | 273 ---- saas/backend/service/models/policy.py | 1092 +-------------- .../models/resource_creator_action.py} | 39 +- saas/backend/service/models/resource_type.py | 16 - .../models/subject.py} | 15 +- saas/backend/service/models/system.py | 15 - saas/backend/service/policy/__init__.py | 3 - saas/backend/service/policy/base.py | 564 -------- saas/backend/service/policy/operation.py | 12 +- saas/backend/service/policy/query.py | 120 +- saas/backend/service/resource.py | 4 +- .../service/resource_creator_action.py | 37 +- saas/backend/service/resource_type.py | 3 +- saas/backend/service/role.py | 21 +- saas/backend/service/system.py | 9 + saas/backend/service/template.py | 4 +- saas/backend/{biz => }/trans/__init__.py | 5 - saas/backend/{biz => }/trans/application.py | 4 +- saas/backend/{biz => }/trans/group.py | 3 +- saas/backend/trans/open.py | 191 +++ saas/backend/trans/open_application.py | 82 ++ saas/backend/trans/open_authorization.py | 243 ++++ saas/backend/trans/open_management.py | 127 ++ saas/backend/{biz => }/trans/policy.py | 16 +- saas/backend/{biz => }/trans/role.py | 3 +- saas/tests/biz/action_tests.py | 132 +- saas/tests/biz/policy_tag_tests.py | 1135 ---------------- saas/tests/biz/policy_tests.py | 871 ------------ saas/tests/biz/related_policy_tests.py | 1191 ----------------- saas/tests/service/application_tests.py | 51 - saas/tests/service/models_tests.py | 1072 --------------- .../service/resource_creator_action_tests.py | 71 - saas/tests/service/translate_tests.py | 304 ----- saas/tests/test_util/factory.py | 235 ---- 97 files changed, 1985 insertions(+), 8706 deletions(-) create mode 100644 saas/backend/api/authorization/permissions.py delete mode 100644 saas/backend/api/authorization/utils.py delete mode 100644 saas/backend/api/authorization/views.py create mode 100644 saas/backend/api/authorization/views/__init__.py create mode 100644 saas/backend/api/authorization/views/resource.py create mode 100644 saas/backend/api/authorization/views/resource_creator_action.py delete mode 100644 saas/backend/apps/group/constants.py create mode 100644 saas/backend/biz/resource_creator_action.py create mode 100644 saas/backend/biz/system.py delete mode 100644 saas/backend/biz/trans/open.py delete mode 100644 saas/backend/biz/trans/policy_related_resources.py create mode 100644 saas/backend/common/authentication.py delete mode 100644 saas/backend/service/models/open.py rename saas/{tests/service/policy_tests.py => backend/service/models/resource_creator_action.py} (52%) rename saas/backend/{apps/action/constants.py => service/models/subject.py} (75%) delete mode 100644 saas/backend/service/policy/base.py rename saas/backend/{biz => }/trans/__init__.py (86%) rename saas/backend/{biz => }/trans/application.py (98%) rename saas/backend/{biz => }/trans/group.py (96%) create mode 100644 saas/backend/trans/open.py create mode 100644 saas/backend/trans/open_application.py create mode 100644 saas/backend/trans/open_authorization.py create mode 100644 saas/backend/trans/open_management.py rename saas/backend/{biz => }/trans/policy.py (96%) rename saas/backend/{biz => }/trans/role.py (97%) delete mode 100644 saas/tests/biz/policy_tag_tests.py delete mode 100644 saas/tests/biz/policy_tests.py delete mode 100644 saas/tests/biz/related_policy_tests.py delete mode 100644 saas/tests/service/application_tests.py delete mode 100644 saas/tests/service/models_tests.py delete mode 100644 saas/tests/service/resource_creator_action_tests.py delete mode 100644 saas/tests/service/translate_tests.py delete mode 100644 saas/tests/test_util/factory.py diff --git a/saas/backend/api/application/views.py b/saas/backend/api/application/views.py index d28332aeb..9670329cd 100644 --- a/saas/backend/api/application/views.py +++ b/saas/backend/api/application/views.py @@ -20,8 +20,8 @@ from backend.api.authentication import ESBAuthentication from backend.api.mixins import ExceptionHandlerMixin from backend.biz.open import ApplicationPolicyListCache -from backend.biz.trans.open import AccessSystemApplicationTrans from backend.common.swagger import ResponseSwaggerAutoSchema +from backend.trans.open_application import AccessSystemApplicationTrans from .serializers import AccessSystemApplicationSLZ, AccessSystemApplicationUrlSLZ @@ -53,7 +53,7 @@ def post(self, request): system_id = data["system"] # 将申请的数据转换为PolicyBeanList数据结构，同时需要进行数据检查 - policy_list = self.access_system_application_biz.to_policies(data) + policy_list = self.access_system_application_biz.to_policy_list(data) # 保存到cache中 cache_id = self.application_policy_list_cache.set(policy_list) diff --git a/saas/backend/api/authentication.py b/saas/backend/api/authentication.py index fc1cf885d..2d4531763 100644 --- a/saas/backend/api/authentication.py +++ b/saas/backend/api/authentication.py @@ -14,11 +14,9 @@ import jwt from django.conf import settings from django.contrib.auth import get_user_model -from rest_framework.authentication import BaseAuthentication, BasicAuthentication +from rest_framework.authentication import BaseAuthentication -from backend.apps.role.models import AnonymousRole, Role from backend.component import esb -from backend.service.constants import RoleType from backend.util.cache import region from .constants import BKNonEntityUser @@ -136,27 +134,3 @@ def _get_jwt_public_key(self, request_from): return self._get_apigw_public_key() data = esb.get_api_public_key() return data["public_key"] - - -class BasicAppCodeAuthentication(BasicAuthentication): - """ - 使用app_code认证的BasicAuth - """ - - def authenticate_credentials(self, userid, password, request=None): - if userid != settings.APP_ID or password != settings.APP_TOKEN: - return None - user_model = get_user_model() - user, _ = user_model.objects.get_or_create( - username="admin", defaults={"is_active": True, "is_staff": False, "is_superuser": False} - ) - if request: - request.bk_app_code = userid - return user, None - - def authenticate(self, request): - user_auth_tuple = super().authenticate(request) - if user_auth_tuple is not None: - role = Role.objects.filter(type=RoleType.SUPER_MANAGER.value).first() or AnonymousRole() - setattr(request, "role", role) - return user_auth_tuple diff --git a/saas/backend/api/authorization/audit.py b/saas/backend/api/authorization/audit.py index 8b10b8620..bb59928b6 100644 --- a/saas/backend/api/authorization/audit.py +++ b/saas/backend/api/authorization/audit.py @@ -12,7 +12,7 @@ from backend.audit.audit import NoNeedAuditException, audit_context_getter from backend.audit.constants import AuditType -from .constants import Operate +from .constants import OperateEnum class SubjectPolicyGrantOrRevokeAuditProvider(BaseSubjectProvider): @@ -20,10 +20,10 @@ class SubjectPolicyGrantOrRevokeAuditProvider(BaseSubjectProvider): def type(self): operate = audit_context_getter(self.request, "operate") - if operate == Operate.REVOKE.value: + if operate == OperateEnum.REVOKE.value: return AuditType.USER_POLICY_UPDATE.value - if operate == Operate.GRANT.value: + if operate == OperateEnum.GRANT.value: return AuditType.USER_POLICY_CREATE.value return "" diff --git a/saas/backend/api/authorization/constants.py b/saas/backend/api/authorization/constants.py index 0812af264..7a4ae4dd5 100644 --- a/saas/backend/api/authorization/constants.py +++ b/saas/backend/api/authorization/constants.py @@ -12,17 +12,11 @@ from backend.util.enum import ChoicesEnum - -class AllowGrantSubjectTypeEnum(ChoicesEnum, LowerStrEnum): - """允许授权的Subject类型""" - - USER = auto() - GROUP = auto() - - _choices_labels = skip(((USER, "用户"), (GROUP, "用户组"))) +# 白名单控制时的任意 +ALLOW_ANY = "*" -class Operate(ChoicesEnum, LowerStrEnum): +class OperateEnum(ChoicesEnum, LowerStrEnum): GRANT = auto() REVOKE = auto() @@ -38,5 +32,17 @@ class AuthorizationAPIEnum(ChoicesEnum, LowerStrEnum): _choices_labels = skip(((AUTHORIZATION_INSTANCE, "实例授权"), (CREATOR_AUTHORIZATION_INSTANCE, "新建关联实例授权"))) -# 白名单控制时的任意 -ALLOW_ANY = "*" +class VerifyAPIParamLocationEnum(ChoicesEnum, LowerStrEnum): + SYSTEM_IN_BODY = auto() + RESOURCE_TYPE_IN_BODY = auto() + ACTION_IN_BODY = auto() + ACTIONS_IN_BODY = auto() + + _choices_labels = skip( + ( + (SYSTEM_IN_BODY, "在body data里的system参数"), + (RESOURCE_TYPE_IN_BODY, "在body data里的type参数"), + (ACTION_IN_BODY, "在body data里的action参数"), + (ACTIONS_IN_BODY, "在body data里的actions参数"), + ) + ) diff --git a/saas/backend/api/authorization/mixins.py b/saas/backend/api/authorization/mixins.py index 4ef0e7ae6..cf241a9d6 100644 --- a/saas/backend/api/authorization/mixins.py +++ b/saas/backend/api/authorization/mixins.py @@ -14,61 +14,93 @@ from rest_framework import exceptions from backend.biz.org_sync.syncer import Syncer -from backend.common.error_codes import error_codes +from backend.biz.policy import PolicyBean, PolicyBeanList, PolicyOperationBiz, PolicyQueryBiz +from backend.biz.role import RoleAuthorizationScopeChecker, RoleBiz +from backend.common.error_codes import APIException, error_codes +from backend.service.constants import SubjectType +from backend.service.models import Subject -from .constants import AuthorizationAPIEnum +from .constants import AuthorizationAPIEnum, OperateEnum from .models import AuthAPIAllowListConfig logger = logging.getLogger("app") -class SubjectCheckMixin: - def check_or_sync_user(self, username): - """ - 检测用户是否存在，不存在则同步用户 - """ - try: - Syncer().sync_single_user(username) - except Exception: # pylint: disable=broad-except - logger.exception(f"[OpenAPI] authorize user[{username}] check error") - raise error_codes.VALIDATE_ERROR.format(f"user[{username}] not exists") - - class AuthorizationAPIAllowListCheckMixin: """授权API相关白名单控制""" - def check_allow_system_action(self, system_id: str, action_id: str): + def verify_api(self, system_id: str, object_id: str, api: AuthorizationAPIEnum): """ - 检查实例授权API对于某个系统的某个Action是否允许调用 - 目前暂时仅用于授权实例API，所以不需要参数auth_api_name + 对授权API进行权限校验，判断该系统是否允许调用 """ - allowed = AuthAPIAllowListConfig.is_allowed( - AuthorizationAPIEnum.AUTHORIZATION_INSTANCE.value, system_id, action_id - ) - if not allowed: + is_allowed = AuthAPIAllowListConfig.is_allowed(api, system_id, object_id) + if not is_allowed: raise exceptions.PermissionDenied( - detail="authorization instance api don't support the action[{}] of system[{}]".format( - action_id, system_id - ) + detail=f"{api} api don't support the [{object_id}] of system[{system_id}]" ) - def check_allow_system_actions(self, system_id: str, action_ids: List[str]): - """批量检查实例授权API对于某个系统的Actions是否允许调用""" - for action_id in action_ids: - self.check_allow_system_action(system_id, action_id) + def verify_api_by_object_ids(self, system_id: str, object_ids: List[str], api: AuthorizationAPIEnum): + """ + 批量Object进行校验 + """ + for object_id in object_ids: + self.verify_api(system_id, object_id, api) + + +class AuthViewMixin: + """所有授权API的一些公共处理函数""" + + role_biz = RoleBiz() + + policy_query_biz = PolicyQueryBiz() + policy_operation_biz = PolicyOperationBiz() - def check_allow_resource_type(self, system_id: str, resource_type_id: str): + def grant_or_revoke(self, operate: OperateEnum, subject: Subject, policy_list: PolicyBeanList) -> List[PolicyBean]: + """授权或回收权限""" + system_id = policy_list.system_id + + # 检测被授权的用户是否存在，不存在则尝试同步 + if subject.type == SubjectType.USER.value: + self._check_or_sync_user(subject.id) + + # 特殊逻辑：校验授权用户组是否超过其分级管理员范围 + if subject.type == SubjectType.GROUP.value and operate == OperateEnum.GRANT.value: + self._check_scope(subject, policy_list) + + policies = [] + # 授权或回收 + if operate == OperateEnum.GRANT.value: + action_ids = [p.action_id for p in policy_list.policies] + self.policy_operation_biz.alter(system_id, subject, policy_list.policies) + policies = self.policy_query_biz.list_by_subject_and_action(system_id, subject, action_ids) + elif operate == OperateEnum.REVOKE.value: + policies = self.policy_operation_biz.revoke(system_id, subject, policy_list.policies) + + return policies + + def _check_or_sync_user(self, username): """ - 检查新建关联实例授权API对于某个系统的某个资源类型是否允许调用 - 目前暂时仅用于新建关联实例授权API，所以不需要参数auth_api_name + 检测用户是否存在，不存在则同步用户 """ - allowed = AuthAPIAllowListConfig.is_allowed( - AuthorizationAPIEnum.CREATOR_AUTHORIZATION_INSTANCE.value, system_id, resource_type_id - ) + try: + Syncer().sync_single_user(username) + except Exception: # pylint: disable=broad-except + logger.exception(f"[OpenAPI] authorize user[{username}] check error") + raise error_codes.VALIDATE_ERROR.format(f"user[{username}] not exists") - if not allowed: - raise exceptions.PermissionDenied( - detail="authorization instance api don't support the resource type[{}] of system[{}]".format( - resource_type_id, system_id - ) - ) + def _check_scope(self, subject: Subject, policy_list: PolicyBeanList): + """检查是否策略超过用户组对应分级管理员可授权的范围""" + assert subject.type == SubjectType.GROUP.value + + # 用户组对应的分级管理员 + role = self.role_biz.get_role_by_group_id(int(subject.id)) + # 校验权限是否满足角色的管理范围 + scope_checker = RoleAuthorizationScopeChecker(role) + system_id = policy_list.system_id + try: + scope_checker.check_policies(system_id, policy_list.policies) + except APIException: + # Note: 这里是临时处理方案，最终方案是完全支持权限模型变更 + # 临时方案：校验不通过，则修改分级管理员的权限范围，使其通过 + need_added_policies = scope_checker.list_not_match_policy(system_id, policy_list.policies) + self.role_biz.inc_update_auth_scope(role.id, system_id, need_added_policies) diff --git a/saas/backend/api/authorization/permissions.py b/saas/backend/api/authorization/permissions.py new file mode 100644 index 000000000..f937ca540 --- /dev/null +++ b/saas/backend/api/authorization/permissions.py @@ -0,0 +1,98 @@ +# -*- coding: utf-8 -*- +""" +TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. +Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. +Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. +You may obtain a copy of the License at http://opensource.org/licenses/MIT +Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on +an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the +specific language governing permissions and limitations under the License. +""" +from rest_framework import permissions + +from backend.api.mixins import SystemClientCheckMixin + +from .constants import VerifyAPIParamLocationEnum +from .mixins import AuthorizationAPIAllowListCheckMixin +from .serializers import AuthActionSLZ, AuthActionsSLZ, AuthResourceTypeSLZ, AuthSystemSLZ + + +class AuthorizationAPIPermission( + permissions.IsAuthenticated, SystemClientCheckMixin, AuthorizationAPIAllowListCheckMixin +): + """ + 授权类API权限校验，校验的参数主要来自request.data、request.query_params、url_kwargs参数和request认证过的数据 + 需要配合 authorization_api_permission + authorization_api_permission = { + "请求函数名称": (鉴权所需参数来源，鉴权API类型) + } + 鉴权所需参数来源对应是：VerifyAPIParamLocationEnum枚举值 + 鉴权API类型对应是：AuthorizationAPIEnum枚举值 + """ + + def has_permission(self, request, view): + # ESB认证必须通过 + if not super().has_permission(request, view): + return False + + # 若配置了当前鉴权Class，但是没有配套的management_api_permission，则直接不通过 + if not hasattr(view, "authorization_api_permission"): + return False + + # 默认值即为请求method，因为继承于APIView（即使是ViewSet，ViewSet也是继承了APIView的） + handler_name = request.method.lower() + # ViewSet.as_view({...}) 设置了method的映射，则进行更新为映射的值 + if hasattr(view, "action"): + handler_name = view.action + + # 判断要处理的函数, 即handler是否配置了权限, + # 若没有配置权限控制，则直接不通过 + if handler_name not in view.authorization_api_permission: + return False + + # API认证与鉴权 + param_source, api = view.authorization_api_permission[handler_name] + # 若校验不通过，则会直接抛出exceptions.PermissionDenied异常 + self._verify_api(request, param_source, api) + + return True + + def _verify_api(self, request, param_source, api): + """ + 根据param_source获取request.data、request.query_params、url_kwargs中的数据，对API进行校验 + """ + # 所有API认证鉴权所需 + app_code = request.bk_app_code + + # 对于所有授权接口，都必须校验调用方是否能访问该系统 + system_slz = AuthSystemSLZ(data=request.data) + system_slz.is_valid(raise_exception=True) + system_id = system_slz.validated_data["system"] + self.verify_system_client(system_id, app_code) + + # 如果仅仅是校验System，则上面已校验，可以直接忽略了 + if param_source == VerifyAPIParamLocationEnum.SYSTEM_IN_BODY.value: + return + + # 资源类型 + if param_source == VerifyAPIParamLocationEnum.RESOURCE_TYPE_IN_BODY.value: + slz = AuthResourceTypeSLZ(data=request.data) + slz.is_valid(raise_exception=True) + resource_type_id = slz.validated_data["type"] + self.verify_api(system_id, resource_type_id, api) + return + + # 操作 + if param_source == VerifyAPIParamLocationEnum.ACTION_IN_BODY.value: + slz = AuthActionSLZ(data=request.data) + slz.is_valid(raise_exception=True) + action_id = slz.validated_data["action"]["id"] + self.verify_api(system_id, action_id, api) + return + + if param_source == VerifyAPIParamLocationEnum.ACTIONS_IN_BODY.value: + slz = AuthActionsSLZ(data=request.data) + slz.is_valid(raise_exception=True) + action_ids = [a["id"] for a in slz.validated_data["actions"]] + self.verify_api_by_object_ids(system_id, action_ids, api) + return diff --git a/saas/backend/api/authorization/serializers.py b/saas/backend/api/authorization/serializers.py index 90bc31858..06c66fc16 100644 --- a/saas/backend/api/authorization/serializers.py +++ b/saas/backend/api/authorization/serializers.py @@ -15,14 +15,25 @@ from backend.apps.policy.serializers import ValueFiled from backend.common.time import PERMANENT_SECONDS +from backend.service.constants import SubjectType -from .constants import AllowGrantSubjectTypeEnum, Operate +from .constants import OperateEnum REVOKE_INSTANCE_LIMIT = 1000 +class AuthSystemSLZ(serializers.Serializer): + """授权的系统""" + + system = serializers.CharField(label="系统ID") + + class SubjectSLZ(serializers.Serializer): - type = serializers.ChoiceField(label="类型", choices=AllowGrantSubjectTypeEnum.get_choices()) + type = serializers.ChoiceField( + label="类型", + # 允许授权的Subject类型 + choices=[(SubjectType.USER.value, "用户"), (SubjectType.GROUP.value, "用户组")], + ) id = serializers.CharField(label="id") @@ -46,14 +57,21 @@ class ResourcePathSLZ(serializers.Serializer): path = serializers.ListField(label="拓扑层级", child=PathNodeSLZ(label="实例"), allow_empty=False) -class AuthActionSLZ(serializers.Serializer): +class AuthActionIDSLZ(serializers.Serializer): id = serializers.CharField(label="操作ID") -class BaseAuthSLZ(serializers.Serializer): +class AuthActionSLZ(serializers.Serializer): + action = AuthActionIDSLZ(label="操作") + + +class AuthActionsSLZ(serializers.Serializer): + actions = serializers.ListField(label="操作列表", child=AuthActionIDSLZ(label="操作"), allow_empty=False) + + +class BaseAuthSLZ(AuthSystemSLZ): asynchronous = serializers.BooleanField(label="是否同步调用", default=False) # noqa - operate = serializers.ChoiceField(label="授权/回收", choices=Operate.get_choices()) - system = serializers.CharField(label="系统ID", required=True) + operate = serializers.ChoiceField(label="授权/回收", choices=OperateEnum.get_choices()) subject = SubjectSLZ(label="授权对象") expired_at = serializers.IntegerField( label="过期时间", required=False, default=0, min_value=0, max_value=PERMANENT_SECONDS @@ -68,13 +86,11 @@ def validate_expired_at(self, value): return value -class AuthInstanceSLZ(BaseAuthSLZ): - action = AuthActionSLZ(label="操作") +class AuthInstanceSLZ(BaseAuthSLZ, AuthActionSLZ): resources = serializers.ListField(label="资源实例", child=ResourceInstanceSLZ(label="实例"), allow_empty=True) -class AuthPathSLZ(BaseAuthSLZ): - action = AuthActionSLZ(label="操作") +class AuthPathSLZ(BaseAuthSLZ, AuthActionSLZ): resources = serializers.ListField(label="资源拓扑", child=ResourcePathSLZ(label="拓扑"), allow_empty=False) @@ -89,19 +105,18 @@ class BatchResourceInstanceSLZ(serializers.Serializer): instances = serializers.ListField(label="资源实例", child=SimpleInstanceSLZ(label="实例"), allow_empty=True) -class AuthBatchInstanceSLZ(BaseAuthSLZ): - actions = serializers.ListField(label="操作列表", child=AuthActionSLZ(label="操作"), allow_empty=False) +class AuthBatchInstanceSLZ(BaseAuthSLZ, AuthActionsSLZ): resources = serializers.ListField(label="资源实例", child=BatchResourceInstanceSLZ(label="批量实例"), allow_empty=True) def validate(self, data): operate = data["operate"] - if operate == Operate.GRANT.value: + if operate == OperateEnum.GRANT.value: for resource in data["resources"]: if len(resource["instances"]) > settings.AUTHORIZATION_INSTANCE_LIMIT: raise serializers.ValidationError( f"maximum number of instance grant {settings.AUTHORIZATION_INSTANCE_LIMIT}" ) - if operate == Operate.REVOKE.value: + if operate == OperateEnum.REVOKE.value: for resource in data["resources"]: if len(resource["instances"]) > REVOKE_INSTANCE_LIMIT: raise serializers.ValidationError(f"maximum number of instance revoke {REVOKE_INSTANCE_LIMIT}") @@ -118,53 +133,52 @@ class BatchResourcePathSLZ(serializers.Serializer): ) -class AuthBatchPathSLZ(BaseAuthSLZ): - actions = serializers.ListField(label="操作列表", child=AuthActionSLZ(label="操作"), allow_empty=False) +class AuthBatchPathSLZ(BaseAuthSLZ, AuthActionsSLZ): resources = serializers.ListField(label="资源拓扑", child=BatchResourcePathSLZ(label="匹配资源拓扑"), allow_empty=False) def validate(self, data): operate = data["operate"] - if operate == Operate.GRANT.value: + if operate == OperateEnum.GRANT.value: for resource in data["resources"]: if len(resource["paths"]) > settings.AUTHORIZATION_INSTANCE_LIMIT: raise serializers.ValidationError( f"maximum number of path grant {settings.AUTHORIZATION_INSTANCE_LIMIT}" ) - if operate == Operate.REVOKE.value: + if operate == OperateEnum.REVOKE.value: for resource in data["resources"]: if len(resource["paths"]) > REVOKE_INSTANCE_LIMIT: raise serializers.ValidationError(f"maximum number of path revoke {REVOKE_INSTANCE_LIMIT}") return data +class AuthResourceTypeSLZ(serializers.Serializer): + type = serializers.CharField(label="资源类型") + + +class ResourceCreatorActionBaseInfoSLZ(AuthSystemSLZ, AuthResourceTypeSLZ): + creator = serializers.CharField(label="创建者") + + class AncestorSLZ(serializers.Serializer): system = serializers.CharField(label="祖先资源的系统ID") type = serializers.CharField(label="祖先资源类型") id = serializers.CharField(label="祖先资源ID") -class ResourceCreatorActionSLZ(serializers.Serializer): - creator = serializers.CharField(label="创建者") - system = serializers.CharField(label="系统ID") - type = serializers.CharField(label="资源类型") +class SingleInstanceSLZ(serializers.Serializer): id = serializers.CharField(label="资源ID") name = serializers.CharField(label="资源名称") ancestors = serializers.ListField(label="祖先", child=AncestorSLZ(label="祖先层级"), allow_empty=True, required=False) -class SingleInstance(serializers.Serializer): - id = serializers.CharField(label="资源ID") - name = serializers.CharField(label="资源名称") - ancestors = serializers.ListField(label="祖先", child=AncestorSLZ(label="祖先层级"), allow_empty=True, required=False) +class ResourceCreatorActionSLZ(ResourceCreatorActionBaseInfoSLZ, SingleInstanceSLZ): + pass -class BatchResourceCreatorActionSLZ(serializers.Serializer): - creator = serializers.CharField(label="创建者") - system = serializers.CharField(label="系统ID") - type = serializers.CharField(label="资源类型") +class BatchResourceCreatorActionSLZ(ResourceCreatorActionBaseInfoSLZ): instances = serializers.ListField( label="批量资源实例", - child=SingleInstance(label="资源实例"), + child=SingleInstanceSLZ(label="资源实例"), allow_empty=False, max_length=settings.AUTHORIZATION_INSTANCE_LIMIT, ) @@ -181,10 +195,7 @@ class SingleAttributeSLZ(serializers.Serializer): values = serializers.ListField(label="属性VALUE", child=SingleAttributeValueSLZ(label="值")) -class ResourceCreatorActionAttributeSLZ(serializers.Serializer): - creator = serializers.CharField(label="创建者") - system = serializers.CharField(label="系统ID") - type = serializers.CharField(label="资源类型") +class ResourceCreatorActionAttributeSLZ(ResourceCreatorActionBaseInfoSLZ): attributes = serializers.ListField( label="属性", default=list, child=SingleAttributeSLZ(label="属性"), allow_empty=True ) diff --git a/saas/backend/api/authorization/urls.py b/saas/backend/api/authorization/urls.py index 8613eea06..7ab40b5ee 100644 --- a/saas/backend/api/authorization/urls.py +++ b/saas/backend/api/authorization/urls.py @@ -13,23 +13,32 @@ from . import views urlpatterns = [ - path("instance/", views.AuthInstanceView.as_view(), name="open.auth_instance"), - path("path/", views.AuthPathView.as_view(), name="open.auth_path"), - path("batch_instance/", views.AuthBatchInstanceView.as_view(), name="open.auth_batch_instance"), - path("batch_path/", views.AuthBatchPathView.as_view(), name="open.auth_batch_path"), + # 授权 + # 单Action单实例 + path("instance/", views.resource.AuthInstanceView.as_view(), name="open.auth_instance"), + # 单Action单拓扑路径 + path("path/", views.resource.AuthPathView.as_view(), name="open.auth_path"), + # 批量Action批量实例 + path("batch_instance/", views.resource.AuthBatchInstanceView.as_view(), name="open.auth_batch_instance"), + # 批量Action批量拓扑 + path("batch_path/", views.resource.AuthBatchPathView.as_view(), name="open.auth_batch_path"), + # 新建关联授权 + # 新建关联授权 - 单一实例授权 path( "resource_creator_action/", - views.ResourceCreatorActionView.as_view(), + views.resource_creator_action.ResourceCreatorActionView.as_view(), name="open.grant_resource_creator_action", ), + # 新建关联授权 - 批量实例授权 path( "batch_resource_creator_action/", - views.BatchResourceCreatorActionView.as_view(), + views.resource_creator_action.BatchResourceCreatorActionView.as_view(), name="open.grant_batch_resource_creator_action", ), + # 新建关联授权 - 属性授权 path( "resource_creator_action_attribute/", - views.ResourceCreatorActionAttributeView.as_view(), + views.resource_creator_action.ResourceCreatorActionAttributeView.as_view(), name="open.grant_resource_creator_action_attribute", ), ] diff --git a/saas/backend/api/authorization/utils.py b/saas/backend/api/authorization/utils.py deleted file mode 100644 index a6a2a2502..000000000 --- a/saas/backend/api/authorization/utils.py +++ /dev/null @@ -1,147 +0,0 @@ -# -*- coding: utf-8 -*- -""" -TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. -Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. -Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. -You may obtain a copy of the License at http://opensource.org/licenses/MIT -Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on -an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the -specific language governing permissions and limitations under the License. -""" -from typing import Dict, List - -from pydantic.tools import parse_obj_as - -from backend.apps.role.models import RoleScope -from backend.biz.policy import PolicyBean -from backend.biz.resource import ResourceBiz, ResourceNodeBean -from backend.biz.role import RoleAuthorizationScopeChecker, RoleBiz -from backend.common.error_codes import APIException -from backend.service.constants import RoleScopeType -from backend.service.models import Action, Policy, RelatedResource, ResourceInstance, Subject, group_paths -from backend.service.role import AuthScopeAction, AuthScopeSystem -from backend.util.json import json_dumps - - -# TODO: [重构]迁移到biz.trans下 -def join_ancestors_to_resource_instances(system_id: str, _type: str, instances: List[Dict]) -> List[ResourceInstance]: - """将资源实例和其祖先组装成ResourceInstance对象""" - resource_biz = ResourceBiz() - - paths: List[List[Dict]] = [] # 多个以path方式表示的实例 - for instance in instances: - _id = instance["id"] - name = instance["name"] - ancestors = instance.get("ancestors") - # 资源实例实例，处理成路径方式表示 - path: List[Dict] = [] - # 处理祖先填充Name - if ancestors: - # 需要查询的资源实例,祖先每个实例都需要 - resource_nodes = [ResourceNodeBean(system_id=r["system"], type=r["type"], id=r["id"]) for r in ancestors] - # 查询资源Name - resource_node_name_dict = resource_biz.fetch_resource_name(resource_nodes, raise_not_found_exception=True) - # 组装成路径 - for r in ancestors: - ancestor_name = resource_node_name_dict.get_name(r["system"], r["type"], r["id"]) - path.append({"system_id": r["system"], "type": r["type"], "id": r["id"], "name": ancestor_name}) - - # 层级最后一个是要创建的资源实例 - path.append({"system_id": system_id, "type": _type, "id": _id, "name": name}) - - # 追加每个以path方式表示的实例 - paths.append(path) - - # 将多个以path方式表示的实例进行分组 - group_instances = group_paths(paths) - - resource_instance = ResourceInstance( - system_id=system_id, type=_type, instances=group_instances, type_name=_type, type_name_en=_type - ) - - return [resource_instance] - - -# TODO: [重构]待重构open模块时一起迁移或重构掉 -def check_scope(system_id: str, actions: List[Action], subject: Subject, resources: List[ResourceInstance]): - policies = [] - for action in actions: - # 创建新的policy - related_resource_types = [] - if len(action.related_resource_types) > 0: - related_resource_types = [RelatedResource.from_resource_instance(r) for r in resources] - policy = Policy(id=action.id, related_resource_types=related_resource_types, type=action.type) - policies.append(policy) - - policy_beans = [PolicyBean.parse_obj(p.dict()) for p in policies] - role = RoleBiz().get_role_by_group_id(int(subject.id)) - # 校验权限是否满足角色的管理范围 - scope_checker = RoleAuthorizationScopeChecker(role) - try: - scope_checker.check_policies(system_id, policy_beans) - except APIException: - # Note: 这里是临时处理方案，最终方案是完全支持权限模型变更 - # 临时方案：校验不通过，则修改分级管理员的权限范围，使其通过 - _add_policies_to_role_authorization_scope(scope_checker, system_id, policy_beans) - - -def _add_policies_to_role_authorization_scope( - scope_checker: RoleAuthorizationScopeChecker, system_id: str, policies: List[PolicyBean] -): - """添加权限到分级管理员的范围里""" - # 需要被添加的策略列表 - need_added_policies = [] - - # Note: 以下代码里有调用 scope_checker 的 protected 方法是因为暂时不侵入修改scope_checker来提供一个public方法 - try: - scope_checker._check_system_in_scope(system_id) - # 如果不需要整个系统都添加，则遍历每条权限进行判断 - for p in policies: - try: - scope_checker._check_policy_in_scope(system_id, p) - except APIException: - # 校验不通过的，则需要添加到分级管理员范围内 - need_added_policies.append(p) - except APIException: - # 整个系统都不在分级管理员的授权范围内，则所有policies都需要添加到分级管理员范围内 - need_added_policies = policies - - if len(need_added_policies) == 0: - return - - # 获取分级管理员可授权范围 - role_id = scope_checker.role.id - auth_scopes: List[AuthScopeSystem] = RoleBiz().list_auth_scope(role_id) - - # 找到对应要变更的系统位置 - index = -1 - for idx, auth_scope in enumerate(auth_scopes): - if auth_scope.system_id == system_id: - index = idx - break - - # 新老策略进行合并 - policies_dict = {p.id: PolicyBean.parse_obj(p) for p in auth_scopes[index].actions} if index != -1 else {} - for policy in need_added_policies: - # 不在，表示新增的 - if policy.action_id not in policies_dict: - policies_dict[policy.action_id] = policy - continue - # 策略合并 - policy.add_related_resource_types(policies_dict[policy.action_id].related_resource_types) - policies_dict[policy.action_id] = policy - - auth_scope = AuthScopeSystem( - system_id=system_id, actions=parse_obj_as(List[AuthScopeAction], [p.dict() for p in policies_dict.values()]) - ) - - # 若系统不在可授权范围内，则直接追加，否则替换掉 - if index == -1: - auth_scopes.append(auth_scope) - else: - auth_scopes[index] = auth_scope - - # 保存 - RoleScope.objects.filter(role_id=role_id, type=RoleScopeType.AUTHORIZATION.value).update( - content=json_dumps([one.dict() for one in auth_scopes]), - ) diff --git a/saas/backend/api/authorization/views.py b/saas/backend/api/authorization/views.py deleted file mode 100644 index 825bd4aa0..000000000 --- a/saas/backend/api/authorization/views.py +++ /dev/null @@ -1,529 +0,0 @@ -# -*- coding: utf-8 -*- -""" -TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. -Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. -Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. -You may obtain a copy of the License at http://opensource.org/licenses/MIT -Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on -an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the -specific language governing permissions and limitations under the License. -""" -from drf_yasg.utils import swagger_auto_schema -from rest_framework import serializers, status -from rest_framework.permissions import IsAuthenticated -from rest_framework.response import Response -from rest_framework.views import APIView - -from backend.api.authentication import ESBAuthentication -from backend.api.mixins import ExceptionHandlerMixin, SystemClientCheckMixin -from backend.audit.audit import audit_context_setter, view_audit_decorator -from backend.biz.action import ActionCheckBiz, ActionForCheck -from backend.common.swagger import ResponseSwaggerAutoSchema -from backend.service.action import ActionService -from backend.service.constants import Operate, SubjectType -from backend.service.models import ApplyAction, Attribute, Subject -from backend.service.models.open import ApplyActionList -from backend.service.models.policy import ResourceInstanceList -from backend.service.policy import PolicyService -from backend.service.resource_creator_action import ResourceCreatorActionService - -from .audit import SubjectPolicyGrantOrRevokeAuditProvider -from .mixins import AuthorizationAPIAllowListCheckMixin, SubjectCheckMixin -from .serializers import ( - AuthBatchInstanceSLZ, - AuthBatchPathSLZ, - AuthInstanceSLZ, - AuthPathSLZ, - BatchResourceCreatorActionSLZ, - ResourceCreatorActionAttributeSLZ, - ResourceCreatorActionSLZ, -) -from .utils import check_scope, join_ancestors_to_resource_instances - - -# TODO 提取公共逻辑到biz, 把不同的数据结构转换成统一的结构, 复用相同的授权逻辑, 数据的转换放到biz.trans -# TODO 存在大量的重复逻辑, 需要提取 -class AuthInstanceView( - AuthorizationAPIAllowListCheckMixin, SystemClientCheckMixin, SubjectCheckMixin, ExceptionHandlerMixin, APIView -): - """ - 单个资源授权回收 - """ - - authentication_classes = [ESBAuthentication] - permission_classes = [IsAuthenticated] - - action_svc = ActionService() - policy_svc = PolicyService() - - action_check_biz = ActionCheckBiz() - - @swagger_auto_schema( - operation_description="单个资源授权回收", - auto_schema=ResponseSwaggerAutoSchema, - request_body=AuthInstanceSLZ, - responses={status.HTTP_200_OK: serializers.Serializer()}, - tags=["open"], - ) - @view_audit_decorator(SubjectPolicyGrantOrRevokeAuditProvider) - def post(self, request, *args, **kwargs): - serializer = AuthInstanceSLZ(data=request.data) - serializer.is_valid(raise_exception=True) - - data = serializer.validated_data - - system_id = data["system"] - action_id = data["action"]["id"] - - # 检查是否该系统允许调用当前授权API - self.check_allow_system_action(system_id, action_id) - - # 校验调用方是否能访问该系统 - self.verify_system_client(system_id, request.bk_app_code) - - # 检测被授权的用户是否存在，不存在则尝试同步 - if data["subject"]["type"] == SubjectType.USER.value: - self.check_or_sync_user(data["subject"]["id"]) - - subject = Subject(**data["subject"]) - - # 类型转换 - apply_action = ApplyAction.from_instance(data) - resource_instances = [rrt.to_resource_instance() for rrt in apply_action.related_resource_types] - # 填充类型名称 - resource_instance_list = ResourceInstanceList(resource_instances) - resource_instance_list.fill_resource_type_name() - - self.action_check_biz.check( - system_id, - [ - ActionForCheck( - id=action_id, - related_resource_types=[one.dict() for one in resource_instance_list.resource_instances], - ) - ], - ) - - action = self.action_svc.get(system_id, action_id) - # 校验授权用户组是否超过其分级管理员范围 - if subject.type == SubjectType.GROUP.value and data["operate"] == Operate.GRANT.value: - check_scope(system_id, [action], subject, resource_instances) - - # 授权或回收 - result, policies = self.policy_svc.grant_or_revoke_instance( - data["operate"], system_id, action, subject, resource_instance_list.resource_instances, data["expired_at"] - ) - - audit_context_setter(operate=data["operate"], subject=subject, system_id=system_id, policies=policies) - - return Response(result) - - -class AuthPathView(SystemClientCheckMixin, SubjectCheckMixin, ExceptionHandlerMixin, APIView): - """ - 单个拓扑层级授权/回收 - """ - - authentication_classes = [ESBAuthentication] - permission_classes = [IsAuthenticated] - - action_svc = ActionService() - policy_svc = PolicyService() - - action_check_biz = ActionCheckBiz() - - @swagger_auto_schema( - operation_description="单个拓扑层级授权/回收", - auto_schema=ResponseSwaggerAutoSchema, - request_body=AuthPathSLZ, - responses={status.HTTP_200_OK: serializers.Serializer()}, - tags=["open"], - ) - @view_audit_decorator(SubjectPolicyGrantOrRevokeAuditProvider) - def post(self, request, *args, **kwargs): - serializer = AuthPathSLZ(data=request.data) - serializer.is_valid(raise_exception=True) - - data = serializer.validated_data - - system_id = data["system"] - - # 校验调用方是否能访问该系统 - self.verify_system_client(system_id, request.bk_app_code) - - # 检测被授权的用户是否存在，不存在则尝试同步 - if data["subject"]["type"] == SubjectType.USER.value: - self.check_or_sync_user(data["subject"]["id"]) - - action_id = data["action"]["id"] - subject = Subject(**data["subject"]) - - apply_action = ApplyAction.from_path(data) - - self.action_check_biz.check(system_id, [ActionForCheck(**apply_action.dict())]) - - # 填充拓扑节点的system_id - apply_action_list = ApplyActionList([apply_action]) - apply_action_list.fill_instance_system(system_id) - - # 类型转换 - resource_instances = [rrt.to_resource_instance() for rrt in apply_action.related_resource_types] - - # 填充类型名称 - resource_instance_list = ResourceInstanceList(resource_instances) - resource_instance_list.fill_resource_type_name() - - self.action_check_biz.check( - system_id, - [ - ActionForCheck( - id=action_id, - related_resource_types=[one.dict() for one in resource_instance_list.resource_instances], - ) - ], - ) - - action = self.action_svc.get(system_id, action_id) - # 校验授权用户组是否超过其分级管理员范围 - if subject.type == SubjectType.GROUP.value and data["operate"] == Operate.GRANT.value: - check_scope(system_id, [action], subject, resource_instances) - - # 授权或回收 - result, policies = self.policy_svc.grant_or_revoke_instance( - data["operate"], system_id, action, subject, resource_instance_list.resource_instances, data["expired_at"] - ) - - audit_context_setter(operate=data["operate"], subject=subject, system_id=system_id, policies=policies) - - return Response(result) - - -class AuthBatchInstanceView( - AuthorizationAPIAllowListCheckMixin, SystemClientCheckMixin, SubjectCheckMixin, ExceptionHandlerMixin, APIView -): - """ - 批量操作批量资源授权回收 - """ - - authentication_classes = [ESBAuthentication] - permission_classes = [IsAuthenticated] - - action_svc = ActionService() - policy_svc = PolicyService() - - action_check_biz = ActionCheckBiz() - - @swagger_auto_schema( - operation_description="批量操作批量资源授权回收", - auto_schema=ResponseSwaggerAutoSchema, - request_body=AuthBatchInstanceSLZ, - responses={status.HTTP_200_OK: serializers.Serializer()}, - tags=["open"], - ) - @view_audit_decorator(SubjectPolicyGrantOrRevokeAuditProvider) - def post(self, request, *args, **kwargs): - serializer = AuthBatchInstanceSLZ(data=request.data) - serializer.is_valid(raise_exception=True) - - data = serializer.validated_data - - system_id = data["system"] - action_ids = [a["id"] for a in data["actions"]] - - # 检查是否该系统允许调用当前授权API - self.check_allow_system_actions(system_id, action_ids) - - # 校验调用方是否能访问该系统 - self.verify_system_client(system_id, request.bk_app_code) - - # 检测被授权的用户是否存在，不存在则尝试同步 - if data["subject"]["type"] == SubjectType.USER.value: - self.check_or_sync_user(data["subject"]["id"]) - - subject = Subject(**data["subject"]) - - # 类型转换 - action = ApplyAction.from_batch_instance(data) - resource_instances = [rrt.to_resource_instance() for rrt in action.related_resource_types] - # 填充类型名称 - resource_instance_list = ResourceInstanceList(resource_instances) - resource_instance_list.fill_resource_type_name() - - related_resource_types = [one.dict() for one in resource_instance_list.resource_instances] - actions_for_check = [ - ActionForCheck(id=ac["id"], related_resource_types=related_resource_types) for ac in data["actions"] - ] - self.action_check_biz.check(system_id, actions_for_check) - - actions = self.action_svc.new_action_list(system_id).filter([ac["id"] for ac in data["actions"]]) - - # 校验授权用户组是否超过其分级管理员范围 - if subject.type == SubjectType.GROUP.value and data["operate"] == Operate.GRANT.value: - check_scope(system_id, actions, subject, resource_instances) - - # 授权或回收 - result, policies = self.policy_svc.grant_or_revoke_batch_instance( - data["operate"], system_id, actions, subject, resource_instance_list.resource_instances, data["expired_at"] - ) - - audit_context_setter(operate=data["operate"], subject=subject, system_id=system_id, policies=policies) - - return Response(result) - - -class AuthBatchPathView(SystemClientCheckMixin, SubjectCheckMixin, ExceptionHandlerMixin, APIView): - """ - 批量操作批量拓扑层级授权/回收 - """ - - authentication_classes = [ESBAuthentication] - permission_classes = [IsAuthenticated] - - action_svc = ActionService() - policy_svc = PolicyService() - - action_check_biz = ActionCheckBiz() - - @swagger_auto_schema( - operation_description="批量操作批量拓扑层级授权/回收", - auto_schema=ResponseSwaggerAutoSchema, - request_body=AuthBatchPathSLZ, - responses={status.HTTP_200_OK: serializers.Serializer()}, - tags=["open"], - ) - @view_audit_decorator(SubjectPolicyGrantOrRevokeAuditProvider) - def post(self, request, *args, **kwargs): - serializer = AuthBatchPathSLZ(data=request.data) - serializer.is_valid(raise_exception=True) - - data = serializer.validated_data - - system_id = data["system"] - - # 校验调用方是否能访问该系统 - self.verify_system_client(system_id, request.bk_app_code) - - # 检测被授权的用户是否存在，不存在则尝试同步 - if data["subject"]["type"] == SubjectType.USER.value: - self.check_or_sync_user(data["subject"]["id"]) - - subject = Subject(**data["subject"]) - - apply_action = ApplyAction.from_batch_path(data) - - # 检查操作数据 - self.action_check_biz.check(system_id, [ActionForCheck(**apply_action.dict())]) - - # 填充拓扑节点的system_id - apply_action_list = ApplyActionList([apply_action]) - apply_action_list.fill_instance_system(system_id) - - # 类型转换 - resource_instances = [rrt.to_resource_instance() for rrt in apply_action.related_resource_types] - # 填充类型名称 - resource_instance_list = ResourceInstanceList(resource_instances) - resource_instance_list.fill_resource_type_name() - - related_resource_types = [one.dict() for one in resource_instance_list.resource_instances] - actions_for_check = [ - ActionForCheck(id=ac["id"], related_resource_types=related_resource_types) for ac in data["actions"] - ] - self.action_check_biz.check(system_id, actions_for_check) - - actions = self.action_svc.new_action_list(system_id).filter([ac["id"] for ac in data["actions"]]) - - # 校验授权用户组是否超过其分级管理员范围 - if subject.type == SubjectType.GROUP.value and data["operate"] == Operate.GRANT.value: - check_scope(system_id, actions, subject, resource_instances) - - # 授权或回收 - result, policies = self.policy_svc.grant_or_revoke_batch_instance( - data["operate"], system_id, actions, subject, resource_instance_list.resource_instances, data["expired_at"] - ) - - audit_context_setter(operate=data["operate"], subject=subject, system_id=system_id, policies=policies) - - return Response(result) - - -# TODO: [重构]新建关联单独拆分views/ResourceCreatorAction.py -class ResourceCreatorActionView( - AuthorizationAPIAllowListCheckMixin, SystemClientCheckMixin, SubjectCheckMixin, ExceptionHandlerMixin, APIView -): - """ - 新建关联授权 - """ - - authentication_classes = [ESBAuthentication] - permission_classes = [IsAuthenticated] - - action_svc = ActionService() - policy_svc = PolicyService() - rca_svc = ResourceCreatorActionService() - - @swagger_auto_schema( - operation_description="新建关联授权", - auto_schema=ResponseSwaggerAutoSchema, - request_body=ResourceCreatorActionSLZ, - responses={status.HTTP_200_OK: serializers.Serializer()}, - tags=["open"], - ) - @view_audit_decorator(SubjectPolicyGrantOrRevokeAuditProvider) - def post(self, request, *args, **kwargs): - serializer = ResourceCreatorActionSLZ(data=request.data) - serializer.is_valid(raise_exception=True) - - data = serializer.validated_data - - system_id = data["system"] - resource_type = data["type"] - - # 检查是否该系统允许调用当前授权API - self.check_allow_resource_type(system_id, resource_type) - - # 校验调用方是否能访问该系统 - self.verify_system_client(system_id, request.bk_app_code) - - # 检测被授权的用户是否存在，不存在则尝试同步 - self.check_or_sync_user(data["creator"]) - - subject = Subject(type=SubjectType.USER.value, id=data["creator"]) - - # 查询出对应资源类型需要授予哪些ActionID - action_ids = set(self.rca_svc.get_actions(system_id, resource_type)) - # 转换为Action结构 - actions = self.action_svc.new_action_list(system_id).filter(list(action_ids)) - - # 转换出资源对象 - resource_instances = join_ancestors_to_resource_instances( - system_id, resource_type, [{"id": data["id"], "name": data["name"], "ancestors": data.get("ancestors")}] - ) - - # TODO: 可能需要校验实例视图，多个Action，具体是单实例符合实例视图还是层级符合实例视图？ - - # 授权或回收 - result, policies = self.policy_svc.grant_or_revoke_batch_instance( - Operate.GRANT.value, system_id, actions, subject, resource_instances - ) - - audit_context_setter(operate=Operate.GRANT.value, subject=subject, system_id=system_id, policies=policies) - - return Response(result) - - -# TODO: [重构]新建关联单独拆分views/ResourceCreatorAction.py -class BatchResourceCreatorActionView( - AuthorizationAPIAllowListCheckMixin, SystemClientCheckMixin, SubjectCheckMixin, ExceptionHandlerMixin, APIView -): - """ - 新建关联授权 - 批量资源实例 - """ - - authentication_classes = [ESBAuthentication] - permission_classes = [IsAuthenticated] - - action_svc = ActionService() - policy_svc = PolicyService() - rca_svc = ResourceCreatorActionService() - - @swagger_auto_schema( - operation_description="新建关联授权", - auto_schema=ResponseSwaggerAutoSchema, - request_body=BatchResourceCreatorActionSLZ, - responses={status.HTTP_200_OK: serializers.Serializer()}, - tags=["open"], - ) - @view_audit_decorator(SubjectPolicyGrantOrRevokeAuditProvider) - def post(self, request, *args, **kwargs): - serializer = BatchResourceCreatorActionSLZ(data=request.data) - serializer.is_valid(raise_exception=True) - - data = serializer.validated_data - - system_id = data["system"] - resource_type = data["type"] - - # 检查是否该系统允许调用当前授权API - self.check_allow_resource_type(system_id, resource_type) - - # 校验调用方是否能访问该系统 - self.verify_system_client(system_id, request.bk_app_code) - - # 检测被授权的用户是否存在，不存在则尝试同步 - self.check_or_sync_user(data["creator"]) - - subject = Subject(type=SubjectType.USER.value, id=data["creator"]) - - # 查询出对应资源类型需要授予哪些ActionID - action_ids = set(self.rca_svc.get_actions(system_id, resource_type)) - # 转换为Action结构 - actions = self.action_svc.new_action_list(system_id).filter(list(action_ids)) - - # 转换出资源对象 - resource_instances = join_ancestors_to_resource_instances(system_id, resource_type, data["instances"]) - # 填充类型名称 - resource_instance_list = ResourceInstanceList(resource_instances) - resource_instance_list.fill_resource_type_name() - - # TODO: 可能需要校验实例视图，多个Action，具体是单实例符合实例视图还是层级符合实例视图？ - - # 授权或回收 - result, policies = self.policy_svc.grant_or_revoke_batch_instance( - Operate.GRANT.value, system_id, actions, subject, resource_instance_list.resource_instances - ) - - audit_context_setter(operate=Operate.GRANT.value, subject=subject, system_id=system_id, policies=policies) - - return Response(result) - - -# TODO: [重构]新建关联单独拆分views/ResourceCreatorAction.py -class ResourceCreatorActionAttributeView(SystemClientCheckMixin, SubjectCheckMixin, ExceptionHandlerMixin, APIView): - """ - 新建关联授权 - 属性授权 - """ - - authentication_classes = [ESBAuthentication] - permission_classes = [IsAuthenticated] - - policy_svc = PolicyService() - rca_svc = ResourceCreatorActionService() - - @swagger_auto_schema( - operation_description="新建关联授权-属性授权", - auto_schema=ResponseSwaggerAutoSchema, - request_body=ResourceCreatorActionAttributeSLZ, - responses={status.HTTP_200_OK: serializers.Serializer()}, - tags=["open"], - ) - @view_audit_decorator(SubjectPolicyGrantOrRevokeAuditProvider) - def post(self, request, *args, **kwargs): - serializer = ResourceCreatorActionAttributeSLZ(data=request.data) - serializer.is_valid(raise_exception=True) - - data = serializer.validated_data - - system_id = data["system"] - resource_type = data["type"] - attributes_data = data["attributes"] - - # 校验调用方是否能访问该系统 - self.verify_system_client(system_id, request.bk_app_code) - - # 检测被授权的用户是否存在，不存在则尝试同步 - self.check_or_sync_user(data["creator"]) - - subject = Subject(type=SubjectType.USER.value, id=data["creator"]) - - # 查询出对应资源类型需要授予哪些ActionID - action_ids = self.rca_svc.get_actions(system_id, resource_type) - - # 转换成资源属性 - attributes = [Attribute(**a) for a in attributes_data] - - # 授权 - result, policies = self.policy_svc.grant_attribute(system_id, action_ids, subject, attributes) - - audit_context_setter(operate=Operate.GRANT.value, subject=subject, system_id=system_id, policies=policies) - - return Response(result) diff --git a/saas/backend/api/authorization/views/__init__.py b/saas/backend/api/authorization/views/__init__.py new file mode 100644 index 000000000..bace4bb13 --- /dev/null +++ b/saas/backend/api/authorization/views/__init__.py @@ -0,0 +1,26 @@ +# -*- coding: utf-8 -*- +""" +TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. +Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. +Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. +You may obtain a copy of the License at http://opensource.org/licenses/MIT +Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on +an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the +specific language governing permissions and limitations under the License. +""" +from .resource import AuthBatchInstanceView, AuthBatchPathView, AuthInstanceView, AuthPathView +from .resource_creator_action import ( + BatchResourceCreatorActionView, + ResourceCreatorActionAttributeView, + ResourceCreatorActionView, +) + +__all__ = [ + "AuthInstanceView", + "AuthPathView", + "AuthBatchInstanceView", + "AuthBatchPathView", + "ResourceCreatorActionView", + "BatchResourceCreatorActionView", + "ResourceCreatorActionAttributeView", +] diff --git a/saas/backend/api/authorization/views/resource.py b/saas/backend/api/authorization/views/resource.py new file mode 100644 index 000000000..bc6598b85 --- /dev/null +++ b/saas/backend/api/authorization/views/resource.py @@ -0,0 +1,207 @@ +# -*- coding: utf-8 -*- +""" +TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. +Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. +Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. +You may obtain a copy of the License at http://opensource.org/licenses/MIT +Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on +an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the +specific language governing permissions and limitations under the License. +""" +from drf_yasg.utils import swagger_auto_schema +from rest_framework import serializers, status +from rest_framework.response import Response +from rest_framework.views import APIView + +from backend.api.authentication import ESBAuthentication +from backend.api.mixins import ExceptionHandlerMixin +from backend.audit.audit import audit_context_setter, view_audit_decorator +from backend.common.swagger import ResponseSwaggerAutoSchema +from backend.service.models import Subject +from backend.trans.open_authorization import AuthorizationTrans + +from ..audit import SubjectPolicyGrantOrRevokeAuditProvider +from ..constants import AuthorizationAPIEnum, VerifyAPIParamLocationEnum +from ..mixins import AuthViewMixin +from ..permissions import AuthorizationAPIPermission +from ..serializers import AuthBatchInstanceSLZ, AuthBatchPathSLZ, AuthInstanceSLZ, AuthPathSLZ + + +class AuthInstanceView(AuthViewMixin, ExceptionHandlerMixin, APIView): + """ + 单个资源授权回收 + """ + + authentication_classes = [ESBAuthentication] + permission_classes = [AuthorizationAPIPermission] + authorization_api_permission = { + "post": (VerifyAPIParamLocationEnum.ACTION_IN_BODY.value, AuthorizationAPIEnum.AUTHORIZATION_INSTANCE.value), + } + + trans = AuthorizationTrans() + + @swagger_auto_schema( + operation_description="单个资源授权回收", + auto_schema=ResponseSwaggerAutoSchema, + request_body=AuthInstanceSLZ, + responses={status.HTTP_200_OK: serializers.Serializer()}, + tags=["open"], + ) + @view_audit_decorator(SubjectPolicyGrantOrRevokeAuditProvider) + def post(self, request, *args, **kwargs): + serializer = AuthInstanceSLZ(data=request.data) + serializer.is_valid(raise_exception=True) + + data = serializer.validated_data + + operate = data["operate"] + subject = Subject(**data["subject"]) + system_id = data["system"] + expired_at = data["expired_at"] + action_id = data["action"]["id"] + resources = data["resources"] + + # 转换为策略列表 + policy_list = self.trans.to_policy_list_for_instance(system_id, action_id, resources, expired_at) + + # 授权或回收 + policies = self.grant_or_revoke(operate, subject, policy_list) + + audit_context_setter(operate=operate, subject=subject, system_id=system_id, policies=policies) + + return Response({"policy_id": policies[0].policy_id}) + + +class AuthPathView(AuthViewMixin, ExceptionHandlerMixin, APIView): + """ + 单个拓扑层级授权/回收 + """ + + authentication_classes = [ESBAuthentication] + permission_classes = [AuthorizationAPIPermission] + authorization_api_permission = { + "post": (VerifyAPIParamLocationEnum.SYSTEM_IN_BODY.value, AuthorizationAPIEnum.AUTHORIZATION_INSTANCE.value), + } + + trans = AuthorizationTrans() + + @swagger_auto_schema( + operation_description="单个拓扑层级授权/回收", + auto_schema=ResponseSwaggerAutoSchema, + request_body=AuthPathSLZ, + responses={status.HTTP_200_OK: serializers.Serializer()}, + tags=["open"], + ) + @view_audit_decorator(SubjectPolicyGrantOrRevokeAuditProvider) + def post(self, request, *args, **kwargs): + serializer = AuthPathSLZ(data=request.data) + serializer.is_valid(raise_exception=True) + + data = serializer.validated_data + + operate = data["operate"] + subject = Subject(**data["subject"]) + system_id = data["system"] + expired_at = data["expired_at"] + action_id = data["action"]["id"] + resources = data["resources"] + + # 转换为策略列表 + policy_list = self.trans.to_policy_list_for_path(system_id, action_id, resources, expired_at) + + # 授权或回收 + policies = self.grant_or_revoke(operate, subject, policy_list) + + audit_context_setter(operate=operate, subject=subject, system_id=system_id, policies=policies) + + return Response({"policy_id": policies[0].policy_id}) + + +class AuthBatchInstanceView(AuthViewMixin, ExceptionHandlerMixin, APIView): + """ + 批量操作批量资源授权回收 + """ + + authentication_classes = [ESBAuthentication] + permission_classes = [AuthorizationAPIPermission] + authorization_api_permission = { + "post": (VerifyAPIParamLocationEnum.ACTIONS_IN_BODY.value, AuthorizationAPIEnum.AUTHORIZATION_INSTANCE.value), + } + + trans = AuthorizationTrans() + + @swagger_auto_schema( + operation_description="批量操作批量资源授权回收", + auto_schema=ResponseSwaggerAutoSchema, + request_body=AuthBatchInstanceSLZ, + responses={status.HTTP_200_OK: serializers.Serializer()}, + tags=["open"], + ) + @view_audit_decorator(SubjectPolicyGrantOrRevokeAuditProvider) + def post(self, request, *args, **kwargs): + serializer = AuthBatchInstanceSLZ(data=request.data) + serializer.is_valid(raise_exception=True) + + data = serializer.validated_data + + operate = data["operate"] + subject = Subject(**data["subject"]) + system_id = data["system"] + expired_at = data["expired_at"] + action_ids = [a["id"] for a in data["actions"]] + resources = data["resources"] + + # 转换为策略列表 + policy_list = self.trans.to_policy_list_for_instances(system_id, action_ids, resources, expired_at) + + # 授权或回收 + policies = self.grant_or_revoke(operate, subject, policy_list) + + audit_context_setter(operate=operate, subject=subject, system_id=system_id, policies=policies) + + return Response([{"action": {"id": p.action_id}, "policy_id": p.policy_id} for p in policies]) + + +class AuthBatchPathView(AuthViewMixin, ExceptionHandlerMixin, APIView): + """ + 批量操作批量拓扑层级授权/回收 + """ + + authentication_classes = [ESBAuthentication] + permission_classes = [AuthorizationAPIPermission] + authorization_api_permission = { + "post": (VerifyAPIParamLocationEnum.SYSTEM_IN_BODY.value, AuthorizationAPIEnum.AUTHORIZATION_INSTANCE.value), + } + + trans = AuthorizationTrans() + + @swagger_auto_schema( + operation_description="批量操作批量拓扑层级授权/回收", + auto_schema=ResponseSwaggerAutoSchema, + request_body=AuthBatchPathSLZ, + responses={status.HTTP_200_OK: serializers.Serializer()}, + tags=["open"], + ) + @view_audit_decorator(SubjectPolicyGrantOrRevokeAuditProvider) + def post(self, request, *args, **kwargs): + serializer = AuthBatchPathSLZ(data=request.data) + serializer.is_valid(raise_exception=True) + + data = serializer.validated_data + + operate = data["operate"] + subject = Subject(**data["subject"]) + system_id = data["system"] + expired_at = data["expired_at"] + action_ids = [a["id"] for a in data["actions"]] + resources = data["resources"] + + # 转换为策略列表 + policy_list = self.trans.to_policy_list_for_paths(system_id, action_ids, resources, expired_at) + + # 授权或回收 + policies = self.grant_or_revoke(operate, subject, policy_list) + + audit_context_setter(operate=operate, subject=subject, system_id=system_id, policies=policies) + + return Response([{"action": {"id": p.action_id}, "policy_id": p.policy_id} for p in policies]) diff --git a/saas/backend/api/authorization/views/resource_creator_action.py b/saas/backend/api/authorization/views/resource_creator_action.py new file mode 100644 index 000000000..08246b04a --- /dev/null +++ b/saas/backend/api/authorization/views/resource_creator_action.py @@ -0,0 +1,185 @@ +# -*- coding: utf-8 -*- +""" +TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. +Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. +Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. +You may obtain a copy of the License at http://opensource.org/licenses/MIT +Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on +an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the +specific language governing permissions and limitations under the License. +""" +from drf_yasg.utils import swagger_auto_schema +from rest_framework import serializers, status +from rest_framework.response import Response +from rest_framework.views import APIView + +from backend.api.authentication import ESBAuthentication +from backend.api.mixins import ExceptionHandlerMixin +from backend.audit.audit import audit_context_setter, view_audit_decorator +from backend.biz.resource_creator_action import ResourceCreatorActionBiz +from backend.common.swagger import ResponseSwaggerAutoSchema +from backend.service.constants import SubjectType +from backend.service.models import Subject +from backend.trans.open_authorization import AuthorizationTrans + +from ..audit import SubjectPolicyGrantOrRevokeAuditProvider +from ..constants import AuthorizationAPIEnum, OperateEnum, VerifyAPIParamLocationEnum +from ..mixins import AuthViewMixin +from ..permissions import AuthorizationAPIPermission +from ..serializers import BatchResourceCreatorActionSLZ, ResourceCreatorActionAttributeSLZ, ResourceCreatorActionSLZ + + +class ResourceCreatorActionView(AuthViewMixin, ExceptionHandlerMixin, APIView): + """ + 新建关联授权 + """ + + authentication_classes = [ESBAuthentication] + permission_classes = [AuthorizationAPIPermission] + authorization_api_permission = { + "post": ( + VerifyAPIParamLocationEnum.RESOURCE_TYPE_IN_BODY.value, + AuthorizationAPIEnum.CREATOR_AUTHORIZATION_INSTANCE.value, + ), + } + + biz = ResourceCreatorActionBiz() + trans = AuthorizationTrans() + + @swagger_auto_schema( + operation_description="新建关联授权", + auto_schema=ResponseSwaggerAutoSchema, + request_body=ResourceCreatorActionSLZ, + responses={status.HTTP_200_OK: serializers.Serializer()}, + tags=["open"], + ) + @view_audit_decorator(SubjectPolicyGrantOrRevokeAuditProvider) + def post(self, request, *args, **kwargs): + serializer = ResourceCreatorActionSLZ(data=request.data) + serializer.is_valid(raise_exception=True) + + data = serializer.validated_data + + subject = Subject(type=SubjectType.USER.value, id=data["creator"]) + system_id = data["system"] + resource_type_id = data["type"] + instances = [{"id": data["id"], "name": data["name"], "ancestors": data.get("ancestors")}] + + # 查询出对应资源类型需要授予哪些ActionID + action_ids = self.biz.list_action_id(system_id, resource_type_id) + + # 转换为策略列表 + policy_list = self.trans.to_policy_list_for_instances_of_creator( + system_id, action_ids, resource_type_id, instances + ) + + # 授权 + policies = self.grant_or_revoke(OperateEnum.GRANT.value, subject, policy_list) + + audit_context_setter(operate=OperateEnum.GRANT.value, subject=subject, system_id=system_id, policies=policies) + + return Response([{"action": {"id": p.action_id}, "policy_id": p.policy_id} for p in policies]) + + +class BatchResourceCreatorActionView(AuthViewMixin, ExceptionHandlerMixin, APIView): + """ + 新建关联授权 - 批量资源实例 + """ + + authentication_classes = [ESBAuthentication] + permission_classes = [AuthorizationAPIPermission] + authorization_api_permission = { + "post": ( + VerifyAPIParamLocationEnum.RESOURCE_TYPE_IN_BODY.value, + AuthorizationAPIEnum.CREATOR_AUTHORIZATION_INSTANCE.value, + ), + } + + biz = ResourceCreatorActionBiz() + trans = AuthorizationTrans() + + @swagger_auto_schema( + operation_description="新建关联授权", + auto_schema=ResponseSwaggerAutoSchema, + request_body=BatchResourceCreatorActionSLZ, + responses={status.HTTP_200_OK: serializers.Serializer()}, + tags=["open"], + ) + @view_audit_decorator(SubjectPolicyGrantOrRevokeAuditProvider) + def post(self, request, *args, **kwargs): + serializer = BatchResourceCreatorActionSLZ(data=request.data) + serializer.is_valid(raise_exception=True) + + data = serializer.validated_data + + subject = Subject(type=SubjectType.USER.value, id=data["creator"]) + system_id = data["system"] + resource_type_id = data["type"] + instances = data["instances"] + + # 查询出对应资源类型需要授予哪些ActionID + action_ids = self.biz.list_action_id(system_id, resource_type_id) + + # 转换为策略列表 + policy_list = self.trans.to_policy_list_for_instances_of_creator( + system_id, action_ids, resource_type_id, instances + ) + + # 授权 + policies = self.grant_or_revoke(OperateEnum.GRANT.value, subject, policy_list) + + audit_context_setter(operate=OperateEnum.GRANT.value, subject=subject, system_id=system_id, policies=policies) + + return Response([{"action": {"id": p.action_id}, "policy_id": p.policy_id} for p in policies]) + + +class ResourceCreatorActionAttributeView(AuthViewMixin, ExceptionHandlerMixin, APIView): + """ + 新建关联授权 - 属性授权 + """ + + authentication_classes = [ESBAuthentication] + permission_classes = [AuthorizationAPIPermission] + authorization_api_permission = { + "post": ( + VerifyAPIParamLocationEnum.SYSTEM_IN_BODY.value, + AuthorizationAPIEnum.CREATOR_AUTHORIZATION_INSTANCE.value, + ), + } + + biz = ResourceCreatorActionBiz() + trans = AuthorizationTrans() + + @swagger_auto_schema( + operation_description="新建关联授权-属性授权", + auto_schema=ResponseSwaggerAutoSchema, + request_body=ResourceCreatorActionAttributeSLZ, + responses={status.HTTP_200_OK: serializers.Serializer()}, + tags=["open"], + ) + @view_audit_decorator(SubjectPolicyGrantOrRevokeAuditProvider) + def post(self, request, *args, **kwargs): + serializer = ResourceCreatorActionAttributeSLZ(data=request.data) + serializer.is_valid(raise_exception=True) + + data = serializer.validated_data + + subject = Subject(type=SubjectType.USER.value, id=data["creator"]) + system_id = data["system"] + resource_type_id = data["type"] + attributes = data["attributes"] + + # 查询出对应资源类型需要授予哪些ActionID + action_ids = self.biz.list_action_id(system_id, resource_type_id) + + # 转换为策略列表 + policy_list = self.trans.to_policy_list_for_attributes_of_creator( + system_id, action_ids, resource_type_id, attributes + ) + + # 授权 + policies = self.grant_or_revoke(OperateEnum.GRANT.value, subject, policy_list) + + audit_context_setter(operate=OperateEnum.GRANT.value, subject=subject, system_id=system_id, policies=policies) + + return Response([{"action": {"id": p.action_id}, "policy_id": p.policy_id} for p in policies]) diff --git a/saas/backend/api/initialization/views.py b/saas/backend/api/initialization/views.py index d70ae33f4..a8c186754 100644 --- a/saas/backend/api/initialization/views.py +++ b/saas/backend/api/initialization/views.py @@ -12,12 +12,12 @@ from rest_framework.response import Response from rest_framework.viewsets import views -from backend.api.authentication import BasicAppCodeAuthentication from backend.api.mixins import ExceptionHandlerMixin from backend.apps.organization.tasks import sync_organization from backend.apps.role.tasks import sync_system_manager from backend.biz.org_sync.syncer import Syncer from backend.biz.role import RoleBiz +from backend.common.authentication import BasicAppCodeAuthentication class InitializationView(ExceptionHandlerMixin, views.APIView): diff --git a/saas/backend/api/management/permissions.py b/saas/backend/api/management/permissions.py index 771972644..aa865c86a 100644 --- a/saas/backend/api/management/permissions.py +++ b/saas/backend/api/management/permissions.py @@ -52,7 +52,11 @@ def has_permission(self, request, view): # 对于配置了忽略鉴权的，直接返回鉴权通过 if (param_source, api) == IGNORE_VERIFY_API_CONFIG: return True - return self._verify_api(view, request, param_source, api) + + # 若校验不通过，则会直接抛出exceptions.PermissionDenied异常 + self._verify_api(view, request, param_source, api) + + return True def _verify_api(self, view, request, param_source, api): """ @@ -71,7 +75,7 @@ def _verify_api(self, view, request, param_source, api): # 由于URL参数是必然会获取得到的，否则是已经404的，不会执行到这里，所以可以直接[]获取而不需要判断是否存在 object_id = request.parser_context["kwargs"][object_id_key] self.verify_api_by_object(app_code, VerifyAPIParamSourceToObjectTypeMap[param_source], int(object_id), api) - return True + return # 参数system来着Body Data或Query if param_source in [ @@ -91,7 +95,7 @@ def _verify_api(self, view, request, param_source, api): source_system_id = slz.validated_data["system"] self.verify_api(app_code, source_system_id, api) - return True + return # 参数来着body data - group_ids if param_source == VerifyAPIParamLocationEnum.GROUP_IDS_IN_BODY: @@ -100,6 +104,4 @@ def _verify_api(self, view, request, param_source, api): group_ids = slz.validated_data["group_ids"] self.verify_api_by_groups(app_code, group_ids, api) - return True - - return False + return diff --git a/saas/backend/api/management/serializers.py b/saas/backend/api/management/serializers.py index b39d9fecc..425e28539 100644 --- a/saas/backend/api/management/serializers.py +++ b/saas/backend/api/management/serializers.py @@ -12,8 +12,8 @@ from rest_framework import serializers from backend.apps.application.serializers import ExpiredAtSLZ, ReasonSLZ -from backend.apps.group.constants import GroupMemberType from backend.apps.role.serializers import RatingMangerBaseInfoSZL, RoleScopeSubjectSLZ +from backend.service.constants import GroupMemberType class ManagementSourceSystemSLZ(serializers.Serializer): diff --git a/saas/backend/api/management/views/application.py b/saas/backend/api/management/views/application.py index 045d83542..47afe00d9 100644 --- a/saas/backend/api/management/views/application.py +++ b/saas/backend/api/management/views/application.py @@ -23,7 +23,7 @@ from backend.biz.group import GroupCheckBiz from backend.common.swagger import ResponseSwaggerAutoSchema from backend.service.constants import ApplicationTypeEnum, SubjectType -from backend.service.models.system import Subject +from backend.service.models import Subject class ManagementGroupApplicationViewSet(ManagementAPIPermissionCheckMixin, ExceptionHandlerMixin, GenericViewSet): diff --git a/saas/backend/api/management/views/grade_manager.py b/saas/backend/api/management/views/grade_manager.py index b5563b257..e625c0c06 100644 --- a/saas/backend/api/management/views/grade_manager.py +++ b/saas/backend/api/management/views/grade_manager.py @@ -8,9 +8,7 @@ an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. """ -from collections import defaultdict -from typing import Dict, List - +from django.db import transaction from drf_yasg.utils import swagger_auto_schema from rest_framework import serializers, status from rest_framework.response import Response @@ -34,12 +32,10 @@ from backend.apps.role.models import Role, RoleSource, RoleUser from backend.apps.role.serializers import RoleIdSLZ from backend.audit.audit import audit_context_setter, view_audit_decorator -from backend.biz.action import ActionCheckBiz, ActionForCheck -from backend.biz.policy import PolicyBean, PolicyBeanList -from backend.biz.role import RoleBiz, RoleCheckBiz, RoleInfoBean -from backend.biz.trans import ToPolicyRelatedResources +from backend.biz.role import RoleBiz, RoleCheckBiz from backend.common.swagger import ResponseSwaggerAutoSchema from backend.service.constants import RoleSourceTypeEnum, RoleType +from backend.trans.open_management import GradeManagerTrans class ManagementGradeManagerViewSet(ManagementAPIPermissionCheckMixin, ExceptionHandlerMixin, GenericViewSet): @@ -53,7 +49,7 @@ class ManagementGradeManagerViewSet(ManagementAPIPermissionCheckMixin, Exception biz = RoleBiz() role_check_biz = RoleCheckBiz() - action_check_biz = ActionCheckBiz() + trans = GradeManagerTrans() @swagger_auto_schema( operation_description="创建分级管理员", @@ -79,36 +75,17 @@ def create(self, request, *args, **kwargs): # 名称唯一性检查 self.role_check_biz.check_unique_name(data["name"]) - # 将授权的权限范围数据转为List[Policy]，并按照系统分组 - system_policies: Dict[str, List[PolicyBean]] = defaultdict(list) - for auth_scope in data["authorization_scopes"]: - # Resources转换为Policy的RelatedResourceTypes结构 - related_resources = ToPolicyRelatedResources().from_resource_paths(auth_scope["resources"]) - - # 将Actions展开并给每个Action添加对应的Resources得到Policies - for ac in auth_scope["actions"]: - system_policies[auth_scope["system"]].append( - PolicyBean(action_id=ac["id"], related_resource_types=related_resources) - ) - - # 校验Policy，并填充资源类型等相关字段数据，最终组装出authorization_scopes - authorization_scopes = [] - for system_id, policies in system_policies.items(): - # 检查Resources与Action RelatedResourceTypes是否匹配 - self.action_check_biz.check(system_id, [ActionForCheck.parse_obj(p.dict()) for p in policies]) - policy_list = PolicyBeanList(system_id, policies, need_check_instance_selection=True) - # 组装出，create role的authorization_scope数据 - authorization_scopes.append({"system_id": system_id, "actions": [p.dict() for p in policy_list.policies]}) - # 使用创建角色所需的authorization_scopes替换掉参数里 - data["authorization_scopes"] = authorization_scopes - - # 创建角色 - role = self.biz.create(RoleInfoBean.parse_obj(data), request.user.username) - - # 记录role创建来源信息 - RoleSource.objects.create( - role_id=role.id, source_type=RoleSourceTypeEnum.API.value, source_system_id=source_system_id - ) + # 转换为RoleInfoBean，用于创建时使用 + role_info = self.trans.to_role_info(data) + + with transaction.atomic(): + # 创建角色 + role = self.biz.create(role_info, request.user.username) + + # 记录role创建来源信息 + RoleSource.objects.create( + role_id=role.id, source_type=RoleSourceTypeEnum.API.value, source_system_id=source_system_id + ) # 审计 audit_context_setter(role=role) diff --git a/saas/backend/api/management/views/group.py b/saas/backend/api/management/views/group.py index 4efaeb5f8..8cf4ddafc 100644 --- a/saas/backend/api/management/views/group.py +++ b/saas/backend/api/management/views/group.py @@ -39,16 +39,15 @@ ) from backend.apps.group.models import Group from backend.apps.group.serializers import GroupAddMemberSLZ -from backend.apps.role.models import Role, RoleRelatedObject +from backend.apps.role.models import Role from backend.audit.audit import add_audit, audit_context_setter, view_audit_decorator from backend.biz.group import GroupBiz, GroupCheckBiz, GroupCreateBean -from backend.biz.policy import PolicyBean, PolicyOperationBiz -from backend.biz.role import RoleBiz -from backend.biz.trans import ToPolicyRelatedResources +from backend.biz.policy import PolicyOperationBiz +from backend.biz.role import RoleBiz, RoleListQuery from backend.common.swagger import PaginatedResponseSwaggerAutoSchema, ResponseSwaggerAutoSchema -from backend.service.constants import RoleRelatedObjectType, RoleType, SubjectType -from backend.service.group_saas_attribute import GroupAttributeService +from backend.service.constants import RoleType, SubjectType from backend.service.models import Subject +from backend.trans.open_management import ManagementCommonTrans class ManagementGradeManagerGroupViewSet(ExceptionHandlerMixin, GenericViewSet): @@ -65,10 +64,8 @@ class ManagementGradeManagerGroupViewSet(ExceptionHandlerMixin, GenericViewSet): lookup_field = "id" queryset = Role.objects.filter(type=RoleType.RATING_MANAGER.value).order_by("-updated_time") - group_attribute_svc = GroupAttributeService() - - group_check_biz = GroupCheckBiz() group_biz = GroupBiz() + group_check_biz = GroupCheckBiz() @swagger_auto_schema( operation_description="批量创建用户组", @@ -113,16 +110,15 @@ def list(self, request, *args, **kwargs): limit = pagination.get_limit(request) offset = pagination.get_offset(request) - # 查询与角色关联的用户组 - object_relation_queryset = RoleRelatedObject.objects.list_object_relation( - role.id, RoleRelatedObjectType.GROUP.value - ) - count = object_relation_queryset.count() - group_ids = [obj.object_id for obj in object_relation_queryset[offset : offset + limit]] - # 查询用户组基本信息 - groups = Group.objects.filter(id__in=group_ids) + # 查询当前分级管理员可以管理的用户组 + group_queryset = RoleListQuery(role, None).query_group() + + # 分页数据 + count = group_queryset.count() + groups = group_queryset[offset : offset + limit] + # 查询用户组属性 - group_attrs = self.group_attribute_svc.batch_get_attributes([g.id for g in groups]) + group_attrs = self.group_biz.batch_get_attributes([g.id for g in groups]) results = [ { "id": g.id, @@ -314,6 +310,7 @@ class ManagementGroupPolicyViewSet(ExceptionHandlerMixin, GenericViewSet): group_biz = GroupBiz() policy_biz = PolicyOperationBiz() role_biz = RoleBiz() + trans = ManagementCommonTrans() @swagger_auto_schema( operation_description="用户组授权", @@ -330,21 +327,21 @@ def create(self, request, *args, **kwargs): serializer.is_valid(raise_exception=True) data = serializer.validated_data - # 将授权的权限数据转为List[Policy] - # 1. Resources转换为Policy的RelatedResourceTypes结构 - related_resources = ToPolicyRelatedResources().from_resource_paths(data["resources"]) - # 2. 将Actions展开并给每个Action添加对应的Resources得到Policies - policies = [PolicyBean(action_id=a["id"], related_resource_types=related_resources) for a in data["actions"]] + system_id = data["system"] + action_ids = [a["id"] for a in data["actions"]] + resources = data["resources"] + + # 将授权的权限数据转为PolicyBeanList + policy_list = self.trans.to_policy_list_for_batch_action_and_resources(system_id, action_ids, resources) # 组装数据进行对用户组权限处理 - system_id = data["system"] role = self.role_biz.get_role_by_group_id(group.id) # preprocess_group_policies 已包含：分级管理员授权范围鉴权、数据校验和部分默认用户组策略数据填充 - policies = self.group_biz.preprocess_group_policies(role, system_id, policies) + policies = self.group_biz.preprocess_group_policies(role, system_id, policy_list.policies) # 用户组授权 subject = Subject(type=SubjectType.GROUP.value, id=str(group.id)) - self.policy_biz.alter(system_id, subject, policies) # TODO 加上subject的授权锁 + self.policy_biz.alter(system_id, subject, policies) # 写入审计上下文 audit_context_setter(group=group, system_id=system_id, policies=policies) diff --git a/saas/backend/api/mixins.py b/saas/backend/api/mixins.py index 93688cd62..1f7663395 100644 --- a/saas/backend/api/mixins.py +++ b/saas/backend/api/mixins.py @@ -16,30 +16,25 @@ from rest_framework.settings import api_settings from rest_framework.views import set_rollback +from backend.biz.system import SystemBiz from backend.common.constants import DjangoLanguageEnum from backend.common.error_codes import error_codes -from backend.component import iam -from backend.util.cache import region class SystemClientCheckMixin: + system_biz = SystemBiz() + def verify_system_client(self, system_id: str, app_code: str): """ 验证app_code是否能访问系统 """ - clients = self._get_system_clients(system_id) + clients = self.system_biz.list_client(system_id) - if app_code not in set(clients): + if app_code not in clients: raise exceptions.PermissionDenied( detail="app_code {} can not access system {}".format(app_code, system_id) ) - @staticmethod - @region.cache_on_arguments(expiration_time=5 * 60) # 5分钟过期 - def _get_system_clients(system_id: str): - system = iam.get_system(system_id, fields="clients") - return system["clients"].split(",") - class ExceptionHandlerMixin: """ diff --git a/saas/backend/apps/action/tasks.py b/saas/backend/apps/action/tasks.py index 59bcedd54..15d15e6e3 100644 --- a/saas/backend/apps/action/tasks.py +++ b/saas/backend/apps/action/tasks.py @@ -14,16 +14,16 @@ from celery import task from backend.apps.action.models import AggregateAction +from backend.biz.system import SystemBiz from backend.service.action import ActionService from backend.service.models.action import Action from backend.service.models.instance_selection import ChainNode -from backend.service.system import SystemService @task(ignore_result=True) def generate_action_aggregate(): # 生成操作聚合配置 - systems = SystemService().list() + systems = SystemBiz().list() action_svc = ActionService() # 编译每个系统 diff --git a/saas/backend/apps/action/views/action_group.py b/saas/backend/apps/action/views/action_group.py index c91d1385b..41775b611 100644 --- a/saas/backend/apps/action/views/action_group.py +++ b/saas/backend/apps/action/views/action_group.py @@ -40,7 +40,7 @@ def get(self, request): system_id = slz.validated_data["system_id"] - actions = self.action_biz.list(system_id) - action_groups = self.biz.list_with_frontend_id_by_actions(system_id, actions) + action_list = self.action_biz.list(system_id) + action_groups = self.biz.list_with_frontend_id_by_actions(system_id, action_list.actions) return Response([one.dict() for one in action_groups]) diff --git a/saas/backend/apps/application/serializers.py b/saas/backend/apps/application/serializers.py index 43903e3ea..3db7ce8e5 100644 --- a/saas/backend/apps/application/serializers.py +++ b/saas/backend/apps/application/serializers.py @@ -20,10 +20,10 @@ from backend.apps.role.serializers import RatingMangerCreateSLZ from backend.biz.application import ApplicationBiz from backend.biz.subject import SubjectInfoList +from backend.biz.system import SystemBiz from backend.common.time import PERMANENT_SECONDS, expired_at_display from backend.service.constants import ApplicationTypeEnum -from backend.service.models.system import Subject -from backend.service.system import SystemService +from backend.service.models import Subject from .base_serializers import BaseAggActionListSLZ, SystemInfoSLZ, validate_action_repeat @@ -202,7 +202,7 @@ def get_data(self, obj): # 授权范围处理 auth_scopes = data["authorization_scopes"] # 填充system name - system_dict = {s.id: s for s in SystemService().list()} + system_dict = {s.id: s for s in SystemBiz().list()} for scope in auth_scopes: if "system_id" in scope: system_id = scope.pop("system_id") diff --git a/saas/backend/apps/application/views.py b/saas/backend/apps/application/views.py index 4be439a65..002e870db 100644 --- a/saas/backend/apps/application/views.py +++ b/saas/backend/apps/application/views.py @@ -31,12 +31,12 @@ from backend.biz.policy import PolicyBean, PolicyBeanList, PolicyQueryBiz from backend.biz.policy_tag import ConditionTagBean, ConditionTagBiz from backend.biz.role import RoleBiz, RoleCheckBiz -from backend.biz.trans.application import ApplicationDataTrans -from backend.biz.trans.role import RoleTrans from backend.common.error_codes import error_codes from backend.common.swagger import PaginatedResponseSwaggerAutoSchema, ResponseSwaggerAutoSchema from backend.service.constants import ADMIN_USER, ApplicationTypeEnum, RoleType, SubjectType from backend.service.models import Subject +from backend.trans.application import ApplicationDataTrans +from backend.trans.role import RoleTrans from .filters import ApplicationFilter from .serializers import ( diff --git a/saas/backend/apps/group/constants.py b/saas/backend/apps/group/constants.py deleted file mode 100644 index ec7966fd3..000000000 --- a/saas/backend/apps/group/constants.py +++ /dev/null @@ -1,52 +0,0 @@ -# -*- coding: utf-8 -*- -""" -TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. -Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. -Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. -You may obtain a copy of the License at http://opensource.org/licenses/MIT -Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on -an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the -specific language governing permissions and limitations under the License. -""" -from aenum import LowerStrEnum, auto, skip - -from backend.util.enum import ChoicesEnum - - -class GroupMemberType(ChoicesEnum, LowerStrEnum): - USER = auto() - DEPARTMENT = auto() - - _choices_labels = skip(((USER, "用户"), (DEPARTMENT, "部门"))) - - -class SubjectRelationType(ChoicesEnum, LowerStrEnum): - DEPARTMENT = auto() - GROUP = auto() - - _choices_labels = skip(((GROUP, "用户组"), (DEPARTMENT, "部门"))) - - -class GroupSaaSAttributeEnum(ChoicesEnum, LowerStrEnum): - """用户组SaaS属性枚举""" - - READONLY = auto() - - _choices_labels = skip(((READONLY, "只读"),)) - - -class GroupAttributeValueTypeEnum(ChoicesEnum, LowerStrEnum): - """用户组SaaS属性值的数据类型""" - - String = auto() - Boolean = auto() - Integer = auto() - - -# 每个属性的值类型 -GROUP_SAAS_ATTRIBUTE_VALUE_TYPE_MAP = { - GroupSaaSAttributeEnum.READONLY.value: GroupAttributeValueTypeEnum.Boolean.value -} - -# 每个属性的默认值 -GROUP_SAAS_ATTRIBUTE_DEFAULT_VALUE_MAP = {GroupSaaSAttributeEnum.READONLY.value: False} diff --git a/saas/backend/apps/group/serializers.py b/saas/backend/apps/group/serializers.py index 0be35e191..69e5968ae 100644 --- a/saas/backend/apps/group/serializers.py +++ b/saas/backend/apps/group/serializers.py @@ -25,15 +25,12 @@ from backend.apps.template.models import PermTemplatePolicyAuthorized from backend.biz.group import GroupBiz, GroupCheckBiz from backend.biz.policy import PolicyBean, PolicyBeanList +from backend.biz.system import SystemBiz from backend.biz.template import TemplateBiz from backend.common.time import PERMANENT_SECONDS -from backend.service.constants import RoleRelatedObjectType +from backend.service.constants import ADMIN_USER, GroupMemberType, RoleRelatedObjectType from backend.service.group_saas_attribute import GroupAttributeService -from backend.service.models.system import Subject -from backend.service.system import SystemService - -from ...service.constants import ADMIN_USER -from .constants import GroupMemberType +from backend.service.models import Subject class GroupMemberSLZ(serializers.Serializer): @@ -171,7 +168,7 @@ def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) template_ids = [tmp.template_id for tmp in args[0]] self._template_name_dict = TemplateBiz().get_template_name_dict_by_ids(template_ids) - self._system_list = SystemService().new_system_list() + self._system_list = SystemBiz().new_system_list() def get_system(self, obj): system_id = obj.system_id @@ -193,7 +190,7 @@ class GroupTemplateDetailSLZ(GroupTemplateSLZ): def __init__(self, *args, **kwargs): serializers.ModelSerializer.__init__(self, *args, **kwargs) self._template_name_dict = TemplateBiz().get_template_name_dict_by_ids([self.instance.id]) - self._system_list = SystemService().new_system_list() + self._system_list = SystemBiz().new_system_list() class Meta: model = PermTemplatePolicyAuthorized diff --git a/saas/backend/apps/group/views.py b/saas/backend/apps/group/views.py index afe68d32a..ac053feeb 100644 --- a/saas/backend/apps/group/views.py +++ b/saas/backend/apps/group/views.py @@ -33,7 +33,6 @@ from backend.biz.policy_tag import ConditionTagBean, ConditionTagBiz from backend.biz.role import RoleBiz, RoleListQuery, RoleObjectRelationChecker from backend.biz.template import TemplateBiz -from backend.biz.trans.group import GroupTrans from backend.common.error_codes import error_codes from backend.common.filters import NoCheckModelFilterBackend from backend.common.serializers import SystemQuerySLZ @@ -41,6 +40,7 @@ from backend.common.time import PERMANENT_SECONDS from backend.service.constants import PermissionCodeEnum, RoleType, SubjectType from backend.service.models import Subject +from backend.trans.group import GroupTrans from .audit import ( GroupCreateAuditProvider, diff --git a/saas/backend/apps/model_builder/views.py b/saas/backend/apps/model_builder/views.py index 909a178e2..a55e1e21b 100644 --- a/saas/backend/apps/model_builder/views.py +++ b/saas/backend/apps/model_builder/views.py @@ -49,12 +49,12 @@ validate_system, ) from backend.biz.instance_selection import InstanceSelectionBiz +from backend.biz.system import SystemBiz from backend.common.error_codes import error_codes from backend.common.swagger import ResponseSwaggerAutoSchema from backend.service.instance_selection import InstanceSelectionService from backend.service.models.resource_type import ResourceTypeDict from backend.service.resource_type import ResourceTypeService -from backend.service.system import SystemService class UserMockSystemModelViewSet(GenericViewSet, mixins.ListModelMixin): @@ -288,8 +288,8 @@ def update_part(self, request, *args, **kwargs): def _list_all_systems(mock_system_id: str, mock_system_name: str) -> List[Tuple[str, str]]: data = [(mock_system_id, mock_system_name)] - svc = SystemService() - systems = svc.list() + biz = SystemBiz() + systems = biz.list() for s in systems: if s.id != mock_system_id: data.append((s.id, s.name)) @@ -306,8 +306,6 @@ class SystemListView(GenericViewSet): permission_classes = [ModelOwnerPermission] - svc = SystemService() - @swagger_auto_schema( operation_description="构建模型时拉取所有系统列表", auto_schema=ResponseSwaggerAutoSchema, diff --git a/saas/backend/apps/policy/views.py b/saas/backend/apps/policy/views.py index e1d1ff399..f10485010 100644 --- a/saas/backend/apps/policy/views.py +++ b/saas/backend/apps/policy/views.py @@ -143,7 +143,10 @@ def update(self, request, *args, **kwargs): permission_logger.info("policy delete partial by user: %s", request.user.username) - system_id, update_policy = self.policy_operation_biz.delete_partial( + # 为避免需要忽略的变量与国际化翻译变量"_"冲突，所以使用"__" + system_id, __ = self.policy_query_biz.get_system_policy(subject, policy_id) + update_policy = self.policy_operation_biz.delete_partial( + system_id, subject, policy_id, resource_system_id, diff --git a/saas/backend/apps/role/serializers.py b/saas/backend/apps/role/serializers.py index af89bf9e5..cd1ea61dc 100644 --- a/saas/backend/apps/role/serializers.py +++ b/saas/backend/apps/role/serializers.py @@ -13,13 +13,20 @@ from rest_framework import serializers from backend.apps.application.base_serializers import BaseAggActionListSLZ, SystemInfoSLZ, validate_action_repeat -from backend.apps.group.constants import GroupMemberType, SubjectRelationType from backend.apps.policy.serializers import ConditionSLZ, InstanceSLZ, ResourceSLZ, ResourceTypeSLZ from backend.apps.role.models import Role, RoleCommonAction, RoleUser from backend.biz.role import RoleBiz from backend.biz.subject import SubjectInfoList from backend.common.time import PERMANENT_SECONDS -from backend.service.constants import ADMIN_USER, ANY_ID, SUBJECT_ALL, SUBJECT_TYPE_ALL, RoleScopeSubjectType +from backend.service.constants import ( + ADMIN_USER, + ANY_ID, + SUBJECT_ALL, + SUBJECT_TYPE_ALL, + GroupMemberType, + RoleScopeSubjectType, + SubjectType, +) class RoleScopeSubjectSLZ(serializers.Serializer): @@ -32,6 +39,10 @@ def validate(self, attrs): # 当id为*时，type必须为* if _id == SUBJECT_ALL and _type != SUBJECT_TYPE_ALL: raise serializers.ValidationError("type must be * when id is *") + # 当type为部门时，id必须是数字字符串或* + if _type == RoleScopeSubjectType.DEPARTMENT.value and _id != SUBJECT_ALL: + if not _id.isdigit(): + raise serializers.ValidationError("department id can only be a string consisting of numbers only") return attrs @@ -262,7 +273,7 @@ def create(self, validated_data): class RoleGroupMemberRenewSLZ(serializers.Serializer): type = serializers.ChoiceField(label="成员类型", choices=GroupMemberType.get_choices()) id = serializers.CharField(label="成员id") - parent_type = serializers.ChoiceField(label="父级类型", choices=[(SubjectRelationType.GROUP.value, "用户组")]) + parent_type = serializers.ChoiceField(label="父级类型", choices=[(SubjectType.GROUP.value, "用户组")]) parent_id = serializers.CharField(label="父级ID") expired_at = serializers.IntegerField(label="过期时间", required=True, max_value=PERMANENT_SECONDS) diff --git a/saas/backend/apps/role/tasks.py b/saas/backend/apps/role/tasks.py index 6c6773aa8..c580c15db 100644 --- a/saas/backend/apps/role/tasks.py +++ b/saas/backend/apps/role/tasks.py @@ -19,10 +19,10 @@ from backend.apps.role.models import Role, RoleRelatedObject, RoleUser from backend.biz.group import GroupBiz from backend.biz.role import RoleBiz, RoleInfoBean +from backend.biz.system import SystemBiz from backend.common.time import get_soon_expire_ts from backend.component import esb from backend.service.constants import RoleRelatedObjectType, RoleType -from backend.service.system import SystemService logger = logging.getLogger("celery") @@ -33,8 +33,7 @@ def sync_system_manager(): 创建系统管理员 """ # 查询后端所有的系统信息 - svc = SystemService() - systems = {system.id: system for system in svc.list()} + systems = {system.id: system for system in SystemBiz().list()} # 查询已创建的系统管理员的系统id exists_system_ids = Role.objects.filter(type=RoleType.SYSTEM_MANAGER.value).values_list("code", flat=True) diff --git a/saas/backend/apps/role/views.py b/saas/backend/apps/role/views.py index ff08ee4cf..f1fcd820a 100644 --- a/saas/backend/apps/role/views.py +++ b/saas/backend/apps/role/views.py @@ -44,13 +44,13 @@ RoleSubjectScopeChecker, ) from backend.biz.subject import SubjectInfoList -from backend.biz.trans.role import RoleTrans from backend.common.error_codes import error_codes from backend.common.serializers import SystemQuerySLZ from backend.common.swagger import PaginatedResponseSwaggerAutoSchema, ResponseSwaggerAutoSchema from backend.common.time import get_soon_expire_ts from backend.service.constants import PermissionCodeEnum, RoleRelatedObjectType, RoleType, SubjectType from backend.service.models import Subject +from backend.trans.role import RoleTrans from .audit import ( CommonActionCreateAuditProvider, diff --git a/saas/backend/apps/subject/serializers.py b/saas/backend/apps/subject/serializers.py index 33334e2ae..eb412e967 100644 --- a/saas/backend/apps/subject/serializers.py +++ b/saas/backend/apps/subject/serializers.py @@ -10,8 +10,8 @@ """ from rest_framework import serializers -from backend.apps.group.constants import SubjectRelationType from backend.common.time import PERMANENT_SECONDS +from backend.service.constants import SubjectRelationType class UserRelationSLZ(serializers.Serializer): @@ -28,9 +28,3 @@ class SubjectGroupSLZ(serializers.Serializer): description = serializers.CharField(label="描述", allow_blank=True) department_id = serializers.IntegerField(label="部门ID", help_text="0则为个人，其他为继承的部门ID") department_name = serializers.CharField(label="部门名称") - - -class SubjectDepartmentSLZ(serializers.Serializer): - id = serializers.CharField(label="部门ID") - name = serializers.CharField(label="部门名称") - full_name = serializers.CharField(label="部门路径名称") diff --git a/saas/backend/apps/subject/urls.py b/saas/backend/apps/subject/urls.py index dcaec11cf..f92610f71 100644 --- a/saas/backend/apps/subject/urls.py +++ b/saas/backend/apps/subject/urls.py @@ -22,9 +22,6 @@ views.SubjectGroupViewSet.as_view({"get": "list", "delete": "destroy"}), name="subject.group", ), - path( - "departments/", views.SubjectDepartmentViewSet.as_view({"get": "list"}), name="subject.department" - ), path( "systems/", views.SubjectSystemViewSet.as_view({"get": "list"}), name="subject.list_policy_system" ), diff --git a/saas/backend/apps/subject/views.py b/saas/backend/apps/subject/views.py index 09cfa262d..2a5dadde3 100644 --- a/saas/backend/apps/subject/views.py +++ b/saas/backend/apps/subject/views.py @@ -17,19 +17,17 @@ from rest_framework.viewsets import GenericViewSet from backend.account.permissions import role_perm_class -from backend.apps.organization.models import Department, User from backend.apps.policy.serializers import PolicyDeleteSLZ, PolicyPartDeleteSLZ, PolicySLZ, PolicySystemSLZ -from backend.apps.template.models import PermTemplatePolicyAuthorized from backend.audit.audit import audit_context_setter, view_audit_decorator from backend.biz.group import GroupBiz from backend.biz.policy import ConditionBean, PolicyOperationBiz, PolicyQueryBiz from backend.common.serializers import SystemQuerySLZ from backend.common.swagger import ResponseSwaggerAutoSchema -from backend.service.constants import PermissionCodeEnum +from backend.service.constants import PermissionCodeEnum, SubjectRelationType from backend.service.models import Subject from .audit import SubjectGroupDeleteAuditProvider, SubjectPolicyDeleteAuditProvider -from .serializers import SubjectDepartmentSLZ, SubjectGroupSLZ, UserRelationSLZ +from .serializers import SubjectGroupSLZ, UserRelationSLZ permission_logger = logging.getLogger("permission") @@ -49,9 +47,8 @@ class SubjectGroupViewSet(GenericViewSet): tags=["subject"], ) def list(self, request, *args, **kwargs): - _type = kwargs["subject_type"] - _id = kwargs["subject_id"] - relations = self.biz.list_subject_group(Subject(type=_type, id=_id), is_recursive=True) + subject = Subject(type=kwargs["subject_type"], id=kwargs["subject_id"]) + relations = self.biz.list_subject_group(subject, is_recursive=True) return Response([one.dict() for one in relations]) @swagger_auto_schema( @@ -63,17 +60,17 @@ def list(self, request, *args, **kwargs): ) @view_audit_decorator(SubjectGroupDeleteAuditProvider) def destroy(self, request, *args, **kwargs): + subject = Subject(type=kwargs["subject_type"], id=kwargs["subject_id"]) + serializer = UserRelationSLZ(data=request.query_params) serializer.is_valid(raise_exception=True) - data = serializer.validated_data - subject = Subject(type=kwargs["subject_type"], id=kwargs["subject_id"]) permission_logger.info("subject group delete by user: %s", request.user.username) - if data["type"] == "group": - group_id = data["id"] - self.biz.remove_members(group_id, [Subject.parse_obj({"type": subject.type, "id": subject.id})]) + # 目前只支持移除用户的直接加入的用户组，不支持其通过部门关系加入的用户组 + if data["type"] == SubjectRelationType.GROUP.value: + self.biz.remove_members(data["id"], [subject]) # 写入审计上下文 audit_context_setter(subject=subject, group=Subject.parse_obj(data)) @@ -81,46 +78,6 @@ def destroy(self, request, *args, **kwargs): return Response({}) -class SubjectDepartmentViewSet(GenericViewSet): - - permission_classes = [role_perm_class(PermissionCodeEnum.MANAGE_ORGANIZATION.value)] - - paginator = None # 去掉swagger中的limit offset参数 - - @swagger_auto_schema( - operation_description="我的权限-部门列表", - auto_schema=ResponseSwaggerAutoSchema, - responses={status.HTTP_200_OK: SubjectDepartmentSLZ(label="部门", many=True)}, - tags=["subject"], - ) - def list(self, request, *args, **kwargs): - _type = kwargs["subject_type"] - _id = kwargs["subject_id"] - if _type != "user": - return Response([]) - # 获取userid - user = User.objects.get(username=_id) - department_id_set = user.ancestor_department_ids - - if not department_id_set: - return Response([]) - - # TODO: [重构] view 不应该有这么原子调用，而是封装在biz层，迁移到biz.subject - # 哪些部门被授权过 - authorized_department_ids = PermTemplatePolicyAuthorized.objects.filter( - subject_type="department", subject_id__in=department_id_set - ).values_list("subject_id", flat=True) - authorized_department_ids = list(map(int, authorized_department_ids)) # 转为整型便于查询 - - # 查询被授过权的部门信息 - data = [ - {"id": dept.id, "name": dept.name, "full_name": dept.full_name} - for dept in Department.objects.filter(id__in=authorized_department_ids) - ] - - return Response(data) - - class SubjectSystemViewSet(GenericViewSet): permission_classes = [role_perm_class(PermissionCodeEnum.MANAGE_ORGANIZATION.value)] @@ -161,13 +118,13 @@ class SubjectPolicyViewSet(GenericViewSet): tags=["subject"], ) def list(self, request, *args, **kwargs): + subject = Subject(type=kwargs["subject_type"], id=kwargs["subject_id"]) + slz = SystemQuerySLZ(data=request.query_params) slz.is_valid(raise_exception=True) system_id = slz.validated_data["system_id"] - subject = Subject(type=kwargs["subject_type"], id=kwargs["subject_id"]) - policies = self.policy_query_biz.list_by_subject(system_id, subject) return Response([p.dict() for p in policies]) @@ -181,15 +138,17 @@ def list(self, request, *args, **kwargs): ) @view_audit_decorator(SubjectPolicyDeleteAuditProvider) def destroy(self, request, *args, **kwargs): + subject = Subject(type=kwargs["subject_type"], id=kwargs["subject_id"]) + slz = PolicyDeleteSLZ(data=request.query_params) slz.is_valid(raise_exception=True) system_id = slz.validated_data["system_id"] ids = slz.validated_data["ids"] - subject = Subject(type=kwargs["subject_type"], id=kwargs["subject_id"]) permission_logger.info("subject policy delete by user: %s", request.user.username) + # 为了记录审计日志，需要在删除前查询 policy_list = self.policy_query_biz.query_policy_list_by_policy_ids(system_id, subject, ids) # 删除权限 @@ -209,9 +168,10 @@ def destroy(self, request, *args, **kwargs): ) @view_audit_decorator(SubjectPolicyDeleteAuditProvider) def update(self, request, *args, **kwargs): + subject = Subject(type=kwargs["subject_type"], id=kwargs["subject_id"]) + slz = PolicyPartDeleteSLZ(data=request.data) slz.is_valid(raise_exception=True) - data = slz.validated_data policy_id = kwargs["pk"] @@ -220,8 +180,6 @@ def update(self, request, *args, **kwargs): condition_ids = data["ids"] condition = data["condition"] - subject = Subject(type=kwargs["subject_type"], id=kwargs["subject_id"]) - permission_logger.info("subject policy delete partial by user: %s", request.user.username) delete_policy = self.policy_operation_biz.delete_partial( diff --git a/saas/backend/apps/template/managers.py b/saas/backend/apps/template/managers.py index 13c281665..08e09fa4f 100644 --- a/saas/backend/apps/template/managers.py +++ b/saas/backend/apps/template/managers.py @@ -14,7 +14,7 @@ from django.db.models.query import QuerySet from django.shortcuts import get_object_or_404 -from backend.service.models.system import Subject +from backend.service.models import Subject class PermTemplateManager(models.Manager): diff --git a/saas/backend/apps/template/serializers.py b/saas/backend/apps/template/serializers.py index a00818301..d6389b230 100644 --- a/saas/backend/apps/template/serializers.py +++ b/saas/backend/apps/template/serializers.py @@ -21,8 +21,8 @@ from backend.apps.policy.serializers import BasePolicyActionSLZ from backend.apps.template.models import PermTemplate, PermTemplatePolicyAuthorized, PermTemplatePreUpdateLock from backend.biz.policy import PolicyBean, PolicyBeanList +from backend.biz.system import SystemBiz from backend.service.constants import SubjectType -from backend.service.system import SystemService from .constants import TemplateTag @@ -56,7 +56,7 @@ class TemplateListSLZ(serializers.ModelSerializer): def __init__(self, *args, **kwargs): self.authorized_template = kwargs.pop("authorized_template", set()) super().__init__(*args, **kwargs) - self._system_list = SystemService().new_system_list() + self._system_list = SystemBiz().new_system_list() self._lock_ids = set() if isinstance(self.instance, (QuerySet, list)) and self.instance: diff --git a/saas/backend/apps/user/tasks.py b/saas/backend/apps/user/tasks.py index 591682385..9c2c00adb 100644 --- a/saas/backend/apps/user/tasks.py +++ b/saas/backend/apps/user/tasks.py @@ -21,12 +21,11 @@ from backend.apps.organization.models import User from backend.apps.subject.audit import log_user_cleanup_policy_audit_event from backend.biz.group import GroupBiz -from backend.biz.policy import PolicyQueryBiz +from backend.biz.policy import PolicyOperationBiz, PolicyQueryBiz from backend.common.time import db_time, get_soon_expire_ts from backend.component import esb from backend.service.constants import SubjectType from backend.service.models import Subject -from backend.service.policy.query import PolicyQueryService logger = logging.getLogger("celery") @@ -79,7 +78,8 @@ def user_cleanup_expired_policy(): """ 清理用户的长时间过期策略 """ - policy_svc = PolicyQueryService() + policy_query_biz = PolicyQueryBiz() + policy_operation_biz = PolicyOperationBiz() expired_at = int(db_time()) - settings.MAX_EXPIRED_POLICY_DELETE_TIME task_id = user_cleanup_expired_policy.request.id @@ -96,14 +96,15 @@ def user_cleanup_expired_policy(): subject = Subject(type=SubjectType.USER.value, id=user.username) # 查询用户指定过期时间之前的所有策略 - policies = policy_svc.list_backend_policy_before_expired_at(expired_at, subject) + policies = policy_query_biz.list_expired(subject, expired_at) if not policies: continue # 分系统删除过期的策略 sorted_policies = sorted(policies, key=lambda p: p.system) for system_id, per_policies in groupby(sorted_policies, lambda p: p.system): - audit_policies = policy_svc.delete_by_ids(system_id, subject, [p.id for p in per_policies]) + per_policies = list(per_policies) + policy_operation_biz.delete_by_ids(system_id, subject, [p.id for p in per_policies]) # 记审计信息 - log_user_cleanup_policy_audit_event(task_id, user, system_id, audit_policies) + log_user_cleanup_policy_audit_event(task_id, user, system_id, per_policies) diff --git a/saas/backend/apps/user/views.py b/saas/backend/apps/user/views.py index 2455b34fd..e8a65a619 100644 --- a/saas/backend/apps/user/views.py +++ b/saas/backend/apps/user/views.py @@ -26,7 +26,7 @@ from backend.common.serializers import SystemQuerySLZ from backend.common.swagger import ResponseSwaggerAutoSchema from backend.common.time import get_soon_expire_ts -from backend.service.constants import SubjectType +from backend.service.constants import SubjectRelationType, SubjectType from backend.service.models import Subject from .serializers import GroupSLZ, UserNewbieSLZ, UserNewbieUpdateSLZ @@ -61,17 +61,17 @@ def list(self, request, *args, **kwargs): ) @view_audit_decorator(SubjectGroupDeleteAuditProvider) def destroy(self, request, *args, **kwargs): + subject = Subject(type=SubjectType.USER.value, id=request.user.username) + serializer = UserRelationSLZ(data=request.query_params) serializer.is_valid(raise_exception=True) - data = serializer.validated_data - subject = Subject(type=SubjectType.USER.value, id=request.user.username) permission_logger.info("subject group delete by user: %s", request.user.username) - if data["type"] == "group": - group_id = data["id"] - self.biz.remove_members(group_id, [Subject.parse_obj({"type": subject.type, "id": subject.id})]) + # 目前只支持移除用户的直接加入的用户组，不支持其通过部门关系加入的用户组 + if data["type"] == SubjectRelationType.GROUP.value: + self.biz.remove_members(data["id"], [subject]) # 写入审计上下文 audit_context_setter(subject=subject, group=Subject.parse_obj(data)) diff --git a/saas/backend/audit/detail.py b/saas/backend/audit/detail.py index 01ec4166e..df89f6fab 100644 --- a/saas/backend/audit/detail.py +++ b/saas/backend/audit/detail.py @@ -19,11 +19,11 @@ from backend.apps.template.models import PermTemplate from backend.audit.models import Event from backend.biz.subject import SubjectInfoList +from backend.biz.system import SystemBiz from backend.service.action import ActionService from backend.service.approval import ApprovalProcessService from backend.service.constants import ApplicationTypeEnum -from backend.service.models.system import Subject -from backend.service.system import SystemService +from backend.service.models import Subject from backend.util.time import timestamp_to_local from .constants import AuditObjectType, AuditType @@ -53,7 +53,7 @@ def sub_objects(self) -> List: perm_templates = PermTemplate.objects.filter(id__in=[t["template_id"] for t in templates]) data = [{"type": AuditObjectType.TEMPLATE.value, "id": t.id, "name": t.name} for t in perm_templates] - system_list = SystemService().new_system_list() + system_list = SystemBiz().new_system_list() for t in templates: if t["template_id"] != 0: continue @@ -111,13 +111,13 @@ def sub_objects(self) -> List: class SubjectPoliciesProvider(BaseProvider): - svc = SystemService() + biz = SystemBiz() @property def extra_info(self) -> Dict: extra = self.event.extra system_id = extra["system_id"] - system = self.svc.get(system_id) + system = self.biz.get(system_id) policies = extra["policies"] for p in policies: if "expired_at" in p and p["expired_at"]: @@ -127,13 +127,13 @@ def extra_info(self) -> Dict: class SubjectPoliciesUpdateProvider(BaseProvider): - svc = SystemService() + biz = SystemBiz() @property def extra_info(self) -> Dict: extra = self.event.extra system_id = extra["system_id"] - system = self.svc.get(system_id) + system = self.biz.get(system_id) policies = extra["policies"] for p in policies: if "expired_at" in p and p["expired_at"]: @@ -275,13 +275,13 @@ def description(self) -> str: class ApprovalActionProvider(ApprovalNameMixin, BaseProvider): - system_svc = SystemService() + system_biz = SystemBiz() action_svc = ActionService() @property def description(self) -> str: system_id = self.event.extra["system_id"] - system = self.system_svc.get(system_id) + system = self.system_biz.get(system_id) process_id = self.event.extra["process_id"] process_name = self.get_process_name(process_id) return f"设置 [{system.name}] 系统操作审批流程: {process_name}(#{process_id})" diff --git a/saas/backend/audit/serializers.py b/saas/backend/audit/serializers.py index 1155bd899..ae33860ac 100644 --- a/saas/backend/audit/serializers.py +++ b/saas/backend/audit/serializers.py @@ -15,7 +15,7 @@ from backend.apps.role.models import Role from backend.audit.detail import EventDetailExtra from backend.audit.models import EventForMeta -from backend.service.system import SystemService +from backend.biz.system import SystemBiz class EventListSchemaSLZ(serializers.ModelSerializer): @@ -43,7 +43,7 @@ def get_system(self, obj): class EventListSLZ(EventListSchemaSLZ): def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) - self._systems = {s.id: s for s in SystemService().list()} + self._systems = {s.id: s for s in SystemBiz().list()} def get_system(self, obj): system_id = obj.system_id @@ -106,7 +106,7 @@ def get_role_name(self, obj): class EventDetailSLZ(EventDetailSchemaSLZ): def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) - self._systems = {s.id: s for s in SystemService().list()} + self._systems = {s.id: s for s in SystemBiz().list()} if self.instance: self._extra = EventDetailExtra(self.instance) diff --git a/saas/backend/biz/action.py b/saas/backend/biz/action.py index 2813bbd24..c11c77fa1 100644 --- a/saas/backend/biz/action.py +++ b/saas/backend/biz/action.py @@ -14,8 +14,6 @@ from pydantic.main import BaseModel from pydantic.tools import parse_obj_as -from backend.apps.action.constants import ActionTag -from backend.biz.role import RoleListQuery from backend.common.error_codes import error_codes from backend.service.action import ActionList, ActionService from backend.service.constants import ACTION_ALL, SubjectType @@ -24,6 +22,9 @@ from backend.service.resource_type import ResourceTypeService from backend.util.model import ExcludeModel +from .constants import ActionTag +from .role import RoleListQuery + class RelatedResourceTypeBean(RelatedResourceType, ExcludeModel): __exclude__ = ["instance_selections"] @@ -92,18 +93,15 @@ class ActionBiz: resource_type_svc = ResourceTypeService() policy_svc = PolicyQueryService() - def _list(self, system_id: str) -> ActionBeanList: + def list(self, system_id: str) -> ActionBeanList: actions = self.action_svc.list(system_id) action_list = ActionBeanList(parse_obj_as(List[ActionBean], actions)) action_list.fill_related_resource_type_name() return action_list - def list(self, system_id: str) -> List[ActionBean]: - return self._list(system_id).actions - def list_by_role(self, system_id: str, role) -> List[ActionBean]: - action_list = self._list(system_id) + action_list = self.list(system_id) scope_action_ids = RoleListQuery(role).list_scope_action_id(system_id) actions = action_list.filter_by_scope_action_ids(scope_action_ids) @@ -149,7 +147,7 @@ def list_pre_application_actions( def search(self, system_id: str, condition: ActionSearchCondition) -> List[ActionBean]: """搜索过滤某个系统下的操作""" - action_list = self._list(system_id) + action_list = self.list(system_id) # 搜索条件 if condition.keyword: action_list = ActionBeanList(action_list.filter_by_name(condition.keyword)) diff --git a/saas/backend/biz/constants.py b/saas/backend/biz/constants.py index 8f966f4f0..14d6d1dfd 100644 --- a/saas/backend/biz/constants.py +++ b/saas/backend/biz/constants.py @@ -27,3 +27,9 @@ class ConditionTag(LowerStrEnum): ADD = auto() DELETE = auto() UNCHANGED = auto() + + +class ActionTag(LowerStrEnum): + READONLY = auto() + CHECKED = auto() + UNCHECKED = auto() diff --git a/saas/backend/biz/group.py b/saas/backend/biz/group.py index 8bf93b440..9c9f6273e 100644 --- a/saas/backend/biz/group.py +++ b/saas/backend/biz/group.py @@ -36,8 +36,8 @@ from backend.service.engine import EngineService from backend.service.group import GroupCreate, GroupMemberExpiredAt, GroupService, SubjectGroup from backend.service.group_saas_attribute import GroupAttributeService -from backend.service.models import Subject -from backend.service.policy.query import Policy, PolicyQueryService +from backend.service.models import Policy, Subject +from backend.service.policy.query import PolicyQueryService from backend.service.role import RoleService, UserRole from backend.service.system import SystemService from backend.service.template import TemplateService @@ -130,6 +130,7 @@ class GroupBiz: update = GroupService.__dict__["update"] get_member_count_before_expired_at = GroupService.__dict__["get_member_count_before_expired_at"] list_exist_groups_before_expired_at = GroupService.__dict__["list_exist_groups_before_expired_at"] + batch_get_attributes = GroupAttributeService.__dict__["batch_get_attributes"] def create_and_add_members( self, role_id: int, name: str, description: str, creator: str, subjects: List[Subject], expired_at: int diff --git a/saas/backend/biz/policy.py b/saas/backend/biz/policy.py index cb42f7662..f386aa976 100644 --- a/saas/backend/biz/policy.py +++ b/saas/backend/biz/policy.py @@ -8,11 +8,14 @@ an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. """ +import functools import time from copy import deepcopy from itertools import chain, groupby from typing import Any, Dict, Iterable, List, Optional, Set, Tuple +from django.core.cache import cache +from django.utils.decorators import method_decorator from django.utils.translation import gettext as _ from pydantic.tools import parse_obj_as @@ -22,25 +25,22 @@ from backend.service.constants import ANY_ID from backend.service.models import ( Action, - InstanceSelection, - PathResourceType, - RelatedResourceType, - ResourceTypeDict, - Subject, -) -from backend.service.models.resource_type import ResourceNode -from backend.service.models.system import System -from backend.service.policy.operation import PolicyOperationService -from backend.service.policy.query import ( BackendThinPolicy, Condition, Instance, + InstanceSelection, PathNode, + PathResourceType, Policy, - PolicyQueryService, RelatedResource, + RelatedResourceType, + ResourceTypeDict, + Subject, + System, SystemCounter, ) +from backend.service.policy.operation import PolicyOperationService +from backend.service.policy.query import PolicyQueryService from backend.service.resource_type import ResourceTypeService from backend.service.system import SystemService from backend.service.utils.translate import translate_path @@ -111,13 +111,6 @@ def ignore_path(self, selection: InstanceSelection) -> List[PathNodeBean]: def display(self) -> str: return "/".join(["{}:{}".format(node.type, node.name) for node in self.nodes]) - def fill_node_name(self, resource_info_name_dict: Dict[ResourceNode, str]): - """ - 填充节点name - """ - for node in self.nodes: - node.name = resource_info_name_dict[ResourceNode.parse_obj(node)] - class InstanceBean(Instance): path: List[List[PathNodeBean]] @@ -761,29 +754,29 @@ def split_to_creation_and_update_for_grant( def split_to_update_and_delete_for_revoke( self, delete_policy_list: "PolicyBeanList" - ) -> Tuple["PolicyBeanList", List[int]]: + ) -> Tuple["PolicyBeanList", "PolicyBeanList"]: """ 回收权限时, 分离出需要更新的策略与删除的策略ID self: 原来已有的policy list delete_policy_list: 需要回收的policy list """ - update_policies, delete_policy_ids = [], [] + update_policies, delete_policies = [], [] for p in self.policies: delete_policy = delete_policy_list.get(p.action_id) if not delete_policy: continue if p.is_unrelated(): - delete_policy_ids.append(p.policy_id) + delete_policies.append(p) continue try: update_policies.append(p.remove_related_resource_types(delete_policy.related_resource_types)) except PolicyEmptyException: - delete_policy_ids.append(p.policy_id) + delete_policies.append(p) - return PolicyBeanList(self.system_id, update_policies), delete_policy_ids + return PolicyBeanList(self.system_id, update_policies), PolicyBeanList(self.system_id, delete_policies) def add(self, policy_list: "PolicyBeanList") -> "PolicyBeanList": """ @@ -914,6 +907,13 @@ def list_by_subject(self, system_id: str, subject: Subject) -> List[PolicyBean]: policy_list = self.new_policy_list(system_id, subject) return policy_list.policies + def list_by_subject_and_action(self, system_id: str, subject: Subject, action_ids: List[str]) -> List[PolicyBean]: + """ + 查询subject指定系统指定操作列表的策略 + """ + policies = self.list_by_subject(system_id, subject) + return [p for p in policies if p.action_id in action_ids] + def new_policy_list(self, system_id: str, subject: Subject) -> PolicyBeanList: policies = self.svc.list_by_subject(system_id, subject) policy_list = PolicyBeanList(system_id, parse_obj_as(List[PolicyBean], policies), need_fill_empty_fields=True) @@ -991,31 +991,56 @@ def get_system_policy(self, subject: Subject, policy_id: int) -> Tuple[str, Poli return system_id, policy_list.policies[0] +def policy_change_lock(func): + """装饰器：策略变更的分布式全局锁，避免并发导致数据错误 + Note: 若被添加于类的方法上，需要使用method_decorator，主要是为了不关注类的self/cls参数 + from django.utils.decorators import method_decorator + method_decorator(policy_change_lock) + """ + + @functools.wraps(func) + def wrapper(*args, **kwargs): + # Note: 必须保证被装饰的函数有参数system_id和subject + system_id = kwargs["system_id"] if "system_id" in kwargs else args[1] + subject = kwargs["subject"] if "subject" in kwargs else args[2] + # TODO: 后面重构cache模块时统一定义前缀 + lock_key = f"bk_iam:lock:{system_id}:{subject.type}:{subject.id}" + # 加 system + subject 锁 + with cache.lock(lock_key, timeout=10): + func(*args, **kwargs) + + return wrapper + + class PolicyOperationBiz: query_biz = PolicyQueryBiz() svc = PolicyOperationService() + @method_decorator(policy_change_lock) def delete_by_ids(self, system_id: str, subject: Subject, policy_ids: List[int]): """ 删除policies """ self.svc.delete_by_ids(system_id, subject, policy_ids) + @method_decorator(policy_change_lock) def delete_partial( self, + system_id: str, subject: Subject, policy_id: int, resource_system_id: str, resource_type_id: str, condition_ids: List[str], conditions: List[ConditionBean], - ) -> Tuple[str, PolicyBean]: + ) -> PolicyBean: """ Policy条件部分删除 返回更新后的Policy """ - system_id, policy = self.query_biz.get_system_policy(subject, policy_id) + # 为避免需要忽略的变量与国际化翻译函数变量名"_"冲突，所以使用"__" + __, policy = self.query_biz.get_system_policy(subject, policy_id) resource_type = policy.get_related_resource_type(resource_system_id, resource_type_id) if not resource_type: raise error_codes.VALIDATE_ERROR.format(_("{}: {} 资源类型不存在").format(resource_system_id, resource_type_id)) @@ -1034,8 +1059,9 @@ def delete_partial( policy.set_related_resource_type(resource_type) self.svc.alter(system_id, subject, update_policies=[Policy.parse_obj(policy)]) - return system_id, policy + return policy + @method_decorator(policy_change_lock) def update(self, system_id: str, subject: Subject, policies: List[PolicyBean]) -> List[PolicyBean]: """ 更新subject的权限策略 @@ -1055,6 +1081,7 @@ def update(self, system_id: str, subject: Subject, policies: List[PolicyBean]) - return update_policy_list.policies + @method_decorator(policy_change_lock) def alter(self, system_id: str, subject: Subject, policies: List[PolicyBean]): """ 变更subject权限策略 @@ -1072,6 +1099,30 @@ def alter(self, system_id: str, subject: Subject, policies: List[PolicyBean]): update_policies=update_policy_list.to_svc_policies(), ) + @method_decorator(policy_change_lock) + def revoke(self, system_id: str, subject: Subject, delete_policies: List[PolicyBean]) -> List[PolicyBean]: + """ + 删除策略，这里diff可能进行部分删除，若完全一样，则整条策略删除 + 返回受影响的策略 + """ + old_policy_list = self.query_biz.new_policy_list(system_id, subject) + deleted_policy_list = PolicyBeanList(system_id, delete_policies) + + # 获取需要更新和整条删除的策略 + update_policy_list, whole_delete_policy_list = old_policy_list.split_to_update_and_delete_for_revoke( + deleted_policy_list + ) + # 变更策略 + self.svc.alter( + system_id=system_id, + subject=subject, + create_policies=[], + update_policies=update_policy_list.to_svc_policies(), + delete_policy_ids=[p.policy_id for p in whole_delete_policy_list.policies], + ) + + return update_policy_list.policies + whole_delete_policy_list.policies + def group_paths(paths: List[List[Dict]]) -> List[InstanceBean]: """ diff --git a/saas/backend/biz/policy_tag.py b/saas/backend/biz/policy_tag.py index 72cf4dc28..a31a19cb1 100644 --- a/saas/backend/biz/policy_tag.py +++ b/saas/backend/biz/policy_tag.py @@ -20,7 +20,7 @@ PolicyBeanList, RelatedResourceBean, ) -from backend.service.policy.query import Attribute, Value +from backend.service.models import Attribute, Value from backend.service.utils.translate import translate_path from .constants import ConditionTag, PolicyTag diff --git a/saas/backend/biz/resource_creator_action.py b/saas/backend/biz/resource_creator_action.py new file mode 100644 index 000000000..851abbca9 --- /dev/null +++ b/saas/backend/biz/resource_creator_action.py @@ -0,0 +1,68 @@ +# -*- coding: utf-8 -*- +""" +TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. +Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. +Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. +You may obtain a copy of the License at http://opensource.org/licenses/MIT +Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on +an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the +specific language governing permissions and limitations under the License. +""" +from typing import List + +from pydantic import BaseModel + +from backend.common.error_codes import error_codes +from backend.service.models import ResourceCreatorActionConfigItem +from backend.service.resource_creator_action import ResourceCreatorActionService + + +class ResourceCreatorActionBean(BaseModel): + id: str # 资源类型ID + action_ids: List[str] # 该资源类型的实例被创建时，对应创建者需要的该资源实例的操作权限 + + +class ResourceCreatorActionBiz: + svc = ResourceCreatorActionService() + + def list_action_id(self, system_id: str, resource_type_id: str) -> List[str]: + """查询某个资源类型当其实例被创建时，创建者需要的操作权限""" + resource_creator_action_config = self.svc.get(system_id) + # 空的话，说明接入系统未配置，必须报错 + if resource_creator_action_config is None: + raise error_codes.VALIDATE_ERROR.format( + "system[{}] do not register resource_creator_actions config".format(system_id) + ) + + # 由于配置是按照资源类型层级存储的，所以需要将其平铺便于后续查询 + rac_beans = self._tiled_resource_creator_action(resource_creator_action_config.config) + resource_type_actions_dict = {i.id: i.action_ids for i in rac_beans} + + # 判断是否存在，不存在直接提示 + if resource_type_id not in resource_type_actions_dict: + raise error_codes.VALIDATE_ERROR.format( + "system[{}]-action[{}] do not register actions for authorization of creator".format( + system_id, resource_type_id + ) + ) + + return resource_type_actions_dict[resource_type_id] + + def _tiled_resource_creator_action( + self, rca_config: List[ResourceCreatorActionConfigItem] + ) -> List[ResourceCreatorActionBean]: + """将新建关联配置按照资源类型平铺""" + rac_beans = [] + + for config_item in rca_config: + rac_beans.append( + ResourceCreatorActionBean(id=config_item.id, action_ids=[a.id for a in config_item.actions]) + ) + if config_item.sub_resource_types is None: + continue + # 遍历子资源类型 + for sub_rca_config in config_item.sub_resource_types: + sub_rac_beans = self._tiled_resource_creator_action(sub_rca_config) + rac_beans.extend(sub_rac_beans) + + return rac_beans diff --git a/saas/backend/biz/role.py b/saas/backend/biz/role.py index e71810640..bf9ac1267 100644 --- a/saas/backend/biz/role.py +++ b/saas/backend/biz/role.py @@ -44,9 +44,8 @@ RoleType, SubjectType, ) -from backend.service.models import Subject, System -from backend.service.policy.query import Attribute -from backend.service.role import AuthScopeSystem, RoleInfo, RoleService +from backend.service.models import Attribute, Subject, System +from backend.service.role import AuthScopeAction, AuthScopeSystem, RoleInfo, RoleService from backend.service.system import SystemService logger = logging.getLogger("app") @@ -182,6 +181,46 @@ def get_auth_scope_bean_by_system(self, role_id: int, system_id: str) -> Optiona return None + def inc_update_auth_scope(self, role_id: int, system_id: str, incr_policies: List[PolicyBean]): + """增量更新分级管理员的授权范围 + Note: 这里没有判断是否已经包含了，而是直接合并添加，比如已有父资源，则增量里有子资源也会添加 + 需要去除包含的，则单独在外层调用RoleAuthorizationScopeChecker进行判断去除，然后提取增量数据后再调用 + """ + # 增量数据为空，无需更新 + if len(incr_policies) == 0: + return + # 转为PolicyList，便于进行数据合并操作 + incr_policy_list = PolicyBeanList(system_id=system_id, policies=incr_policies, need_fill_empty_fields=True) + + # 查询已有的可授权范围 + auth_scopes = self.svc.list_auth_scope(role_id) + + # 遍历，查找需要修改的数据和对应位置 + need_modified_policy_list = PolicyBeanList(system_id=system_id, policies=[]) + index = -1 + for idx, auth_scope in enumerate(auth_scopes): + if auth_scope.system_id == system_id: + index = idx + need_modified_policy_list = PolicyBeanList( + system_id=system_id, policies=parse_obj_as(List[PolicyBean], auth_scope.actions) + ) + break + + # 合并增量数据 + need_modified_policy_list.add(incr_policy_list) + + # 修改已有的可授权范围 + new_auth_scope = AuthScopeSystem( + system_id=system_id, actions=parse_obj_as(List[AuthScopeAction], need_modified_policy_list.policies) + ) + if index == -1: + auth_scopes.append(new_auth_scope) + else: + auth_scopes[index] = new_auth_scope + + # 变更可授权的权限范围 + self.svc.update_role_auth_scope(role_id, auth_scopes) + class RoleCheckBiz: def check_unique_name(self, new_name: str, old_name: str = ""): @@ -264,8 +303,6 @@ def query_group(self): """ 查询用户组列表 """ - assert self.user - group_ids = self._get_role_related_object_ids(RoleRelatedObjectType.GROUP.value) return Group.objects.filter(id__in=group_ids) @@ -277,6 +314,7 @@ def _get_role_related_object_ids(self, object_type: str) -> List[int]: ) ) + assert self.user mgr_ids = self._list_authorization_scope_include_user_role_ids() # 查询 所有这些管理员创建的 对象 ids return list( @@ -438,6 +476,24 @@ def check_policies(self, system_id: str, policies: List[PolicyBean]): for p in policies: self._check_policy_in_scope(system_id, p) + def list_not_match_policy(self, system_id: str, policies: List[PolicyBean]) -> List[PolicyBean]: + """与check_policies的检测逻辑一样，只是不直接抛异常，而是返回不满足的策略""" + try: + self._check_system_in_scope(system_id) + except APIException: + # 整个系统都不满足，则返回原有所有策略 + return policies + + # 遍历每条权限进行判断 + not_match_policies = [] + for p in policies: + try: + self._check_policy_in_scope(system_id, p) + except APIException: + not_match_policies.append(p) + + return not_match_policies + def _check_policy_in_scope(self, system_id, policy: PolicyBean): if self._check_action_in_scope(system_id, policy.action_id) == ACTION_ALL: return diff --git a/saas/backend/biz/subject.py b/saas/backend/biz/subject.py index c72f1f137..ea45db12b 100644 --- a/saas/backend/biz/subject.py +++ b/saas/backend/biz/subject.py @@ -82,8 +82,3 @@ def _to_subject_infos(self, subjects: List[Subject]) -> List[SubjectInfo]: subject_infos.append(subject_info) return subject_infos - - -# ---------------------------------------------------------------------------------------------- # -# [重构] biz.Subject：提供Subject相关数据组装、校验、填充后数据等给到View层调用，调用service层获取相关数据 -# ---------------------------------------------------------------------------------------------- # diff --git a/saas/backend/biz/system.py b/saas/backend/biz/system.py new file mode 100644 index 000000000..a6effd4bb --- /dev/null +++ b/saas/backend/biz/system.py @@ -0,0 +1,25 @@ +# -*- coding: utf-8 -*- +""" +TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. +Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. +Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. +You may obtain a copy of the License at http://opensource.org/licenses/MIT +Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on +an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the +specific language governing permissions and limitations under the License. +""" +from typing import List + +from backend.service.system import SystemService + + +class SystemBiz: + svc = SystemService() + + get = SystemService.__dict__["get"] + list = SystemService.__dict__["list"] + new_system_list = SystemService.__dict__["new_system_list"] + + def list_client(self, system_id: str) -> List[str]: + """查询可访问系统的clients""" + return self.svc.list_client(system_id) diff --git a/saas/backend/biz/template.py b/saas/backend/biz/template.py index 53cec890c..666d6817f 100644 --- a/saas/backend/biz/template.py +++ b/saas/backend/biz/template.py @@ -39,8 +39,7 @@ from backend.common.time import PERMANENT_SECONDS from backend.service.action import ActionList, ActionService from backend.service.constants import RoleRelatedObjectType, SubjectType, TemplatePreUpdateStatus -from backend.service.models import Action, ChainNode, Subject -from backend.service.policy.query import Policy +from backend.service.models import Action, ChainNode, Policy, Subject from backend.service.template import TemplateGroupPreCommit, TemplateService diff --git a/saas/backend/biz/trans/open.py b/saas/backend/biz/trans/open.py deleted file mode 100644 index 554c2426e..000000000 --- a/saas/backend/biz/trans/open.py +++ /dev/null @@ -1,316 +0,0 @@ -# -*- coding: utf-8 -*- -""" -TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. -Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. -Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. -You may obtain a copy of the License at http://opensource.org/licenses/MIT -Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on -an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the -specific language governing permissions and limitations under the License. -""" -from typing import Dict, List - -from pydantic.tools import parse_obj_as - -from backend.common.error_codes import error_codes - -from ..action import ActionCheckBiz, ActionForCheck -from ..instance_selection import InstanceSelectionBean, InstanceSelectionBiz, PathResourceTypeBean -from ..policy import PolicyBean, PolicyBeanList, group_paths -from ..resource import ResourceBiz, ResourceNodeBean, ResourceNodeNameDictBean - - -class OpenCommonTrans: - """主要是处理open api的通用处理，因为所有open api都会保持相同的概念协议，所有很多转换逻辑都是通用""" - - resource_biz = ResourceBiz() - - def _list_instance_name_by_paths(self, paths: List[List[Dict]]) -> ResourceNodeNameDictBean: - """查询所有路径里的资源实例名称 - paths: [ - [ - { - system, - type, - id, - }, - ... - ] - ] - """ - resource_nodes = [ - ResourceNodeBean(system_id=node["system"], type=node["type"], id=node["id"]) - for path in paths - for node in path - ] - # 查询资源Name - return self.resource_biz.fetch_resource_name(resource_nodes, raise_not_found_exception=True) - - @staticmethod - def _fill_paths_instance_name(paths: List[List[Dict]], name_provider: ResourceNodeNameDictBean): - """查询所有路径里的资源实例名称 - paths: [ - [ - { - system, - type, - id, - }, - ... - ] - ] - """ - for path in paths: - for node in path: - node["name"] = name_provider.get_name(node["system"], node["type"], node["id"]) - - def _fill_paths_instance_name_for_actions(self, actions: List[Dict]): - """给(多个)路径填充资源实例名称 - actions: [ - { - id: 操作ID - related_resource_types: [ - { - system, - type, - instances: [ - [ - { - system, - type, - id, - }, - ... - ] - ], - } - ] - } - ] - """ - # 1. 遍历所有操作里的所有路径 - paths = [] - for action in actions: - for rrt in action["related_resource_types"]: - paths.extend(rrt["instances"]) - - # 2. 查询路径里的资源实例 - resource_node_name_dict = self._list_instance_name_by_paths(paths) - - # 3. 填充实例名称 - for action in actions: - for rrt in action["related_resource_types"]: - self._fill_paths_instance_name(rrt["instances"], resource_node_name_dict) - - -class AccessSystemApplicationTrans(OpenCommonTrans): - """接入系统请求自定义权限的申请链接的请求数据""" - - action_check_biz = ActionCheckBiz() - instance_selection_biz = InstanceSelectionBiz() - - def _raise_match_selection_fail_exception(self, path): - raise error_codes.VALIDATE_ERROR.format(f"resource({path}) not satisfy instance selection") - - def _fill_instance_path_system(self, path: List[Dict], selections: List[InstanceSelectionBean]): - """使用实例视图，对资源实例路径进行system填充 - path: [ - { - system, # 大部分情况下为空，只有引用了其他系统资源同时与当前系统的资源类型ID冲突时才需要 - type, - id, - }, - ... - ] - """ - # 遍历每个实例视图，查询哪些实例视图与path是匹配 - path_resource_types = [ - PathResourceTypeBean(system_id=node.get("system", ""), id=node["type"]) for node in path - ] - match_selections = [selection for selection in selections if selection.match_path(path_resource_types)] - - # 若没有任何一个实例视图匹配，说明数据有问题，直接异常 - if not match_selections: - self._raise_match_selection_fail_exception(path) - - # 判断是否路径上每个节点都有system，有的话不需要使用实例视图填充 - if all([node.get("system") != "" for node in path]): - return - - # 取匹配的实例视图的第一个来做填充 - first_match_selection = match_selections[0] - - # 获取到实例视图提供的系统列表, 填充到现有的path中 - system_ids = first_match_selection.list_match_path_system_id(path_resource_types) - for node, system_id in zip(path, system_ids): - node["system"] = system_id - - # 如果有多个实例视图可以匹配, 所有实例视图返回的system_ids必须一致 - for selection in match_selections[1:]: - if system_ids != selection.list_match_path_system_id(path_resource_types): - self._raise_match_selection_fail_exception(path) - - def _fill_instance_system(self, system_id: str, action: Dict): - """填充system，由于申请数据里的资源实例只有type和id，不知道该资源是哪个系统的，所以需要根据权限模型的进行填充 - action: { - id: 操作ID - related_resource_types: [ - { - system, - type, - instances: [ - [ - { - system, # 大部分情况下为空，只有引用了其他系统资源同时与当前系统的资源类型ID冲突时才需要 - type, - id, - }, - ... - ] - ] - } - ] - } - """ - # 使用模型里的实例视图进行填充 - for rrt in action["related_resource_types"]: - # 查询实例视图 - selections = self.instance_selection_biz.list_by_action_resource_type( - system_id, action["id"], rrt["system"], rrt["type"] - ) - - # 对于只支持属性配置的操作，不需要填充 - if not selections: - # 没有实例视图，但是在授权时配置里实例，则不允许 - if rrt["instances"]: - raise error_codes.VALIDATE_ERROR.format(f"action({action['id']}) not support to grant instance") - continue - - # 填充instance的system_id - for path in rrt["instances"]: - self._fill_instance_path_system(path, selections) - - @staticmethod - def _to_policy(action: Dict) -> PolicyBean: - """申请的数据转换为策略数据结构 - action: { - id: 操作ID - related_resource_types: [ - { - system, - type, - instances: [ - [ - { - system, - type, - id, - name, - }, - ... - ] - ], - attributes: [ - { - id, - name, - values: [ - { - id, - name - }, - ... - ] - }, - ... - ] - } - ] - } - """ - related_resource_types = [] - for rt in action["related_resource_types"]: - # 将path里system转为system_id - for path in rt["instances"]: - for node in path: - node["system_id"] = node.pop("system") - - # 将多个以path方式表示的实例进行分组 - instances = group_paths(rt["instances"]) - - related_resource_types.append( - { - "system_id": rt["system"], - "type": rt["type"], - "condition": [{"instances": instances, "attributes": rt["attributes"]}], - } - ) - - return PolicyBean.parse_obj({"action_id": action["id"], "related_resource_types": related_resource_types}) - - def to_policies(self, data: Dict) -> PolicyBeanList: - """ - 组装出申请的策略 - { - system: - actions: [ - { - id: 操作ID - related_resource_types: [ - { - system, - type, - instances: [ - [ - { - system, # 大部分情况下为空，只有引用了其他系统资源同时与当前系统的资源类型ID冲突时才需要 - type, - id, - }, - ... - ] - ], - attributes: [ - { - id, - name, - values: [ - { - id, - name - }, - ... - ] - }, - ... - ] - } - ] - } - ] - } - """ - system_id = data["system"] - actions = data["actions"] - - # 1. 初步检查是否合法数据，与权限模型是否一致 - self.action_check_biz.check(system_id, parse_obj_as(List[ActionForCheck], actions)) - - # 2. 遍历每个授权操作的策略，对实例的system_id进行填充 - for action in actions: - self._fill_instance_system(system_id, action) - - # 3. 将给所有资源实例添加名字 - self._fill_paths_instance_name_for_actions(actions) - - # 4. 转换为策略数据结构 - policies = [self._to_policy(action) for action in actions] - policy_list = PolicyBeanList( - system_id=system_id, - policies=policies, - need_fill_empty_fields=True, - need_check_instance_selection=False, - need_ignore_path=False, - ) - - return policy_list diff --git a/saas/backend/biz/trans/policy_related_resources.py b/saas/backend/biz/trans/policy_related_resources.py deleted file mode 100644 index a264441ec..000000000 --- a/saas/backend/biz/trans/policy_related_resources.py +++ /dev/null @@ -1,47 +0,0 @@ -# -*- coding: utf-8 -*- -""" -TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. -Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. -Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. -You may obtain a copy of the License at http://opensource.org/licenses/MIT -Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on -an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the -specific language governing permissions and limitations under the License. -""" -from typing import Dict, List - -from backend.biz.policy import ConditionBean, RelatedResourceBean, group_paths - - -class ToPolicyRelatedResources: - """转换为策略里Action关联的资源实例数据结构，可能 包括多种资源类型""" - - @staticmethod - def _from_single_resource_paths(resource: Dict) -> RelatedResourceBean: - """ - resource数据结构：{system, type, paths:[ [{system, type, id, name}], [...], ...] } - """ - # 将paths:[ [{system, type, id, name}], [...], ...]里的system改为system_id - # 因为group_paths方法里系统key是以system_id标识的 - for path in resource["paths"]: - for node in path: - node["system_id"] = node.pop("system") - - # RelatedResource.Condition.Instances是以分类后的资源实例存储的 - instances = group_paths(resource["paths"]) - - # 若instances为空，则为无限制 - condition = [ConditionBean(instances=instances, attributes=[])] if instances else [] - - # 构造RelatedResource数据 - return RelatedResourceBean(system_id=resource["system"], type=resource["type"], condition=condition) - - def from_resource_paths(self, resources: List[Dict]) -> List[RelatedResourceBean]: - """ - resources 数据结构：[ - {system, type, paths:[ [{system, type, id, name}], [...], ...] } - ] - 将API里的Resources数据转换为Policy RelatedResourceTypes数据结构 - 这里的Resources指的Action关联的多种资源类型，并非批量资源实例 - """ - return [self._from_single_resource_paths(r) for r in resources] diff --git a/saas/backend/common/authentication.py b/saas/backend/common/authentication.py new file mode 100644 index 000000000..182ad9704 --- /dev/null +++ b/saas/backend/common/authentication.py @@ -0,0 +1,40 @@ +# -*- coding: utf-8 -*- +""" +TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. +Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. +Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. +You may obtain a copy of the License at http://opensource.org/licenses/MIT +Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on +an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the +specific language governing permissions and limitations under the License. +""" +from django.conf import settings +from django.contrib.auth import get_user_model +from rest_framework.authentication import BasicAuthentication + +from backend.apps.role.models import AnonymousRole, Role +from backend.service.constants import RoleType + + +class BasicAppCodeAuthentication(BasicAuthentication): + """ + 使用app_code认证的BasicAuth + """ + + def authenticate_credentials(self, userid, password, request=None): + if userid != settings.APP_ID or password != settings.APP_TOKEN: + return None + user_model = get_user_model() + user, _ = user_model.objects.get_or_create( + username="admin", defaults={"is_active": True, "is_staff": False, "is_superuser": False} + ) + if request: + request.bk_app_code = userid + return user, None + + def authenticate(self, request): + user_auth_tuple = super().authenticate(request) + if user_auth_tuple is not None: + role = Role.objects.filter(type=RoleType.SUPER_MANAGER.value).first() or AnonymousRole() + setattr(request, "role", role) + return user_auth_tuple diff --git a/saas/backend/debug/views.py b/saas/backend/debug/views.py index cf9c03003..5becfd8e2 100644 --- a/saas/backend/debug/views.py +++ b/saas/backend/debug/views.py @@ -16,7 +16,7 @@ from rest_framework.response import Response from rest_framework.viewsets import GenericViewSet -from backend.api.authentication import BasicAppCodeAuthentication +from backend.common.authentication import BasicAppCodeAuthentication from backend.common.debug import RedisStorage from backend.common.swagger import ResponseSwaggerAutoSchema diff --git a/saas/backend/service/action_group.py b/saas/backend/service/action_group.py index 40eb1101d..484d3d62d 100644 --- a/saas/backend/service/action_group.py +++ b/saas/backend/service/action_group.py @@ -13,7 +13,8 @@ from pydantic import parse_obj_as from backend.component import iam -from backend.service.models.action_group import ActionGroup + +from .models import ActionGroup class ActionGroupService: diff --git a/saas/backend/service/aggregate_action.py b/saas/backend/service/aggregate_action.py index f0f3e7d93..848252a32 100644 --- a/saas/backend/service/aggregate_action.py +++ b/saas/backend/service/aggregate_action.py @@ -11,7 +11,8 @@ from typing import List from backend.apps.action.models import AggregateAction as AggregateActionModel -from backend.service.models import AggregateActions + +from .models import AggregateActions class AggregateActionsService: diff --git a/saas/backend/service/constants.py b/saas/backend/service/constants.py index b86468bea..c3381894a 100644 --- a/saas/backend/service/constants.py +++ b/saas/backend/service/constants.py @@ -21,35 +21,61 @@ SUBJECT_TYPE_ALL = "*" -# TODO 被 service.models 应用, 删除service.models同时删除 -class PolicyTag(LowerStrEnum): - """ - 策略新增更新标签 - """ +class SubjectType(ChoicesEnum, LowerStrEnum): + ALL = "*" + USER = auto() + DEPARTMENT = auto() + GROUP = auto() - ADD = auto() - UPDATE = auto() - UNCHANGED = auto() - DELETE = auto() - RELATED = auto() + _choices_labels = skip(((USER, _("用户")), (GROUP, _("用户组")), (DEPARTMENT, _("部门")))) -# TODO 被 service.models 应用, 删除service.models同时删除 -class ConditionTag(LowerStrEnum): - ADD = auto() - DELETE = auto() - UNCHANGED = auto() +class SubjectRelationType(ChoicesEnum, LowerStrEnum): + """用户的权限来源关系""" + DEPARTMENT = auto() + GROUP = auto() -class SubjectType(ChoicesEnum, LowerStrEnum): - ALL = "*" + _choices_labels = skip(((GROUP, "用户组"), (DEPARTMENT, "部门"))) + + +# ---------------------------------------------------------------------------------------------- # +# Group Constants +# ---------------------------------------------------------------------------------------------- # +class GroupMemberType(ChoicesEnum, LowerStrEnum): USER = auto() DEPARTMENT = auto() - GROUP = auto() - _choices_labels = skip(((USER, _("用户")), (GROUP, _("用户组")), (DEPARTMENT, _("部门")))) + _choices_labels = skip(((USER, "用户"), (DEPARTMENT, "部门"))) + + +class GroupSaaSAttributeEnum(ChoicesEnum, LowerStrEnum): + """用户组SaaS属性枚举""" + + READONLY = auto() + + _choices_labels = skip(((READONLY, "只读"),)) + + +class GroupAttributeValueTypeEnum(ChoicesEnum, LowerStrEnum): + """用户组SaaS属性值的数据类型""" + + String = auto() + Boolean = auto() + Integer = auto() +# 每个属性的值类型 +GROUP_SAAS_ATTRIBUTE_VALUE_TYPE_MAP = { + GroupSaaSAttributeEnum.READONLY.value: GroupAttributeValueTypeEnum.Boolean.value +} +# 每个属性的默认值 +GROUP_SAAS_ATTRIBUTE_DEFAULT_VALUE_MAP = {GroupSaaSAttributeEnum.READONLY.value: False} + + +# ---------------------------------------------------------------------------------------------- # +# Policy Constants +# ---------------------------------------------------------------------------------------------- # class SelectionMode(ChoicesEnum, LowerStrEnum): ALL = auto() INSTANCE = auto() @@ -58,11 +84,6 @@ class SelectionMode(ChoicesEnum, LowerStrEnum): _choices_labels = skip(((ALL, _("实例与属性")), (INSTANCE, _("实例")), (ATTRIBUTE, _("属性")))) -class Operate(LowerStrEnum): - GRANT = auto() - REVOKE = auto() - - # ---------------------------------------------------------------------------------------------- # # Role Constants # ---------------------------------------------------------------------------------------------- # diff --git a/saas/backend/service/engine.py b/saas/backend/service/engine.py index 3caf710d8..c0149c4a8 100644 --- a/saas/backend/service/engine.py +++ b/saas/backend/service/engine.py @@ -12,11 +12,11 @@ from pydantic import BaseModel -from backend.biz.policy import PathNodeBeanList from backend.common.error_codes import error_codes from backend.component.engine import batch_query_subjects -from backend.service.policy.query import Condition, PathNode, Policy, RelatedResource -from backend.service.utils.translate import translate_path + +from .models import Condition, PathNode, Policy, RelatedResource +from .utils.translate import translate_path MAX_ENGINE_SEARCH_RESOURCE_COUNT = 20 @@ -157,7 +157,7 @@ def _gen_resource_by_path(self, rrt: RelatedResource, attrs: Dict[str, Any], pat if last_node.type == rrt.type and last_node.system_id == rrt.system_id: resource["id"] = last_node.id if path[:-1]: - resource["attribute"]["_bk_iam_path_"] = translate_path(PathNodeBeanList(path[:-1]).dict()) + resource["attribute"]["_bk_iam_path_"] = translate_path([n.dict() for n in path[:-1]]) else: - resource["attribute"]["_bk_iam_path_"] = translate_path(PathNodeBeanList(path).dict()) + resource["attribute"]["_bk_iam_path_"] = translate_path([n.dict() for n in path]) return resource diff --git a/saas/backend/service/group_saas_attribute.py b/saas/backend/service/group_saas_attribute.py index 7e8a15713..c8c881d40 100644 --- a/saas/backend/service/group_saas_attribute.py +++ b/saas/backend/service/group_saas_attribute.py @@ -13,15 +13,15 @@ from collections import defaultdict from typing import Any, Dict, List -from backend.apps.group.constants import ( +from backend.apps.group.models import GroupSaaSAttribute +from backend.common.error_codes import error_codes + +from .constants import ( GROUP_SAAS_ATTRIBUTE_DEFAULT_VALUE_MAP, GROUP_SAAS_ATTRIBUTE_VALUE_TYPE_MAP, GroupAttributeValueTypeEnum, GroupSaaSAttributeEnum, ) -from backend.apps.group.models import GroupSaaSAttribute -from backend.common.error_codes import error_codes - from .models import GroupAttributes logger = logging.getLogger(__name__) @@ -68,7 +68,7 @@ def batch_get_attributes(self, group_ids: List[int]) -> Dict[int, GroupAttribute # 初始化为每个属性默认值 attrs = copy.deepcopy(GROUP_SAAS_ATTRIBUTE_DEFAULT_VALUE_MAP) # 遍历每个属性是否配置了，若配置了则使用配置的值 - for attr_enum in GroupSaaSAttributeEnum: + for attr_enum in GroupSaaSAttributeEnum: # type: ignore[attr-defined] attr = attr_enum.value value_str = group_attr_values[attr] # 若value为空字符串，则说明没有配置 diff --git a/saas/backend/service/instance_selection.py b/saas/backend/service/instance_selection.py index 73e393bc9..222f51e09 100644 --- a/saas/backend/service/instance_selection.py +++ b/saas/backend/service/instance_selection.py @@ -11,7 +11,8 @@ from typing import List from backend.component import iam -from backend.service.models import Action, InstanceSelection, RawInstanceSelection + +from .models import Action, InstanceSelection, RawInstanceSelection class InstanceSelectionService: diff --git a/saas/backend/service/models/__init__.py b/saas/backend/service/models/__init__.py index 104802b88..7aa796170 100644 --- a/saas/backend/service/models/__init__.py +++ b/saas/backend/service/models/__init__.py @@ -45,15 +45,18 @@ ) from .group import GroupAttributes from .instance_selection import ChainNode, InstanceSelection, PathResourceType, RawInstanceSelection -from .open import ( - ApplyAction, - ApplyPathNode, - ApplyRelatedResourceType, - ResourceCreatorAction, - ResourceCreatorActionConfig, - ResourceCreatorSingleAction, +from .policy import ( + Attribute, + BackendThinPolicy, + Condition, + Instance, + PathNode, + Policy, + PolicyIDExpiredAt, + RelatedResource, + SystemCounter, + Value, ) -from .policy import Attribute, Condition, Instance, PathHelper, Policy, RelatedResource, ResourceInstance, group_paths from .resource import ( ResourceAttribute, ResourceAttributeValue, @@ -62,8 +65,10 @@ ResourceTypeProviderConfig, SystemProviderConfig, ) +from .resource_creator_action import ResourceCreatorActionConfig, ResourceCreatorActionConfigItem from .resource_type import ResourceType, ResourceTypeDict -from .system import Subject, System +from .subject import Subject +from .system import System __all__ = [ "Action", @@ -71,21 +76,8 @@ "RelatedResourceType", "ResourceType", "ChainNode", - "ApplyAction", - "ApplyPathNode", - "ApplyRelatedResourceType", - "ResourceCreatorAction", + "ResourceCreatorActionConfigItem", "ResourceCreatorActionConfig", - "ResourceCreatorSingleAction", - "Attribute", - "Condition", - "Instance", - "PathHelper", - "Policy", - "RelatedResource", - "ResourceInstance", - "group_paths", - "Subject", "System", "AggregateActions", "ApprovalProcess", @@ -127,4 +119,15 @@ "ApplicantDepartment", "ApplicationSystem", "ApplicationSubject", + "BackendThinPolicy", + "Policy", + "SystemCounter", + "PolicyIDExpiredAt", + "Subject", + "Condition", + "Instance", + "PathNode", + "RelatedResource", + "Value", + "Attribute", ] diff --git a/saas/backend/service/models/action.py b/saas/backend/service/models/action.py index cfde128d4..99f878159 100644 --- a/saas/backend/service/models/action.py +++ b/saas/backend/service/models/action.py @@ -71,6 +71,12 @@ def index_of_related_resource_type(self, system_id: str, resource_type_id: str) return i return -1 + def is_unrelated(self) -> bool: + """ + 是否是非关联 + """ + return len(self.related_resource_types) == 0 + def _filter_error_instance_selection( system_id: str, resource_type_id: str, selections: List[InstanceSelection] diff --git a/saas/backend/service/models/open.py b/saas/backend/service/models/open.py deleted file mode 100644 index 5e3e95a68..000000000 --- a/saas/backend/service/models/open.py +++ /dev/null @@ -1,273 +0,0 @@ -# -*- coding: utf-8 -*- -""" -TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. -Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. -Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. -You may obtain a copy of the License at http://opensource.org/licenses/MIT -Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on -an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the -specific language governing permissions and limitations under the License. -""" -from typing import Any, Dict, List, Optional - -from pydantic import BaseModel - -from backend.common.error_codes import error_codes -from backend.service.models.action import Action - -from .instance_selection import InstanceSelection, PathResourceType -from .policy import ResourceInstance, group_paths - -# TODO 只设计结构相关的转换, 重构提到 biz.open 相关模块 -# TODO 需要删除这个文件 - - -class ResourceCreatorSingleAction(BaseModel): - """ - 新建关联配置中单个Action - """ - - id: str - required: bool - - -class ResourceCreatorActionConfig(BaseModel): - """ - 资源类型对应的被创建时所需的Action配置等 - """ - - id: str - actions: List[ResourceCreatorSingleAction] - sub_resource_types: Optional[List["ResourceCreatorActionConfig"]] = None - - def get_resource_type_actions_map(self) -> Dict[str, List[ResourceCreatorSingleAction]]: - """ - 资源类型与Actions的映射，包括递归的 - """ - rta = {self.id: self.actions} - - if self.sub_resource_types: - for srt in self.sub_resource_types: - rta.update(srt.get_resource_type_actions_map()) - - return rta - - -ResourceCreatorActionConfig.update_forward_refs() - - -class ResourceCreatorAction(BaseModel): - """ - 新建关联配置 - """ - - mode: str - config: List[ResourceCreatorActionConfig] - - -class ApplyPathNode(BaseModel): - """ - 申请与授权的拓扑节点 - """ - - system_id: str = "" - type: str - id: str - name: str - - def to_path_resource_type(self) -> PathResourceType: - return PathResourceType(system_id=self.system_id, id=self.type) - - -class ApplyPathNodeList: - def __init__(self, path: List[ApplyPathNode]) -> None: - self.path = path - - def fill_instance_system(self, instance_selections: List[InstanceSelection]): - """ - 填充实例缺失的system_id - """ - match_selections = self._list_match_instance_selections(instance_selections) - if self.need_fill_system(): - self._fill_node_system_id_by_instance_selections(match_selections) - - def need_fill_system(self): - """ - 是否需要填充system_id - """ - return not all([node.system_id for node in self.path]) - - def _list_match_instance_selections(self, instance_selections: List[InstanceSelection]) -> List[InstanceSelection]: - """ - 筛选出匹配的实例视图 - """ - path_resource_types = [node.to_path_resource_type() for node in self.path] - selections = [selection for selection in instance_selections if selection.match_path(path_resource_types)] - if not selections: - self._raise_match_selection_fail_exception() - - return selections - - def _fill_node_system_id_by_instance_selections(self, instance_selections: List[InstanceSelection]): - """ - 使用是视图填充path中缺失的system_id - """ - # 取匹配的实例视图的第一个来做填充 - first_match_selection = instance_selections[0] - path_resource_types = [node.to_path_resource_type() for node in self.path] - - # 获取到实例视图提供的系统列表, 填充到现有的path中 - system_ids = first_match_selection.list_match_path_system_id(path_resource_types) - for node, system_id in zip(self.path, system_ids): - node.system_id = system_id - - # 如果有多个实例视图可以匹配, 所有实例视图返回的system_ids必须一致 - for selection in instance_selections[1:]: - if system_ids != selection.list_match_path_system_id(path_resource_types): - self._raise_match_selection_fail_exception() - - def _raise_match_selection_fail_exception(self): - raise error_codes.VALIDATE_ERROR.format("resource({}) not satisfy instance selection".format(self.path)) - - -class ApplyRelatedResourceType(BaseModel): - """ - 申请与授权的关联资源 - """ - - system_id: str - type: str - instances: List[List[ApplyPathNode]] - attributes: List[Any] = [] - - def to_resource_instance(self) -> ResourceInstance: - """ - 转换授权的资源结构 - """ - instances = group_paths(self.dict()["instances"]) - - return ResourceInstance( - system_id=self.system_id, type=self.type, instances=instances, type_name=self.type, type_name_en=self.type - ) - - def iter_path_list(self): - for path in self.instances: - yield ApplyPathNodeList(path) - - -# TODO 提到biz业务逻辑 -class ApplyAction(BaseModel): - """ - 申请与授权的操作 - """ - - id: str - related_resource_types: List[ApplyRelatedResourceType] - - def fill_instance_system(self, action: Action): - """ - 填充实例缺失的system_id - """ - for system_rrt, rrt in zip(action.related_resource_types, self.related_resource_types): - selections = system_rrt.instance_selections - if not selections: - continue - - # 填充instance system_id - for path_list in rrt.iter_path_list(): - path_list.fill_instance_system(selections) - - @classmethod - def from_path(cls, data: Any) -> "ApplyAction": - """ - 授权到单个拓扑转换 - """ - return cls( - id=data["action"]["id"], - related_resource_types=[ - ApplyRelatedResourceType( - system_id=resource["system"], - type=resource["type"], - instances=[[ApplyPathNode(system_id=node["system"], **node) for node in resource["path"]]], - ) - for resource in data["resources"] - ], - ) - - @classmethod - def from_batch_path(cls, data: Any) -> "ApplyAction": - """ - 批量拓扑授权转换 - """ - return cls( - id=data["actions"][0]["id"], - related_resource_types=[ - ApplyRelatedResourceType( - system_id=resource["system"], - type=resource["type"], - instances=[ - [ApplyPathNode(system_id=node["system"], **node) for node in path] - for path in resource["paths"] - ], - ) - for resource in data["resources"] - ], - ) - - @classmethod - def from_instance(cls, data: Any) -> "ApplyAction": - """ - 实例授权转换 - """ - return cls( - id=data["action"]["id"], - related_resource_types=[ - ApplyRelatedResourceType( - system_id=resource["system"], - type=resource["type"], - instances=[[ApplyPathNode(system_id=resource["system"], **resource)]], - ) - for resource in data["resources"] - ], - ) - - @classmethod - def from_batch_instance(cls, data: Any) -> "ApplyAction": - """ - 批量实例授权转换 - """ - return cls( - id=data["actions"][0]["id"], - related_resource_types=[ - ApplyRelatedResourceType( - system_id=resource["system"], - type=resource["type"], - instances=[ - [ApplyPathNode(system_id=resource["system"], type=resource["type"], **instance)] - for instance in resource["instances"] - ], - ) - for resource in data["resources"] - ], - ) - - -class ApplyActionList: - def __init__(self, apply_actions: List[ApplyAction]) -> None: - self.apply_actions = apply_actions - - def fill_instance_system(self, system_id: str): - """ - 填充实例缺失的system_id - """ - from backend.service.action import ActionList, ActionService - - # TODO !!! service model 不能直接调用service, 提取到biz后, 没有问题 - actions = ActionService().list(system_id) - action_list = ActionList(actions) - - for apply_action in self.apply_actions: - action = action_list.get(apply_action.id) - if not action: - continue - apply_action.fill_instance_system(action) diff --git a/saas/backend/service/models/policy.py b/saas/backend/service/models/policy.py index d82a02ff9..50fe110c6 100644 --- a/saas/backend/service/models/policy.py +++ b/saas/backend/service/models/policy.py @@ -8,891 +8,94 @@ an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. """ -import logging -from copy import deepcopy -from itertools import chain, groupby -from typing import Any, Dict, List, Optional, Set, Tuple +from typing import Any, List, Tuple -from pydantic import BaseModel, Extra +from pydantic import BaseModel, Field from backend.apps.policy.models import Policy as PolicyModel -from backend.common.error_codes import error_codes -from backend.common.time import expired_at_display -from backend.service.models.instance_selection import PathResourceType -from backend.service.models.resource_type import ResourceTypeDict +from backend.service.utils.translate import ResourceExpressionTranslator from backend.util.uuid import gen_uuid -from ..constants import ANY_ID, ConditionTag, PolicyTag -from ..utils.translate import ResourceExpressionTranslator, translate_path -from .action import Action, InstanceSelection, RelatedResourceType -from .resource_type import ResourceNode -from .system import Subject +from .subject import Subject -logger = logging.getLogger("app") -# TODO 需要删除这个文件 - - -class PathHelper: - """ - path: List[Dict] - - 整体封装Instance中Path相关的操作 - """ - - def __init__(self, path: List[Dict[str, Any]]): - self.path = path - - def check_selection_ignore_path( # TODO 复用selection check逻辑, 只有selection 需要ignore的时候才需要做ignore的逻辑 - self, rrt: "RelatedResource", selection: InstanceSelection - ) -> Tuple[bool, Optional[List[Dict]]]: - """ - 检查实例拓扑是否匹配实例视图 - """ - if len(self.path) == 1: - node = self.path[0] - # 只有一个节点, 节点与关联资源类型相同, 不需要再检查实例视图 - # 可能是从授权接口, 新建关联等等方式授权而来 - if node["system_id"] == rrt.system_id and node["type"] == rrt.type: - return True, self.path - - path_resource_types = [PathResourceType(system_id=node["system_id"], id=node["type"]) for node in self.path] - if not selection.match_path(path_resource_types): - return False, None - - # 完全匹配忽略路径的实例视图, 并且忽略路径, 只取最后一个节点, 并且最后一个节点不是任意 - if ( - selection.ignore_iam_path - and len(self.path) == len(selection.resource_type_chain) # noqa - and self.path[-1]["id"] != ANY_ID # noqa - ): - return True, self.path[-1:] - - return True, self.path +class PathNode(BaseModel): + id: str + name: str + system_id: str = "" # NOTE 兼容一下, 早期的policy数据中可能没有system_id + type: str class Instance(BaseModel): type: str - name: str = "" - name_en: str = "" - path: List[Any] - tag: Optional[str] = None - - def __init__(self, **data: Any): - super().__init__(**deepcopy(data)) - - def set_tag(self, tag: str, recursive=False): - self.tag = tag - if recursive: - path = self.path - self.path = [] - for p in path: - self.path.append({"tag": tag, "chain": p}) - - def __add__(self, instance: "Instance") -> "Instance": - path_set = self._get_path_set() - for p in instance.path: - if translate_path(p) not in path_set: - self.path.append(deepcopy(p)) - return self - - def __contains__(self, instance: "Instance") -> bool: - path_set = self._get_path_set() - for p in instance.path: - if translate_path(p) not in path_set: - return False - return True - - def __sub__(self, instance: "Instance") -> "Instance": - path_set = instance._get_path_set() - self.path = [p for p in self.path if translate_path(p) not in path_set] - return self - - def diff(self, instance: "Instance") -> "Instance": - tag_instance = Instance(tag=ConditionTag.UNCHANGED.value, type=self.type, name=self.name, path=[]) - - new_path_set = self._get_path_set() - old_path_dict = {translate_path(p): p for p in instance.path} - - for p in self.path: - if translate_path(p) not in old_path_dict: - tag_instance.path.append({"tag": ConditionTag.ADD.value, "chain": p}) - else: - tag_instance.path.append({"tag": ConditionTag.UNCHANGED.value, "chain": p}) - - if set(old_path_dict.keys()) - new_path_set: - for p in instance.path: - if translate_path(p) not in new_path_set: - tag_instance.path.append({"tag": ConditionTag.DELETE.value, "chain": p}) - - return tag_instance - - def compare(self, instance: "Instance") -> bool: - return self._get_path_set() == instance._get_path_set() - - def add_instance(self, instance: "Instance") -> bool: - """ - 授权api增加合并实例数据, 返回已有实例是否变更标志 - """ - path_set = self._get_path_set() - length = len(self.path) - - for p in instance.path: - if translate_path(p) not in path_set: - self.path.append(p) - - return length != len(self.path) - - def _get_path_set(self): - return {translate_path(p) for p in self.path} - - def remove_instance(self, instance: "Instance") -> bool: - """ - 回收实例权限, 返回已有实例是否变更标志 - """ - path_set = instance._get_path_set() - length = len(self.path) + path: List[List[PathNode]] - self.path = [p for p in self.path if translate_path(p) not in path_set] - return length != len(self.path) - def list_resource_node(self) -> List[ResourceNode]: - """ - 通过拆解每个路径里的层级，返回所有拆解出的单一资源实例 - """ - return [ResourceNode(**node) for path in self.path for node in path] - - def check_selection_ignore_path(self, rrt: "RelatedResource", selections: List[InstanceSelection]): - """ - 检查实例拓扑是否匹配实例视图 - """ - for i in range(len(self.path)): - helper = PathHelper(self.path[i]) - for selection in selections: - ok, path = helper.check_selection_ignore_path(rrt, selection) - if ok: - self.path[i] = path - break - else: - raise error_codes.VALIDATE_ERROR.format( - "{} could not match any instance selection".format(self._path_display(helper.path)) - ) - - def _path_display(self, path: List[Dict]) -> str: - """ - 转换拓扑节点, 返回显示字符串 - """ - return "/".join(["{}:{}".format(node["type_name"], node["name"]) for node in path]) - - def get_system_set(self): - """ - 获取所有节点中的system_id - """ - return {node["system_id"] for path in self.path for node in path} - - def fill_type_name(self, resource_type_dict: ResourceTypeDict): - """ - 填充资源类型名称 - """ - for path in self.path: - for node in path: - node["type_name"], node["type_name_en"] = resource_type_dict.get_name(node["system_id"], node["type"]) - - if self.type == node["type"]: - self.name = node["type_name"] - self.name_en = node["type_name_en"] - - if node["id"] == ANY_ID: - node["name"] = "{}: 无限制".format(node["type_name"]) - - def fill_node_name(self, resource_info_name_dict: Dict[ResourceNode, str]) -> None: - """ - 填充每个节点资源实例名称 - """ - for p in self.path: - for n in p: - n["name"] = resource_info_name_dict[ResourceNode(**n)] - - def path_count(self): - return len(self.path) - - def set_path_node_tag_ADD(self): - for p in self.path: - for node in p: - node["tag"] = ConditionTag.ADD.value +class Value(BaseModel): + id: Any + name: str class Attribute(BaseModel): id: str - name: str = "" - values: List[Dict[str, str]] - tag: Optional[str] = None - - def __init__(self, **data: Any): - super().__init__(**deepcopy(data)) - - def set_tag(self, tag: str, recursive=False): - self.tag = tag - if recursive: - for v in self.values: - v["tag"] = tag + name: str + values: List[Value] def sort_values(self): - self.values.sort(key=lambda value: value["id"]) + self.values.sort(key=lambda value: value.id) def trim(self) -> Tuple: - return self.id, tuple([value["id"] for value in self.values]) - - def diff(self, attribute: "Attribute") -> "Attribute": - tag_attribute = Attribute(tag=ConditionTag.UNCHANGED.value, id=self.id, name=self.name, values=[]) - - new_id_set = {v["id"] for v in self.values} - old_id_set = {v["id"] for v in attribute.values} - - for v in deepcopy(self.values): - if v["id"] not in old_id_set: - v["tag"] = ConditionTag.ADD.value - else: - v["tag"] = ConditionTag.UNCHANGED.value - tag_attribute.values.append(v) - - if old_id_set - new_id_set: - for v in deepcopy(attribute.values): - if v["id"] not in new_id_set: - v["tag"] = ConditionTag.DELETE.value - tag_attribute.values.append(v) - - return tag_attribute - - def compare(self, attribute: "Attribute") -> bool: - return {value["id"] for value in self.values} == {value["id"] for value in attribute.values} - - -# TODO 一些只负责做类型转换的结构, 提取到biz中 -class ResourceInstance(BaseModel): - """ - 实例/路径授权结构, 只用户授权 - """ - - system_id: str - type: str - instances: List[Instance] - type_name: str = "" - type_name_en: str = "" - - def get_system_set(self) -> Set[str]: - """ - 获取所有的system_id - """ - ids = set.union(*[instance.get_system_set() for instance in self.instances]) if self.instances else set() - ids.add(self.system_id) - return ids - - def fill_type_name(self, resource_type_dict: ResourceTypeDict): - """ - 填充资源类型名称 - """ - self.type_name, self.type_name_en = resource_type_dict.get_name(self.system_id, self.type) - - for instance in self.instances: - instance.fill_type_name(resource_type_dict) - - -# TODO 提到biz中 -class ResourceInstanceList: - def __init__(self, resource_instances: List[ResourceInstance]) -> None: - self.resource_instances = resource_instances - - def fill_resource_type_name(self): - """ - 填充资源类型的名称 - """ - # TODO 提取到biz后, 解除循环依赖 - from backend.service.resource_type import ResourceTypeService - - system_ids = list(set.union(*[r.get_system_set() for r in self.resource_instances])) - resource_type_dict = ResourceTypeService().get_resource_type_dict(system_ids) - for resource_instance in self.resource_instances: - resource_instance.fill_type_name(resource_type_dict) + return self.id, tuple([value.id for value in self.values]) class Condition(BaseModel): instances: List[Instance] attributes: List[Attribute] - id: str = "" - tag: Optional[str] = None + id: str - def set_tag(self, tag: str, recursive=False): - self.tag = tag - if recursive: - for i in self.instances: - i.set_tag(tag, recursive) - for a in self.attributes: - a.set_tag(tag, recursive) + def __init__(self, **data: Any) -> None: + if "id" not in data: + data["id"] = gen_uuid() + super().__init__(**data) def sort_attributes(self): for a in self.attributes: a.sort_values() self.attributes.sort(key=lambda attribute: attribute.id) - def hash_attributes(self) -> Tuple: + def hash_attributes(self): self.sort_attributes() - return tuple([attribute.trim() for attribute in self.attributes]) + return hash(tuple([attribute.trim() for attribute in self.attributes])) - def is_attributes_empty(self) -> bool: + def has_no_attributes(self) -> bool: return len(self.attributes) == 0 - def is_instances_empty(self) -> bool: + def has_no_instances(self) -> bool: return len(self.instances) == 0 - def merge_instances(self, instances: List[Instance]): - """ - 合并传入的实例, 去重 - """ - instances_dict = {instance.type: instance for instance in self.instances} - for instance in instances: - _type = instance.type - if _type in instances_dict: - instances_dict[_type] + instance - else: - self.instances.append(deepcopy(instance)) - - def has_instances(self, instances: List[Instance]) -> bool: - """ - 判断是否包含传入的实例 - """ - instances_dict = {instance.type: instance for instance in self.instances} - for instance in instances: - _type = instance.type - if _type in instances_dict: - if instance not in instances_dict[_type]: - return False - else: - return False - return True - - def remove_instances(self, instances: List[Instance]): - """ - 移除传入的实例 - """ - instances_dict = {instance.type: instance for instance in self.instances} - for instance in instances: - _type = instance.type - if _type in instances_dict: - instances_dict[_type] - instance - self.instances = [instance for instance in self.instances if len(instance.path)] - - def diff(self, condition: "Condition") -> "Condition": - """ - 对比单个条件 - """ - tag_condition = Condition(tag=ConditionTag.UNCHANGED.value, id=self.id, instances=[], attributes=[]) - - new_instance_type_set = {i.type for i in self.instances} - old_instance_type_set = {i.type for i in condition.instances} - old_instance_type_dict = {i.type: i for i in condition.instances} - - # 比较每一组实例 - for i in self.instances: - # 如果实例类型在老的实例中不存在, 则属于新增 - if i.type not in old_instance_type_set: - tag_instance = deepcopy(i) - tag_instance.set_tag(ConditionTag.ADD.value, True) - tag_condition.instances.append(tag_instance) - # 已存在, 需要继续对比 - else: - tag_condition.instances.append(i.diff(old_instance_type_dict[i.type])) - - # 如果有老的不在新的实例中, 打上删除标签, 加入到实例数据后面 - if old_instance_type_set - new_instance_type_set: - for i in condition.instances: - if i.type not in new_instance_type_set: - tag_instance = deepcopy(i) - tag_instance.set_tag(ConditionTag.DELETE.value, True) - tag_condition.instances.append(tag_instance) - - new_attribute_id_set = {i.id for i in self.attributes} - old_attribute_id_set = {i.id for i in condition.attributes} - old_attribute_id_dict = {i.id: i for i in condition.attributes} - - # 比较每一组属性 - for a in self.attributes: - # 如果属性的key不在老的属性数据中, 则属于新增 - if a.id not in old_attribute_id_set: - tag_attribute = deepcopy(a) - tag_attribute.set_tag(ConditionTag.ADD.value, True) - tag_condition.attributes.append(tag_attribute) - # 如果在老的数据中, 则继续对比 - else: - tag_condition.attributes.append(a.diff(old_attribute_id_dict[a.id])) - - # 如果有老的不在新的属性数据中, 打上删除标签, 加入到属性数据后面 - if old_attribute_id_set - new_attribute_id_set: - for a in condition.attributes: - if a.id not in new_attribute_id_set: - tag_attribute = deepcopy(a) - tag_attribute.set_tag(ConditionTag.DELETE.value, True) - tag_condition.attributes.append(tag_attribute) - - return tag_condition - - def compare(self, condition: "Condition") -> bool: - """ - 比较条件 - """ - new_instance_dict = {instance.type: instance for instance in self.instances} - old_instance_dict = {instance.type: instance for instance in condition.instances} - - if set(new_instance_dict.keys()) != set(old_instance_dict.keys()): - return False - - for key in new_instance_dict.keys(): - if not new_instance_dict[key].compare(old_instance_dict[key]): - return False - - # 比较属性选择 - new_attribute_dict = {attribute.id: attribute for attribute in self.attributes} - old_attribute_dict = {attribute.id: attribute for attribute in condition.attributes} - - if set(new_attribute_dict.keys()) != set(old_attribute_dict.keys()): - return False - - for key in new_attribute_dict.keys(): - if not new_attribute_dict[key].compare(old_attribute_dict[key]): - return False - - return True - - def add_instance(self, instance: Instance) -> bool: - """ - 实例授权, 合并到已有的条件中, 返回是否变更标志 - """ - for i in self.instances: - if i.type == instance.type: - return i.add_instance(instance) - - self.instances.append(instance) - return True - - def remove_instance(self, instance: Instance) -> bool: - """ - 回收实例权限, 返回是否变更条件 - """ - is_modified = False - for i in self.instances: - if i.type == instance.type: - if i.remove_instance(instance): - is_modified = True - - if is_modified: - self.instances = [i for i in self.instances if len(i.path) != 0] - return is_modified - - def list_resource_node(self) -> List[ResourceNode]: - """ - 通过拆解每个路径里的层级，返回所有拆解出的单一资源实例 - """ - nodes = [] - # 遍历每一组实例分组 - for instance in self.instances: - nodes.extend(instance.list_resource_node()) - return nodes - - def get_system_set(self) -> Set[str]: - """ - 获取所有的system_id - """ - if self.is_instances_empty(): - return set() - return set.union(*[instance.get_system_set() for instance in self.instances]) - - def instances_count(self, _type: str): - return sum([i.path_count() for i in self.instances if i.type == _type]) - - def iter_path(self): - for instance in self.instances: - for path in instance.path: - yield path - - def set_instance_path_node_tag_ADD(self): - for instance in self.instances: - instance.set_path_node_tag_ADD() - class RelatedResource(BaseModel): system_id: str type: str condition: List[Condition] - name: str = "" - name_en: str = "" - tag: Optional[str] = None - selection_mode: str = "" # 方便前端使用 - _is_empty: bool = False - - class Config: - extra = Extra.allow # 允许Model在初始化时不传部分field - - def __init__(self, **data: Any): - super().__init__(**data) - self.merge_self_conditions() - - def merge_self_conditions(self): - """ - 合并条件 - """ - if self.is_any(): - return - - # 筛选出只有属性的条件, 并去重 - empty_instance_contions = {c.hash_attributes(): c for c in self.condition if c.is_instances_empty()} - - # 合并属性相同的实例 - condition_dict: Dict[Any, Condition] = {} - # 排序可以使有id的排在前面 - for c in sorted(self.condition, key=lambda c: c.id, reverse=True): - # 如果条件是有实例的 - if not c.is_instances_empty(): - _hash = c.hash_attributes() - if _hash in condition_dict: - condition_dict[_hash].merge_instances(c.instances) - else: - condition_dict[_hash] = c - - conditions = [] - conditions.extend(chain(condition_dict.values(), empty_instance_contions.values())) - self.condition = conditions - - def merge_conditions(self, conditions: List[Condition], maximize=False): - """ - 合并输入的条件 - """ - if self.is_any() and not self.is_empty(): - return - - if maximize and len(conditions) == 0: - self.condition = [] - return - - # 分为不带实例的条件与带实例的条件 - empty_instance_contions = {c.hash_attributes(): c for c in self.condition if c.is_instances_empty()} - condition_dict = {c.hash_attributes(): c for c in self.condition if not c.is_instances_empty()} - - for c in conditions: - # 如果申请的条件都为空, 不需要合并 - if c.is_instances_empty() and c.is_attributes_empty(): - continue - - _hash = c.hash_attributes() - # 如果不带实例 - if c.is_instances_empty(): - # 如果计算的条件的属性hash值不在字典中, 需要新增 - if _hash not in empty_instance_contions: - empty_instance_contions[_hash] = deepcopy(c) - else: - # 带实例的条件如果hash不在字典中, 需要新增, 在字典中, 合并实例 - if _hash not in condition_dict: - condition_dict[_hash] = deepcopy(c) - else: - condition_dict[_hash].merge_instances(c.instances) - - conditions = [] - conditions.extend(chain(condition_dict.values(), empty_instance_contions.values())) - self.condition = conditions - self._is_empty = len(conditions) == 0 - - def remove_conditions(self, conditions: List[Condition]): - """ - 删除已有的条件 - """ - # 如果新旧条件都是任意, 相当于清空 - if self.is_any() and len(conditions) == 0: - self._is_empty = True - return - - if self.is_any(): - return - - empty_instance_contions = {c.hash_attributes(): c for c in self.condition if c.is_instances_empty()} - condition_dict = {c.hash_attributes(): c for c in self.condition if not c.is_instances_empty()} - - for c in conditions: - _hash = c.hash_attributes() - if c.is_instances_empty(): - if _hash in empty_instance_contions: - empty_instance_contions.pop(_hash) - else: - if _hash in condition_dict: - # 移除条件中需要删除的部分实例 - condition_dict[_hash].remove_instances(c.instances) - # 如果条件的所有实例都删空了, 需要移除整组条件 - if condition_dict[_hash].is_instances_empty(): - condition_dict.pop(_hash) - - conditions = [] - conditions.extend(chain(condition_dict.values(), empty_instance_contions.values())) - self.condition = conditions - self._is_empty = len(conditions) == 0 # 如果所有的条件都被删完了, 记录状态 - - def has_conditions(self, conditions: List[Condition]) -> bool: - """ - 是否包含所有的条件 - """ - # 如果已有权限是任意, 新的权限不是任意, 则不包含 - if len(conditions) == 0 and not self.is_any(): - return False - - # 如果是任意, 包含所有 - if self.is_any(): - return True - - empty_instance_contions = {c.hash_attributes() for c in self.condition if c.is_instances_empty()} - condition_dict = {c.hash_attributes(): c for c in self.condition if not c.is_instances_empty()} - - # 三种可能为False - # 1. 不带实例的条件不在空实例集合中 - # 2. 带实例的条件不在带实例的条件字典中 - # 3. 带实例的条件包含的实例数据超出了现有的数据 - for c in conditions: - _hash = c.hash_attributes() - if c.is_instances_empty() and _hash not in empty_instance_contions: - return False - elif not c.is_instances_empty() and _hash not in condition_dict: - return False - elif ( - not c.is_instances_empty() - and _hash in condition_dict # noqa - and not condition_dict[_hash].has_instances(c.instances) # noqa - ): - return False - - return True - - def is_any(self) -> bool: - """ - 是否是任意 - """ - return len(self.condition) == 0 - - def is_empty(self): - """ - 条件是否被删空 - """ - return self._is_empty - - def set_empty(self): - self.condition = [] - self._is_empty = True - - def compare(self, rt: "RelatedResource") -> bool: - """ - 对比资源类型 - """ - if len(self.condition) != len(rt.condition): - return False - - # 比较无实例操作是否一致 - if {c.hash_attributes() for c in self.condition if c.is_instances_empty()} != { - c.hash_attributes() for c in rt.condition if c.is_instances_empty() - }: - return False - - new_conditions = {c.hash_attributes(): c for c in self.condition if not c.is_instances_empty()} - old_conditions = {c.hash_attributes(): c for c in rt.condition if not c.is_instances_empty()} - - if set(new_conditions.keys()) != set(old_conditions.keys()): - return False - - for key in new_conditions.keys(): - if not new_conditions[key].compare(old_conditions[key]): - return False - - return True - - def set_tag_update(self): - self.tag = PolicyTag.UPDATE.value - - def set_tag_unchanged(self): - self.tag = PolicyTag.UNCHANGED.value - - def set_tag_delete(self): - self.tag = PolicyTag.DELETE.value - - def get_tag(self) -> Optional[str]: - return self.tag - - def fill_type_name(self, rrt: RelatedResourceType, resource_type_dict: ResourceTypeDict) -> None: - """ - 填充名称 - """ - self.selection_mode = rrt.selection_mode - - self.name, self.name_en = resource_type_dict.get_name(self.system_id, self.type) - - for c in self.condition: - for i in c.instances: - i.fill_type_name(resource_type_dict) - - def fill_resource_node_name(self, resource_info_name_dict: Dict[ResourceNode, str]) -> None: - """ - 填充每个节点资源实例名称 - """ - for c in self.condition: - for i in c.instances: - i.fill_node_name(resource_info_name_dict) - - def add_instance(self, instance: Instance) -> bool: - """ - 实例授权, 合并到已有的条件中, 返回是否变更标志 - """ - if self.is_any(): - return False - - for c in self.condition: - if c.is_attributes_empty(): - return c.add_instance(instance) - - self.condition.append(Condition(id=gen_uuid(), instances=[instance], attributes=[])) - return True - - def remove_instance(self, instance: Instance) -> bool: - """ - 回收实例权限, 返回是否变更标志 - """ - if self.is_any(): - return False - - is_modified = False - for c in self.condition: - if c.is_attributes_empty(): - if c.remove_instance(instance): - is_modified = True - - if is_modified: - self.condition = [c for c in self.condition if not (c.is_attributes_empty() and len(c.instances) == 0)] - self._is_empty = len(self.condition) == 0 - return is_modified - - def list_resource_node(self) -> List[ResourceNode]: - """ - 通过拆解每个路径里的层级，返回所有拆解出的单一资源实例 - """ - nodes = [] - # 遍历每一组权限配置 - for condition in self.condition: - nodes.extend(condition.list_resource_node()) - return nodes - - @classmethod - def from_resource_instance(cls, resource_instance: ResourceInstance): - condition = [Condition(id=gen_uuid(), instances=resource_instance.instances, attributes=[])] - # 若实例为空列表，表示无限制 - if len(resource_instance.instances) == 0: - condition = [] - - return cls( - system_id=resource_instance.system_id, - type=resource_instance.type, - condition=condition, - name=resource_instance.type_name, - name_en=resource_instance.type_name_en, - ) - - @classmethod - def from_attributes(cls, system_id: str, _type: str, name: str, name_en: str, attributes: List[Attribute]): - return cls( - system_id=system_id, - type=_type, - condition=[Condition(id=gen_uuid(), instances=[], attributes=attributes)], - name=name, - name_en=name_en, - ) - - def check_selection_ignore_path(self, selections: List[InstanceSelection]): - """ - 校验条件中的实例拓扑是否满足实例视图 - """ - for c in self.condition: - if c.is_instances_empty(): - continue - - for instance in c.instances: - instance.check_selection_ignore_path(self, selections) - - def get_system_set(self) -> Set[str]: - """ - 获取所有的system_id - """ - if self.is_any() or self.is_empty(): - return {self.system_id} - ids = set.union(*[condition.get_system_set() for condition in self.condition]) - ids.add(self.system_id) - return ids - - def instances_count(self): - return sum([c.instances_count(self.type) for c in self.condition]) - - def set_instance_path_node_tag_ADD(self): - for c in self.condition: - c.set_instance_path_node_tag_ADD() class Policy(BaseModel): - id: str + action_id: str = Field(alias="id") related_resource_types: List[RelatedResource] - environment: Optional[Dict] = None - policy_id: int = 0 - expired_at: Optional[int] = None - - type: Optional[str] = None - name: str = "" - name_en: str = "" - description: str = "" - description_en: str = "" - expired_display: Optional[str] = None - tag: Optional[str] = None - - # 用于新老策略对比差异时，记录是否仅仅只是过期时间不一样 - is_diff_only_expired_at: bool = False - - def __init__(self, **data: Any): - if "expired_at" in data and (data["expired_at"] is not None) and ("expired_display" not in data): - data["expired_display"] = expired_at_display(data["expired_at"]) - super().__init__(**data) - - def set_expired_at(self, expired_at: int): - self.expired_at = expired_at - self.expired_display = expired_at_display(self.expired_at) + policy_id: int + expired_at: int - def set_tag_add(self): - self.tag = PolicyTag.ADD.value - - def set_tag_update(self): - self.tag = PolicyTag.UPDATE.value - - def set_tag_unchanged(self): - self.tag = PolicyTag.UNCHANGED.value - - def set_tag_delete(self): - self.tag = PolicyTag.DELETE.value - - def to_backend_dict(self): - translator = ResourceExpressionTranslator() - return { - "action_id": self.id, - "resource_expression": translator.translate([rt.dict() for rt in self.related_resource_types]), - "environment": "{}", - "expired_at": self.expired_at, - "id": self.policy_id, - } + class Config: + allow_population_by_field_name = True # 支持alias字段同时传 action_id 与 id @classmethod - def from_db_model(cls, policy: PolicyModel) -> "Policy": + def from_db_model(cls, policy: PolicyModel, expired_at: int) -> "Policy": return cls( - id=policy.action_id, + action_id=policy.action_id, related_resource_types=policy.resources, - environment=policy.environment, policy_id=policy.policy_id, - type=policy.action_type, + expired_at=expired_at, ) def to_db_model(self, system_id: str, subject: Subject) -> PolicyModel: @@ -900,219 +103,36 @@ def to_db_model(self, system_id: str, subject: Subject) -> PolicyModel: subject_type=subject.type, subject_id=subject.id, system_id=system_id, - action_type=self.type, - action_id=self.id, + action_type="", + action_id=self.action_id, ) p.resources = [rt.dict() for rt in self.related_resource_types] - p.environment = self.environment + p.environment = {} return p - def is_unrelated(self) -> bool: - """ - 是否是非关联 - """ - return len(self.related_resource_types) == 0 - - def merge(self, policy: "Policy", maximize=False): - """ - 合并 - - maximize 是否最大化合并, 如果老的policy是任意, 则不合并 - """ - if self.is_unrelated() and policy.is_unrelated(): - return - - rt_dict = {(rt.system_id, rt.type): rt for rt in policy.related_resource_types} - for rt in self.related_resource_types: - key = (rt.system_id, rt.type) - if key in rt_dict: - rt.merge_conditions(rt_dict[key].condition, maximize) - - def has(self, policy: "Policy") -> bool: - """ - 包含 - """ - if self.is_unrelated() and policy.is_unrelated(): - return True - - rt_dict = {(rt.system_id, rt.type): rt for rt in policy.related_resource_types} - for rt in self.related_resource_types: - key = (rt.system_id, rt.type) - if key in rt_dict: - if not rt.has_conditions(rt_dict[key].condition): - return False - return True - - def diff(self, policy: "Policy") -> bool: - """ - 求差集 - - 返回值, 是否完全一致 - - 处理多个资源类型依赖关系, 如果只有一个资源类型修改了, 那么另外一个资源类型的条件要保持不变 - - is_related: 是否是依赖操作, 如果是, 在已有的权限是任意时, 不能变更 - """ - if self.is_unrelated() and policy.is_unrelated(): - is_diff = self.compare_expired_at(policy) - self.is_diff_only_expired_at = is_diff # 需要有一个是否变更的标志 - return is_diff - - related_resource_types = deepcopy(self.related_resource_types) - rt_dict = {(rt.system_id, rt.type): rt for rt in policy.related_resource_types} - for rt in related_resource_types: - key = (rt.system_id, rt.type) - if key in rt_dict: - # 如果从有限权限变更成任意, 可以确定有变更 - if rt.is_any() and not rt_dict[key].is_any(): - return False - - rt.remove_conditions(rt_dict[key].condition) - - # 如果所有的资源类型都被删空, 返回True - is_empty = all([rt.is_empty() for rt in related_resource_types]) - # 如果完全没变, 但是申请的时间变了 - if is_empty and not self.compare_expired_at(policy): - self.is_diff_only_expired_at = True - return False - - # 如果有部分资源没有被删空, 返回False, 并对删空的部分补偿回来 - if not is_empty: - original_rt_dict = {(rt.system_id, rt.type): rt for rt in self.related_resource_types} - for rt in related_resource_types: - key = (rt.system_id, rt.type) - if rt.is_empty(): - rt.merge_conditions(original_rt_dict[key].condition) - - # 更新 - self.related_resource_types = related_resource_types - - return is_empty - - def compare_expired_at(self, policy: "Policy") -> bool: - return self.expired_at == policy.expired_at - - def compare(self, policy: "Policy") -> bool: - """ - 对比条件 - """ - if not self._compare_types(policy): - return False - - rt_dict = {(rt.system_id, rt.type): rt for rt in policy.related_resource_types} - for rt in self.related_resource_types: - key = (rt.system_id, rt.type) - if key in rt_dict: - if not rt_dict[key].compare(rt): - return False - return True - - def _compare_types(self, policy: "Policy") -> bool: - """ - 比较依赖资源是否一致 - """ - return {(rt.system_id, rt.type) for rt in policy.related_resource_types} == { - (rt.system_id, rt.type) for rt in self.related_resource_types + def to_backend_dict(self): + translator = ResourceExpressionTranslator() + return { + "action_id": self.action_id, + "resource_expression": translator.translate([rt.dict() for rt in self.related_resource_types]), + "environment": "{}", + "expired_at": self.expired_at, + "id": self.policy_id, } - def fill_action_base_info(self, action: Action): - """填充Action的基本信息""" - self.name = action.name - self.name_en = action.name_en - self.description = action.description - self.description_en = action.description_en - self.type = action.type - def fill_name(self, action: Action, system_resource_types: ResourceTypeDict) -> None: - """ - 填充名称 - """ - self.fill_action_base_info(action) +class BackendThinPolicy(BaseModel): + id: int + system: str + action_id: str + expired_at: int - for rt in self.related_resource_types: - action_rrt = action.get_related_resource_type(rt.system_id, rt.type) - if not action_rrt: - continue - rt.fill_type_name(action_rrt, system_resource_types) - - def fill_resource_node_name(self, resource_info_name_dict: Dict[ResourceNode, str]) -> None: - """ - 填充每个节点资源实例的Name - """ - for rt in self.related_resource_types: - rt.fill_resource_node_name(resource_info_name_dict) - - def add_resources_instance(self, resources: List[ResourceInstance]) -> bool: - """ - 实例授权, 返回是否变更标志 - """ - is_modified = False - - rt_dict = {(rt.system_id, rt.type): rt for rt in self.related_resource_types} - for r in resources: - rt = rt_dict[(r.system_id, r.type)] - if r.instances: - for instance in r.instances: - # NOTE 这个里的and顺序不能弄反, 一定要先add - if rt.add_instance(instance) and (not is_modified): - is_modified = True - else: - # 若资源实例为空列表，说明授权无限制资源实例 - # 若原有策略为无限制，则不修改，否则修改为无限制 - if not rt.is_any(): - rt.merge_conditions([], True) - is_modified = True - - return is_modified - - def remove_resources_instance(self, resources: List[ResourceInstance]) -> bool: - """ - 回收实例权限, 返回是否便功能标志 - 只有关联的资源类型的条件都有变更, 才真正的改变策略 - """ - result = [] - - rt_dict = {(rt.system_id, rt.type): rt for rt in self.related_resource_types} - for r in resources: - rt = rt_dict[(r.system_id, r.type)] - is_modified = False - for instance in r.instances: - # NOTE 这个里的and顺序不能弄反, 一定要先add - if rt.remove_instance(instance) and (not is_modified): - is_modified = True - result.append(is_modified) - return all(result) - - def get_system_set(self) -> Set[str]: - """ - 获取所有的system_id - """ - if self.is_unrelated(): - return set() - return set.union(*[rrt.get_system_set() for rrt in self.related_resource_types]) - - def set_instance_path_node_tag_ADD(self): - for rrt in self.related_resource_types: - rrt.set_instance_path_node_tag_ADD() - - -def group_paths(paths: List[List[Dict]]) -> List[Instance]: - """ - 对拓扑分组 - """ - instances: List[Instance] = [] - - # 对拓扑路径分组, 如果拓扑最后的节点是任意, 则使用倒数第二个节点分组 - def key_func(path: List[Dict]): - node = path[-1] - if node["id"] == ANY_ID and len(path) > 1: - node = path[-2] - return node["system_id"], node["type"] +class SystemCounter(BaseModel): + id: str + count: int - sorted_paths = sorted(paths, key=key_func) - # 按链路的最后一个资源的类型分组 - for k, group in groupby(sorted_paths, key=key_func): - instances.append(Instance(type=k[1], path=list(group))) - return instances +class PolicyIDExpiredAt(BaseModel): + id: int + expired_at: int diff --git a/saas/tests/service/policy_tests.py b/saas/backend/service/models/resource_creator_action.py similarity index 52% rename from saas/tests/service/policy_tests.py rename to saas/backend/service/models/resource_creator_action.py index bae1d80c4..59c89f388 100644 --- a/saas/tests/service/policy_tests.py +++ b/saas/backend/service/models/resource_creator_action.py @@ -8,23 +8,34 @@ an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. """ -import mock -from django.test import TestCase +from typing import List, Optional -from backend.service.policy import PolicyService -from tests.test_util.factory import PolicyFactory +from pydantic import BaseModel -class PolicyServiceTests(TestCase): - def test_check_policy_instance_count(self): - policy_factory = PolicyFactory() - policy = policy_factory.example() +class ResourceCreatorActionInfo(BaseModel): + """ + 新建关联配置中单个Action + """ - policy.related_resource_types[0].instances_count = mock.Mock(return_value=10) + id: str + required: bool - svc = PolicyService() - svc.check_policy_instance_count(policy) - with self.assertRaises(Exception): - policy.related_resource_types[0].instances_count = mock.Mock(return_value=10001) - svc.check_policy_instance_count(policy) +class ResourceCreatorActionConfigItem(BaseModel): + """ + 资源类型对应的被创建时所需的Action配置等 + """ + + id: str + actions: List[ResourceCreatorActionInfo] + sub_resource_types: Optional[List["ResourceCreatorActionConfigItem"]] = None + + +class ResourceCreatorActionConfig(BaseModel): + """ + 新建关联配置 + """ + + mode: str + config: List[ResourceCreatorActionConfigItem] diff --git a/saas/backend/service/models/resource_type.py b/saas/backend/service/models/resource_type.py index 78f809971..b635d313e 100644 --- a/saas/backend/service/models/resource_type.py +++ b/saas/backend/service/models/resource_type.py @@ -25,19 +25,3 @@ class ResourceTypeDict(BaseModel): def get_name(self, system_id: str, resource_type_id: str) -> Tuple[str, str]: rt = self.data.get((system_id, resource_type_id), None) return (rt["name"], rt["name_en"]) if rt else ("", "") - - -# TODO: [重构] 迁移ResourceNode => biz.resource -class ResourceNode(BaseModel): - """资源实例""" - - system_id: str - type: str - id: str - name: str = "" - - def __hash__(self): - return hash((self.system_id, self.type, self.id)) - - def __eq__(self, other): - return self.system_id == other.system_id and self.type == other.type and self.id == other.id diff --git a/saas/backend/apps/action/constants.py b/saas/backend/service/models/subject.py similarity index 75% rename from saas/backend/apps/action/constants.py rename to saas/backend/service/models/subject.py index 439c158de..1230a0409 100644 --- a/saas/backend/apps/action/constants.py +++ b/saas/backend/service/models/subject.py @@ -8,10 +8,15 @@ an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. """ -from aenum import LowerStrEnum, auto +from pydantic import BaseModel -class ActionTag(LowerStrEnum): - READONLY = auto() - CHECKED = auto() - UNCHECKED = auto() +class Subject(BaseModel): + type: str + id: str + + def __hash__(self): + return hash((self.type, self.id)) + + def __eq__(self, other): + return self.type == other.type and self.id == other.id diff --git a/saas/backend/service/models/system.py b/saas/backend/service/models/system.py index 33eaa4456..8fb89c0f0 100644 --- a/saas/backend/service/models/system.py +++ b/saas/backend/service/models/system.py @@ -8,12 +8,8 @@ an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. """ -import logging - from pydantic import BaseModel -logger = logging.getLogger("app") - class System(BaseModel): id: str @@ -21,14 +17,3 @@ class System(BaseModel): name_en: str description: str description_en: str - - -class Subject(BaseModel): - type: str - id: str - - def __hash__(self): - return hash((self.type, self.id)) - - def __eq__(self, other): - return self.type == other.type and self.id == other.id diff --git a/saas/backend/service/policy/__init__.py b/saas/backend/service/policy/__init__.py index 890260f03..5d3baadf7 100644 --- a/saas/backend/service/policy/__init__.py +++ b/saas/backend/service/policy/__init__.py @@ -8,6 +8,3 @@ an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. """ -from .base import PolicyQueryMixin, PolicyService - -__all__ = ["PolicyService", "PolicyQueryMixin"] diff --git a/saas/backend/service/policy/base.py b/saas/backend/service/policy/base.py deleted file mode 100644 index e60b20718..000000000 --- a/saas/backend/service/policy/base.py +++ /dev/null @@ -1,564 +0,0 @@ -# -*- coding: utf-8 -*- -""" -TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. -Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. -Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. -You may obtain a copy of the License at http://opensource.org/licenses/MIT -Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on -an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the -specific language governing permissions and limitations under the License. -""" -import logging -import time -from copy import copy, deepcopy -from itertools import chain -from typing import Any, Dict, List, Tuple - -from django.conf import settings -from django.core.cache import cache -from django.db import transaction - -from backend.apps.policy.models import Policy as PolicyModel -from backend.common.error_codes import error_codes -from backend.common.time import PERMANENT_SECONDS, generate_default_expired_at -from backend.component import iam -from backend.service.constants import ADMIN_USER, Operate, SelectionMode, SubjectType -from backend.service.models import Action, Attribute, Policy, RelatedResource, ResourceInstance, Subject -from backend.util.json import json_dumps - -from ..action import ActionList, ActionService -from ..resource_type import ResourceTypeService - -permission_logger = logging.getLogger("permission") - -# TODO 需要删除这个文件 - - -class PolicyQueryMixin: - # TODO 授权后查询表达式, 非查询类接口 - def get_policy(self, system_id: str, subject: Subject, action_id: str) -> Dict: - """ - 获取policy表达式 - """ - return iam.get_backend_expression(system_id, subject.dict(), action_id) - - # TODO 前端展示用的, 包含所有的信息/授权时需要取已有的策略, 做比较, 筛选等等操作, 填充等等操作 - # TODO 模型分离, 用于前端展示的模型, 用于比较/校验/筛选的模型 - # TODO service 只处理模型的查询, 对于名称的填充由biz处理, service的查询模型相对来说需要固定, 不做兼容, 上层biz来处理不同的模型字段 - def list_system_policy_by_subject(self, system_id: str, subject: Subject, fill_name: bool = True) -> List[Policy]: - """ - 获取subject的所有policy - """ - # 查询用户有权限的policy列表 - policy_dict = self._get_backend_policy_dict(system_id, subject) - - # 从db查询 - qs = PolicyModel.objects.filter( - system_id=system_id, - subject_type=subject.type, - subject_id=subject.id, - policy_id__in=list(policy_dict.keys()), - ) - policies = [Policy.from_db_model(p) for p in qs] - - # 组装数据 - for p in policies: - p.set_expired_at(policy_dict[p.policy_id]["expired_at"]) - p.set_tag_unchanged() # TODO service不管这个, 由biz填充 - - if fill_name: - self.fill_policies_name_by_system(system_id, policies) # TODO 由biz填充 - - return policies - - # TODO 针对backend返回的policy可以订一个结构, 封装相关的方法 - def _get_backend_policy_dict(self, system_id: str, subject: Subject) -> Dict: - backend_policies = iam.list_system_policy(system_id, subject.type, subject.id) - return {p["id"]: p for p in backend_policies} - - # TODO 分上层的用途分割模型, fill相关的操作放到biz - def fill_policies_name(self, policies: List[Policy], actions: List[Action]) -> None: - """ - 填充policies的名称字段 - """ - action_list = ActionList(actions) - - # 获取policies中所有的system_id信息 - system_ids = set.union(*[policy.get_system_set() for policy in policies]) - - # 获取所有相关的资源类型信息 - resource_type_dict = ResourceTypeService().get_resource_type_dict(list(system_ids)) - - # 填充policy中的涉及到的需要的Name字段 - for policy in policies: - action = action_list.get(policy.id) - if not action: - continue - - policy.fill_name(action, resource_type_dict) - - # TODO 上提到biz - def fill_policies_name_by_system(self, system_id: str, policies: List[Policy]): - """ - 使用system_id查询并填充policies的字段 - """ - if not policies: - return - actions = ActionService().list(system_id) - self.fill_policies_name(policies, actions) - - -class PolicyService(PolicyQueryMixin): - """ - 策略授权对象 - - application_authorize 自定义申请单在审批后授权 - delete_partial policy中条件部分删除 - delete_by_ids 删除策略 - """ - - # TODO 操作类 - def alter_subject_policies(self, system_id: str, subject: Subject, policies: List[Policy]) -> List[Policy]: - """ - 变更用户的策略 - """ - if not policies: - return [] - - # 加system+subject锁, 避免并发引发数据不一致 - with cache.lock(self._get_authorization_lock_key(system_id, subject), timeout=10): - # 查询用户已有的权限 - old_policies = self.list_system_policy_by_subject(system_id, subject) - - # TODO 相关的diff方法, 检查方法全部放到biz - # 对比申请权限与已有权限的差异 - create_policies, update_policies, _ = self._diff_policies(policies, old_policies, True) - - # 如果老策略已经覆盖要变更的策略，则直接返回 - if not create_policies and not update_policies: - return [] - - # 检查更新的policy, 实例数据不超过1万 - for p in update_policies: - self.check_policy_instance_count(p) - - # 开启事务 - with transaction.atomic(): - # 1. 创建SaaS策略 - self._create_db_policies(system_id, subject, create_policies) - - # 2. 更新SaaS策略 - self._update_db_policies(system_id, subject, update_policies) - - # 5. 变更后端权限 - self._alter_backend_policies(system_id, subject, create_policies, update_policies, []) - - # 6. 更新SaaS策略policy_id - self._sync_subject_policy_id(system_id, subject) - - # 返回授权的策略 - return self._compare_grant_policies( - system_id, create_policies, update_policies, {p.id: p for p in old_policies} - ) - - # TODO biz层封装相关的方法 - def _diff_policies( - self, new_policies: List[Policy], old_policies: List[Policy], merge=False - ) -> Tuple[List[Policy], List[Policy], List[Policy]]: - """ - 对比出需要创建的policy, 需要更新的policy - """ - create_policies = [] # 需要创建的policies - update_policies = [] # 需要更新的policies - unchanged_policies = [] # 不变的policies - - old_policies_dict = {p.id: p for p in old_policies} - for p in new_policies: - # 不在已有的操作中的新操作 - if p.id not in old_policies_dict: - create_policies.append(p) - else: - old_policy = old_policies_dict[p.id] - p.policy_id = old_policy.policy_id - - # 对比过期时间, 申请的时间小于已有权限的过期时间, 过期时间不变 - if (old_policy.expired_at or 0) > (p.expired_at or 0): - p.expired_at = old_policy.expired_at - - # 如果老策略已经包含了新策略里，则不需要更新 - if old_policy.has(p) and old_policy.compare_expired_at(p): - unchanged_policies.append(old_policy) - continue - - # 合并数据 - p.merge(old_policy) - update_policies.append(p) - - # 其它未变更的操作 - other_action_set = set(old_policies_dict.keys()) - set({p.id for p in new_policies}) - for action_id in list(other_action_set): - unchanged_policies.append(old_policies_dict[action_id]) - - return create_policies, update_policies, unchanged_policies - - # TODO 操作类接口 - def _create_db_policies(self, system_id: str, subject: Subject, policies: List[Policy]) -> None: - """ - 创建新的策略 - """ - db_policies = [p.to_db_model(system_id, subject) for p in policies] - - PolicyModel.objects.bulk_create(db_policies, batch_size=100) - - def _update_db_policies(self, system_id: str, subject: Subject, policies: List[Policy]) -> None: - """ - 更新已有的策略 - """ - policies_dict = {p.policy_id: p for p in policies} - - db_policies = PolicyModel.objects.filter( - subject_id=subject.id, - subject_type=subject.type, - system_id=system_id, - policy_id__in=list(policies_dict.keys()), - ).only("id", "policy_id") - - # 使用主键更新, 避免死锁 - for p in db_policies: - new_policy = policies_dict[p.policy_id] - - PolicyModel.objects.filter(id=p.id).update( - _resources=json_dumps([rt.dict() for rt in new_policy.related_resource_types]), - _environment=json_dumps(new_policy.environment), - ) - - def _alter_backend_policies( - self, - system_id: str, - subject: Subject, - create_policies: List[Policy], - update_policies: List[Policy], - delete_policy_ids: List[int], - ): - """ - 执行对policies的创建, 更新, 删除操作, 调用后端批量操作接口 - """ - # 组装backend变更策略的数据 - backend_create_policies = [p.to_backend_dict() for p in create_policies] - - backend_update_policies = [p.to_backend_dict() for p in update_policies] - - return iam.alter_policies( - system_id, subject.type, subject.id, backend_create_policies, backend_update_policies, delete_policy_ids - ) - - def _sync_subject_policy_id(self, system_id: str, subject: Subject) -> None: - """ - 同步SaaS-后端策略的policy_id - """ - policies = PolicyModel.objects.filter( - system_id=system_id, subject_type=subject.type, subject_id=subject.id, policy_id=0 - ) - - if len(policies) > 0: - backend_policies = iam.list_system_policy(system_id, subject.type, subject.id) - policy_id_dict = {p["action_id"]: p["id"] for p in backend_policies} - for p in policies: - p.policy_id = policy_id_dict.get(p.action_id, 0) - PolicyModel.objects.bulk_update(policies, fields=["policy_id"], batch_size=100) - - @staticmethod - def _get_authorization_lock_key(system_id: str, subject: Subject): - """ - 生成 system + action + subject 锁 key - """ - return f"bk_iam:lock:{system_id}:{subject.type}:{subject.id}" - - def _alter_policies(self, subject, system_id, create_policies, update_policies): - """ - 策略调整 - """ - # 开启事务 - with transaction.atomic(): - if update_policies: - self._update_db_policies(system_id, subject, update_policies) - - if create_policies: - self._create_db_policies(system_id, subject, create_policies) - - if update_policies or create_policies: - self._alter_backend_policies(system_id, subject, create_policies, update_policies, []) - if create_policies: - self._sync_subject_policy_id(system_id, subject) - - # TODO 放到biz的小方法中, 不必放到biz class中 - def generate_expired_at(self, expired_at: int = 0): - """生成过期时间""" - # 如果传入设置的过期时间, 大于当前时间，且小于或等于永久，则使用它 - if time.time() < expired_at <= PERMANENT_SECONDS: - return expired_at - - return generate_default_expired_at() - - def _grant_resources_instance( - self, - system_id: str, - actions: List[Action], - subject: Subject, - resources: List[ResourceInstance], - expired_at: int = 0, - ) -> List[Policy]: - """ - 资源实例授权 - """ - new_policy_expired_at = self.generate_expired_at(expired_at) - # 加 system + subject 锁 - with cache.lock(self._get_authorization_lock_key(system_id, subject), timeout=10): - - policies = self.list_system_policy_by_subject(system_id, subject) - policies_dict = {p.id: p for p in policies} - - # 遍历actions, 如果已有policy则更新, 如果不存在则创建 - # TODO 应该提供相关的数据结构转换方法, 全部转成policies再处理 - create_policies, update_policies = [], [] - for action in actions: - if action.id in policies_dict: - # 对于与资源实例无关的Action，直接跳过 - if len(action.related_resource_types) == 0: - continue - policy = deepcopy(policies_dict[action.id]) - # TODO: 参数有效期, 大于已有有效期, 是否更新??? - if policy.add_resources_instance(resources): # TODO 做成数据转换, 全部转换为policy, 再通过policy复用相关的方法 - # 检查整个policy的path数量没有超过1万 - self.check_policy_instance_count(policy) - - # 需要更新的policy - update_policies.append(policy) - continue - - # 创建新的policy - related_resource_types = [] - if len(action.related_resource_types) > 0: - related_resource_types = [RelatedResource.from_resource_instance(r) for r in resources] - policy = Policy( - id=action.id, - related_resource_types=related_resource_types, - environment={}, - expired_at=new_policy_expired_at, - type=action.type, - ) - create_policies.append(policy) - - self._alter_policies(subject, system_id, create_policies, update_policies) - - # 返回授权的策略信息 - return self._compare_grant_policies(system_id, create_policies, update_policies, policies_dict) - - # TODO 不需要了, 审计以实际传入的数据为准 - def _compare_grant_policies( - self, - system_id, - create_policies: List[Policy], - update_policies: List[Policy], - old_policy_dict: Dict[str, Policy], - ) -> List[Policy]: - """ - 对比出实际授权的策略 - """ - grant_policies = copy(create_policies) - for policy in update_policies: - policy.diff(old_policy_dict[policy.id]) - grant_policies.append(policy) - - self.fill_policies_name_by_system(system_id, grant_policies) - - return grant_policies - - # TODO 结构转换为policies后, 统一使用policyList的相关方法处理 - def _revoke_resources_instance( - self, system_id: str, actions: List[Action], subject: Subject, resources: List[ResourceInstance] - ): - # 加 system + subject 锁 - # TODO 结构转换后, 通过policy相关的方法处理 - with cache.lock(self._get_authorization_lock_key(system_id, subject), timeout=10): - - policies = self.list_system_policy_by_subject(system_id, subject) - policies_dict = {p.id: p for p in policies} - - update_policies, delete_policies = [], [] - for action in actions: - if action.id in policies_dict: - policy = deepcopy(policies_dict[action.id]) - if policy.remove_resources_instance(resources): - if all([r.is_empty() for r in policy.related_resource_types]): - delete_policies.append(policy) - else: - update_policies.append(policy) - - with transaction.atomic(): - delete_ids = [p.policy_id for p in delete_policies] - if update_policies: - self._update_db_policies(system_id, subject, update_policies) - - if delete_policies: - PolicyModel.objects.filter( - system_id=system_id, subject_type=subject.type, subject_id=subject.id, policy_id__in=delete_ids - ).delete() - - if update_policies or delete_policies: - self._alter_backend_policies(system_id, subject, [], update_policies, delete_ids) - - # 返回被回收的策略 - revoke_policies = [policies_dict[p.id] for p in delete_policies] - for p in update_policies: - old_policy = policies_dict[p.id] - old_policy.diff(p) - revoke_policies.append(old_policy) - self.fill_policies_name_by_system(system_id, revoke_policies) - - return update_policies, delete_policies, revoke_policies - - def grant_or_revoke_instance( - self, - operate: str, - system_id: str, - action: Action, - subject: Subject, - resource_instances: List[ResourceInstance], - expired_at: int = 0, - ) -> Tuple[Dict, List[Policy]]: - """ - 单个资源实例授权或回收 - """ - if subject.type == SubjectType.USER.value and subject.id == ADMIN_USER: - return {}, [] - - permission_logger.info("open api %s by system: %s", operate, system_id) - - if operate == Operate.GRANT.value: - grant_policies = self._grant_resources_instance( - system_id, [action], subject, resource_instances, expired_at - ) - return self.get_policy(system_id, subject, action.id), grant_policies - - if operate == Operate.REVOKE.value: - update_policies, delete_policies, revoke_policies = self._revoke_resources_instance( - system_id, [action], subject, resource_instances - ) - if update_policies: - return self.get_policy(system_id, subject, action.id), revoke_policies - if delete_policies: - policy = delete_policies[0] - return {"policy_id": policy.policy_id, "expression": {}}, revoke_policies - - return {}, [] - - def grant_or_revoke_batch_instance( - self, - operate: str, - system_id: str, - actions: List[Action], - subject: Subject, - resource_instances: List[ResourceInstance], - expired_at: int = 0, - ) -> Tuple[List[Any], List[Policy]]: - """ - 批量资源实例授权或回收 - """ - if subject.type == SubjectType.USER.value and subject.id == ADMIN_USER: - return [], [] - - permission_logger.info("open api %s by system: %s", operate, system_id) - - if operate == Operate.GRANT.value: - grant_policies = self._grant_resources_instance( - system_id, actions, subject, resource_instances, expired_at - ) - policies = self.list_system_policy_by_subject(system_id, subject, False) - return ( - [ - {"action": {"id": p.id}, "policy_id": p.policy_id} - for p in policies - if p.id in {ac.id for ac in actions} - ], - grant_policies, - ) - - if operate == Operate.REVOKE.value: - update_policies, delete_policies, revoke_policies = self._revoke_resources_instance( - system_id, actions, subject, resource_instances - ) # 批量回收 - return ( - [{"action": {"id": p.id}, "policy_id": p.policy_id} for p in chain(update_policies, delete_policies)], - revoke_policies, - ) - - return [], [] - - def grant_attribute( - self, system_id: str, action_ids: List[str], subject: Subject, attributes: List[Attribute] - ) -> Tuple[List[Any], List[Policy]]: - """ - 属性授权 - 其中attributes 并非批量属性授权，而是属性之间有逻辑And关系 - 注意：仅仅支持 - """ - # 查询Action，并且其关联的资源类型Name/NameEn - actions = [a for a in ActionService().list(system_id) if a.id in set(action_ids)] - # 遍历每个Action，转换出需要赋予权限的策略 - policies = [] - for action in actions: - # 对于与资源实例无关的Action，直接生成权限 - if len(action.related_resource_types) == 0: - policies.append( - Policy( - id=action.id, - related_resource_types=[], - environment={}, - expired_at=generate_default_expired_at(), - type=action.type, - ) - ) - continue - # 目前仅仅支持一种依赖资源类型的Action，多种则直接忽略 - if len(action.related_resource_types) != 1: - continue - - rrt = action.related_resource_types[0] - # Action不支持属性授权，也直接忽略 - if rrt.selection_mode not in [SelectionMode.ATTRIBUTE.value, SelectionMode.ALL.value]: - continue - - related_resource_types = [ - RelatedResource.from_attributes(rrt.system_id, rrt.id, rrt.name, rrt.name_en, attributes) - ] - policies.append( - Policy( - id=action.id, - related_resource_types=related_resource_types, - environment={}, - expired_at=generate_default_expired_at(), - type=action.type, - ) - ) - # 变更权限 - grant_policies = self.alter_subject_policies(system_id, subject, policies) - - subject_policies = self.list_system_policy_by_subject(system_id, subject, False) - return ( - [{"action": {"id": p.id}, "policy_id": p.policy_id} for p in subject_policies if p.id in set(action_ids)], - grant_policies, - ) - - # TODO: [重构] 迁移拆分svc.Policy.get_instances() 、 biz.Policy.check_instance_count - def check_policy_instance_count(self, policy: Policy): - """ - 检查策略的实例数量不超过限制 - """ - for rrt in policy.related_resource_types: - if rrt.instances_count() > settings.SINGLE_POLICY_MAX_INSTANCES_LIMIT: - raise error_codes.VALIDATE_ERROR.format( - "操作[{}]关联的[{}]的实例数已达上限{}个，请改用范围或者属性授权。".format( - policy.name, rrt.name, settings.SINGLE_POLICY_MAX_INSTANCES_LIMIT - ) - ) diff --git a/saas/backend/service/policy/operation.py b/saas/backend/service/policy/operation.py index ebff3dad1..06fbc4fcc 100644 --- a/saas/backend/service/policy/operation.py +++ b/saas/backend/service/policy/operation.py @@ -11,19 +11,13 @@ from typing import List, Optional from django.db import transaction -from pydantic import BaseModel from backend.apps.policy.models import Policy as PolicyModel from backend.component import iam -from backend.service.models.system import Subject from backend.util.json import json_dumps -from .query import Policy, PolicyList, new_backend_policy_list_by_subject - - -class PolicyIDExpredAt(BaseModel): - id: int - expired_at: int +from ..models import Policy, PolicyIDExpiredAt, Subject +from .query import PolicyList, new_backend_policy_list_by_subject class PolicyOperationService: @@ -139,7 +133,7 @@ def _sync_db_policy_id(self, system_id: str, subject: Subject) -> None: PolicyModel.objects.bulk_update(db_policies, fields=["policy_id"], batch_size=100) - def renew(self, subject: Subject, thin_policies: List[PolicyIDExpredAt]): + def renew(self, subject: Subject, thin_policies: List[PolicyIDExpiredAt]): """ 权策续期 """ diff --git a/saas/backend/service/policy/query.py b/saas/backend/service/policy/query.py index 09a306b22..96a81eb44 100644 --- a/saas/backend/service/policy/query.py +++ b/saas/backend/service/policy/query.py @@ -11,118 +11,12 @@ from typing import Any, Dict, List, Optional, Tuple from django.db.models import Count -from pydantic import BaseModel -from pydantic.fields import Field from backend.apps.policy.models import Policy as PolicyModel from backend.common.error_codes import error_codes from backend.component import iam -from backend.service.models import Subject -from backend.service.utils.translate import ResourceExpressionTranslator -from backend.util.uuid import gen_uuid - -# TODO Policy重构完成后, 迁移模型到models下 -class PathNode(BaseModel): - id: str - name: str - system_id: str = "" # NOTE 兼容一下, 早期的policy数据中可能没有system_id - type: str - - -class Instance(BaseModel): - type: str - path: List[List[PathNode]] - - -class Value(BaseModel): - id: Any - name: str - - -class Attribute(BaseModel): - id: str - name: str - values: List[Value] - - def sort_values(self): - self.values.sort(key=lambda value: value.id) - - def trim(self) -> Tuple: - return self.id, tuple([value.id for value in self.values]) - - -class Condition(BaseModel): - instances: List[Instance] - attributes: List[Attribute] - id: str - - def __init__(self, **data: Any) -> None: - if "id" not in data: - data["id"] = gen_uuid() - super().__init__(**data) - - def sort_attributes(self): - for a in self.attributes: - a.sort_values() - self.attributes.sort(key=lambda attribute: attribute.id) - - def hash_attributes(self): - self.sort_attributes() - return hash(tuple([attribute.trim() for attribute in self.attributes])) - - def has_no_attributes(self) -> bool: - return len(self.attributes) == 0 - - def has_no_instances(self) -> bool: - return len(self.instances) == 0 - - -class RelatedResource(BaseModel): - system_id: str - type: str - condition: List[Condition] - - -class Policy(BaseModel): - action_id: str = Field(alias="id") - related_resource_types: List[RelatedResource] - policy_id: int - expired_at: int - - class Config: - allow_population_by_field_name = True # 支持alias字段同时传 action_id 与 id - - @classmethod - def from_db_model(cls, policy: PolicyModel, expired_at: int) -> "Policy": - return cls( - action_id=policy.action_id, - related_resource_types=policy.resources, - policy_id=policy.policy_id, - expired_at=expired_at, - ) - - def to_db_model(self, system_id: str, subject: Subject) -> PolicyModel: - p = PolicyModel( - subject_type=subject.type, - subject_id=subject.id, - system_id=system_id, - action_type="", - action_id=self.action_id, - ) - p.resources = [rt.dict() for rt in self.related_resource_types] - p.environment = {} - return p - - def to_backend_dict(self): - translator = ResourceExpressionTranslator() - return { - "action_id": self.action_id, - "resource_expression": translator.translate([rt.dict() for rt in self.related_resource_types]), - "environment": "{}", - "expired_at": self.expired_at, - "id": self.policy_id, - } +from ..models import BackendThinPolicy, Policy, Subject, SystemCounter class PolicyList: @@ -166,18 +60,6 @@ def update(self, policy: Policy): old_policy.policy_id = policy.policy_id -class BackendThinPolicy(BaseModel): - id: int - system: str - action_id: str - expired_at: int - - -class SystemCounter(BaseModel): - id: str - count: int - - class BackendThinPolicyList: def __init__(self, policies: List[BackendThinPolicy]) -> None: self.policies = policies diff --git a/saas/backend/service/resource.py b/saas/backend/service/resource.py index 59d9c2f57..d54f8977b 100644 --- a/saas/backend/service/resource.py +++ b/saas/backend/service/resource.py @@ -103,7 +103,9 @@ def set(self, id_name_map: Dict[str, str]): try: with redis_region.backend.client.pipeline() as pipe: for _id, name in id_name_map.items(): - pipe.set(self._generate_id_cache_key(_id), name, ex=5 * 60) # 缓存5分钟 + # 只缓存name是字符串的，其他非法的不缓存 + if isinstance(name, str): + pipe.set(self._generate_id_cache_key(_id), name, ex=5 * 60) # 缓存5分钟 pipe.execute() except RedisError as error: logger.exception(f"set resource id name cache error: {error}") diff --git a/saas/backend/service/resource_creator_action.py b/saas/backend/service/resource_creator_action.py index f62077c64..df8aaca7f 100644 --- a/saas/backend/service/resource_creator_action.py +++ b/saas/backend/service/resource_creator_action.py @@ -8,44 +8,19 @@ an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. """ -from typing import Dict, List +from typing import Optional -from backend.common.error_codes import error_codes from backend.component import iam -from .models import ResourceCreatorAction, ResourceCreatorSingleAction +from .models import ResourceCreatorActionConfig class ResourceCreatorActionService: - def get(self, system_id) -> ResourceCreatorAction: + @staticmethod + def get(system_id: str) -> Optional[ResourceCreatorActionConfig]: """获取系统的新建关联配置""" rca = iam.get_resource_creator_actions(system_id) - # 空的话，说明接入系统未配置，必须报错 if not rca: - raise error_codes.VALIDATE_ERROR.format( - "system[{}] do not register resource_creator_actions".format(system_id) - ) - return ResourceCreatorAction(**rca) + return None - def _get_resource_type_actions_map(self, system_id: str) -> Dict[str, List[ResourceCreatorSingleAction]]: - """展开打平resource_type 与actions映射""" - resource_creator_action = self.get(system_id) - rta_map = {} - for c in resource_creator_action.config: - rta_map.update(c.get_resource_type_actions_map()) - return rta_map - - def get_actions(self, system_id: str, resource_type_id: str) -> List[str]: - """ - 根据资源类型，获取该类型需要授权的Action - 目前暂时直接返回系统默认配置，后续可以根据user配置等生成（需要subject参数） - """ - resource_type_actions_map = self._get_resource_type_actions_map(system_id) - # 判断是否存在，不存在直接提示 - if resource_type_id not in resource_type_actions_map: - raise error_codes.VALIDATE_ERROR.format( - "system[{}]-action[{}] do not register actions for authorization of creator".format( - system_id, resource_type_id - ) - ) - return [action.id for action in resource_type_actions_map[resource_type_id]] + return ResourceCreatorActionConfig(**rca) diff --git a/saas/backend/service/resource_type.py b/saas/backend/service/resource_type.py index dc9ab8620..13806ed7a 100644 --- a/saas/backend/service/resource_type.py +++ b/saas/backend/service/resource_type.py @@ -12,9 +12,8 @@ from typing import Dict, List, Tuple from backend.component import iam -from backend.service.models.resource_type import ResourceTypeDict -from .models import ResourceType +from .models import ResourceType, ResourceTypeDict class ResourceTypeService: diff --git a/saas/backend/service/role.py b/saas/backend/service/role.py index a0e8fb4bd..5dd6803f1 100644 --- a/saas/backend/service/role.py +++ b/saas/backend/service/role.py @@ -28,11 +28,11 @@ from backend.apps.template.models import PermTemplate, PermTemplatePolicyAuthorized from backend.common.error_codes import error_codes from backend.component import iam -from backend.service.constants import RoleRelatedObjectType, RoleScopeType, RoleSourceTypeEnum, RoleType, SubjectType -from backend.service.models import Subject -from backend.service.policy.query import RelatedResource from backend.util.json import json_dumps +from .constants import RoleRelatedObjectType, RoleScopeType, RoleSourceTypeEnum, RoleType, SubjectType +from .models import RelatedResource, Subject + logger = logging.getLogger("app") @@ -212,18 +212,27 @@ def _delete_backend_role_member(self, role: Role, deleted_members: List[str]): ) def _update_role_scope(self, role_id: int, subjects: List[Subject], systems: List[AuthScopeSystem]): - """创建Role的授权范围""" + """更新Role的授权范围""" # 1. 修改系统操作的限制范围 + self.update_role_auth_scope(role_id, systems) + + # 2. 修改授权对象的限制范围 + self._update_role_subject_scope(role_id, subjects) + + def update_role_auth_scope(self, role_id: int, systems: List[AuthScopeSystem]): + """更新Role可授权的权限范围""" RoleScope.objects.filter(role_id=role_id, type=RoleScopeType.AUTHORIZATION.value).update( content=json_dumps([system.dict() for system in systems]) ) - # 2. 修改授权对象的限制范围 + def _update_role_subject_scope(self, role_id: int, subjects: List[Subject]): + """更新Role可授权的人员范围""" + # 1. 修改授权对象的限制范围 RoleScope.objects.filter(role_id=role_id, type=RoleScopeType.SUBJECT.value).update( content=json_dumps([subject.dict() for subject in subjects]) ) - # 3. 更新role subject scope 关系 + # 2. 更新role subject scope 关系 self._update_scope_subject(role_id, subjects) def _update_scope_subject(self, role_id: int, subjects: List[Subject]): diff --git a/saas/backend/service/system.py b/saas/backend/service/system.py index 80d6da86d..868357fec 100644 --- a/saas/backend/service/system.py +++ b/saas/backend/service/system.py @@ -11,6 +11,7 @@ from typing import List, Optional from backend.component import iam +from backend.util.cache import region from .models import System @@ -35,5 +36,13 @@ def get(self, system_id: str) -> System: system = iam.get_system(system_id) return System(**system) + @region.cache_on_arguments(expiration_time=5 * 60) # 5分钟过期 + def list_client(self, system_id: str) -> List[str]: + """ + 查询可访问系统的clients + """ + system = iam.get_system(system_id, fields="clients") + return system["clients"].split(",") + def new_system_list(self) -> SystemList: return SystemList(self.list()) diff --git a/saas/backend/service/template.py b/saas/backend/service/template.py index 64330c80e..20eb391d0 100644 --- a/saas/backend/service/template.py +++ b/saas/backend/service/template.py @@ -18,9 +18,9 @@ from backend.apps.template.models import PermTemplate, PermTemplatePolicyAuthorized, PermTemplatePreGroupSync from backend.common.error_codes import error_codes from backend.component import iam -from backend.service.policy.query import Policy, PolicyList, SystemCounter, new_backend_policy_list_by_subject -from .models import Subject +from .models import Policy, Subject, SystemCounter +from .policy.query import PolicyList, new_backend_policy_list_by_subject class TemplateGroupPreCommit(BaseModel): diff --git a/saas/backend/biz/trans/__init__.py b/saas/backend/trans/__init__.py similarity index 86% rename from saas/backend/biz/trans/__init__.py rename to saas/backend/trans/__init__.py index 29b354825..5d3baadf7 100644 --- a/saas/backend/biz/trans/__init__.py +++ b/saas/backend/trans/__init__.py @@ -8,8 +8,3 @@ an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. """ -from .policy_related_resources import ToPolicyRelatedResources - -__all__ = [ - "ToPolicyRelatedResources", -] diff --git a/saas/backend/biz/trans/application.py b/saas/backend/trans/application.py similarity index 98% rename from saas/backend/biz/trans/application.py rename to saas/backend/trans/application.py index 359354921..278be96c9 100644 --- a/saas/backend/biz/trans/application.py +++ b/saas/backend/trans/application.py @@ -15,12 +15,12 @@ from django.conf import settings from django.utils.translation import gettext as _ +from backend.biz.application import ActionApplicationDataBean +from backend.biz.policy import PolicyBeanList, PolicyQueryBiz from backend.common.error_codes import error_codes from backend.service.constants import SubjectType from backend.service.models import Subject -from ..application import ActionApplicationDataBean -from ..policy import PolicyBeanList, PolicyQueryBiz from .policy import PolicyTrans diff --git a/saas/backend/biz/trans/group.py b/saas/backend/trans/group.py similarity index 96% rename from saas/backend/biz/trans/group.py rename to saas/backend/trans/group.py index 30e3bcaad..f39d58992 100644 --- a/saas/backend/biz/trans/group.py +++ b/saas/backend/trans/group.py @@ -11,7 +11,8 @@ from typing import Any, Dict, List from backend.biz.group import GroupTemplateGrantBean -from backend.biz.trans.policy import PolicyTrans + +from .policy import PolicyTrans class GroupTrans: diff --git a/saas/backend/trans/open.py b/saas/backend/trans/open.py new file mode 100644 index 000000000..95fae2556 --- /dev/null +++ b/saas/backend/trans/open.py @@ -0,0 +1,191 @@ +# -*- coding: utf-8 -*- +""" +TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. +Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. +Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. +You may obtain a copy of the License at http://opensource.org/licenses/MIT +Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on +an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the +specific language governing permissions and limitations under the License. +""" +from typing import Any, List + +from pydantic import BaseModel, Field +from pydantic.tools import parse_obj_as + +from backend.biz.action import ActionCheckBiz, ActionForCheck +from backend.biz.instance_selection import InstanceSelectionBean, InstanceSelectionBiz, PathResourceTypeBean +from backend.biz.policy import PolicyBean, PolicyBeanList, group_paths +from backend.biz.resource import ResourceBiz, ResourceNodeBean +from backend.common.error_codes import error_codes + + +class OpenResourcePathNode(BaseModel): + system_id: str = Field(alias="system", default="") # 默认值为空，兼容早期API都允许不传system + type: str + id: str + name: str = "" + + class Config: + allow_population_by_field_name = True # 支持alias字段传 system 或 system_id + + +class OpenRelatedResource(BaseModel): + system_id: str = Field(alias="system") + type: str + paths: List[List[OpenResourcePathNode]] = [] + attributes: List[Any] = [] # 一般情况下，若支持属性，其API协议与PolicyBean等都一致的，所以不需要额外定义，Any表示即可 + + class Config: + allow_population_by_field_name = True # 支持alias字段传 system 或 system_id + + def _raise_match_selection_fail_exception(self, path: List[OpenResourcePathNode]): + raise error_codes.VALIDATE_ERROR.format(f"resource({path}) not satisfy instance selection") + + def fill_instance_system(self, selections: List[InstanceSelectionBean]): + """使用实例视图，对所有资源实例路径进行system填充""" + for path in self.paths: + # 遍历每个实例视图，查询哪些实例视图与path是匹配 + path_resource_types = [PathResourceTypeBean(system_id=node.system_id, id=node.type) for node in path] + match_selections = [selection for selection in selections if selection.match_path(path_resource_types)] + + # 若没有任何一个实例视图匹配，说明数据有问题，直接异常 + if not match_selections: + self._raise_match_selection_fail_exception(path) + + # 判断是否路径上每个节点都有system，有的话不需要使用实例视图填充 + if all([node.system_id != "" for node in path]): + continue + + # 取匹配的实例视图的第一个来做填充 + first_match_selection = match_selections[0] + + # 获取到实例视图提供的系统列表, 填充到现有的path中 + system_ids = first_match_selection.list_match_path_system_id(path_resource_types) + for node, system_id in zip(path, system_ids): + node.system_id = system_id + + # 如果有多个实例视图可以匹配, 所有实例视图返回的system_ids必须一致 + for selection in match_selections[1:]: + if system_ids != selection.list_match_path_system_id(path_resource_types): + self._raise_match_selection_fail_exception(path) + + def fill_instance_name(self): + """填充资源实例名称 + Note: 这里的填充名字只会对缺名称的进行填充，因为对于授权API是说，是可以完全信任接入系统传的名称 + """ + # 必须保证所有资源实例的system_id都存在 + assert all([node.system_id != "" for path in self.paths for node in path]) + + # 查询资源Name + resource_biz = ResourceBiz() + resource_nodes = [ResourceNodeBean.parse_obj(node) for path in self.paths for node in path if node.name == ""] + name_provider = resource_biz.fetch_resource_name(resource_nodes, raise_not_found_exception=True) + + # 填充实例名称 + for path in self.paths: + for node in path: + if node.name == "": + node.name = name_provider.get_name(node.system_id, node.type, node.id) + + +class OpenPolicy(BaseModel): + """ + 这是Open API 对于 授权等涉及到策略相关的对外统一数据结构 + """ + + system_id: str = Field(alias="system") + action_id: str = Field(alias="id") + related_resource_types: List[OpenRelatedResource] + + class Config: + allow_population_by_field_name = True # 支持alias字段传 system或system_id 和action_id或id + + def fill_instance_system(self): + """填充system，由于申请数据里的资源实例可能只有type和id，不知道该资源是哪个系统的，所以需要根据权限模型的进行填充""" + # 使用模型里的实例视图进行填充 + instance_selection_biz = InstanceSelectionBiz() + for rrt in self.related_resource_types: + # 查询实例视图 + selections = instance_selection_biz.list_by_action_resource_type( + self.system_id, + self.action_id, + rrt.system_id, + rrt.type, + ) + + # 对于只支持属性配置的操作，不需要填充 + if not selections: + # 没有实例视图，但是在授权时配置里实例，则不允许 + if len(rrt.paths) > 0: + raise error_codes.VALIDATE_ERROR.format(f"action({self.action_id}) not support to grant instance") + continue + + # 填充path的system_id + rrt.fill_instance_system(selections) + + def fill_instance_name(self): + """填充资源实例名称""" + for rrt in self.related_resource_types: + rrt.fill_instance_name() + + +class OpenCommonTrans: + """主要是处理open api的通用处理，因为所有open api都会保持相同的概念协议，所有很多转换逻辑都是通用""" + + action_check_biz = ActionCheckBiz() + + @staticmethod + def _to_policies(open_policies: List[OpenPolicy]) -> List[PolicyBean]: + """批量将OpenPolicy转换为PolicyBean""" + policies = [] + for open_policy in open_policies: + related_resource_types = [] + for rrt in open_policy.related_resource_types: + rrt_dict = rrt.dict() + # 将多个以path方式表示的实例进行分组 + instances = group_paths(rrt_dict["paths"]) + + # 若instances和attributes都为空，则为无限制 + condition = ( + [{"instances": instances, "attributes": rrt_dict["attributes"]}] + if instances or rrt_dict["attributes"] + else [] + ) + + related_resource_types.append( + { + "system_id": rrt.system_id, + "type": rrt.type, + "condition": condition, + } + ) + + policy = PolicyBean.parse_obj( + {"action_id": open_policy.action_id, "related_resource_types": related_resource_types} + ) + policies.append(policy) + + return policies + + def _to_policy_list(self, system_id: str, open_policies: List[OpenPolicy], expired_at=0) -> PolicyBeanList: + """授权数据转换的公共逻辑：(1) 校验与权限模型是否一致（2）转换为策略数据，并校验实例视图和填充相关字段""" + # 1. 初步检查是否合法数据，与权限模型是否一致 + self.action_check_biz.check(system_id, parse_obj_as(List[ActionForCheck], open_policies)) + + # 2. 转换为策略数据结构 + policies = self._to_policies(open_policies) + # 设置有效期 + if expired_at > 0: + for p in policies: + p.set_expired_at(expired_at) + + policy_list = PolicyBeanList( + system_id=system_id, + policies=policies, + need_fill_empty_fields=True, # 填充相关字段 + need_check_instance_selection=True, # 校验实例视图 + need_ignore_path=False, + ) + + return policy_list diff --git a/saas/backend/trans/open_application.py b/saas/backend/trans/open_application.py new file mode 100644 index 000000000..9c1452f7a --- /dev/null +++ b/saas/backend/trans/open_application.py @@ -0,0 +1,82 @@ +# -*- coding: utf-8 -*- +""" +TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. +Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. +Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. +You may obtain a copy of the License at http://opensource.org/licenses/MIT +Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on +an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the +specific language governing permissions and limitations under the License. +""" +from typing import Dict, List + +from pydantic.tools import parse_obj_as + +from backend.biz.policy import PolicyBeanList + +from .open import OpenCommonTrans, OpenPolicy + + +class AccessSystemApplicationTrans(OpenCommonTrans): + """接入系统请求自定义权限的申请链接的请求数据""" + + def to_policy_list(self, data: Dict) -> PolicyBeanList: + """ + 组装出申请的策略 + { + system: + actions: [ + { + id: 操作ID + related_resource_types: [ + { + system, + type, + instances: [ + [ + { + system, # 大部分情况下为空，只有引用了其他系统资源同时与当前系统的资源类型ID冲突时才需要 + type, + id, + }, + ... + ] + ], + attributes: [ + { + id, + name, + values: [ + { + id, + name + }, + ... + ] + }, + ... + ] + } + ] + } + ] + } + """ + system_id = data["system"] + actions = data["actions"] + + # 1. 将数据转换为OpenPolicy用于后续处理 + for action in actions: + action["system_id"] = system_id + for rrt in action["related_resource_types"]: + rrt["paths"] = rrt.pop("instances", []) + open_policies = parse_obj_as(List[OpenPolicy], actions) + + # 2. 填充资源实例所需数据：（1）system_id （2）name + for open_policy in open_policies: + # 填充system_id + open_policy.fill_instance_system() + # 将给所有资源实例添加名字 + open_policy.fill_instance_name() + + return self._to_policy_list(system_id, open_policies) diff --git a/saas/backend/trans/open_authorization.py b/saas/backend/trans/open_authorization.py new file mode 100644 index 000000000..207634a6d --- /dev/null +++ b/saas/backend/trans/open_authorization.py @@ -0,0 +1,243 @@ +# -*- coding: utf-8 -*- +""" +TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. +Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. +Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. +You may obtain a copy of the License at http://opensource.org/licenses/MIT +Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on +an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the +specific language governing permissions and limitations under the License. +""" +from typing import Any, Dict, List + +from pydantic.tools import parse_obj_as + +from backend.biz.action import ActionBiz +from backend.biz.policy import PolicyBeanList +from backend.common.error_codes import error_codes + +from .open import OpenCommonTrans, OpenPolicy + + +class AuthorizationTrans(OpenCommonTrans): + """授权API的数据转换""" + + action_biz = ActionBiz() + + def to_policy_list_for_instance( + self, system_id: str, action_id: str, resources: List[Dict], expired_at=0 + ) -> PolicyBeanList: + """单个实例授权 + resources: [ + { + system, + type, + id, + name + } + ] + """ + # 将数据转换为OpenPolicy用于后续处理 + related_resource_types = [{"system_id": i["system"], "type": i["type"], "paths": [[i]]} for i in resources] + open_policy = OpenPolicy.parse_obj( + {"system_id": system_id, "action_id": action_id, "related_resource_types": related_resource_types} + ) + + return self._to_policy_list(system_id, [open_policy], expired_at) + + def to_policy_list_for_instances( + self, system_id: str, action_ids: List[str], resources: List[Dict], expired_at=0 + ) -> PolicyBeanList: + """批量实例授权 + resources: [ + { + system, + type, + instances: [ + { + id, + name + } + ] + } + ] + """ + # 将数据转换为OpenPolicy用于后续处理 + related_resource_types = [ + { + "system_id": i["system"], + "type": i["type"], + "paths": [ + [{"system_id": i["system"], "type": i["type"], "id": j["id"], "name": j["name"]}] + for j in i["instances"] # 每个实例都是一个路径 + ], + } + for i in resources + ] + actions = [ + {"system_id": system_id, "action_id": action_id, "related_resource_types": related_resource_types} + for action_id in action_ids + ] + open_policies = parse_obj_as(List[OpenPolicy], actions) + + return self._to_policy_list(system_id, open_policies, expired_at) + + def to_policy_list_for_path( + self, system_id: str, action_id: str, resources: List[Dict], expired_at=0 + ) -> PolicyBeanList: + """单一路径授权 + resources: [ + { + system, + type, + path: [ + { + type, # 缺少对应资源类型的system_id + id, + name + }, + ... + ] + } + ] + """ + # 将数据转换为OpenPolicy用于后续处理 + related_resource_types = [ + {"system_id": i["system"], "type": i["type"], "paths": [i["path"]]} for i in resources + ] + open_policy = OpenPolicy.parse_obj( + {"system_id": system_id, "action_id": action_id, "related_resource_types": related_resource_types} + ) + # 填充路径上资源实例缺少的system_id + open_policy.fill_instance_system() + + return self._to_policy_list(system_id, [open_policy], expired_at) + + def to_policy_list_for_paths( + self, system_id: str, action_ids: List[str], resources: List[Dict], expired_at=0 + ) -> PolicyBeanList: + """批量实例授权 + resources: [ + { + system, + type, + paths: [ + [ + { + type, # 缺少对应资源类型的system_id + id, + name + }, + ... + ], + ... + ] + } + ] + """ + # 将数据转换为OpenPolicy用于后续处理 + actions = [ + {"system_id": system_id, "action_id": action_id, "related_resource_types": resources} + for action_id in action_ids + ] + open_policies = parse_obj_as(List[OpenPolicy], actions) + # 填充路径上资源实例缺少的system_id + for open_policy in open_policies: + open_policy.fill_instance_system() + + return self._to_policy_list(system_id, open_policies, expired_at) + + def _gen_action_for_resources_of_creator( + self, system_id: str, action_ids: List[str], resources: List[Any] + ) -> List[Dict]: + """ + 生成Action结构，用于后续转换为OpenPolicy + """ + # 查询Action信息，组装出实际Action结构 + action_list = self.action_biz.list(system_id) + actions = [] + for action_id in action_ids: + action = action_list.get(action_id) + # 对于新建关联配置里有，但实际action不存在，则说明权限模型注册有问题，直接报错 + if not action: + raise error_codes.VALIDATE_ERROR.format(f"system({system_id}) has not action({action_id})") + + actions.append( + { + "system_id": system_id, + "action_id": action_id, + # 对于新建关联，是可以连同授予"与资源实例无关"的操作权限 + "related_resource_types": resources if not action.is_unrelated() else [], + } + ) + return actions + + def to_policy_list_for_instances_of_creator( + self, system_id: str, action_ids: List[str], resource_type_id: str, instances: List[Dict] + ) -> PolicyBeanList: + """批量新建关联实例授权 + instances: [ + { + id, + name, + ancestors: [ # 祖先不一定会有 + { + system, + type, + id, + }, + ... + ] + }, + ... + ] + """ + # 将instances转换为resources结构 + paths = [] + for ist in instances: + # 获取祖先 + path = ist.get("ancestors") or [] + # 将本资源实例添加到路径的最后 + path.append({"system": system_id, "type": resource_type_id, "id": ist["id"], "name": ist["name"]}) + paths.append(path) + resources = [{"system": system_id, "type": resource_type_id, "paths": paths}] + + # 组装出实际Action结构 + actions = self._gen_action_for_resources_of_creator(system_id, action_ids, resources) + + # 将数据转换为OpenPolicy用于后续处理 + open_policies = parse_obj_as(List[OpenPolicy], actions) + # 填充路径上祖先实例缺少的名称 + for open_policy in open_policies: + open_policy.fill_instance_name() + + return self._to_policy_list(system_id, open_policies) + + def to_policy_list_for_attributes_of_creator( + self, system_id: str, action_ids: List[str], resource_type_id: str, attributes: List[Dict] + ) -> PolicyBeanList: + """批量新建关联属性授权 + attributes: [ + { + id, + name, + values: [ + { + id, + name + }, + ... + ] + }, + ... + ] + """ + resources = [{"system": system_id, "type": resource_type_id, "attributes": attributes}] + + # 组装出实际Action结构 + actions = self._gen_action_for_resources_of_creator(system_id, action_ids, resources) + + # 将数据转换为OpenPolicy用于后续处理 + open_policies = parse_obj_as(List[OpenPolicy], actions) + + return self._to_policy_list(system_id, open_policies) diff --git a/saas/backend/trans/open_management.py b/saas/backend/trans/open_management.py new file mode 100644 index 000000000..d24c1c4ba --- /dev/null +++ b/saas/backend/trans/open_management.py @@ -0,0 +1,127 @@ +# -*- coding: utf-8 -*- +""" +TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. +Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. +Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. +You may obtain a copy of the License at http://opensource.org/licenses/MIT +Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on +an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the +specific language governing permissions and limitations under the License. +""" +from typing import Dict, List + +from pydantic.tools import parse_obj_as + +from backend.biz.policy import PolicyBeanList +from backend.biz.role import RoleInfoBean + +from .open import OpenCommonTrans, OpenPolicy + + +class ManagementCommonTrans(OpenCommonTrans): + """主要是处理，管理类API一些通用的公共转换逻辑""" + + def to_policy_list_for_batch_action_and_resources( + self, system_id: str, action_ids: List[str], resources: List[Dict] + ) -> PolicyBeanList: + """ + 这里是将管理类API对外暴露的策略相关的协议数据，转换为策略数据结构列表 + 因为管理类API对外协议一般都是一样的，所以可以通用转换 + resources: [ + { + system, + type, + paths: [ + [ + { + system, + type, + id, + name, + } + ] + ] + }, + ... + ] + } + """ + # 将数据转换为OpenPolicy用于后续处理 + actions = [ + {"system_id": system_id, "action_id": action_id, "related_resource_types": resources} + for action_id in action_ids + ] + open_policies = parse_obj_as(List[OpenPolicy], actions) + + # 转换为策略列表(转换时会对action、实例视图等进行校验) + return self._to_policy_list(system_id, open_policies) + + +class GradeManagerTrans(ManagementCommonTrans): + """处理分级管理员数据转换""" + + def to_role_info(self, data: Dict) -> RoleInfoBean: + """ + 将分级管理的信息数据转换为 RoleInfoBean，用于后续分级管理员创建 + data: { + system, + name, + description, + members: [...], + subject_scopes: [ + { + type, + id + }, + ... + ], + authorization_scopes: [ + { + system, + actions: [ + { + id, + }, + ... + ], + resources: [ + { + system, + type, + paths: [ + [ + { + system, + type, + id, + name, + } + ] + ] + }, + ... + ] + } + ] + } + """ + # 将授权的权限范围数据转换为策略格式的auth_scopes + authorization_scopes = [] + for auth_scope in data["authorization_scopes"]: + system_id = auth_scope["system"] + resources = auth_scope["resources"] + action_ids = [action["id"] for action in auth_scope["actions"]] + # 转换为策略列表(转换时会对action、实例视图等进行校验) + policy_list = self.to_policy_list_for_batch_action_and_resources(system_id, action_ids, resources) + authorization_scopes.append( + { + "system_id": system_id, + # 由于RoleInfoBean需要的action_id是以id表示，而非action_id，所以PolicyBean转为字典时需要用其别名 + "actions": [p.dict(by_alias=True) for p in policy_list.policies], + } + ) + + # 替换掉data里原有的authorization_scopes + data["authorization_scopes"] = authorization_scopes + + return RoleInfoBean.parse_obj(data) diff --git a/saas/backend/biz/trans/policy.py b/saas/backend/trans/policy.py similarity index 96% rename from saas/backend/biz/trans/policy.py rename to saas/backend/trans/policy.py index ffaaf9f7f..7e9c011c3 100644 --- a/saas/backend/biz/trans/policy.py +++ b/saas/backend/trans/policy.py @@ -15,12 +15,18 @@ from pydantic.tools import parse_obj_as +from backend.biz.action import ActionBean, ActionBeanList, ActionBiz, ActionCheckBiz, ActionForCheck +from backend.biz.policy import ( + ConditionBean, + InstanceBean, + PathNodeBean, + PolicyBean, + PolicyBeanList, + RelatedResourceBean, +) from backend.common.error_codes import error_codes from backend.util.cache import region -from ..action import ActionBean, ActionBeanList, ActionBiz, ActionCheckBiz, ActionForCheck -from ..policy import ConditionBean, InstanceBean, PathNodeBean, PolicyBean, PolicyBeanList, RelatedResourceBean - class PolicyTrans: action_biz = ActionBiz() @@ -71,14 +77,14 @@ def _gen_policy_by_action_and_condition( @region.cache_on_arguments(expiration_time=60) # 缓存1分钟 def _get_action_list(self, system_id: str) -> ActionBeanList: """获取某个系统的操作列表""" - return ActionBeanList(actions=self.action_biz.list(system_id)) + return self.action_biz.list(system_id) def _get_action(self, system_id: str, action_id: str) -> ActionBean: """查询操作的权限模型""" action_list = self._get_action_list(system_id) action = action_list.get(action_id) if not action: - raise error_codes.VALIDATE_ERROR.format(f"{action_id} action not exists") + raise error_codes.VALIDATE_ERROR.format(f"system({system_id}) has not action({action_id})") return action diff --git a/saas/backend/biz/trans/role.py b/saas/backend/trans/role.py similarity index 97% rename from saas/backend/biz/trans/role.py rename to saas/backend/trans/role.py index adf45eb88..32042fb3d 100644 --- a/saas/backend/biz/trans/role.py +++ b/saas/backend/trans/role.py @@ -12,7 +12,8 @@ from backend.biz.policy import PolicyBeanList from backend.biz.role import RoleInfoBean -from backend.biz.trans.policy import PolicyTrans + +from .policy import PolicyTrans class RoleTrans: diff --git a/saas/tests/biz/action_tests.py b/saas/tests/biz/action_tests.py index 5ef2979b4..17c8562e8 100644 --- a/saas/tests/biz/action_tests.py +++ b/saas/tests/biz/action_tests.py @@ -11,138 +11,8 @@ import mock from django.test import TestCase -from backend.biz.action import ActionBean, ActionCheckBiz, ActionForCheck +from backend.biz.action import ActionBean from backend.biz.action_group import ActionGroupBean, ActionGroupBiz -from backend.service.action import ActionList, ActionService -from backend.service.models import ApplyAction -from tests.test_util.factory import ActionFactory - - -class ActionServiceFillSystemTests(TestCase): - def test_apply_instance(self): - from backend.component import iam - - iam.list_action = mock.Mock( - return_value=[ - { - "description": "", - "description_en": "", - "id": "edit_host", - "name": "编辑主机", - "name_en": "edit_host", - "related_actions": [], - "related_resource_types": [ - { - "id": "host", - "instance_selections": [ - { - "system_id": "bk_cmdb", - "id": "host", - "name": "主机", - "name_en": "host host", - "ignore_iam_path": False, - "resource_type_chain": [{"system_id": "bk_cmdb", "id": "host"}], - } - ], - "name": "主机", - "name_en": "host", - "scope": None, - "system_id": "bk_cmdb", - } - ], - "type": "delete", - "version": 0, - }, - ] - ) - - system_id = "bk_cmdb" - action = ApplyAction( - **{ - "id": "edit_host", - "related_resource_types": [ - { - "system_id": "bk_cmdb", - "type": "host", - "instances": [[{"system_id": "", "type": "host", "id": "host1", "name": "host1"}]], - "attributes": [], - } - ], - } - ) - - svc = ActionService() - action_list = ActionList(svc.list(system_id)) - svc_action = action_list.get(action.id) - action.fill_instance_system(svc_action) - - self.assertEqual( - action, - ApplyAction( - **{ - "id": "edit_host", - "related_resource_types": [ - { - "system_id": "bk_cmdb", - "type": "host", - "instances": [[{"system_id": "bk_cmdb", "type": "host", "id": "host1", "name": "host1"}]], - "attributes": [], - } - ], - } - ), - ) - - -class ActionServiceTests(TestCase): - def test_check_system_actions(self): - from backend.component import iam - - iam.list_action = mock.Mock( - return_value=[ - { - "description": "", - "description_en": "", - "id": "view_host", - "name": "编辑主机", - "name_en": "edit_host", - "related_actions": [], - "related_resource_types": [ - { - "id": "host", - "instance_selections": [ - { - "system_id": "bk_cmdb", - "id": "host", - "name": "主机", - "name_en": "host host", - "ignore_iam_path": False, - "resource_type_chain": [{"system_id": "bk_cmdb", "id": "host"}], - } - ], - "name": "主机", - "name_en": "host", - "scope": None, - "system_id": "bk_cmdb", - } - ], - "type": "delete", - "version": 0, - }, - ] - ) - - iam.list_resource_type = mock.Mock(return_value={}) - - action = ActionFactory().example() - - action_check_biz = ActionCheckBiz() - - action_check_biz.check("system", [ActionForCheck.parse_obj(action)]) - - with self.assertRaises(Exception): - action.related_resource_types[0].id = "test" - action_check_biz.check("system", [ActionForCheck.parse_obj(action)]) class ActionGroupTests(TestCase): diff --git a/saas/tests/biz/policy_tag_tests.py b/saas/tests/biz/policy_tag_tests.py deleted file mode 100644 index ed356c998..000000000 --- a/saas/tests/biz/policy_tag_tests.py +++ /dev/null @@ -1,1135 +0,0 @@ -# -*- coding: utf-8 -*- -""" -TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. -Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. -Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. -You may obtain a copy of the License at http://opensource.org/licenses/MIT -Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on -an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the -specific language governing permissions and limitations under the License. -""" -import mock -from django.test import TestCase - -from backend.biz.constants import PolicyTag -from backend.biz.policy_tag import ( - AttributeTagBean, - ConditionTagBean, - ConditionTagBiz, - InstanceTagBean, - PathNodeTagBean, - PolicyTagBean, - PolicyTagBeanList, - RelatedResourceTagBean, - ValueTagBean, -) -from backend.component import iam -from tests.test_util.factory import AttributeFactory, ConditionFactory, InstanceFactory - - -class CompareAndTagAttributeTests(TestCase): - def setUp(self): - self.attribute_factory = AttributeFactory() - - def test_compare_and_tag_attribute(self): - new_attribute = self.attribute_factory.new( - "id", "name", [{"id": "id1", "name": "name1"}, {"id": "id2", "name": "name2"}] - ) - - old_attribute = self.attribute_factory.new( - "id", "name", [{"id": "id2", "name": "name1"}, {"id": "id3", "name": "name2"}] - ) - - diff_attribute = AttributeTagBean(**new_attribute.dict()).compare_and_tag( - AttributeTagBean(**old_attribute.dict()) - ) - - self.assertEqual(diff_attribute.tag, "unchanged") - self.assertEqual(diff_attribute.values[0].tag, "add") - self.assertEqual(diff_attribute.values[1].tag, "unchanged") - self.assertEqual(diff_attribute.values[2].tag, "delete") - - -class CompareAndTagInstanceTests(TestCase): - def setUp(self): - self.instance_factory = InstanceFactory() - - def test_compare_and_tag_instance(self): - new_instance = self.instance_factory.new( - "type", - "name", - [ - [{"type": "type", "type_name": "name", "id": "id1", "name": "name1"}], - [{"type": "type", "type_name": "name", "id": "id2", "name": "name2"}], - ], - ) - - old_instance = self.instance_factory.new( - "type", - "name", - [ - [{"type": "type", "type_name": "name", "id": "id2", "name": "name2"}], - [{"type": "type", "type_name": "name", "id": "id3", "name": "name3"}], - ], - ) - - diff_instance = InstanceTagBean(**new_instance.dict()).compare_and_tag(InstanceTagBean(**old_instance.dict())) - - self.assertEqual(diff_instance.tag, "unchanged") - self.assertEqual(diff_instance.path[0][-1].tag, "add") - self.assertEqual(diff_instance.path[1][-1].tag, "unchanged") - self.assertEqual(diff_instance.path[2][-1].tag, "delete") - - -class CompareAndTagConditionTests(TestCase): - def setUp(self): - self.condition_factory = ConditionFactory() - self.attribute_factory = AttributeFactory() - self.instance_factory = InstanceFactory() - - def test_condition_compare_and_tag(self): - new_condition = self.condition_factory.new( - instances=[ - self.instance_factory.new( - "type", "name", [[{"type": "type", "type_name": "name", "id": "id1", "name": "name1"}]] - ), - self.instance_factory.new( - "type1", "name", [[{"type": "type1", "type_name": "name", "id": "id1", "name": "name1"}]] - ), - ], - attributes=[ - self.attribute_factory.new("id", "name", [{"id": "id1", "name": "name1"}]), - self.attribute_factory.new("id1", "name", [{"id": "id1", "name": "name1"}]), - ], - ) - - old_condition = self.condition_factory.new( - instances=[ - self.instance_factory.new( - "type", "name", [[{"type": "type", "type_name": "name", "id": "id2", "name": "name2"}]] - ), - self.instance_factory.new( - "type2", "name", [[{"type": "type2", "type_name": "name", "id": "id1", "name": "name1"}]] - ), - ], - attributes=[ - self.attribute_factory.new("id", "name", [{"id": "id1", "name": "name1"}]), - self.attribute_factory.new("id2", "name", [{"id": "id1", "name": "name1"}]), - ], - ) - - diff_condition = ConditionTagBean(**new_condition.dict()).compare_and_tag( - ConditionTagBean(**old_condition.dict()) - ) - - self.assertEqual(diff_condition.tag, "unchanged") - self.assertEqual(len(diff_condition.instances), 3) - self.assertEqual(diff_condition.instances[0].tag, "unchanged") - self.assertEqual(diff_condition.instances[1].tag, "add") - self.assertEqual(diff_condition.instances[2].tag, "delete") - self.assertEqual(len(diff_condition.attributes), 3) - self.assertEqual(diff_condition.attributes[0].tag, "unchanged") - self.assertEqual(diff_condition.attributes[1].tag, "add") - self.assertEqual(diff_condition.attributes[2].tag, "delete") - - -class CompareAndTagConditionsTests(TestCase): - def test_right(self): - new_conditions = [ - { - "id": "1", - "instances": [], - "attributes": [ - { - "id": "id2", - "name": "name1", - "values": [{"id": "id1", "name": "name1"}, {"id": "id2", "name": "name2"}], - } - ], - }, - { - "id": "2", - "instances": [], - "attributes": [ - { - "id": "id3", - "name": "name1", - "values": [{"id": "id1", "name": "name1"}, {"id": "id2", "name": "name2"}], - } - ], - }, - { - "id": "3", - "instances": [ - { - "type": "test1", - "name": "test1", - "path": [[{"type": "test1", "type_name": "test1", "id": "id1", "name": "id1"}]], - } - ], - "attributes": [ - { - "id": "id2", - "name": "name1", - "values": [{"id": "id1", "name": "name1"}, {"id": "id2", "name": "name2"}], - } - ], - }, - { - "id": "4", - "instances": [ - { - "type": "test1", - "name": "test1", - "path": [[{"type": "test1", "type_name": "test1", "id": "id1", "name": "id1"}]], - } - ], - "attributes": [ - { - "id": "id3", - "name": "name1", - "values": [{"id": "id1", "name": "name1"}, {"id": "id2", "name": "name2"}], - } - ], - }, - ] - - old_conditions = [ - { - "id": "2", - "instances": [], - "attributes": [ - { - "id": "id3", - "name": "name1", - "values": [{"id": "id1", "name": "name1"}, {"id": "id2", "name": "name2"}], - } - ], - }, - {"id": "3", "instances": [], "attributes": []}, - { - "id": "4", - "instances": [ - { - "type": "test1", - "name": "test1", - "path": [[{"type": "test1", "type_name": "test1", "id": "id1", "name": "id1"}]], - } - ], - "attributes": [ - { - "id": "id3", - "name": "name1", - "values": [{"id": "id1", "name": "name1"}, {"id": "id2", "name": "name2"}], - } - ], - }, - { - "id": "5", - "instances": [ - { - "type": "test1", - "name": "test1", - "path": [[{"type": "test1", "type_name": "test1", "id": "id1", "name": "id1"}]], - } - ], - "attributes": [ - { - "id": "id4", - "name": "name1", - "values": [{"id": "id1", "name": "name1"}, {"id": "id2", "name": "name2"}], - } - ], - }, - ] - - new_conditions = [ConditionTagBean(**c) for c in new_conditions] - old_conditions = [ConditionTagBean(**c) for c in old_conditions] - - svc = ConditionTagBiz() - - result = [ - ConditionTagBean(**c) - for c in [ - { - "instances": [], - "attributes": [ - { - "id": "id2", - "name": "name1", - "values": [ - {"id": "id1", "name": "name1", "tag": "add"}, - {"id": "id2", "name": "name2", "tag": "add"}, - ], - "tag": "add", - } - ], - "id": "1", - "tag": "add", - }, - { - "instances": [], - "attributes": [ - { - "id": "id3", - "name": "name1", - "values": [ - {"id": "id1", "name": "name1", "tag": "unchanged"}, - {"id": "id2", "name": "name2", "tag": "unchanged"}, - ], - "tag": "unchanged", - } - ], - "id": "2", - "tag": "unchanged", - }, - { - "instances": [ - { - "type": "test1", - "name": "test1", - "name_en": "", - "path": [ - [{"tag": "add", "type": "test1", "type_name": "test1", "id": "id1", "name": "id1"}] - ], - "tag": "add", - } - ], - "attributes": [ - { - "id": "id2", - "name": "name1", - "values": [ - {"id": "id1", "name": "name1", "tag": "add"}, - {"id": "id2", "name": "name2", "tag": "add"}, - ], - "tag": "add", - } - ], - "id": "3", - "tag": "add", - }, - {"instances": [], "attributes": [], "id": "3", "tag": "delete"}, - { - "instances": [ - { - "type": "test1", - "name": "test1", - "name_en": "", - "path": [ - [ - { - "tag": "unchanged", - "type": "test1", - "type_name": "test1", - "id": "id1", - "name": "id1", - } - ] - ], - "tag": "unchanged", - } - ], - "attributes": [ - { - "id": "id3", - "name": "name1", - "values": [ - {"id": "id1", "name": "name1", "tag": "unchanged"}, - {"id": "id2", "name": "name2", "tag": "unchanged"}, - ], - "tag": "unchanged", - } - ], - "id": "4", - "tag": "unchanged", - }, - { - "instances": [ - { - "type": "test1", - "name": "test1", - "name_en": "", - "path": [ - [{"tag": "delete", "type": "test1", "type_name": "test1", "id": "id1", "name": "id1"}] - ], - "tag": "delete", - } - ], - "attributes": [ - { - "id": "id4", - "name": "name1", - "values": [ - {"id": "id1", "name": "name1", "tag": "delete"}, - {"id": "id2", "name": "name2", "tag": "delete"}, - ], - "tag": "delete", - } - ], - "id": "5", - "tag": "delete", - }, - ] - ] - - self.assertEqual(svc.compare_and_tag(new_conditions, old_conditions, True), result) - - -class PolicyTagBeanListTests(TestCase): - def test_merge(self): - new_policy_list = PolicyTagBeanList( - "system_id", - [ - PolicyTagBean( - **{ - "type": "edit", - "id": "edit_host", - "name": "编辑主机", - "description": "", - "related_resource_types": [], - "environment": {}, - "expired_at": 31536000, - } - ), - PolicyTagBean( - **{ - "type": "edit", - "id": "view_host", - "name": "查看主机", - "description": "", - "related_resource_types": [], - "environment": {}, - "expired_at": 31536000, - } - ), - ], - ) - - old_policy_list = PolicyTagBeanList( - "system_id", - [ - PolicyTagBean( - **{ - "type": "edit", - "id": "view_host", - "name": "查看主机", - "description": "", - "related_resource_types": [{"system_id": "bk_cmdb", "type": "host", "condition": []}], - "environment": {}, - "policy_id": 1, - "expired_at": 31536000, - } - ), - PolicyTagBean( - **{ - "type": "edit", - "id": "delete_host", - "name": "查看主机", - "description": "", - "related_resource_types": [], - "environment": {}, - "expired_at": 31536000, - } - ), - ], - ) - - policy_list = old_policy_list.merge(new_policy_list) - self.assertEquals(len(policy_list.policies), 3) - self.assertEquals(policy_list.policies[0].tag, "update") - - def test_fill_empty_fields(self): - from backend.util.cache import cache_dictionary - - cache_dictionary.clear() - - iam.list_action = mock.Mock( - return_value=[ - { - "description": "", - "description_en": "", - "id": "view_host", - "name": "查看主机", - "name_en": "view_host", - "related_actions": [], - "related_resource_types": [ - { - "id": "host", - "instance_selections": [], - "name": "主机", - "name_en": "host", - "scope": None, - "system_id": "bk_cmdb", - } - ], - "type": "view", - "version": 0, - }, - ] - ) - - iam.list_resource_type = mock.Mock(return_value={"bk_cmdb": [{"id": "host", "name": "主机", "name_en": "host"}]}) - - policy = PolicyTagBean( - **{ - "id": "view_host", - "related_resource_types": [ - { - "system_id": "bk_cmdb", - "type": "host", - "condition": [ - { - "instances": [ - { - "type": "host", - "path": [ - [{"id": "host1", "name": "主机1", "system_id": "bk_cmdb", "type": "host"}] - ], - } - ], - "attributes": [ - {"id": "os", "name": "os", "values": [{"id": "linux", "name": "linux"}]} - ], - "id": "6280159a089847b99648faf3b5ff9e35", - } - ], - } - ], - } - ) - - policy_list = PolicyTagBeanList("bk_cmdb", [policy]) - policy_list.fill_empty_fields() - - want = [ - PolicyTagBean( - id="view_host", - related_resource_types=[ - RelatedResourceTagBean( - system_id="bk_cmdb", - type="host", - condition=[ - ConditionTagBean( - instances=[ - InstanceTagBean( - type="host", - path=[ - [ - PathNodeTagBean( - id="host1", - name="主机1", - system_id="bk_cmdb", - type="host", - type_name="主机", - type_name_en="host", - tag="", - ) - ] - ], - name="主机", - name_en="host", - tag="", - ) - ], - attributes=[ - AttributeTagBean( - id="os", - name="os", - values=[ValueTagBean(id="linux", name="linux", tag="")], - tag="", - ) - ], - id="6280159a089847b99648faf3b5ff9e35", - tag="", - ) - ], - name="主机", - name_en="host", - selection_mode="instance", - ) - ], - policy_id=0, - expired_at=0, - type="view", - name="查看主机", - name_en="view_host", - description="", - description_en="", - expired_display="", - tag="", - ) - ] - - self.assertEquals(policy_list.policies, want) - - def test_sub(self): - policies = [ - PolicyTagBean( - **{ - "id": "view_host", - "related_resource_types": [ - { - "system_id": "bk_cmdb", - "type": "host", - "condition": [ - { - "instances": [ - { - "type": "host", - "path": [ - [ - { - "id": "host1", - "name": "主机1", - "system_id": "bk_cmdb", - "type": "host", - } - ], - [ - { - "id": "host2", - "name": "主机2", - "system_id": "bk_cmdb", - "type": "host", - } - ], - ], - } - ], - "attributes": [ - {"id": "os", "name": "os", "values": [{"id": "linux", "name": "linux"}]} - ], - "id": "6280159a089847b99648faf3b5ff9e35", - } - ], - } - ], - } - ), - PolicyTagBean( - **{ - "id": "edit_host", - "related_resource_types": [ - { - "system_id": "bk_cmdb", - "type": "host", - "condition": [ - { - "instances": [ - { - "type": "host", - "path": [ - [ - { - "id": "host1", - "name": "主机1", - "system_id": "bk_cmdb", - "type": "host", - } - ] - ], - } - ], - "attributes": [ - {"id": "os", "name": "os", "values": [{"id": "linux", "name": "linux"}]} - ], - "id": "6280159a089847b99648faf3b5ff9e35", - } - ], - } - ], - } - ), - ] - - policies2 = [ - PolicyTagBean( - **{ - "id": "view_host", - "related_resource_types": [ - { - "system_id": "bk_cmdb", - "type": "host", - "condition": [ - { - "instances": [ - { - "type": "host", - "path": [ - [ - { - "id": "host2", - "name": "主机2", - "system_id": "bk_cmdb", - "type": "host", - } - ] - ], - } - ], - "attributes": [ - {"id": "os", "name": "os", "values": [{"id": "linux", "name": "linux"}]} - ], - "id": "6280159a089847b99648faf3b5ff9e35", - } - ], - } - ], - } - ), - PolicyTagBean( - **{ - "id": "edit_host", - "related_resource_types": [ - { - "system_id": "bk_cmdb", - "type": "host", - "condition": [ - { - "instances": [ - { - "type": "host", - "path": [ - [ - { - "id": "host1", - "name": "主机1", - "system_id": "bk_cmdb", - "type": "host", - } - ] - ], - } - ], - "attributes": [ - {"id": "os", "name": "os", "values": [{"id": "linux", "name": "linux"}]} - ], - "id": "6280159a089847b99648faf3b5ff9e35", - } - ], - } - ], - } - ), - ] - - sub_list = PolicyTagBeanList("bk_cmdb", policies).sub(PolicyTagBeanList("bk_cmdb", policies2)) - - want = [ - PolicyTagBean( - id="view_host", - related_resource_types=[ - RelatedResourceTagBean( - system_id="bk_cmdb", - type="host", - condition=[ - ConditionTagBean( - instances=[ - InstanceTagBean( - type="host", - path=[ - [ - PathNodeTagBean( - id="host1", - name="主机1", - system_id="bk_cmdb", - type="host", - type_name="", - type_name_en="", - tag="", - ) - ] - ], - name="", - name_en="", - tag="", - ) - ], - attributes=[ - AttributeTagBean( - id="os", - name="os", - values=[ValueTagBean(id="linux", name="linux", tag="")], - tag="", - ) - ], - id="6280159a089847b99648faf3b5ff9e35", - tag="", - ) - ], - name="", - name_en="", - selection_mode="", - ) - ], - policy_id=0, - expired_at=0, - type="", - name="", - name_en="", - description="", - description_en="", - expired_display="", - tag="", - ) - ] - - self.assertEquals(sub_list.policies, want) - - def test_add(self): - policies = [ - PolicyTagBean( - **{ - "id": "view_host", - "related_resource_types": [ - { - "system_id": "bk_cmdb", - "type": "host", - "condition": [ - { - "instances": [ - { - "type": "host", - "path": [ - [ - { - "id": "host1", - "name": "主机1", - "system_id": "bk_cmdb", - "type": "host", - } - ], - [ - { - "id": "host2", - "name": "主机2", - "system_id": "bk_cmdb", - "type": "host", - } - ], - ], - } - ], - "attributes": [ - {"id": "os", "name": "os", "values": [{"id": "linux", "name": "linux"}]} - ], - "id": "6280159a089847b99648faf3b5ff9e35", - } - ], - } - ], - } - ) - ] - - policies2 = [ - PolicyTagBean( - **{ - "id": "view_host", - "related_resource_types": [ - { - "system_id": "bk_cmdb", - "type": "host", - "condition": [ - { - "instances": [ - { - "type": "host", - "path": [ - [ - { - "id": "host2", - "name": "主机2", - "system_id": "bk_cmdb", - "type": "host", - } - ], - [ - { - "id": "host3", - "name": "主机3", - "system_id": "bk_cmdb", - "type": "host", - } - ], - ], - } - ], - "attributes": [ - {"id": "os", "name": "os", "values": [{"id": "linux", "name": "linux"}]} - ], - "id": "6280159a089847b99648faf3b5ff9e35", - } - ], - } - ], - } - ), - PolicyTagBean( - **{ - "id": "edit_host", - "related_resource_types": [ - { - "system_id": "bk_cmdb", - "type": "host", - "condition": [ - { - "instances": [ - { - "type": "host", - "path": [ - [ - { - "id": "host1", - "name": "主机1", - "system_id": "bk_cmdb", - "type": "host", - } - ] - ], - } - ], - "attributes": [ - {"id": "os", "name": "os", "values": [{"id": "linux", "name": "linux"}]} - ], - "id": "6280159a089847b99648faf3b5ff9e35", - } - ], - } - ], - } - ), - ] - - add_list = PolicyTagBeanList("bk_cmdb", policies).add(PolicyTagBeanList("bk_cmdb", policies2)) - want = [ - PolicyTagBean( - id="view_host", - related_resource_types=[ - RelatedResourceTagBean( - system_id="bk_cmdb", - type="host", - condition=[ - ConditionTagBean( - instances=[ - InstanceTagBean( - type="host", - path=[ - [ - PathNodeTagBean( - id="host1", - name="主机1", - system_id="bk_cmdb", - type="host", - type_name="", - type_name_en="", - tag="", - ) - ], - [ - PathNodeTagBean( - id="host2", - name="主机2", - system_id="bk_cmdb", - type="host", - type_name="", - type_name_en="", - tag="", - ) - ], - [ - PathNodeTagBean( - id="host3", - name="主机3", - system_id="bk_cmdb", - type="host", - type_name="", - type_name_en="", - tag="", - ) - ], - ], - name="", - name_en="", - tag="", - ) - ], - attributes=[ - AttributeTagBean( - id="os", - name="os", - values=[ValueTagBean(id="linux", name="linux", tag="")], - tag="", - ) - ], - id="6280159a089847b99648faf3b5ff9e35", - tag="", - ) - ], - name="", - name_en="", - selection_mode="", - ) - ], - policy_id=0, - expired_at=0, - type="", - name="", - name_en="", - description="", - description_en="", - expired_display="", - tag="", - ), - PolicyTagBean( - id="edit_host", - related_resource_types=[ - RelatedResourceTagBean( - system_id="bk_cmdb", - type="host", - condition=[ - ConditionTagBean( - instances=[ - InstanceTagBean( - type="host", - path=[ - [ - PathNodeTagBean( - id="host1", - name="主机1", - system_id="bk_cmdb", - type="host", - type_name="", - type_name_en="", - tag="", - ) - ] - ], - name="", - name_en="", - tag="", - ) - ], - attributes=[ - AttributeTagBean( - id="os", - name="os", - values=[ValueTagBean(id="linux", name="linux", tag="")], - tag="", - ) - ], - id="6280159a089847b99648faf3b5ff9e35", - tag="", - ) - ], - name="", - name_en="", - selection_mode="", - ) - ], - policy_id=0, - expired_at=0, - type="", - name="", - name_en="", - description="", - description_en="", - expired_display="", - tag="", - ), - ] - - self.assertEquals(add_list.policies, want) - - def test_set_tag(self): - policy = PolicyTagBean( - **{ - "id": "view_host", - "related_resource_types": [ - { - "system_id": "bk_cmdb", - "type": "host", - "condition": [ - { - "instances": [ - { - "type": "host", - "path": [ - [{"id": "host1", "name": "主机1", "system_id": "bk_cmdb", "type": "host"}] - ], - } - ], - "attributes": [ - {"id": "os", "name": "os", "values": [{"id": "linux", "name": "linux"}]} - ], - "id": "6280159a089847b99648faf3b5ff9e35", - } - ], - } - ], - } - ) - - policy_list = PolicyTagBeanList("bk_cmdb", [policy]) - policy_list.set_tag(PolicyTag.ADD.value) - want = [ - PolicyTagBean( - id="view_host", - related_resource_types=[ - RelatedResourceTagBean( - system_id="bk_cmdb", - type="host", - condition=[ - ConditionTagBean( - instances=[ - InstanceTagBean( - type="host", - path=[ - [ - PathNodeTagBean( - id="host1", - name="主机1", - system_id="bk_cmdb", - type="host", - type_name="", - type_name_en="", - tag="add", - ) - ] - ], - name="", - name_en="", - tag="add", - ) - ], - attributes=[ - AttributeTagBean( - id="os", - name="os", - values=[ValueTagBean(id="linux", name="linux", tag="add")], - tag="add", - ) - ], - id="6280159a089847b99648faf3b5ff9e35", - tag="add", - ) - ], - name="", - name_en="", - selection_mode="", - ) - ], - policy_id=0, - expired_at=0, - type="", - name="", - name_en="", - description="", - description_en="", - expired_display="", - tag="add", - ) - ] - - self.assertEquals(policy_list.policies, want) diff --git a/saas/tests/biz/policy_tests.py b/saas/tests/biz/policy_tests.py deleted file mode 100644 index c05fcf773..000000000 --- a/saas/tests/biz/policy_tests.py +++ /dev/null @@ -1,871 +0,0 @@ -# -*- coding: utf-8 -*- -""" -TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. -Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. -Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. -You may obtain a copy of the License at http://opensource.org/licenses/MIT -Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on -an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the -specific language governing permissions and limitations under the License. -""" -import mock -from django.test import TestCase - -from backend.biz.policy import ( - ConditionBean, - ConditionBeanList, - InstanceBean, - PathNodeBean, - PathNodeBeanList, - PolicyBean, - PolicyBeanList, - PolicyEmptyException, - RelatedResourceBean, -) -from backend.common.error_codes import CodeException -from backend.service.models.instance_selection import ChainNode, InstanceSelection -from backend.service.models.resource_type import ResourceTypeDict -from backend.service.policy.query import Attribute -from tests.test_util.factory import ( - AttributeFactory, - ConditionBeanFactory, - InstanceBeanFactory, - InstanceSelectionFactory, - PolicyBeanFactory, - RelatedResourceBeanFactory, -) - - -class InstanceAddSubInstance(TestCase): - def setUp(self): - self.instance_factory = InstanceBeanFactory() - - def test_add_instance_true(self): - instance = self.instance_factory.example() - new_instance = self.instance_factory.new( - "host", "主机", [[{"type": "host", "type_name": "主机", "id": "host2", "name": "主机2"}]] - ) - - instance.add_paths(new_instance.path) - - self.assertEqual(len(instance.path), 2) - - def test_add_instance_false(self): - instance = self.instance_factory.example() - - instance.add_paths(instance.path) - - self.assertEqual(len(instance.path), 1) - - def test_remove_instance_true(self): - instance = self.instance_factory.new( - "host", - "主机", - [ - [{"type": "host", "type_name": "主机", "id": "host1", "name": "主机1"}], - [{"type": "host", "type_name": "主机", "id": "host2", "name": "主机2"}], - ], - ) - old_instance = self.instance_factory.example() - - instance.remove_paths(old_instance.path) - - self.assertEqual(len(instance.path), 1) - - def test_remove_instance_false(self): - instance = self.instance_factory.example() - old_instance = self.instance_factory.new( - "host", "主机", [[{"type": "host", "type_name": "主机", "id": "host2", "name": "主机2"}]] - ) - - instance.remove_paths(old_instance.path) - - self.assertEqual(len(instance.path), 1) - - -class ConditionAddSubTest(TestCase): - def setUp(self): - self.condition_factory = ConditionBeanFactory() - self.instance_factory = InstanceBeanFactory() - - def test_condition_add_true(self): - condition = self.condition_factory.new(instances=[self.instance_factory.example()]) - old_condition = self.condition_factory.new( - instances=[ - self.instance_factory.new( - "host", "主机", [[{"type": "host", "type_name": "主机", "id": "host2", "name": "主机2"}]] - ) - ] - ) - - condition.add_instances(old_condition.instances) - self.assertEqual(len(condition.instances), 1) - self.assertEqual(len(condition.instances[0].path), 2) - - condition = self.condition_factory.new(instances=[self.instance_factory.example()]) - old_condition = self.condition_factory.new( - instances=[ - self.instance_factory.new( - "业务", "biz", [[{"type": "biz", "type_name": "业务", "id": "biz1", "name": "蓝鲸"}]] - ) - ] - ) - - condition.add_instances(old_condition.instances) - - self.assertEqual(len(condition.instances), 2) - - def test_condition_add_false(self): - condition = self.condition_factory.new(instances=[self.instance_factory.example()]) - - condition.add_instances(condition.instances) - - self.assertEqual(len(condition.instances), 1) - - def test_condition_remove_true(self): - condition = self.condition_factory.new( - instances=[ - self.instance_factory.new( - "host", - "主机", - [ - [{"type": "host", "type_name": "主机", "id": "host1", "name": "主机1"}], - [{"type": "host", "type_name": "主机", "id": "host2", "name": "主机2"}], - ], - ) - ] - ) - old_condition = self.condition_factory.new(instances=[self.instance_factory.example()]) - - condition.remove_instances(old_condition.instances) - self.assertEqual(len(condition.instances[0].path), 1) - - def test_condition_remove_false(self): - condition = self.condition_factory.new(instances=[self.instance_factory.example()]) - old_condition = self.condition_factory.new( - instances=[ - self.instance_factory.new( - "host", "主机", [[{"type": "host", "type_name": "主机", "id": "host2", "name": "主机2"}]] - ) - ] - ) - condition.remove_instances(old_condition.instances) - self.assertEqual(len(condition.instances), 1) - self.assertEqual(len(condition.instances[0].path), 1) - - -class ConditionListAddSubInstance(TestCase): - def setUp(self): - self.resource_factory = RelatedResourceBeanFactory() - self.instance_factory = InstanceBeanFactory() - self.condition_factory = ConditionBeanFactory() - self.attribute_factory = AttributeFactory() - - def test_add_instance_any(self): - resource = self.resource_factory.new("bk_cmdb", "host", "主机") - condition_list = ConditionBeanList(resource.condition) - condition_list_2 = ConditionBeanList([self.condition_factory.new(instances=[self.instance_factory.example()])]) - - condition_list.add(condition_list_2) - - self.assertEqual(len(condition_list.conditions), 0) - - def test_add_new_condition(self): - resource = self.resource_factory.new( - "bk_cmdb", "host", "主机", [self.condition_factory.new(attributes=[self.attribute_factory.example()])] - ) - - condition_list = ConditionBeanList(resource.condition) - condition_list_2 = ConditionBeanList([self.condition_factory.new(instances=[self.instance_factory.example()])]) - - condition_list.add(condition_list_2) - - self.assertEqual(len(condition_list.conditions), 2) - - def test_add_instance_true(self): - resource = self.resource_factory.new( - "bk_cmdb", "host", "主机", [self.condition_factory.new(instances=[self.instance_factory.example()])] - ) - - condition_list = ConditionBeanList(resource.condition) - condition_list_2 = ConditionBeanList( - [ - self.condition_factory.new( - instances=[ - self.instance_factory.new( - "host", "主机", [[{"type": "host", "type_name": "主机", "id": "host2", "name": "主机2"}]] - ) - ] - ) - ] - ) - - condition_list.add(condition_list_2) - self.assertEqual(len(condition_list.conditions), 1) - self.assertEqual(len(condition_list.conditions[0].instances), 1) - self.assertEqual(len(condition_list.conditions[0].instances[0].path), 2) - - def test_remove_instance_any(self): - resource = self.resource_factory.new("bk_cmdb", "host", "主机") - - condition_list = ConditionBeanList(resource.condition) - condition_list_2 = ConditionBeanList([self.condition_factory.new(instances=[self.instance_factory.example()])]) - - condition_list.sub(condition_list_2) - - self.assertEqual(len(condition_list.conditions), 0) - - def test_remove_instance_true(self): - resource = self.resource_factory.new( - "bk_cmdb", "host", "主机", [self.condition_factory.new(instances=[self.instance_factory.example()])] - ) - - condition_list = ConditionBeanList(resource.condition) - condition_list_2 = ConditionBeanList([self.condition_factory.new(instances=[self.instance_factory.example()])]) - - condition_list.sub(condition_list_2) - - self.assertTrue(condition_list.is_empty) - - -class InstanceCheckSelection(TestCase): - def setUp(self): - self.instance_selection_factory = InstanceSelectionFactory() - self.instance_factory = InstanceBeanFactory() - self.resource_factory = RelatedResourceBeanFactory() - - def test_path_display(self): - instance = self.instance_factory.example() - node_list = PathNodeBeanList(instance.path[0]) - path_display = node_list.display() - self.assertEqual(path_display, "host:主机1") - - def test_check_selections_export_1(self): - """ - 检查实例视图, 实例的节点的类型与资源类型一样 - """ - instance = self.instance_factory.example() - rrt = self.resource_factory.example() - selections = [self.instance_selection_factory.new("1", "1", False, [])] - instance.check_instance_selection(rrt.system_id, rrt.type, selections, True) - - def test_check_selections_export_2(self): - instance = self.instance_factory.new( - "host", - "主机", - [ - [ - {"system_id": "bk_cmdb", "type": "biz", "type_name": "biz", "id": "biz1", "name": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "type_name": "set", "id": "set1", "name": "set1"}, - { - "system_id": "bk_cmdb", - "type": "module", - "type_name": "module", - "id": "module1", - "name": "module1", - }, - {"system_id": "bk_cmdb", "type": "host", "type_name": "host", "id": "host1", "name": "host1"}, - ] - ], - ) - rrt = self.resource_factory.example() - selections = [self.instance_selection_factory.example()] - instance.check_instance_selection(rrt.system_id, rrt.type, selections, True) - - def test_check_selections_export_3(self): - instance = self.instance_factory.new( - "host", - "主机", - [ - [ - {"system_id": "bk_cmdb", "type": "biz", "type_name": "biz", "id": "biz1", "name": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "type_name": "set", "id": "set1", "name": "set1"}, - { - "system_id": "bk_cmdb", - "type": "module", - "type_name": "module", - "id": "module1", - "name": "module1", - }, - {"system_id": "bk_cmdb", "type": "host", "type_name": "host", "id": "host1", "name": "host1"}, - ] - ], - ) - rrt = self.resource_factory.example() - selections = [self.instance_selection_factory.example()] - selections[0].ignore_iam_path = True - instance.check_instance_selection(rrt.system_id, rrt.type, selections, True) - self.assertEqual(len(instance.path[0]), 1) - - def test_check_selections_export_4(self): - instance = self.instance_factory.new( - "host", - "主机", - [ - [ - {"system_id": "bk_cmdb", "type": "biz", "type_name": "biz", "id": "biz1", "name": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "type_name": "set", "id": "set1", "name": "set1"}, - ] - ], - ) - rrt = self.resource_factory.example() - selections = [self.instance_selection_factory.example()] - selections[0].ignore_iam_path = True - instance.check_instance_selection(rrt.system_id, rrt.type, selections, True) - self.assertEqual(len(instance.path[0]), 2) - - def test_check_selections_err(self): - instance = self.instance_factory.new( - "host", "主机", [[{"system_id": "bk_cmdb", "type": "set", "type_name": "set", "id": "set1", "name": "set1"}]] - ) - rrt = self.resource_factory.example() - selections = [self.instance_selection_factory.example()] - try: - instance.check_instance_selection(rrt.system_id, rrt.type, selections, True) - except CodeException as e: - self.assertEqual(e.message, "参数校验失败: set:set1 could not match any instance selection") - - -class InstanceTests(TestCase): - def setUp(self): - self.instance_factory = InstanceBeanFactory() - - def test_get_system_set(self): - instance = self.instance_factory.example() - - self.assertEqual(instance.get_system_id_set(), {"bk_cmdb"}) - - def test_fill_type_name(self): - instance = self.instance_factory.new( - "host", "主机", [[{"system_id": "bk_cmdb", "type": "host", "type_name": "主机", "id": "*", "name": "主机1"}]] - ) - - resource_type_dict = ResourceTypeDict( - data={("bk_cmdb", "host"): {"name": "host_test", "name_en": "host_test_en"}} - ) - - instance.fill_empty_fields(resource_type_dict) - self.assertEqual(instance.name, "host_test") - self.assertEqual(instance.name_en, "host_test_en") - self.assertEqual(instance.path[0][0].type_name, "host_test") - self.assertEqual(instance.path[0][0].type_name_en, "host_test_en") - - def test_sub(self): - instance = self.instance_factory.new( - "host", - "主机", - [ - [ - {"system_id": "bk_cmdb", "type": "biz", "type_name": "biz", "id": "biz1", "name": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "type_name": "set", "id": "set1", "name": "set1"}, - ], - [{"system_id": "bk_cmdb", "type": "host", "type_name": "主机", "id": "host1", "name": "主机1"}], - ], - ) - - instance.remove_paths(self.instance_factory.example().path) - - self.assertEqual(len(instance.path), 1) - - -class PathNodeBeanListperTests(TestCase): - def setUp(self): - self.instance_selection_factory = InstanceSelectionFactory() - self.resource_factory = RelatedResourceBeanFactory() - - def test_multi_leaf_node_ok(self): - """ - 测试多级叶子节点相同的情况 - 比如用户管理的部门下的部门 - """ - path = [ - {"system_id": "bk_cmdb", "type": "biz", "id": "", "name": ""}, - {"system_id": "bk_cmdb", "type": "set", "id": "", "name": ""}, - {"system_id": "bk_cmdb", "type": "module", "id": "", "name": ""}, - {"system_id": "bk_cmdb", "type": "host", "id": "", "name": ""}, - {"system_id": "bk_cmdb", "type": "host", "id": "", "name": ""}, - ] - - selection = self.instance_selection_factory.example() - - rrt = self.resource_factory.example() - - helper = PathNodeBeanList([PathNodeBean(**one) for one in path]) - ok = helper.match_selection(rrt.system_id, rrt.type, selection) - - self.assertTrue(ok) - - def test_multi_leaf_node_false(self): - """ - 测试多级叶子节点相同的情况 - """ - path = [ - {"system_id": "bk_cmdb", "type": "biz", "id": "", "name": ""}, - {"system_id": "bk_cmdb", "type": "set", "id": "", "name": ""}, - {"system_id": "bk_cmdb", "type": "module", "id": "", "name": ""}, - {"system_id": "bk_cmdb", "type": "host", "id": "", "name": ""}, - {"system_id": "bk_cmdb", "type": "test", "id": "", "name": ""}, - ] - - selection = self.instance_selection_factory.example() - - rrt = self.resource_factory.example() - - helper = PathNodeBeanList([PathNodeBean(**one) for one in path]) - ok = helper.match_selection(rrt.system_id, rrt.type, selection) - - self.assertFalse(ok) - - -class ConditionTests(TestCase): - def setUp(self): - self.condition_factory = ConditionBeanFactory() - self.instance_factory = InstanceBeanFactory() - - def test_get_system_set(self): - condition = self.condition_factory.example() - systems = condition.get_system_id_set() - self.assertEqual(systems, {"bk_cmdb"}) - - condition = self.condition_factory.new() - systems = condition.get_system_id_set() - self.assertEqual(systems, set()) - - -class RelatedResourceTests(TestCase): - def setUp(self): - self.resource_factory = RelatedResourceBeanFactory() - self.condition_factory = ConditionBeanFactory() - self.instance_selection_factory = InstanceSelectionFactory() - self.attribute_factory = AttributeFactory() - - def test_check_selection_ignore_path(self): - resource = self.resource_factory.example() - selection = self.instance_selection_factory.example() - resource.check_selection([selection], True) - - resource = self.resource_factory.new( - "bk_cmdb", "host", "主机", [self.condition_factory.new(attributes=[self.attribute_factory.example()])] - ) - resource.check_selection([selection], True) - - def test_get_system_set(self): - resource = self.resource_factory.example() - systems = resource.get_system_id_set() - self.assertEqual(systems, {"bk_cmdb"}) - - -class PolicyTests(TestCase): - def setUp(self): - self.policy_factory = PolicyBeanFactory() - self.resource_factory = RelatedResourceBeanFactory() - self.condition_factory = ConditionBeanFactory() - self.attribute_factory = AttributeFactory() - - def test_set_expired_at(self): - policy = self.policy_factory.example() - policy.set_expired_at(4102444800) - self.assertEqual(policy.expired_at, 4102444800) - - def test_has(self): - policy = self.policy_factory.new("create_host", []) - self.assertTrue(policy.has_related_resource_types(policy.related_resource_types)) - - policy = self.policy_factory.example() - self.assertTrue(policy.has_related_resource_types(policy.related_resource_types)) - - new_policy = self.policy_factory.new( - "view_host", - [ - self.resource_factory.new( - "bk_cmdb", - "host", - "主机", - [self.condition_factory.new(attributes=[self.attribute_factory.example()])], - ) - ], - ) - - self.assertFalse(new_policy.has_related_resource_types(policy.related_resource_types)) - - def test_diff(self): - policy = self.policy_factory.new("create_host", []) - policy.remove_related_resource_types(policy.related_resource_types) - - policy = self.policy_factory.example() - with self.assertRaises(PolicyEmptyException): - policy.remove_related_resource_types(policy.related_resource_types) - - def test_get_system_set(self): - policy = self.policy_factory.new("create_host", []) - systems = policy.get_system_id_set() - self.assertEqual(systems, set()) - - -class PolicyListTests(TestCase): - def test_right(self): - new_policy_list = PolicyBeanList( - "system_id", - [ - PolicyBean( - **{ - "type": "edit", - "id": "edit_host", - "name": "编辑主机", - "description": "", - "related_resource_types": [], - "environment": {}, - "expired_at": 31536000, - } - ), - PolicyBean( - **{ - "type": "edit", - "id": "view_host", - "name": "查看主机", - "description": "", - "related_resource_types": [], - "environment": {}, - "expired_at": 31536000, - } - ), - ], - ) - - old_policy_list = PolicyBeanList( - "system_id", - [ - PolicyBean( - **{ - "type": "edit", - "id": "view_host", - "name": "查看主机", - "description": "", - "related_resource_types": [{"system_id": "bk_cmdb", "type": "host", "condition": []}], - "environment": {}, - "policy_id": 1, - "expired_at": 31536000, - } - ), - PolicyBean( - **{ - "type": "edit", - "id": "delete_host", - "name": "查看主机", - "description": "", - "related_resource_types": [], - "environment": {}, - "expired_at": 31536000, - } - ), - ], - ) - - create_policy_list, update_policy_list = old_policy_list.split_to_creation_and_update_for_grant( - new_policy_list - ) - - self.assertListEqual( - create_policy_list.policies, - [ - PolicyBean( - **{ - "type": "edit", - "id": "edit_host", - "name": "编辑主机", - "description": "", - "related_resource_types": [], - "environment": {}, - "expired_at": 31536000, - } - ) - ], - ) - - self.assertListEqual(update_policy_list.policies, []) - - def test_expired_at(self): - new_policy_list = PolicyBeanList( - "system_id", - [ - PolicyBean( - **{ - "type": "edit", - "id": "edit_host", - "name": "编辑主机", - "description": "", - "related_resource_types": [], - "environment": {}, - "expired_at": 31536002, - } - ), - PolicyBean( - **{ - "type": "view", - "id": "view_host", - "name": "查看主机", - "description": "", - "related_resource_types": [], - "environment": {}, - "expired_at": 31536000, - } - ), - ], - ) - - old_policy_list = PolicyBeanList( - "system_id", - [ - PolicyBean( - **{ - "type": "edit", - "id": "edit_host", - "name": "编辑主机", - "description": "", - "related_resource_types": [], - "environment": {}, - "policy_id": 1, - "expired_at": 31536001, - } - ), - PolicyBean( - **{ - "type": "view", - "id": "view_host", - "name": "查看主机", - "description": "", - "related_resource_types": [], - "environment": {}, - "policy_id": 2, - "expired_at": 31536000, - } - ), - ], - ) - - create_policy_list, update_policy_list = old_policy_list.split_to_creation_and_update_for_grant( - new_policy_list - ) - - self.assertListEqual(create_policy_list.policies, []) - - self.assertListEqual( - update_policy_list.policies, - [ - PolicyBean( - **{ - "type": "edit", - "id": "edit_host", - "name": "编辑主机", - "description": "", - "related_resource_types": [], - "environment": {}, - "expired_at": 31536002, - "policy_id": 1, - } - ) - ], - ) - - -class RelatedResourceCloneAndFilterTests(TestCase): - def setUp(self): - self.instance_factory = InstanceBeanFactory() - - def test_right_1(self): - conditions = [ConditionBean(instances=[self.instance_factory.example()], attributes=[])] - resource_type = RelatedResourceBean(condition=conditions, type="type", system_id="system") - selections = [] - self.assertEqual(resource_type.clone_and_filter_by_instance_selections(selections, True), None) - - def test_right_2(self): - import uuid - - uuid.uuid4 = mock.Mock(return_value=uuid.UUID("fa17b2cbf38141d7a5a0591573fc0f82")) - - conditions = [ - ConditionBean( - instances=[ - InstanceBean( - type="host", - path=[ - [{"system_id": "bk_cmdb", "type": "set", "id": "set1"}], - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host1"}, - ], - ], - ), - InstanceBean(type="biz", path=[[{"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}]]), - ], - attributes=[], - ), - ConditionBean( - instances=[ - InstanceBean(type="host", path=[[{"system_id": "bk_cmdb", "type": "host", "id": "host3"}]]) - ], - attributes=[Attribute(id="", name="", values=[{"id": "test1", "name": "test1"}])], - ), - ConditionBean( - instances=[ - InstanceBean( - type="host", - path=[ - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host2"}, - ], - ], - ), - ], - attributes=[Attribute(id="", name="", values=[{"id": "test2", "name": "test2"}])], - ), - ] - resource_type = RelatedResourceBean(condition=conditions, type="bk_cmdb", system_id="host") - selections = [ - InstanceSelection( - id="test1", - system_id="bk_cmdb", - name="test1", - name_en="test1", - ignore_iam_path=False, - resource_type_chain=[ - ChainNode(system_id="bk_cmdb", id="biz"), - ChainNode(system_id="bk_cmdb", id="set"), - ChainNode(system_id="bk_cmdb", id="module"), - ChainNode(system_id="bk_cmdb", id="host"), - ], - ), - InstanceSelection( - id="test2", - system_id="bk_cmdb", - name="test2", - name_en="test2", - ignore_iam_path=False, - resource_type_chain=[ - ChainNode(system_id="bk_cmdb", id="biz"), - ChainNode(system_id="bk_cmdb", id="set"), - ], - ), - ] - new_rt = resource_type.clone_and_filter_by_instance_selections(selections) - self.assertEqual( - new_rt.condition, - [ - ConditionBean( - instances=[ - InstanceBean( - type="host", - path=[ - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host1"}, - ], - ], - ), - InstanceBean(type="biz", path=[[{"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}]]), - ], - attributes=[], - ), - ConditionBean( - instances=[ - InstanceBean( - type="host", - path=[ - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host2"}, - ], - ], - ), - ], - attributes=[Attribute(id="", name="", values=[{"id": "test2", "name": "test2"}])], - ), - ], - ) - - -class InstanceCloneAndFilterTests(TestCase): - def test_clone_and_filter_by_selections_1(self): - selections = [ - InstanceSelection( - id="test1", - system_id="bk_cmdb", - name="test1", - name_en="test1", - ignore_iam_path=True, - resource_type_chain=[ - ChainNode(system_id="bk_cmdb", id="biz"), - ChainNode(system_id="bk_cmdb", id="set"), - ChainNode(system_id="bk_cmdb", id="module"), - ChainNode(system_id="bk_cmdb", id="host"), - ], - ) - ] - path = [ - {"system_id": "bk_cmdb", "type": "host", "id": "host1", "name": "host1"}, - ] - instance = InstanceBean(path=[path], type="host") - new_instance = instance.clone_and_filter_by_instance_selections("bk_cmdb", "host", selections) - self.assertEqual( - new_instance.path, - [[PathNodeBean(**{"system_id": "bk_cmdb", "type": "host", "id": "host1", "name": "host1"})]], - ) - - def test_clone_and_filter_by_selections_2(self): - path = [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1", "name": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1", "name": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1", "name": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host1", "name": "host1"}, - ] - selections = [ - InstanceSelection( - id="test1", - system_id="bk_cmdb", - name="test1", - name_en="test1", - ignore_iam_path=True, - resource_type_chain=[ - ChainNode(system_id="bk_cmdb", id="biz"), - ChainNode(system_id="bk_cmdb", id="host"), - ], - ) - ] - instance = InstanceBean(path=[path], type="host") - new_instance = instance.clone_and_filter_by_instance_selections("bk_cmdb", "host", selections) - self.assertEqual(new_instance, None) - - def test_clone_and_filter_by_selections_3(self): - path = [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1", "name": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1", "name": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1", "name": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host1", "name": "host1"}, - ] - selections = [ - InstanceSelection( - id="test1", - system_id="bk_cmdb", - name="test1", - name_en="test1", - ignore_iam_path=True, - resource_type_chain=[ - ChainNode(system_id="bk_cmdb", id="biz"), - ChainNode(system_id="bk_cmdb", id="set"), - ChainNode(system_id="bk_cmdb", id="module"), - ChainNode(system_id="bk_cmdb", id="host"), - ], - ) - ] - instance = InstanceBean(path=[path], type="host") - new_instance = instance.clone_and_filter_by_instance_selections("bk_cmdb", "host", selections) - self.assertEqual(new_instance.path, [[PathNodeBean(**one) for one in path]]) diff --git a/saas/tests/biz/related_policy_tests.py b/saas/tests/biz/related_policy_tests.py deleted file mode 100644 index bb8697895..000000000 --- a/saas/tests/biz/related_policy_tests.py +++ /dev/null @@ -1,1191 +0,0 @@ -# -*- coding: utf-8 -*- -""" -TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. -Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. -Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. -You may obtain a copy of the License at http://opensource.org/licenses/MIT -Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on -an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the -specific language governing permissions and limitations under the License. -""" -import mock -from django.test import TestCase - -from backend.biz.policy import ConditionBean, InstanceBean, PolicyBean, RelatedResourceBean -from backend.biz.related_policy import RelatedPolicyBiz -from backend.common.time import PERMANENT_SECONDS -from backend.service.constants import SelectionMode -from backend.service.models import Action, Attribute, ChainNode, InstanceSelection, RelatedResourceType -from tests.test_util.factory import ActionFactory, PolicyBeanFactory - - -class FilterResourceTypeSameTypeTests(TestCase): - def setUp(self) -> None: - import uuid - - uuid.uuid4 = mock.Mock(return_value=uuid.UUID("fa17b2cbf38141d7a5a0591573fc0f82")) - - def test_attribute(self): - svc = RelatedPolicyBiz() - policy_rrt = RelatedResourceBean( - system_id="bk_cmdb", - type="host", - condition=[ - ConditionBean( - instances=[ - InstanceBean( - type="host", - path=[ - [{"system_id": "bk_cmdb", "type": "set", "id": "set1"}], - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host1"}, - ], - ], - ), - InstanceBean(type="biz", path=[[{"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}]]), - ], - attributes=[], - ), - ConditionBean( - instances=[ - InstanceBean(type="host", path=[[{"system_id": "bk_cmdb", "type": "host", "id": "host3"}]]) - ], - attributes=[Attribute(id="", name="", values=[{"id": "test1", "name": ""}])], - ), - ConditionBean( - instances=[], - attributes=[Attribute(id="", name="", values=[{"id": "test2", "name": ""}])], - ), - ], - ) - action_rrt = RelatedResourceType( - id="host", - system_id="bk_cmdb", - name="test", - name_en="test", - selection_mode=SelectionMode.ATTRIBUTE.value, - ) - self.assertEqual( - svc._filter_condition_of_same_type(policy_rrt, action_rrt), - RelatedResourceBean( - system_id="bk_cmdb", - type="host", - condition=[ - ConditionBean( - instances=[], attributes=[Attribute(id="", name="", values=[{"id": "test2", "name": ""}])] - ) - ], - ), - ) - - def test_instance(self): - svc = RelatedPolicyBiz() - policy_rrt = RelatedResourceBean( - system_id="bk_cmdb", - type="host", - condition=[ - ConditionBean( - instances=[ - InstanceBean( - type="host", - path=[ - [{"system_id": "bk_cmdb", "type": "set", "id": "set1"}], - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host1"}, - ], - ], - ), - InstanceBean(type="biz", path=[[{"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}]]), - ], - attributes=[], - ), - ConditionBean( - instances=[ - InstanceBean(type="host", path=[[{"system_id": "bk_cmdb", "type": "host", "id": "host3"}]]) - ], - attributes=[Attribute(id="", name="", values=[{"id": "test1", "name": ""}])], - ), - ConditionBean( - instances=[], - attributes=[Attribute(id="", name="", values=[{"id": "test2", "name": ""}])], - ), - ], - ) - action_rrt = RelatedResourceType( - id="host", - system_id="bk_cmdb", - name="test", - name_en="test", - selection_mode=SelectionMode.INSTANCE.value, - instance_selections=[ - InstanceSelection( - id="test1", - system_id="bk_cmdb", - name="test1", - name_en="test1", - ignore_iam_path=False, - resource_type_chain=[ - ChainNode(system_id="bk_cmdb", id="biz"), - ChainNode(system_id="bk_cmdb", id="set"), - ChainNode(system_id="bk_cmdb", id="module"), - ChainNode(system_id="bk_cmdb", id="host"), - ], - ) - ], - ) - self.assertEqual( - svc._filter_condition_of_same_type(policy_rrt, action_rrt), - RelatedResourceBean( - system_id="bk_cmdb", - type="host", - condition=[ - ConditionBean( - instances=[ - InstanceBean( - type="host", - path=[ - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host1"}, - ], - ], - ), - InstanceBean(type="biz", path=[[{"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}]]), - ], - attributes=[], - ), - ], - ), - ) - - def test_all(self): - svc = RelatedPolicyBiz() - policy_rrt = RelatedResourceBean( - system_id="bk_cmdb", - type="host", - condition=[ - ConditionBean( - instances=[], - attributes=[Attribute(id="", name="", values=[{"id": "test2", "name": ""}])], - ), - ConditionBean( - instances=[ - InstanceBean( - type="host", - path=[ - [{"system_id": "bk_cmdb", "type": "set", "id": "set1"}], - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host1"}, - ], - ], - ), - InstanceBean(type="biz", path=[[{"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}]]), - ], - attributes=[], - ), - ConditionBean( - instances=[ - InstanceBean(type="host", path=[[{"system_id": "bk_cmdb", "type": "host", "id": "host3"}]]) - ], - attributes=[Attribute(id="", name="", values=[{"id": "test1", "name": ""}])], - ), - ], - ) - action_rrt = RelatedResourceType( - id="host", - system_id="bk_cmdb", - name="test", - name_en="test", - selection_mode=SelectionMode.ALL.value, - instance_selections=[ - InstanceSelection( - id="test1", - system_id="bk_cmdb", - name="test1", - name_en="test1", - ignore_iam_path=False, - resource_type_chain=[ - ChainNode(system_id="bk_cmdb", id="biz"), - ChainNode(system_id="bk_cmdb", id="set"), - ChainNode(system_id="bk_cmdb", id="module"), - ChainNode(system_id="bk_cmdb", id="host"), - ], - ) - ], - ) - self.assertEqual( - svc._filter_condition_of_same_type(policy_rrt, action_rrt), - RelatedResourceBean( - system_id="bk_cmdb", - type="host", - condition=[ - ConditionBean( - instances=[], - attributes=[Attribute(id="", name="", values=[{"id": "test2", "name": ""}])], - ), - ConditionBean( - instances=[ - InstanceBean( - type="host", - path=[ - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host1"}, - ], - ], - ), - InstanceBean(type="biz", path=[[{"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}]]), - ], - attributes=[], - ), - ConditionBean( - instances=[ - InstanceBean(type="host", path=[[{"system_id": "bk_cmdb", "type": "host", "id": "host3"}]]) - ], - attributes=[Attribute(id="", name="", values=[{"id": "test1", "name": ""}])], - ), - ], - ), - ) - - def test_none(self): - svc = RelatedPolicyBiz() - policy_rrt = RelatedResourceBean( - system_id="bk_cmdb", - type="host", - condition=[ - ConditionBean( - instances=[ - InstanceBean( - type="host", - path=[ - [{"system_id": "bk_cmdb", "type": "set", "id": "set1"}], - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host1"}, - ], - ], - ), - InstanceBean(type="biz", path=[[{"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}]]), - ], - attributes=[], - ), - ], - ) - action_rrt = RelatedResourceType( - id="host", - system_id="bk_cmdb", - name="test", - name_en="test", - selection_mode=SelectionMode.ATTRIBUTE.value, - ) - self.assertEqual(svc._filter_condition_of_same_type(policy_rrt, action_rrt), None) - - -class FilterConditionDifferentTypeTests(TestCase): - def test_right_1(self): - svc = RelatedPolicyBiz() - conditions = [ConditionBean(instances=[], attributes=[])] - selections = [] - self.assertEqual(svc._filter_condition_of_different_type_by_instance_selection(conditions, selections), []) - - def test_right_2(self): - import uuid - - uuid.uuid4 = mock.Mock(return_value=uuid.UUID("fa17b2cbf38141d7a5a0591573fc0f82")) - - svc = RelatedPolicyBiz() - conditions = [ - ConditionBean( - instances=[ - InstanceBean( - type="host", - path=[ - [{"system_id": "bk_cmdb", "type": "set", "id": "set1"}], - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host1"}, - ], - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host2"}, - ], - ], - ), - InstanceBean(type="biz", path=[[{"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}]]), - ], - attributes=[], - ), - ConditionBean( - instances=[ - InstanceBean(type="host", path=[[{"system_id": "bk_cmdb", "type": "host", "id": "host3"}]]) - ], - attributes=[], - ), - ConditionBean( - instances=[ - InstanceBean( - type="host", - path=[ - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz2"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host2"}, - ], - ], - ), - ], - attributes=[], - ), - ] - selections = [ - InstanceSelection( - id="test2", - system_id="bk_cmdb", - name="test2", - name_en="test2", - ignore_iam_path=False, - resource_type_chain=[ChainNode(system_id="bk_cmdb", id="biz")], - ), - ] - self.assertEqual( - svc._filter_condition_of_different_type_by_instance_selection(conditions, selections), - [ - ConditionBean( - id="fa17b2cbf38141d7a5a0591573fc0f82", - instances=[ - InstanceBean( - type="biz", - path=[ - [{"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}], - [{"system_id": "bk_cmdb", "type": "biz", "id": "biz2"}], - ], - ), - ], - attributes=[], - ), - ], - ) - - -class FilterResourceTypeDifferentTypeTests(TestCase): - def test_attribute(self): - svc = RelatedPolicyBiz() - policy_rrt = RelatedResourceBean(system_id="bk_cmdb", type="host", condition=[]) - action_rrt = RelatedResourceType( - id="biz", - system_id="bk_cmdb", - name="test", - name_en="test", - selection_mode=SelectionMode.ATTRIBUTE.value, - ) - self.assertEqual(svc._filter_condition_of_different_type([policy_rrt], action_rrt), None) - - def test_one_rrt(self): - import uuid - - uuid.uuid4 = mock.Mock(return_value=uuid.UUID("fa17b2cbf38141d7a5a0591573fc0f82")) - - svc = RelatedPolicyBiz() - policy_rrt = RelatedResourceBean( - system_id="bk_cmdb", - type="host", - condition=[ - ConditionBean( - instances=[], - attributes=[Attribute(id="", name="", values=[{"id": "test2", "name": ""}])], - ), - ConditionBean( - instances=[ - InstanceBean( - type="host", - path=[ - [{"system_id": "bk_cmdb", "type": "set", "id": "set1"}], - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host1"}, - ], - ], - ), - InstanceBean(type="biz", path=[[{"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}]]), - ], - attributes=[], - ), - ConditionBean( - instances=[ - InstanceBean(type="host", path=[[{"system_id": "bk_cmdb", "type": "host", "id": "host3"}]]) - ], - attributes=[Attribute(id="", name="", values=[{"id": "test1", "name": ""}])], - ), - ], - ) - action_rrt = RelatedResourceType( - id="biz", - system_id="bk_cmdb", - name="test", - name_en="test", - selection_mode=SelectionMode.ALL.value, - instance_selections=[ - InstanceSelection( - id="test1", - system_id="bk_cmdb", - name="test1", - name_en="test1", - ignore_iam_path=False, - resource_type_chain=[ChainNode(system_id="bk_cmdb", id="biz")], - ) - ], - ) - self.assertEqual( - svc._filter_condition_of_different_type([policy_rrt], action_rrt), - RelatedResourceBean( - system_id="bk_cmdb", - type="biz", - condition=[ - ConditionBean( - id="fa17b2cbf38141d7a5a0591573fc0f82", - instances=[ - InstanceBean(type="biz", path=[[{"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}]]), - ], - attributes=[], - ), - ], - ), - ) - - def test_multi_rrt(self): - import uuid - - uuid.uuid4 = mock.Mock(return_value=uuid.UUID("fa17b2cbf38141d7a5a0591573fc0f82")) - - svc = RelatedPolicyBiz() - policy_rrts = [ - RelatedResourceBean( - system_id="bk_cmdb", - type="host", - condition=[ - ConditionBean( - instances=[ - InstanceBean( - type="host", - path=[ - [ - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host1"}, - ], - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host1"}, - ], - ], - ), - InstanceBean(type="biz", path=[[{"system_id": "bk_cmdb", "type": "biz", "id": "biz2"}]]), - ], - attributes=[], - ), - ], - ), - RelatedResourceBean( - system_id="bk_job", - type="job", - condition=[ - ConditionBean( - instances=[ - InstanceBean( - type="job", - path=[ - [{"system_id": "bk_job", "type": "job", "id": "job1"}], - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}, - {"system_id": "bk_job", "type": "set", "id": "job2"}, - ], - ], - ), - InstanceBean(type="biz", path=[[{"system_id": "bk_cmdb", "type": "biz", "id": "biz2"}]]), - ], - attributes=[], - ), - ], - ), - ] - action_rrt = action_rrt = RelatedResourceType( - id="biz", - system_id="bk_cmdb", - name="test", - name_en="test", - selection_mode=SelectionMode.ALL.value, - instance_selections=[ - InstanceSelection( - id="test1", - system_id="bk_cmdb", - name="test1", - name_en="test1", - ignore_iam_path=False, - resource_type_chain=[ChainNode(system_id="bk_cmdb", id="biz")], - ) - ], - ) - self.assertEqual( - svc._filter_condition_of_different_type(policy_rrts, action_rrt), - RelatedResourceBean( - system_id="bk_cmdb", - type="biz", - condition=[ - ConditionBean( - id="fa17b2cbf38141d7a5a0591573fc0f82", - instances=[ - InstanceBean( - type="biz", - path=[ - [{"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}], - [{"system_id": "bk_cmdb", "type": "biz", "id": "biz2"}], - ], - ), - ], - attributes=[], - ), - ], - ), - ) - - def test_multi_rrt_none(self): - svc = RelatedPolicyBiz() - policy_rrts = [ - RelatedResourceBean( - system_id="bk_cmdb", - type="host", - condition=[ - ConditionBean( - instances=[ - InstanceBean( - type="host", - path=[ - [ - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host1"}, - ], - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host1"}, - ], - ], - ), - InstanceBean(type="biz", path=[[{"system_id": "bk_cmdb", "type": "biz", "id": "biz2"}]]), - ], - attributes=[], - ), - ], - ), - RelatedResourceBean( - system_id="bk_job", - type="job", - condition=[ - ConditionBean( - instances=[ - InstanceBean( - type="job", - path=[ - [{"system_id": "bk_job", "type": "job", "id": "job1"}], - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz3"}, - {"system_id": "bk_job", "type": "set", "id": "job2"}, - ], - ], - ), - InstanceBean(type="biz", path=[[{"system_id": "bk_cmdb", "type": "biz", "id": "biz4"}]]), - ], - attributes=[], - ), - ], - ), - ] - action_rrt = action_rrt = RelatedResourceType( - id="biz", - system_id="bk_cmdb", - name="test", - name_en="test", - selection_mode=SelectionMode.ALL.value, - instance_selections=[ - InstanceSelection( - id="test1", - system_id="bk_cmdb", - name="test1", - name_en="test1", - ignore_iam_path=False, - resource_type_chain=[ChainNode(system_id="bk_cmdb", id="biz")], - ) - ], - ) - self.assertEqual(svc._filter_condition_of_different_type(policy_rrts, action_rrt), None) - - -class MergeMultiConditionsTests(TestCase): - def test_empty(self): - svc = RelatedPolicyBiz() - rrt_conditions = [ - [ - ConditionBean( - instances=[ - InstanceBean( - type="biz", - path=[ - [{"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}], - [{"system_id": "bk_cmdb", "type": "biz", "id": "biz2"}], - ], - ), - ], - attributes=[], - ), - ], - [ - ConditionBean( - instances=[ - InstanceBean(type="biz", path=[[{"system_id": "bk_cmdb", "type": "biz", "id": "biz3"}]]) - ], - attributes=[], - ), - ], - [ - ConditionBean( - instances=[ - InstanceBean(type="biz", path=[[{"system_id": "bk_cmdb", "type": "biz", "id": "biz4"}]]) - ], - attributes=[], - ), - ], - ] - self.assertEqual(svc._merge_multi_conditions(rrt_conditions), []) - - def test_right(self): - import uuid - - uuid.uuid4 = mock.Mock(return_value=uuid.UUID("fa17b2cbf38141d7a5a0591573fc0f82")) - - svc = RelatedPolicyBiz() - rrt_conditions = [ - [ - ConditionBean( - instances=[ - InstanceBean( - type="biz", - path=[ - [{"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}], - [{"system_id": "bk_cmdb", "type": "biz", "id": "biz2"}], - ], - ), - InstanceBean( - type="host", - path=[ - [{"system_id": "bk_cmdb", "type": "host", "id": "host1"}], - [{"system_id": "bk_cmdb", "type": "host", "id": "host2"}], - ], - ), - ], - attributes=[], - ), - ], - [ - ConditionBean( - instances=[ - InstanceBean( - type="biz", - path=[ - [{"system_id": "bk_cmdb", "type": "biz", "id": "biz3"}], - [{"system_id": "bk_cmdb", "type": "biz", "id": "biz2"}], - ], - ), - InstanceBean( - type="host", - path=[[{"system_id": "bk_cmdb", "type": "host", "id": "host3"}]], - ), - ], - attributes=[], - ), - ], - [ - ConditionBean( - instances=[ - InstanceBean( - type="biz", - path=[ - [{"system_id": "bk_cmdb", "type": "biz", "id": "biz4"}], - [{"system_id": "bk_cmdb", "type": "biz", "id": "biz2"}], - ], - ), - InstanceBean( - type="host", - path=[[{"system_id": "bk_cmdb", "type": "host", "id": "host4"}]], - ), - ], - attributes=[], - ), - ], - ] - self.assertEqual( - svc._merge_multi_conditions(rrt_conditions), - [ - ConditionBean( - instances=[ - InstanceBean(type="biz", path=[[{"system_id": "bk_cmdb", "type": "biz", "id": "biz2"}]]) - ], - attributes=[], - ) - ], - ) - - -class CreateDependingPolicyTests(TestCase): - def test_branch_1(self): - policy = PolicyBean(id="create_host", related_resource_types=[], expired_at=PERMANENT_SECONDS) - action = Action( - id="multi_rrt", - name="test", - name_en="test", - description="test", - description_en="test", - type="create", - related_resource_types=[ - RelatedResourceType( - id="biz", - system_id="bk_cmdb", - name="test", - name_en="test", - ), - RelatedResourceType( - id="host", - system_id="bk_cmdb", - name="test", - name_en="test", - ), - ], - related_actions=[], - ) - - svc = RelatedPolicyBiz() - self.assertEqual(svc._create_related_policy(policy, action), None) - - def test_branch_2(self): - policy = PolicyBean( - id="create_host", - related_resource_types=[], - expired_at=PERMANENT_SECONDS, - ) - action = Action( - id="empty", - name="test", - name_en="test", - description="test", - description_en="test", - type="create", - related_resource_types=[], - related_actions=[], - ) - - svc = RelatedPolicyBiz() - self.assertEqual( - svc._create_related_policy(policy, action), - PolicyBean( - id="empty", - related_resource_types=[], - expired_at=policy.expired_at, - ), - ) - - def test_branch_3(self): - policy = PolicyBean( - id="create_host", - related_resource_types=[], - expired_at=PERMANENT_SECONDS, - ) - action = Action( - id="empty", - name="test", - name_en="test", - description="test", - description_en="test", - type="create", - related_resource_types=[ - RelatedResourceType( - id="biz", - system_id="bk_cmdb", - name="test", - name_en="test", - ) - ], - related_actions=[], - ) - - svc = RelatedPolicyBiz() - self.assertEqual(svc._create_related_policy(policy, action), None) - - def test_branch_4(self): - policy = PolicyBean( - id="edit_host", - related_resource_types=[ - RelatedResourceBean( - system_id="bk_cmdb", - type="host", - condition=[], - ) - ], - expired_at=PERMANENT_SECONDS, - ) - action = Action( - id="view_host", - name="test", - name_en="test", - description="test", - description_en="test", - type="", - related_resource_types=[ - RelatedResourceType( - id="host", - system_id="bk_cmdb", - name="test", - name_en="test", - ) - ], - related_actions=[], - ) - - svc = RelatedPolicyBiz() - self.assertEqual( - svc._create_related_policy(policy, action), - PolicyBean( - id="view_host", - related_resource_types=[ - RelatedResourceBean( - system_id="bk_cmdb", - type="host", - condition=[], - ) - ], - expired_at=PERMANENT_SECONDS, - ), - ) - - def test_branch_5(self): - import uuid - - uuid.uuid4 = mock.Mock(return_value=uuid.UUID("fa17b2cbf38141d7a5a0591573fc0f82")) - - policy = PolicyBean( - id="edit_host", - related_resource_types=[ - RelatedResourceBean( - system_id="bk_cmdb", - type="host", - condition=[ - ConditionBean( - instances=[ - InstanceBean( - type="host", - path=[ - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz2"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host2"}, - ], - ], - ), - ], - attributes=[], - ) - ], - ) - ], - expired_at=PERMANENT_SECONDS, - ) - action = Action( - id="view_host", - name="test", - name_en="test", - description="test", - description_en="test", - type="", - related_resource_types=[ - RelatedResourceType( - id="host", - system_id="bk_cmdb", - name="test", - name_en="test", - instance_selections=[ - InstanceSelection( - id="test1", - system_id="bk_cmdb", - name="test1", - name_en="test1", - ignore_iam_path=False, - resource_type_chain=[ - ChainNode(system_id="bk_cmdb", id="biz"), - ChainNode(system_id="bk_cmdb", id="set"), - ChainNode(system_id="bk_cmdb", id="module"), - ChainNode(system_id="bk_cmdb", id="host"), - ], - ) - ], - ) - ], - related_actions=[], - ) - - svc = RelatedPolicyBiz() - self.assertEqual( - svc._create_related_policy(policy, action), - PolicyBean( - id="view_host", - related_resource_types=[ - RelatedResourceBean( - system_id="bk_cmdb", - type="host", - condition=[ - ConditionBean( - instances=[ - InstanceBean( - type="host", - path=[ - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz2"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host2"}, - ], - ], - ), - ], - attributes=[], - ) - ], - ) - ], - expired_at=PERMANENT_SECONDS, - ), - ) - - def test_branch_6(self): - import uuid - - uuid.uuid4 = mock.Mock(return_value=uuid.UUID("fa17b2cbf38141d7a5a0591573fc0f82")) - - policy = PolicyBean( - id="edit_host", - related_resource_types=[ - RelatedResourceBean( - system_id="bk_cmdb", - type="host", - condition=[ - ConditionBean( - instances=[ - InstanceBean( - type="host", - path=[ - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz2"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host2"}, - ], - ], - ), - ], - attributes=[], - ) - ], - ) - ], - expired_at=PERMANENT_SECONDS, - ) - action = Action( - id="view_biz", - name="test", - name_en="test", - description="test", - description_en="test", - type="", - related_resource_types=[ - RelatedResourceType( - id="biz", - system_id="bk_cmdb", - name="test", - name_en="test", - instance_selections=[ - InstanceSelection( - id="test1", - system_id="bk_cmdb", - name="test1", - name_en="test1", - ignore_iam_path=False, - resource_type_chain=[ChainNode(system_id="bk_cmdb", id="biz")], - ) - ], - ) - ], - related_actions=[], - ) - - svc = RelatedPolicyBiz() - self.assertEqual( - svc._create_related_policy(policy, action), - PolicyBean( - id="view_biz", - related_resource_types=[ - RelatedResourceBean( - system_id="bk_cmdb", - type="biz", - condition=[ - ConditionBean( - id="fa17b2cbf38141d7a5a0591573fc0f82", - instances=[ - InstanceBean( - type="biz", - path=[[{"system_id": "bk_cmdb", "type": "biz", "id": "biz2"}]], - ), - ], - attributes=[], - ) - ], - ) - ], - expired_at=PERMANENT_SECONDS, - ), - ) - - def test_branch_7(self): - policy = PolicyBean( - id="edit_host", - related_resource_types=[ - RelatedResourceBean( - system_id="bk_cmdb", - type="host", - condition=[ - ConditionBean( - instances=[ - InstanceBean( - type="host", - path=[ - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz2"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host2"}, - ], - ], - ), - ], - attributes=[], - ) - ], - ) - ], - expired_at=PERMANENT_SECONDS, - ) - action = Action( - id="view_biz", - name="test", - name_en="test", - description="test", - description_en="test", - type="", - related_resource_types=[ - RelatedResourceType( - id="biz", - system_id="bk_cmdb", - name="test", - name_en="test", - instance_selections=[ - InstanceSelection( - id="test1", - system_id="bk_cmdb", - name="test1", - name_en="test1", - ignore_iam_path=False, - resource_type_chain=[ChainNode(system_id="bk_cmdb", id="set")], - ) - ], - ) - ], - related_actions=[], - ) - - svc = RelatedPolicyBiz() - self.assertEqual(svc._create_related_policy(policy, action), None) - - -class CreateRelatedPoliciesTests(TestCase): - def test_create_related_policies_empty(self): - action_factory = ActionFactory() - action = action_factory.example() - action.id = "action" - - policy_factory = PolicyBeanFactory() - policy = policy_factory.example() - policy.action_id = "policy" - - svc = RelatedPolicyBiz() - with mock.patch.object(svc.action_svc, "list") as mock_func: - mock_func.return_value = [action] - - related_policies = svc.create_related_policies("test", policy) - - self.assertEqual(related_policies, []) - - action.related_actions = [] - policy.action_id = "action" - - with mock.patch.object(svc.action_svc, "list") as mock_func: - mock_func.return_value = [action] - - svc = RelatedPolicyBiz() - related_policies = svc.create_related_policies("test", policy) - - self.assertEqual(related_policies, []) - - def test_create_related_policies_ok(self): - action_factory = ActionFactory() - action = action_factory.example() - action.id = "action1" - action.related_actions = ["action2", "action3"] - - action2 = action_factory.example() - action2.id = "action2" - - policy_factory = PolicyBeanFactory() - policy = policy_factory.example() - policy.action_id = "action1" - - policy2 = policy_factory.example() - policy2.action_id = "action2" - - svc = RelatedPolicyBiz() - with mock.patch.object(svc.action_svc, "list") as mock_func, mock.patch.object( - svc, "_create_related_policy" - ) as mock_create: - mock_func.return_value = [action, action2] - mock_create.return_value = policy2 - - related_policies = svc.create_related_policies("test", policy) - self.assertEqual(len(related_policies), 1) - self.assertEqual(related_policies[0], policy2) diff --git a/saas/tests/service/application_tests.py b/saas/tests/service/application_tests.py deleted file mode 100644 index e053579aa..000000000 --- a/saas/tests/service/application_tests.py +++ /dev/null @@ -1,51 +0,0 @@ -# -*- coding: utf-8 -*- -""" -TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. -Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. -Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. -You may obtain a copy of the License at http://opensource.org/licenses/MIT -Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on -an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the -specific language governing permissions and limitations under the License. -""" -from copy import deepcopy - -from django.test import TestCase - -from backend.biz.policy import PolicyBean, PolicyBeanList -from tests.test_util.factory import PolicyFactory - - -class ApplicationServiceTests(TestCase): - def test_filter_application_policies(self): - policy_factory = PolicyFactory() - policy = policy_factory.example() - - policy2 = deepcopy(policy) - policy2.related_resource_types[0].condition[0].instances = [] - - policy3 = deepcopy(policy) - policy3.id = "action" - - policy_list1 = PolicyBeanList("system_id", [PolicyBean(**policy2.dict())]) - policy_list2 = PolicyBeanList("system_id", [PolicyBean(**policy.dict()), PolicyBean(**policy3.dict())]) - - policies = policy_list2.sub(policy_list1).policies - self.assertEqual(len(policies), 2) - - def test_merge_apply_policies(self): - policy_factory = PolicyFactory() - policy = policy_factory.example() - - policy2 = deepcopy(policy) - policy2.related_resource_types[0].condition[0].instances = [] - - policy3 = deepcopy(policy) - policy3.id = "action" - - policy_list1 = PolicyBeanList("system_id", [PolicyBean(**policy2.dict())]) - policy_list2 = PolicyBeanList("system_id", [PolicyBean(**policy.dict()), PolicyBean(**policy3.dict())]) - - policies = policy_list1.add(policy_list2).policies - - self.assertEqual(len(policies), 2) diff --git a/saas/tests/service/models_tests.py b/saas/tests/service/models_tests.py deleted file mode 100644 index 1a74b90b8..000000000 --- a/saas/tests/service/models_tests.py +++ /dev/null @@ -1,1072 +0,0 @@ -# -*- coding: utf-8 -*- -""" -TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. -Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. -Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. -You may obtain a copy of the License at http://opensource.org/licenses/MIT -Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on -an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the -specific language governing permissions and limitations under the License. -""" -from django.test import TestCase - -from backend.biz.policy_tag import AttributeTagBean -from backend.common.error_codes import CodeException -from backend.service.models import ( - PathHelper, - Policy, - RelatedResource, - ResourceCreatorActionConfig, - ResourceCreatorSingleAction, - Subject, - group_paths, -) -from backend.service.models.resource_type import ResourceNode, ResourceTypeDict -from tests.test_util.factory import ( - ActionFactory, - AttributeFactory, - ConditionFactory, - InstanceFactory, - InstanceSelectionFactory, - PolicyFactory, - RelatedResourceTypeFactory, - ResourceFactory, - ResourceInstanceFactory, -) - - -class GroupPathTests(TestCase): - def test_group_paths(self): - """ - 资源拓扑根据类型分组 - """ - paths = [ - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "host1"}, - ], - [{"system_id": "bk_cmdb", "type": "host", "id": "host2"}], - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module1"}, - {"system_id": "bk_cmdb", "type": "host", "id": "*"}, - ], - [ - {"system_id": "bk_cmdb", "type": "biz", "id": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "id": "set1"}, - {"system_id": "bk_cmdb", "type": "module", "id": "module2"}, - ], - ] - - instances = group_paths(paths) - - self.assertEqual(len(instances), 2) - self.assertEqual(instances[0].type, "host") - self.assertEqual(instances[1].type, "module") - self.assertEqual(len(instances[0].path), 2) - self.assertEqual(len(instances[1].path), 2) - - -class DiffAttributeTests(TestCase): - def setUp(self): - self.attribute_factory = AttributeFactory() - - def test_diff_attribute(self): - new_attribute = self.attribute_factory.new( - "id", "name", [{"id": "id1", "name": "name1"}, {"id": "id2", "name": "name2"}] - ) - - old_attribute = self.attribute_factory.new( - "id", "name", [{"id": "id2", "name": "name1"}, {"id": "id3", "name": "name2"}] - ) - - diff_attribute = AttributeTagBean(**new_attribute.dict()).compare_and_tag( - AttributeTagBean(**old_attribute.dict()) - ) - - self.assertEqual(diff_attribute.tag, "unchanged") - self.assertEqual(diff_attribute.values[0].tag, "add") - self.assertEqual(diff_attribute.values[1].tag, "unchanged") - self.assertEqual(diff_attribute.values[2].tag, "delete") - - -class DiffInstanceTests(TestCase): - def setUp(self): - self.instance_factory = InstanceFactory() - - def test_diff_instance(self): - new_instance = self.instance_factory.new( - "type", - "name", - [ - [{"type": "type", "type_name": "name", "id": "id1", "name": "name1"}], - [{"type": "type", "type_name": "name", "id": "id2", "name": "name2"}], - ], - ) - - old_instance = self.instance_factory.new( - "type", - "name", - [ - [{"type": "type", "type_name": "name", "id": "id2", "name": "name2"}], - [{"type": "type", "type_name": "name", "id": "id3", "name": "name3"}], - ], - ) - - diff_instance = new_instance.diff(old_instance) - - self.assertEqual(diff_instance.tag, "unchanged") - self.assertEqual(diff_instance.path[0]["tag"], "add") - self.assertEqual(diff_instance.path[1]["tag"], "unchanged") - self.assertEqual(diff_instance.path[2]["tag"], "delete") - - -class DiffConditionTests(TestCase): - def setUp(self): - self.condition_factory = ConditionFactory() - self.attribute_factory = AttributeFactory() - self.instance_factory = InstanceFactory() - - def test_condition_diff(self): - new_condition = self.condition_factory.new( - instances=[ - self.instance_factory.new( - "type", "name", [[{"type": "type", "type_name": "name", "id": "id1", "name": "name1"}]] - ), - self.instance_factory.new( - "type1", "name", [[{"type": "type1", "type_name": "name", "id": "id1", "name": "name1"}]] - ), - ], - attributes=[ - self.attribute_factory.new("id", "name", [{"id": "id1", "name": "name1"}]), - self.attribute_factory.new("id1", "name", [{"id": "id1", "name": "name1"}]), - ], - ) - - old_condition = self.condition_factory.new( - instances=[ - self.instance_factory.new( - "type", "name", [[{"type": "type", "type_name": "name", "id": "id2", "name": "name2"}]] - ), - self.instance_factory.new( - "type2", "name", [[{"type": "type2", "type_name": "name", "id": "id1", "name": "name1"}]] - ), - ], - attributes=[ - self.attribute_factory.new("id", "name", [{"id": "id1", "name": "name1"}]), - self.attribute_factory.new("id2", "name", [{"id": "id1", "name": "name1"}]), - ], - ) - - diff_condition = new_condition.diff(old_condition) - - self.assertEqual(diff_condition.tag, "unchanged") - self.assertEqual(len(diff_condition.instances), 3) - self.assertEqual(diff_condition.instances[0].tag, "unchanged") - self.assertEqual(diff_condition.instances[1].tag, "add") - self.assertEqual(diff_condition.instances[2].tag, "delete") - self.assertEqual(len(diff_condition.attributes), 3) - self.assertEqual(diff_condition.attributes[0].tag, "unchanged") - self.assertEqual(diff_condition.attributes[1].tag, "add") - self.assertEqual(diff_condition.attributes[2].tag, "delete") - - -class CompareConditionTests(TestCase): - def setUp(self): - self.condition_factory = ConditionFactory() - self.attribute_factory = AttributeFactory() - self.instance_factory = InstanceFactory() - - def test_condition_compare_ok(self): - old_condition = new_condition = self.condition_factory.example() - self.assertTrue(new_condition.compare(old_condition)) - - def test_export_1_false(self): - """ - 从第一个return返回false - """ - new_condition = self.condition_factory.new() - - old_condition = self.condition_factory.new( - instances=[ - self.instance_factory.new( - "biz", "", [[{"type": "biz", "type_name": "业务", "id": "biz1", "name": "蓝鲸"}]] - ) - ] - ) - self.assertFalse(new_condition.compare(old_condition)) - - def test_export_2_false(self): - new_condition = self.condition_factory.new( - instances=[ - self.instance_factory.new( - "host", "", [[{"type": "biz", "type_name": "业务", "id": "biz1", "name": "蓝鲸"}]] - ) - ] - ) - - old_condition = self.condition_factory.new( - instances=[ - self.instance_factory.new( - "biz", "", [[{"type": "biz", "type_name": "业务", "id": "biz1", "name": "蓝鲸"}]] - ) - ] - ) - self.assertFalse(new_condition.compare(old_condition)) - - def test_export_3_false(self): - new_condition = self.condition_factory.new( - instances=[ - self.instance_factory.new( - "biz", - "", - [ - [{"type": "biz", "type_name": "业务", "id": "biz1", "name": "蓝鲸"}], - [{"type": "biz", "type_name": "业务", "id": "biz2", "name": "蓝鲸"}], - ], - ) - ] - ) - - old_condition = self.condition_factory.new( - instances=[ - self.instance_factory.new( - "biz", "", [[{"type": "biz", "type_name": "业务", "id": "biz1", "name": "蓝鲸"}]] - ) - ] - ) - self.assertFalse(new_condition.compare(old_condition)) - - def test_export_4_false(self): - new_condition = self.condition_factory.new( - instances=[ - self.instance_factory.new( - "biz", - "", - [ - [ - {"type": "biz", "type_name": "业务", "id": "biz1", "name": "蓝鲸"}, - {"type": "biz", "type_name": "业务", "id": "biz2", "name": "蓝鲸"}, - ], - ], - ) - ] - ) - - old_condition = self.condition_factory.new( - instances=[ - self.instance_factory.new( - "biz", "", [[{"type": "biz", "type_name": "业务", "id": "biz1", "name": "蓝鲸"}]] - ) - ] - ) - self.assertFalse(new_condition.compare(old_condition)) - - def test_export_5_false(self): - new_condition = self.condition_factory.new( - instances=[ - self.instance_factory.new( - "biz", "", [[{"type": "biz", "type_name": "业务", "id": "biz1", "name": "蓝鲸"}]] - ) - ] - ) - - old_condition = self.condition_factory.new( - instances=[ - self.instance_factory.new( - "biz", "", [[{"type": "biz", "type_name": "业务", "id": "biz2", "name": "蓝鲸"}]] - ) - ] - ) - self.assertFalse(new_condition.compare(old_condition)) - - def test_export_6_false(self): - new_condition = self.condition_factory.new( - attributes=[ - self.attribute_factory.new("id", "", [{"id": "biz1", "name": "蓝鲸"}]), - self.attribute_factory.new("id", "", [{"id": "biz2", "name": "蓝鲸"}]), - ] - ) - - old_condition = self.condition_factory.new( - attributes=[self.attribute_factory.new("id", "", [{"id": "biz1", "name": "蓝鲸"}])] - ) - self.assertFalse(new_condition.compare(old_condition)) - - def test_export_7_false(self): - new_condition = self.condition_factory.new( - attributes=[self.attribute_factory.new("host", "", [{"id": "biz1", "name": "蓝鲸"}])] - ) - - old_condition = self.condition_factory.new( - attributes=[self.attribute_factory.new("biz", "", [{"id": "biz1", "name": "蓝鲸"}])] - ) - self.assertFalse(new_condition.compare(old_condition)) - - def test_export_8_false(self): - new_condition = self.condition_factory.new( - attributes=[self.attribute_factory.new("biz", "", [{"id": "biz1", "name": "蓝鲸"}])] - ) - - old_condition = self.condition_factory.new( - attributes=[ - self.attribute_factory.new("biz", "", [{"id": "biz1", "name": "蓝鲸"}, {"id": "biz2", "name": "蓝鲸"}]) - ] - ) - self.assertFalse(new_condition.compare(old_condition)) - - def test_export_9_false(self): - new_condition = self.condition_factory.new( - attributes=[self.attribute_factory.new("biz", "", [{"id": "biz1", "name": "蓝鲸"}])] - ) - - old_condition = self.condition_factory.new( - attributes=[self.attribute_factory.new("biz", "", [{"id": "biz2", "name": "蓝鲸"}])] - ) - self.assertFalse(new_condition.compare(old_condition)) - - -class CompareResourceTests(TestCase): - def test_compare(self): - new_resource = old_resource = ResourceFactory().example() - self.assertTrue(new_resource.compare(old_resource)) - - -class InstanceAddRemoveInstance(TestCase): - def setUp(self): - self.instance_factory = InstanceFactory() - - def test_add_instance_true(self): - instance = self.instance_factory.example() - - is_modified = instance.add_instance( - self.instance_factory.new( - "host", "主机", [[{"type": "host", "type_name": "主机", "id": "host2", "name": "主机2"}]] - ) - ) - - self.assertTrue(is_modified) - self.assertEqual(len(instance.path), 2) - - def test_add_instance_false(self): - instance = self.instance_factory.example() - - is_modified = instance.add_instance(self.instance_factory.example()) - - self.assertFalse(is_modified) - - def test_remove_instance_true(self): - instance = self.instance_factory.new( - "host", - "主机", - [ - [{"type": "host", "type_name": "主机", "id": "host1", "name": "主机1"}], - [{"type": "host", "type_name": "主机", "id": "host2", "name": "主机2"}], - ], - ) - - is_modified = instance.remove_instance(self.instance_factory.example()) - - self.assertTrue(is_modified) - self.assertEqual(len(instance.path), 1) - - def test_remove_instance_false(self): - instance = self.instance_factory.example() - - is_modified = instance.remove_instance( - self.instance_factory.new( - "host", "主机", [[{"type": "host", "type_name": "主机", "id": "host2", "name": "主机2"}]] - ) - ) - - self.assertFalse(is_modified) - - -class ConditionAddRemoveTest(TestCase): - def setUp(self): - self.condition_factory = ConditionFactory() - self.instance_factory = InstanceFactory() - - def test_condition_add_instance_true(self): - condition = self.condition_factory.new(instances=[self.instance_factory.example()]) - - is_modified = condition.add_instance( - self.instance_factory.new( - "host", "主机", [[{"type": "host", "type_name": "主机", "id": "host2", "name": "主机2"}]] - ) - ) - - self.assertTrue(is_modified) - self.assertEqual(len(condition.instances[0].path), 2) - - condition = self.condition_factory.new(instances=[self.instance_factory.example()]) - - is_modified = condition.add_instance( - self.instance_factory.new("业务", "biz", [[{"type": "biz", "type_name": "业务", "id": "biz1", "name": "蓝鲸"}]]) - ) - - self.assertTrue(is_modified) - self.assertEqual(len(condition.instances), 2) - - def test_condition_add_instance_false(self): - condition = self.condition_factory.new(instances=[self.instance_factory.example()]) - - is_modified = condition.add_instance(self.instance_factory.example()) - - self.assertFalse(is_modified) - - def test_condition_remove_instance_true(self): - condition = self.condition_factory.new( - instances=[ - self.instance_factory.new( - "host", - "主机", - [ - [{"type": "host", "type_name": "主机", "id": "host1", "name": "主机1"}], - [{"type": "host", "type_name": "主机", "id": "host2", "name": "主机2"}], - ], - ) - ] - ) - - is_modified = condition.remove_instance(self.instance_factory.example()) - - self.assertTrue(is_modified) - self.assertEqual(len(condition.instances[0].path), 1) - - def test_condition_remove_instance_false(self): - condition = self.condition_factory.new(instances=[self.instance_factory.example()]) - - is_modified = condition.remove_instance( - self.instance_factory.new( - "host", "主机", [[{"type": "host", "type_name": "主机", "id": "host2", "name": "主机2"}]] - ) - ) - - self.assertFalse(is_modified) - - -class RelatedResourceAddRemoveInstance(TestCase): - def setUp(self): - self.resource_factory = ResourceFactory() - self.instance_factory = InstanceFactory() - self.condition_factory = ConditionFactory() - self.attribute_factory = AttributeFactory() - - def test_add_instance_any(self): - resource = self.resource_factory.new("bk_cmdb", "host", "主机") - - is_modified = resource.add_instance(self.instance_factory.example()) - - self.assertFalse(is_modified) - self.assertEqual(len(resource.condition), 0) - - def test_add_instance_new_condition(self): - resource = self.resource_factory.new( - "bk_cmdb", "host", "主机", [self.condition_factory.new(attributes=[self.attribute_factory.example()])] - ) - - is_modified = resource.add_instance(self.instance_factory.example()) - - self.assertTrue(is_modified) - - def test_add_instance_true(self): - resource = self.resource_factory.new( - "bk_cmdb", "host", "主机", [self.condition_factory.new(instances=[self.instance_factory.example()])] - ) - - is_modified = resource.add_instance( - self.instance_factory.new( - "host", "主机", [[{"type": "host", "type_name": "主机", "id": "host2", "name": "主机2"}]] - ) - ) - - self.assertTrue(is_modified) - - def test_remove_instance_any(self): - resource = self.resource_factory.new("bk_cmdb", "host", "主机") - - is_modified = resource.remove_instance(self.instance_factory.example()) - - self.assertFalse(is_modified) - - def test_remove_instance_true(self): - resource = self.resource_factory.new( - "bk_cmdb", "host", "主机", [self.condition_factory.new(instances=[self.instance_factory.example()])] - ) - - is_modified = resource.remove_instance(self.instance_factory.example()) - - self.assertTrue(is_modified) - self.assertTrue(resource.is_empty()) - - -class RelatedResourceTypeTests(TestCase): - def setUp(self): - self.instance_selection_factory = InstanceSelectionFactory() - self.related_resource_type_factory = RelatedResourceTypeFactory() - - def test_filter(self): - rrt = self.related_resource_type_factory.new( - "host", - "bk_cmdb", - [ - self.instance_selection_factory.new( - "test1", - "bk_cmdb", - True, - [ - {"system_id": "bk_cmdb", "id": "biz"}, - {"system_id": "bk_cmdb", "id": "set"}, - {"system_id": "bk_cmdb", "id": "module"}, - {"system_id": "bk_cmdb", "id": "host"}, - ], - ), - self.instance_selection_factory.new( - "test2", - "bk_cmdb", - True, - [{"system_id": "bk_cmdb", "id": "biz"}, {"system_id": "bk_cmdb", "id": "set"}], - ), - self.instance_selection_factory.new( - "test3", - "bk_cmdb", - True, - [ - {"system_id": "bk_job", "id": "biz"}, - {"system_id": "bk_cmdb", "id": "set"}, - {"system_id": "bk_cmdb", "id": "module"}, - {"system_id": "bk_cmdb", "id": "host"}, - ], - ), - self.instance_selection_factory.new( - "test3", - "bk_cmdb", - False, - [{"system_id": "bk_cmdb", "id": "biz"}, {"system_id": "bk_cmdb", "id": "set"}], - ), - ], - ) - - self.assertEqual(len(rrt.instance_selections), 2) - - def test_ignore_iam_none(self): - rrt = self.related_resource_type_factory.new("host", "system_id", []) - self.assertEqual(rrt.instance_selections, []) - - -class InstanceCheckSelection(TestCase): - def setUp(self): - self.instance_selection_factory = InstanceSelectionFactory() - self.instance_factory = InstanceFactory() - self.resource_factory = ResourceFactory() - - def test_path_display(self): - instance = self.instance_factory.example() - path_display = instance._path_display( - [{"type_name": "type1", "name": "name1"}, {"type_name": "type2", "name": "name2"}] - ) - self.assertEqual(path_display, "type1:name1/type2:name2") - - def test_check_selections_export_1(self): - """ - 检查实例视图, 实例的节点的类型与资源类型一样 - """ - instance = self.instance_factory.example() - rrt = self.resource_factory.example() - selections = [self.instance_selection_factory.new("1", "1", False, [])] - instance.check_selection_ignore_path(rrt, selections) - - def test_check_selections_export_2(self): - instance = self.instance_factory.new( - "host", - "主机", - [ - [ - {"system_id": "bk_cmdb", "type": "biz", "type_name": "biz", "id": "biz1", "name": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "type_name": "set", "id": "set1", "name": "set1"}, - { - "system_id": "bk_cmdb", - "type": "module", - "type_name": "module", - "id": "module1", - "name": "module1", - }, - {"system_id": "bk_cmdb", "type": "host", "type_name": "host", "id": "host1", "name": "host1"}, - ] - ], - ) - rrt = self.resource_factory.example() - selections = [self.instance_selection_factory.example()] - instance.check_selection_ignore_path(rrt, selections) - - def test_check_selections_export_3(self): - instance = self.instance_factory.new( - "host", - "主机", - [ - [ - {"system_id": "bk_cmdb", "type": "biz", "type_name": "biz", "id": "biz1", "name": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "type_name": "set", "id": "set1", "name": "set1"}, - { - "system_id": "bk_cmdb", - "type": "module", - "type_name": "module", - "id": "module1", - "name": "module1", - }, - {"system_id": "bk_cmdb", "type": "host", "type_name": "host", "id": "host1", "name": "host1"}, - ] - ], - ) - rrt = self.resource_factory.example() - selections = [self.instance_selection_factory.example()] - selections[0].ignore_iam_path = True - instance.check_selection_ignore_path(rrt, selections) - self.assertEqual(len(instance.path[0]), 1) - - def test_check_selections_export_4(self): - instance = self.instance_factory.new( - "host", - "主机", - [ - [ - {"system_id": "bk_cmdb", "type": "biz", "type_name": "biz", "id": "biz1", "name": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "type_name": "set", "id": "set1", "name": "set1"}, - ] - ], - ) - rrt = self.resource_factory.example() - selections = [self.instance_selection_factory.example()] - selections[0].ignore_iam_path = True - instance.check_selection_ignore_path(rrt, selections) - self.assertEqual(len(instance.path[0]), 2) - - def test_check_selections_err(self): - instance = self.instance_factory.new( - "host", "主机", [[{"system_id": "bk_cmdb", "type": "set", "type_name": "set", "id": "set1", "name": "set1"}]] - ) - rrt = self.resource_factory.example() - selections = [self.instance_selection_factory.example()] - try: - instance.check_selection_ignore_path(rrt, selections) - except CodeException as e: - self.assertEqual(e.message, "参数校验失败: set:set1 could not match any instance selection") - - -class InstanceTests(TestCase): - def setUp(self): - self.instance_factory = InstanceFactory() - - def test_get_system_set(self): - instance = self.instance_factory.example() - - self.assertEqual(instance.get_system_set(), {"bk_cmdb"}) - - def test_fill_type_name(self): - instance = self.instance_factory.new( - "host", "主机", [[{"system_id": "bk_cmdb", "type": "host", "type_name": "主机", "id": "*", "name": "主机1"}]] - ) - - resource_type_dict = ResourceTypeDict( - data={("bk_cmdb", "host"): {"name": "host_test", "name_en": "host_test_en"}} - ) - - instance.fill_type_name(resource_type_dict) - self.assertEqual(instance.name, "host_test") - self.assertEqual(instance.name_en, "host_test_en") - self.assertEqual(instance.path[0][0]["type_name"], "host_test") - self.assertEqual(instance.path[0][0]["type_name_en"], "host_test_en") - - def test_fill_node_name(self): - instance = self.instance_factory.example() - - resource_info_name_dict = { - ResourceNode(**{"system_id": "bk_cmdb", "type": "host", "id": "host1"}): "host_name" - } - - instance.fill_node_name(resource_info_name_dict) - self.assertEqual(instance.path[0][0]["name"], "host_name") - - def test_list_resource_node(self): - instance = self.instance_factory.example() - nodes = instance.list_resource_node() - self.assertEqual(len(nodes), 1) - - def test_contains(self): - instance = self.instance_factory.example() - self.assertTrue(instance in instance) - - new_instance = self.instance_factory.new( - "host", "主机", [[{"system_id": "bk_cmdb", "type": "host", "type_name": "主机", "id": "*", "name": "主机1"}]] - ) - - self.assertFalse(new_instance in instance) - - def test_sub(self): - instance = self.instance_factory.new( - "host", - "主机", - [ - [ - {"system_id": "bk_cmdb", "type": "biz", "type_name": "biz", "id": "biz1", "name": "biz1"}, - {"system_id": "bk_cmdb", "type": "set", "type_name": "set", "id": "set1", "name": "set1"}, - ], - [{"system_id": "bk_cmdb", "type": "host", "type_name": "主机", "id": "host1", "name": "主机1"}], - ], - ) - - instance -= self.instance_factory.example() - - self.assertEqual(len(instance.path), 1) - - -class PathHelperTests(TestCase): - def setUp(self): - self.instance_selection_factory = InstanceSelectionFactory() - self.resource_factory = ResourceFactory() - - def test_multi_leaf_node_ok(self): - """ - 测试多级叶子节点相同的情况 - 比如用户管理的部门下的部门 - """ - path = [ - {"system_id": "bk_cmdb", "type": "biz"}, - {"system_id": "bk_cmdb", "type": "set"}, - {"system_id": "bk_cmdb", "type": "module"}, - {"system_id": "bk_cmdb", "type": "host"}, - {"system_id": "bk_cmdb", "type": "host"}, - ] - - selection = self.instance_selection_factory.example() - - rrt = self.resource_factory.example() - - helper = PathHelper(path) - ok, path = helper.check_selection_ignore_path(rrt, selection) - - self.assertTrue(ok) - - def test_multi_leaf_node_false(self): - """ - 测试多级叶子节点相同的情况 - """ - path = [ - {"system_id": "bk_cmdb", "type": "biz"}, - {"system_id": "bk_cmdb", "type": "set"}, - {"system_id": "bk_cmdb", "type": "module"}, - {"system_id": "bk_cmdb", "type": "host"}, - {"system_id": "bk_cmdb", "type": "test"}, - ] - - selection = self.instance_selection_factory.example() - - rrt = self.resource_factory.example() - - helper = PathHelper(path) - ok, path = helper.check_selection_ignore_path(rrt, selection) - - self.assertFalse(ok) - - -class ActionTests(TestCase): - def setUp(self): - self.action_factory = ActionFactory() - - -class ResourceInstanceTests(TestCase): - def setUp(self): - self.resource_instance_factory = ResourceInstanceFactory() - - def test_get_system_set(self): - ri = self.resource_instance_factory.example() - systems = ri.get_system_set() - self.assertEqual(systems, {"bk_cmdb"}) - - def test_fill_type_name(self): - ri = self.resource_instance_factory.example() - resource_type_dict = ResourceTypeDict( - data={("bk_cmdb", "host"): {"name": "host_test", "name_en": "host_test_en"}} - ) - ri.fill_type_name(resource_type_dict) - self.assertEqual(ri.type_name, "host_test") - self.assertEqual(ri.instances[0].path[0][0]["type_name"], "host_test") - - -class ConditionTests(TestCase): - def setUp(self): - self.condition_factory = ConditionFactory() - self.instance_factory = InstanceFactory() - - def test_merge_instances(self): - condition = self.condition_factory.example() - instance = self.instance_factory.new( - "biz", "业务", [[{"system_id": "bk_cmdb", "type": "biz", "type_name": "业务", "id": "biz1", "name": "业务1"}]] - ) - condition.merge_instances([instance]) - self.assertEqual(len(condition.instances), 2) - - def test_has_instances(self): - condition = self.condition_factory.example() - instance = self.instance_factory.example() - self.assertTrue(condition.has_instances([instance])) - - instance = self.instance_factory.new( - "biz", "业务", [[{"system_id": "bk_cmdb", "type": "biz", "type_name": "业务", "id": "biz1", "name": "业务1"}]] - ) - self.assertFalse(condition.has_instances([instance])) - - instance = self.instance_factory.new( - "host", "主机", [[{"system_id": "bk_cmdb", "type": "host", "type_name": "主机", "id": "host2", "name": "主机2"}]] - ) - self.assertFalse(condition.has_instances([instance])) - - def test_remove_instance(self): - condition = self.condition_factory.example() - instance = self.instance_factory.example() - condition.remove_instances([instance]) - self.assertEqual(len(condition.instances), 0) - - def test_list_resource_node(self): - condition = self.condition_factory.example() - nodes = condition.list_resource_node() - self.assertEqual(len(nodes), 1) - - def test_get_system_set(self): - condition = self.condition_factory.example() - systems = condition.get_system_set() - self.assertEqual(systems, {"bk_cmdb"}) - - condition = self.condition_factory.new() - systems = condition.get_system_set() - self.assertEqual(systems, set()) - - -class RelatedResourceTests(TestCase): - def setUp(self): - self.resource_factory = ResourceFactory() - self.condition_factory = ConditionFactory() - self.resource_instance_factory = ResourceInstanceFactory() - self.instance_selection_factory = InstanceSelectionFactory() - self.attribute_factory = AttributeFactory() - - def test_merge_conditions(self): - resource = self.resource_factory.new("bk_cmdb", "host", "主机") - condition = self.condition_factory.example() - resource.merge_conditions([condition]) - self.assertTrue(resource.is_any()) - - resource = self.resource_factory.example() - resource.merge_conditions([], True) - self.assertTrue(resource.is_any()) - - def test_remove_conditions(self): - resource = self.resource_factory.new("bk_cmdb", "host", "主机") - resource.remove_conditions([]) - self.assertTrue(resource.is_empty()) - - resource = self.resource_factory.new("bk_cmdb", "host", "主机") - condition = self.condition_factory.example() - resource.remove_conditions([condition]) - self.assertTrue(resource.is_any()) - - resource = self.resource_factory.example() - resource.remove_conditions([condition]) - self.assertTrue(resource.is_empty()) - - def test_has_conditions(self): - resource = self.resource_factory.example() - self.assertFalse(resource.has_conditions([])) - - resource = self.resource_factory.new("bk_cmdb", "host", "主机") - condition = self.condition_factory.example() - self.assertTrue(resource.has_conditions([condition])) - - resource = self.resource_factory.example() - self.assertTrue(resource.has_conditions([condition])) - - def test_set_empty(self): - resource = self.resource_factory.example() - resource.set_empty() - self.assertTrue(resource.is_empty()) - self.assertEqual(len(resource.condition), 0) - - def test_set_tag(self): - resource = self.resource_factory.example() - resource.set_tag_update() - self.assertEqual(resource.get_tag(), "update") - - resource.set_tag_unchanged() - self.assertEqual(resource.get_tag(), "unchanged") - - resource.set_tag_delete() - self.assertEqual(resource.get_tag(), "delete") - - def test_fill_resource_node_name(self): - resource = self.resource_factory.example() - - resource_info_name_dict = { - ResourceNode(**{"system_id": "bk_cmdb", "type": "host", "id": "host1"}): "host_name" - } - - resource.fill_resource_node_name(resource_info_name_dict) - self.assertEqual(resource.condition[0].instances[0].path[0][0]["name"], "host_name") - - def test_list_resource_node(self): - resource = self.resource_factory.example() - nodes = resource.list_resource_node() - self.assertEqual(len(nodes), 1) - - def test_from_resource_instance(self): - ri = self.resource_instance_factory.example() - resource = RelatedResource.from_resource_instance(ri) - self.assertEqual(resource.system_id, "bk_cmdb") - self.assertEqual(resource.type, "host") - - def test_check_selection_ignore_path(self): - resource = self.resource_factory.example() - selection = self.instance_selection_factory.example() - resource.check_selection_ignore_path([selection]) - - resource = self.resource_factory.new( - "bk_cmdb", "host", "主机", [self.condition_factory.new(attributes=[self.attribute_factory.example()])] - ) - resource.check_selection_ignore_path([selection]) - - def test_get_system_set(self): - resource = self.resource_factory.example() - resource.set_empty() - systems = resource.get_system_set() - self.assertEqual(systems, {"bk_cmdb"}) - - -class PolicyTests(TestCase): - def setUp(self): - self.policy_factory = PolicyFactory() - self.resource_factory = ResourceFactory() - self.condition_factory = ConditionFactory() - self.resource_instance_factory = ResourceInstanceFactory() - self.attribute_factory = AttributeFactory() - - def test_set_expired_at(self): - policy = self.policy_factory.example() - policy.set_expired_at(4102444800) - self.assertEqual(policy.expired_at, 4102444800) - - def test_set_tag(self): - policy = self.policy_factory.example() - policy.set_tag_update() - self.assertEqual(policy.tag, "update") - - policy.set_tag_unchanged() - self.assertEqual(policy.tag, "unchanged") - - policy.set_tag_delete() - self.assertEqual(policy.tag, "delete") - - policy.set_tag_add() - self.assertEqual(policy.tag, "add") - - def test_to_backend_dict(self): - policy = self.policy_factory.example() - data = policy.to_backend_dict() - self.assertEqual(data["action_id"], "view_host") - - def test_from_db_model(self): - policy = self.policy_factory.example() - m = policy.to_db_model("bk_cmdb", Subject(**{"type": "user", "id": "admin"})) - p = Policy.from_db_model(m) - self.assertEqual(p.id, "view_host") - - def test_to_db_model(self): - policy = self.policy_factory.example() - m = policy.to_db_model("bk_cmdb", Subject(**{"type": "user", "id": "admin"})) - self.assertEqual(m.action_id, "view_host") - - def test_has(self): - policy = self.policy_factory.new("create_host", []) - self.assertTrue(policy.has(policy)) - - policy = self.policy_factory.example() - self.assertTrue(policy.has(policy)) - - new_policy = self.policy_factory.new( - "view_host", - [ - self.resource_factory.new( - "bk_cmdb", - "host", - "主机", - [self.condition_factory.new(attributes=[self.attribute_factory.example()])], - ) - ], - ) - self.assertFalse(new_policy.has(policy)) - - def test_diff(self): - policy = self.policy_factory.new("create_host", []) - self.assertTrue(policy.diff(policy)) - - policy = self.policy_factory.example() - self.assertTrue(policy.diff(policy)) - - def test_fill_resource_node_name(self): - policy = self.policy_factory.example() - - resource_info_name_dict = { - ResourceNode(**{"system_id": "bk_cmdb", "type": "host", "id": "host1"}): "host_name" - } - - policy.fill_resource_node_name(resource_info_name_dict) - self.assertEqual(policy.related_resource_types[0].condition[0].instances[0].path[0][0]["name"], "host_name") - - def test_add_resources_instance(self): - policy = self.policy_factory.example() - ri = self.resource_instance_factory.example() - self.assertTrue(policy.add_resources_instance([ri])) - - def test_remove_resources_instance(self): - policy = self.policy_factory.example() - ri = self.resource_instance_factory.example() - self.assertFalse(policy.remove_resources_instance([ri])) - - def test_get_system_set(self): - policy = self.policy_factory.new("create_host", []) - systems = policy.get_system_set() - self.assertEqual(systems, set()) - - -class ResourceCreatorActionConfigTests(TestCase): - def test_get_resource_type_actions_map(self): - rcac = ResourceCreatorActionConfig( - **{ - "id": "test", - "actions": [{"id": "test1", "required": False}, {"id": "test2", "required": False}], - "sub_resource_types": [ - { - "id": "test3", - "actions": [{"id": "test4", "required": False}, {"id": "test5", "required": False}], - "sub_resource_types": [], - } - ], - } - ) - - result = rcac.get_resource_type_actions_map() - self.assertEqual( - result, - { - "test": [ - ResourceCreatorSingleAction(**{"id": "test1", "required": False}), - ResourceCreatorSingleAction(**{"id": "test2", "required": False}), - ], - "test3": [ - ResourceCreatorSingleAction(**{"id": "test4", "required": False}), - ResourceCreatorSingleAction(**{"id": "test5", "required": False}), - ], - }, - ) diff --git a/saas/tests/service/resource_creator_action_tests.py b/saas/tests/service/resource_creator_action_tests.py deleted file mode 100644 index d91a1a35d..000000000 --- a/saas/tests/service/resource_creator_action_tests.py +++ /dev/null @@ -1,71 +0,0 @@ -# -*- coding: utf-8 -*- -""" -TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. -Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. -Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. -You may obtain a copy of the License at http://opensource.org/licenses/MIT -Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on -an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the -specific language governing permissions and limitations under the License. -""" -import mock -from django.test import TestCase - -from backend.service.models import ResourceCreatorActionConfig, ResourceCreatorSingleAction -from backend.service.resource_creator_action import ResourceCreatorAction, ResourceCreatorActionService - - -class ResourceCreatorActionServiceTests(TestCase): - def test_get_resource_type_actions_map(self): - rcac = ResourceCreatorActionConfig( - **{ - "id": "test", - "actions": [{"id": "test1", "required": False}, {"id": "test2", "required": False}], - "sub_resource_types": [ - { - "id": "test3", - "actions": [{"id": "test4", "required": False}, {"id": "test5", "required": False}], - "sub_resource_types": [], - } - ], - } - ) - - svc = ResourceCreatorActionService() - svc.get = mock.Mock(return_value=ResourceCreatorAction(mode="test", config=[rcac])) - - result = svc._get_resource_type_actions_map("test") - self.assertEqual( - result, - { - "test": [ - ResourceCreatorSingleAction(**{"id": "test1", "required": False}), - ResourceCreatorSingleAction(**{"id": "test2", "required": False}), - ], - "test3": [ - ResourceCreatorSingleAction(**{"id": "test4", "required": False}), - ResourceCreatorSingleAction(**{"id": "test5", "required": False}), - ], - }, - ) - - def test_get_actions(self): - svc = ResourceCreatorActionService() - svc._get_resource_type_actions_map = mock.Mock( - return_value={ - "test": [ - ResourceCreatorSingleAction(**{"id": "test1", "required": False}), - ResourceCreatorSingleAction(**{"id": "test2", "required": False}), - ], - "test3": [ - ResourceCreatorSingleAction(**{"id": "test4", "required": False}), - ResourceCreatorSingleAction(**{"id": "test5", "required": False}), - ], - } - ) - - with self.assertRaises(Exception): - svc.get_actions("test", "testx") - - result = svc.get_actions("test", "test") - self.assertEqual(result, ["test1", "test2"]) diff --git a/saas/tests/service/translate_tests.py b/saas/tests/service/translate_tests.py deleted file mode 100644 index 1458296b4..000000000 --- a/saas/tests/service/translate_tests.py +++ /dev/null @@ -1,304 +0,0 @@ -# -*- coding: utf-8 -*- -""" -TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. -Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. -Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. -You may obtain a copy of the License at http://opensource.org/licenses/MIT -Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on -an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the -specific language governing permissions and limitations under the License. -""" -import json - -from django.test import TestCase - -from backend.service.utils.translate import ResourceExpressionTranslator -from tests.test_util.factory import AttributeFactory, ConditionFactory, InstanceFactory, ResourceFactory - - -class TransferAttributeTests(TestCase): - """ - 测试_translate_attribute方法 - """ - - def setUp(self): - self.translator = ResourceExpressionTranslator() - self.attribute_factory = AttributeFactory() - - def test_empty_values_err(self): - """空值属性""" - attribute = self.attribute_factory.new_dict("id", "name") - - with self.assertRaises(Exception): - self.translator._translate_attribute(attribute) - - def test_multi_bool_err(self): - """多值bool""" - attribute = self.attribute_factory.new_dict( - "id", "name", [{"id": True, "name": ""}, {"id": False, "name": ""}] - ) - - with self.assertRaises(Exception): - self.translator._translate_attribute(attribute) - - def test_wrong_type_err(self): - """错误的值类型""" - attribute = self.attribute_factory.new_dict("id", "name", [{"id": set(), "name": ""}]) - - with self.assertRaises(Exception): - self.translator._translate_attribute(attribute) - - def test_string_ok(self): - """string值""" - attribute = self.attribute_factory.new_dict( - "id", "name", [{"id": "id1", "name": ""}, {"id": "id2", "name": ""}] - ) - - expression = self.translator._translate_attribute(attribute) - - self.assertEqual(expression, {"StringEquals": {"id": ["id1", "id2"]}}) - - def test_number_ok(self): - """int float""" - attribute = self.attribute_factory.new_dict("id", "name", [{"id": 1, "name": ""}, {"id": 1.1, "name": ""}]) - - expression = self.translator._translate_attribute(attribute) - - self.assertEqual(expression, {"NumericEquals": {"id": [1, 1.1]}}) - - def test_bool_ok(self): - """bool""" - attribute = self.attribute_factory.new_dict("id", "name", [{"id": True, "name": ""}]) - - expression = self.translator._translate_attribute(attribute) - - self.assertEqual(expression, {"Bool": {"id": [True]}}) - - -class TransferInstanceTests(TestCase): - """测试_translate_instance方法""" - - def setUp(self): - self.translator = ResourceExpressionTranslator() - self.instance_factory = InstanceFactory() - - def test_empty_path_err(self): - """ - 空拓扑路径 - """ - instance = self.instance_factory.new_dict("host", "主机") - - with self.assertRaises(Exception): - self.translator._translate_instance("host", instance) - - def test_id_ok(self): - """ - 实例id转换 - """ - instance = self.instance_factory.new_dict( - "host", "主机", [[{"type": "host", "type_name": "主机", "id": "host1", "name": "主机1"}]] - ) - - expression = self.translator._translate_instance("host", instance) - - self.assertEqual( - expression["StringEquals"]["id"], - ["host1"], - ) - - def test_id_with_path_ok(self): - """ - 带路径的实例 - """ - instance = self.instance_factory.new_dict( - "host", - "主机", - [ - [ - {"type": "biz", "type_name": "业务", "id": "biz1", "name": "蓝鲸"}, - {"type": "host", "type_name": "主机", "id": "host2", "name": "主机2"}, - ], - ], - ) - - expression = self.translator._translate_instance("host", instance) - - self.assertEqual(expression["AND"]["content"][0], {"StringEquals": {"id": ["host2"]}}) - self.assertEqual(expression["AND"]["content"][1], {"StringPrefix": {"_bk_iam_path_": ["/biz,biz1/"]}}) - - def test_path_ok(self): - """前缀拓扑""" - instance = self.instance_factory.new_dict( - "set", - "集群", - [ - [ - {"type": "biz", "type_name": "业务", "id": "biz1", "name": "蓝鲸"}, - {"type": "set", "type_name": "集群", "id": "set1", "name": "集群1"}, - ], - ], - ) - - expression = self.translator._translate_instance("host", instance) - - self.assertEqual(expression["StringPrefix"]["_bk_iam_path_"], ["/biz,biz1/set,set1/"]) - - def test_path_with_any_id_ok(self): - """路径中叶子节点为任意""" - instance = self.instance_factory.new_dict( - "set", - "集群", - [ - [ - {"type": "biz", "type_name": "业务", "id": "biz1", "name": "蓝鲸"}, - {"type": "set", "type_name": "集群", "id": "set1", "name": "集群1"}, - {"type": "host", "type_name": "主机", "id": "*", "name": ""}, - ], - ], - ) - - expression = self.translator._translate_instance("host", instance) - - self.assertEqual(expression["StringPrefix"]["_bk_iam_path_"], ["/biz,biz1/set,set1/"]) - - def test_or_condition_ok(self): - """组合条件""" - instance = self.instance_factory.new_dict( - "host", - "主机", - [ - [{"type": "host", "type_name": "主机", "id": "host1", "name": "主机1"}], - [ - {"type": "biz", "type_name": "业务", "id": "biz1", "name": "蓝鲸"}, - {"type": "host", "type_name": "主机", "id": "host2", "name": "主机2"}, - ], - ], - ) - - expression = self.translator._translate_instance("host", instance) - - self.assertEqual(len(expression["OR"]["content"]), 2) - - -class TransferConditionTests(TestCase): - def setUp(self): - self.translator = ResourceExpressionTranslator() - - self.instance_factory = InstanceFactory() - self.attribute_factory = AttributeFactory() - self.condition_factory = ConditionFactory() - self.resource_factory = ResourceFactory() - - def test_empty_condition_ok(self): - """ - 任意 - """ - resource = self.resource_factory.new_dict("bk_cmdb", "host", "主机") - - expression = self.translator._translate_condition(resource) - - self.assertEqual( - expression["Any"]["id"], - [], - ) - - def test_instance_ok(self): - """ - 只有instance - """ - resource = self.resource_factory.new_dict( - "bk_cmdb", - "host", - "主机", - [self.condition_factory.new_dict(instances=[self.instance_factory.example().dict()])], - ) - - expression = self.translator._translate_condition(resource) - - self.assertTrue( - "StringEquals" in expression, - ) - - def test_attribute_ok(self): - """ - 只有attribute - """ - resource = self.resource_factory.new_dict( - "bk_cmdb", - "host", - "主机", - [self.condition_factory.new_dict(attributes=[self.attribute_factory.example().dict()])], - ) - - expression = self.translator._translate_condition(resource) - self.assertTrue( - "StringEquals" in expression, - ) - - def test_instance_and_attribute_ok(self): - """ - instance and attribute - """ - resource = self.resource_factory.new_dict( - "bk_cmdb", - "host", - "主机", - [ - self.condition_factory.new_dict( - attributes=[self.attribute_factory.example().dict()], - instances=[self.instance_factory.example().dict()], - ) - ], - ) - - expression = self.translator._translate_condition(resource) - - self.assertTrue( - "AND" in expression, - ) - - def test_or_condition_ok(self): - """ - 多个条件组合 - """ - resource = self.resource_factory.new_dict( - "bk_cmdb", - "host", - "主机", - [ - self.condition_factory.new_dict(instances=[self.instance_factory.example().dict()]), - self.condition_factory.new_dict(attributes=[self.attribute_factory.example().dict()]), - ], - ) - - expression = self.translator._translate_condition(resource) - - self.assertTrue( - "OR" in expression, - ) - - -class TransferResourcesTests(TestCase): - def test_translate_ok(self): - resources = [ResourceFactory().example().dict()] - - translator = ResourceExpressionTranslator() - - expression = translator.translate(resources) - self.assertEqual( - expression, - json.dumps( - [ - { - "system": "bk_cmdb", - "type": "host", - "expression": { - "AND": { - "content": [{"StringEquals": {"id": ["host1"]}}, {"StringEquals": {"os": ["linux"]}}] - } - }, - } - ], - separators=(",", ":"), - ), - ) diff --git a/saas/tests/test_util/factory.py b/saas/tests/test_util/factory.py deleted file mode 100644 index 9da1dcfac..000000000 --- a/saas/tests/test_util/factory.py +++ /dev/null @@ -1,235 +0,0 @@ -# -*- coding: utf-8 -*- -""" -TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. -Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. -Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. -You may obtain a copy of the License at http://opensource.org/licenses/MIT -Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on -an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the -specific language governing permissions and limitations under the License. -""" -from typing import Dict, List, Optional - -from backend.biz.policy import ConditionBean, InstanceBean, PolicyBean, RelatedResourceBean -from backend.service.models import ( - Action, - Attribute, - Condition, - Instance, - InstanceSelection, - Policy, - RelatedResource, - RelatedResourceType, - ResourceInstance, -) - - -class AttributeFactory: - """属性数据生成""" - - def new_dict(self, _id: str, name: str, values: Optional[List[Dict]] = None) -> Dict: - return {"id": _id, "name": name, "values": values or []} - - def example(self) -> Attribute: - return self.new("os", "os", [{"id": "linux", "name": "linux"}]) - - def new(self, _id: str, name: str, values: Optional[List[Dict]] = None) -> Attribute: - return Attribute(**self.new_dict(_id, name, values)) - - -class InstanceFactory: - def new_dict(self, _type: str, name: str, paths: Optional[List[List[Dict]]] = None) -> Dict: - return { - "name": name, - "type": _type, - "path": paths or [], - } - - def example(self) -> Instance: - return self.new( - "host", "主机", [[{"system_id": "bk_cmdb", "type": "host", "type_name": "主机", "id": "host1", "name": "主机1"}]] - ) - - def new(self, _type: str, name: str, paths: Optional[List[List[Dict]]] = None) -> Instance: - return Instance(**self.new_dict(_type, name, paths)) - - -class InstanceBeanFactory: - def new_dict(self, _type: str, name: str, paths: Optional[List[List[Dict]]] = None) -> Dict: - return { - "name": name, - "type": _type, - "path": paths or [], - } - - def example(self) -> InstanceBean: - return self.new( - "host", "主机", [[{"system_id": "bk_cmdb", "type": "host", "type_name": "主机", "id": "host1", "name": "主机1"}]] - ) - - def new(self, _type: str, name: str, paths: Optional[List[List[Dict]]] = None) -> InstanceBean: - return InstanceBean(**self.new_dict(_type, name, paths)) - - -class ConditionFactory: - """条件数据生成""" - - def __init__(self): - self.attribute_factory = AttributeFactory() - self.instance_factory = InstanceFactory() - - def new_dict(self, instances: Optional[List[Dict]] = None, attributes: Optional[List[Dict]] = None) -> Dict: - return {"instances": instances or [], "attributes": attributes or []} - - def example(self) -> Condition: - return self.new([self.instance_factory.example()], [self.attribute_factory.example()]) - - def new( - self, instances: Optional[List[Instance]] = None, attributes: Optional[List[Attribute]] = None - ) -> Condition: - return Condition(**self.new_dict([i.dict() for i in instances or []], [a.dict() for a in attributes or []])) - - -class ConditionBeanFactory: - """条件数据生成""" - - def __init__(self): - self.attribute_factory = AttributeFactory() - self.instance_factory = InstanceBeanFactory() - - def new_dict(self, instances: Optional[List[Dict]] = None, attributes: Optional[List[Dict]] = None) -> Dict: - return {"instances": instances or [], "attributes": attributes or []} - - def example(self) -> ConditionBean: - return self.new([self.instance_factory.example()], [self.attribute_factory.example()]) - - def new( - self, instances: Optional[List[InstanceBean]] = None, attributes: Optional[List[Attribute]] = None - ) -> ConditionBean: - return ConditionBean( - **self.new_dict([i.dict() for i in instances or []], [a.dict() for a in attributes or []]) - ) - - -class ResourceFactory: - def __init__(self): - self.condition_factory = ConditionFactory() - - def new_dict(self, system_id: str, _type: str, name: str, condition: Optional[List[Dict]] = None) -> Dict: - return {"system_id": system_id, "type": _type, "name": name, "condition": condition or []} - - def example(self) -> RelatedResource: - return self.new("bk_cmdb", "host", "主机", [self.condition_factory.example()]) - - def new( - self, system_id: str, _type: str, name: str, condition: Optional[List[Condition]] = None - ) -> RelatedResource: - return RelatedResource(**self.new_dict(system_id, _type, name, [c.dict() for c in condition or []])) - - -class RelatedResourceBeanFactory: - def __init__(self): - self.condition_factory = ConditionBeanFactory() - - def new_dict(self, system_id: str, _type: str, name: str, condition: Optional[List[Dict]] = None) -> Dict: - return {"system_id": system_id, "type": _type, "name": name, "condition": condition or []} - - def example(self) -> RelatedResourceBean: - return self.new("bk_cmdb", "host", "主机", [self.condition_factory.example()]) - - def new( - self, system_id: str, _type: str, name: str, condition: Optional[List[Condition]] = None - ) -> RelatedResourceBean: - return RelatedResourceBean(**self.new_dict(system_id, _type, name, [c.dict() for c in condition or []])) - - -class InstanceSelectionFactory: - def new( - self, _id: str, system_id: str, ignore_iam_path: bool, resource_type_chain: List[Dict] - ) -> InstanceSelection: - return InstanceSelection( - id=_id, - system_id=system_id, - name=_id, - name_en=_id, - ignore_iam_path=ignore_iam_path, - resource_type_chain=resource_type_chain, - ) - - def example(self) -> InstanceSelection: - return self.new( - "test", - "bk_cmdb", - False, - [ - {"system_id": "bk_cmdb", "id": "biz"}, - {"system_id": "bk_cmdb", "id": "set"}, - {"system_id": "bk_cmdb", "id": "module"}, - {"system_id": "bk_cmdb", "id": "host"}, - ], - ) - - -class RelatedResourceTypeFactory: - def __init__(self): - self.instance_selection_factory = InstanceSelectionFactory() - - def new(self, _id: str, system_id: str, instance_selections: List[InstanceSelection]) -> RelatedResourceType: - return RelatedResourceType( - id=_id, system_id=system_id, name=_id, name_en=_id, instance_selections=instance_selections - ) - - def example(self) -> RelatedResourceType: - return self.new("host", "bk_cmdb", [self.instance_selection_factory.example()]) - - -class ActionFactory: - def __init__(self): - self.related_resource_type_factory = RelatedResourceTypeFactory() - - def new(self, _id: str, _type: str, related_resource_types: List[RelatedResourceType]) -> Action: - return Action( - id=_id, - type=_type, - name=_id, - name_en=_id, - description=_id, - description_en=_id, - related_resource_types=related_resource_types, - ) - - def example(self): - return self.new("view_host", "host", [self.related_resource_type_factory.example()]) - - -class ResourceInstanceFactory: - def __init__(self): - self.instance_factory = InstanceFactory() - - def new(self, system_id: str, _type: str, instances: List[Instance]) -> ResourceInstance: - return ResourceInstance(system_id=system_id, type=_type, instances=instances) - - def example(self): - return self.new("bk_cmdb", "host", [self.instance_factory.example()]) - - -class PolicyFactory: - def __init__(self): - self.resource_factory = ResourceFactory() - - def new(self, _id: str, related_resource_types: List[RelatedResource]): - return Policy(id=_id, related_resource_types=related_resource_types, environment={}) - - def example(self): - return self.new("view_host", [self.resource_factory.example()]) - - -class PolicyBeanFactory: - def __init__(self): - self.resource_factory = RelatedResourceBeanFactory() - - def new(self, _id: str, related_resource_types: List[RelatedResourceBean]): - return PolicyBean(id=_id, related_resource_types=related_resource_types, environment={}) - - def example(self): - return self.new("view_host", [self.resource_factory.example()]) From e92f61f9127601235f6f11c7b796a1e5ee9c4006 Mon Sep 17 00:00:00 2001 From: Timmy Date: Tue, 24 Aug 2021 14:29:46 +0800 Subject: [PATCH 13/33] =?UTF-8?q?fix(group=20biz):=20check=20role=20scope?= =?UTF-8?q?=20only=20added=20policies=20when=20group=20auth=20=E2=80=A6=20?= =?UTF-8?q?(#9)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(group biz): check role scope only added policies when group auth update * chore(backend/api/management/views/group.py): remove unused policy biz --- saas/backend/api/management/views/group.py | 21 ++++++------ saas/backend/biz/group.py | 39 +++++++++++----------- 2 files changed, 29 insertions(+), 31 deletions(-) diff --git a/saas/backend/api/management/views/group.py b/saas/backend/api/management/views/group.py index 8cf4ddafc..85f1158a7 100644 --- a/saas/backend/api/management/views/group.py +++ b/saas/backend/api/management/views/group.py @@ -41,11 +41,10 @@ from backend.apps.group.serializers import GroupAddMemberSLZ from backend.apps.role.models import Role from backend.audit.audit import add_audit, audit_context_setter, view_audit_decorator -from backend.biz.group import GroupBiz, GroupCheckBiz, GroupCreateBean -from backend.biz.policy import PolicyOperationBiz +from backend.biz.group import GroupBiz, GroupCheckBiz, GroupCreateBean, GroupTemplateGrantBean from backend.biz.role import RoleBiz, RoleListQuery from backend.common.swagger import PaginatedResponseSwaggerAutoSchema, ResponseSwaggerAutoSchema -from backend.service.constants import RoleType, SubjectType +from backend.service.constants import RoleType from backend.service.models import Subject from backend.trans.open_management import ManagementCommonTrans @@ -308,7 +307,6 @@ class ManagementGroupPolicyViewSet(ExceptionHandlerMixin, GenericViewSet): queryset = Group.objects.all() group_biz = GroupBiz() - policy_biz = PolicyOperationBiz() role_biz = RoleBiz() trans = ManagementCommonTrans() @@ -335,15 +333,16 @@ def create(self, request, *args, **kwargs): policy_list = self.trans.to_policy_list_for_batch_action_and_resources(system_id, action_ids, resources) # 组装数据进行对用户组权限处理 + system_id = data["system"] + template = GroupTemplateGrantBean( + system_id=system_id, + template_id=0, # 自定义权限template_id为0 + policies=policy_list.policies, + ) role = self.role_biz.get_role_by_group_id(group.id) - # preprocess_group_policies 已包含：分级管理员授权范围鉴权、数据校验和部分默认用户组策略数据填充 - policies = self.group_biz.preprocess_group_policies(role, system_id, policy_list.policies) - - # 用户组授权 - subject = Subject(type=SubjectType.GROUP.value, id=str(group.id)) - self.policy_biz.alter(system_id, subject, policies) + self.group_biz.grant(role, group, [template]) # 写入审计上下文 - audit_context_setter(group=group, system_id=system_id, policies=policies) + audit_context_setter(group=group, system_id=system_id, policies=policy_list.policies) return Response({}) diff --git a/saas/backend/biz/group.py b/saas/backend/biz/group.py index 9c9f6273e..68bcd2ff6 100644 --- a/saas/backend/biz/group.py +++ b/saas/backend/biz/group.py @@ -191,9 +191,13 @@ def list_system_counter(self, group_id: int) -> List[GroupSystemCounterBean]: return group_systems - def check_update_policies_resource_name( - self, system_id: str, template_id: int, policies: List[PolicyBean], subject: Subject + def check_update_policies_resource_name_and_role_scope( + self, role, system_id: str, template_id: int, policies: List[PolicyBean], subject: Subject ): + """ + 检查更新策略中增量数据实例名称 + 检查更新策略中增量数据是否满足角色的授权范围 + """ # 查询已授权的策略数据 if template_id == 0: old_policies = parse_obj_as(List[PolicyBean], self.policy_query_svc.list_by_subject(system_id, subject)) @@ -207,38 +211,33 @@ def check_update_policies_resource_name( # 校验新增数据资源实例名称是否正确 added_policy_list.check_resource_name() - def preprocess_group_policies(self, role, system_id: str, policies: List[PolicyBean]): - """ - 用户组的policies预处理 - """ # 校验权限是否满足角色的管理范围 scope_checker = RoleAuthorizationScopeChecker(role) - scope_checker.check_policies(system_id, policies) + scope_checker.check_policies(system_id, added_policy_list.policies) + def update_policies(self, role, group_id: int, system_id: str, template_id: int, policies: List[PolicyBean]): + """ + 更新用户组单个权限 + """ + subject = Subject(type=SubjectType.GROUP.value, id=str(group_id)) + # 检查新增的实例名字, 检查新增的实例是否满足角色的授权范围 + self.check_update_policies_resource_name_and_role_scope(role, system_id, template_id, policies, subject) + # 检查策略是否与操作信息匹配 self.action_check_biz.check(system_id, [ActionForCheck.parse_obj(p.dict()) for p in policies]) policy_list = PolicyBeanList(system_id, policies, need_ignore_path=True) - # 设置过期时间为永久 for p in policy_list.policies: p.set_expired_at(PERMANENT_SECONDS) - return policy_list.policies - - def update_policies(self, role, group_id: int, system_id: str, template_id: int, policies: List[PolicyBean]): - """ - 更新用户组单个权限 - """ - subject = Subject(type=SubjectType.GROUP.value, id=str(group_id)) - self.check_update_policies_resource_name(system_id, template_id, policies, subject) - policies = self.preprocess_group_policies(role, system_id, policies) - # 自定义权限 if template_id == 0: - self.policy_operation_biz.update(system_id, subject, policies) + self.policy_operation_biz.update(system_id, subject, policy_list.policies) # 权限模板权限 else: - self.template_svc.update_template_auth(subject, template_id, parse_obj_as(List[Policy], policies)) + self.template_svc.update_template_auth( + subject, template_id, parse_obj_as(List[Policy], policy_list.policies) + ) def _convert_to_subject_group_beans(self, relations: List[SubjectGroup]) -> List[SubjectGroupBean]: """ From 26606718421cea31fce5f4dadc32f7f14263215c Mon Sep 17 00:00:00 2001 From: Timmy Date: Tue, 24 Aug 2021 14:41:06 +0800 Subject: [PATCH 14/33] feat(build/v3): add v3 smart build files (#41) * feat(build/v3): add v3 smart build files re #13 --- saas/blueapps/conf/default_settings.py | 3 +- saas/blueapps/core/celery/celery.py | 3 +- saas/blueapps/template/backends/mako.py | 3 +- saas/blueapps/template/context_processors.py | 3 +- saas/build/app.yml | 4 +- saas/build/v3/Aptfile | 2 + saas/build/v3/app_desc.yaml | 42 ++++++ saas/build/v3/bin/post_compile | 2 + saas/build/v3/bin/start.sh | 2 + saas/build/v3/bin/start_beat.sh | 2 + saas/build/v3/bin/start_celery.sh | 2 + saas/build/v3/requirements.txt | 6 + saas/config/__init__.py | 4 +- saas/config/default.py | 3 - saas/config/prod.py | 128 ++++++++++++++----- saas/poetry.lock | 61 ++++++++- saas/pyproject.toml | 2 +- saas/requirements.txt | 2 +- saas/requirements_dev.txt | 2 +- saas/urls.py | 14 +- 20 files changed, 223 insertions(+), 67 deletions(-) create mode 100644 saas/build/v3/Aptfile create mode 100644 saas/build/v3/app_desc.yaml create mode 100644 saas/build/v3/bin/post_compile create mode 100644 saas/build/v3/bin/start.sh create mode 100644 saas/build/v3/bin/start_beat.sh create mode 100644 saas/build/v3/bin/start_celery.sh create mode 100644 saas/build/v3/requirements.txt diff --git a/saas/blueapps/conf/default_settings.py b/saas/blueapps/conf/default_settings.py index f6f6b50cc..ec6aa8959 100644 --- a/saas/blueapps/conf/default_settings.py +++ b/saas/blueapps/conf/default_settings.py @@ -1,4 +1,5 @@ # -*- coding: utf-8 -*- +from __future__ import absolute_import """ TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. @@ -8,8 +9,6 @@ an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. """ -from __future__ import absolute_import - import re from blueapps.conf.environ import * # noqa diff --git a/saas/blueapps/core/celery/celery.py b/saas/blueapps/core/celery/celery.py index 110e09256..e76c83f05 100644 --- a/saas/blueapps/core/celery/celery.py +++ b/saas/blueapps/core/celery/celery.py @@ -1,4 +1,5 @@ # -*- coding: utf-8 -*- +from __future__ import absolute_import, unicode_literals """ TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. @@ -8,8 +9,6 @@ an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. """ -from __future__ import absolute_import, unicode_literals - import os from django.conf import settings diff --git a/saas/blueapps/template/backends/mako.py b/saas/blueapps/template/backends/mako.py index 7d85537f7..e49452825 100644 --- a/saas/blueapps/template/backends/mako.py +++ b/saas/blueapps/template/backends/mako.py @@ -1,4 +1,5 @@ # -*- coding: utf-8 -*- +from __future__ import absolute_import """ TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. @@ -12,8 +13,6 @@ Learn more at: https://gist.github.com/artscoop/0eba5033527f9e488ee17b346d16284d """ -from __future__ import absolute_import - import tempfile from django.conf import settings diff --git a/saas/blueapps/template/context_processors.py b/saas/blueapps/template/context_processors.py index 87d5ca6e3..fb89a1d56 100644 --- a/saas/blueapps/template/context_processors.py +++ b/saas/blueapps/template/context_processors.py @@ -1,4 +1,5 @@ # coding=utf-8 +from __future__ import absolute_import """ TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. @@ -8,8 +9,6 @@ an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. """ -from __future__ import absolute_import - import json import logging import datetime diff --git a/saas/build/app.yml b/saas/build/app.yml index e990f17e4..1919163c4 100644 --- a/saas/build/app.yml +++ b/saas/build/app.yml @@ -7,7 +7,7 @@ date: '2020-04-16 12:00:00' desktop: height: 720 is_max: true - width: 1200 + width: 1280 introduction: 权限中心是蓝鲸智云提供的集中权限管理服务，用于蓝鲸体系内各平台和SaaS的权限集中接入，以及提供细化到具体资源实例的资源访问权限控制。 introduction_en: IAM（Identity and Access Management） is centralized authority management services provided by Blueking，which is used for centralized access of various Platforms and SaaS within the BlueKing System, and provides access control for resources that are refined to specific resource instance. is_use_celery: true @@ -15,4 +15,4 @@ env: - key: BKAPP_CONTAINER_MEM value: 2048 language: python -version: xx.xx.xx +version: __APP_VERSION__ diff --git a/saas/build/v3/Aptfile b/saas/build/v3/Aptfile new file mode 100644 index 000000000..8c719489a --- /dev/null +++ b/saas/build/v3/Aptfile @@ -0,0 +1,2 @@ +libssl-dev +default-libmysqlclient-dev diff --git a/saas/build/v3/app_desc.yaml b/saas/build/v3/app_desc.yaml new file mode 100644 index 000000000..cd1a512bb --- /dev/null +++ b/saas/build/v3/app_desc.yaml @@ -0,0 +1,42 @@ +spec_version: 2 +app_version: "__APP_VERSION__" +app: + region: default + bk_app_code: "bk_iam" + bk_app_name: 权限中心 + market: + category: 运维工具 + introduction: 权限中心是蓝鲸智云提供的集中权限管理服务用于蓝鲸体系内各平台和SaaS的权限集中接入以及提供细化到具体资源实例的资源访问权限控制。 + description: 权限中心是蓝鲸智云提供的集中权限管理服务用于蓝鲸体系内各平台和SaaS的权限集中接入以及提供细化到具体资源实例的资源访问权限控制。 + display_options: + width: 1280 + height: 720 + is_win_maximize: True +modules: + default: + is_default: True + source_dir: ./src/ + language: Python + services: + - name: mysql + - name: rabbitmq + - name: redis + env_variables: + - key: DISABLE_COLLECTSTATIC + value: 1 + processes: + web: + command: bash bin/start.sh + plan: 4C2G5R + replicas: 2 + celery: + command: bash bin/start_celery.sh + plan: 4C2G5R + replicas: 2 + beat: + command: bash bin/start_beat.sh + replicas: 1 + svc_discovery: + bk_saas: + - 'bk_iam' + - 'bk_itsm' diff --git a/saas/build/v3/bin/post_compile b/saas/build/v3/bin/post_compile new file mode 100644 index 000000000..965ffd190 --- /dev/null +++ b/saas/build/v3/bin/post_compile @@ -0,0 +1,2 @@ +#!/bin/bash +python manage.py migrate --no-input diff --git a/saas/build/v3/bin/start.sh b/saas/build/v3/bin/start.sh new file mode 100644 index 000000000..a19c6e079 --- /dev/null +++ b/saas/build/v3/bin/start.sh @@ -0,0 +1,2 @@ +#!/bin/bash +gunicorn wsgi -w 10 -k gevent -b :5000 --access-logfile - --error-logfile - --access-logformat '[%(h)s] %({request_id}i)s %(u)s %(t)s "%(r)s" %(s)s %(D)s %(b)s "%(f)s" "%(a)s"' --env prometheus_multiproc_dir=/tmp/ diff --git a/saas/build/v3/bin/start_beat.sh b/saas/build/v3/bin/start_beat.sh new file mode 100644 index 000000000..fbdba0ee9 --- /dev/null +++ b/saas/build/v3/bin/start_beat.sh @@ -0,0 +1,2 @@ +#!/bin/bash +python manage.py celery beat -l info diff --git a/saas/build/v3/bin/start_celery.sh b/saas/build/v3/bin/start_celery.sh new file mode 100644 index 000000000..1d6466bc1 --- /dev/null +++ b/saas/build/v3/bin/start_celery.sh @@ -0,0 +1,2 @@ +#!/bin/bash +python manage.py celery worker -l info diff --git a/saas/build/v3/requirements.txt b/saas/build/v3/requirements.txt new file mode 100644 index 000000000..9fef38c46 --- /dev/null +++ b/saas/build/v3/requirements.txt @@ -0,0 +1,6 @@ +# for deploy on paas v3 +gunicorn==19.6.0 +gevent==20.9.0 + +# for sentry +raven==6.5.0 diff --git a/saas/config/__init__.py b/saas/config/__init__.py index 5ff2c075a..fb305b3cb 100644 --- a/saas/config/__init__.py +++ b/saas/config/__init__.py @@ -1,4 +1,6 @@ # -*- coding: utf-8 -*- +from __future__ import absolute_import + """ TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available. Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved. @@ -8,8 +10,6 @@ an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. """ -from __future__ import absolute_import - __all__ = ["celery_app", "RUN_VER", "APP_CODE", "SECRET_KEY", "BK_URL", "BASE_DIR"] import os diff --git a/saas/config/default.py b/saas/config/default.py index 732af6937..94eed2162 100644 --- a/saas/config/default.py +++ b/saas/config/default.py @@ -264,9 +264,6 @@ STATIC_URL = SITE_URL + "staticfiles/" AJAX_URL_PREFIX = SITE_URL + "api/v1" -# iam host -BK_IAM_HOST = os.environ.get("BK_IAM_V3_INNER_HOST", "http://bkiam.service.consul:9081") - # cors CORS_ALLOW_CREDENTIALS = True # 在 response 添加 Access-Control-Allow-Credentials, 即允许跨域使用 cookies CORS_ORIGIN_WHITELIST = [] # 默认只支持同域名请求 diff --git a/saas/config/prod.py b/saas/config/prod.py index d9128e626..2423bccdd 100644 --- a/saas/config/prod.py +++ b/saas/config/prod.py @@ -34,36 +34,99 @@ # import logging # logging.getLogger('app').setLevel('INFO') -# 正式环境数据库可以在这里配置 - -DATABASES.update( - { - "default": { - "ENGINE": "django.db.backends.mysql", - "NAME": os.environ.get("DB_NAME"), - "USER": os.environ.get("DB_USERNAME"), - "PASSWORD": os.environ.get("DB_PASSWORD"), - "HOST": os.environ.get("DB_HOST"), - "PORT": os.environ.get("DB_PORT"), - }, - "audit": { - "ENGINE": "django.db.backends.mysql", - "NAME": os.environ.get("AUDIT_DB_NAME") or os.environ.get("DB_NAME"), - "USER": os.environ.get("AUDIT_DB_USERNAME") or os.environ.get("DB_USERNAME"), - "PASSWORD": os.environ.get("AUDIT_DB_PASSWORD") or os.environ.get("DB_PASSWORD"), - "HOST": os.environ.get("AUDIT_DB_HOST") or os.environ.get("DB_HOST"), - "PORT": os.environ.get("AUDIT_DB_PORT") or os.environ.get("DB_PORT"), - }, - } -) +# V3 Smart 配置 +if "BKPAAS_ENVIRONMENT" in os.environ: + import base64 + import json + + def get_app_service_url(app_code: str) -> str: + value = os.environ["BKPAAS_SERVICE_ADDRESSES_BKSAAS"] + decoded_value = json.loads(base64.b64decode(value).decode("utf-8")) + return decoded_value[app_code] + + # 兼容component的APP_ID,APP_TOKEN + APP_CODE = APP_ID = os.environ.get("BKPAAS_APP_ID", APP_CODE) + SECRET_KEY = APP_TOKEN = os.environ.get("BKPAAS_APP_SECRET", SECRET_KEY) + BK_PAAS_INNER_HOST = os.environ.get("BK_PAAS2_INNER_URL", BK_PAAS_INNER_HOST) + + # 正式环境数据库可以在这里配置 + DATABASES.update( # 需要兼容V3环境变量 + { + "default": { + "ENGINE": "django.db.backends.mysql", + "NAME": os.environ.get("MYSQL_NAME"), + "USER": os.environ.get("MYSQL_USER"), + "PASSWORD": os.environ.get("MYSQL_PASSWORD"), + "HOST": os.environ.get("MYSQL_HOST"), + "PORT": os.environ.get("MYSQL_PORT"), + }, + "audit": { + "ENGINE": "django.db.backends.mysql", + "NAME": os.environ.get("AUDIT_DB_NAME") or os.environ.get("MYSQL_NAME"), + "USER": os.environ.get("AUDIT_DB_USERNAME") or os.environ.get("MYSQL_USER"), + "PASSWORD": os.environ.get("AUDIT_DB_PASSWORD") or os.environ.get("MYSQL_PASSWORD"), + "HOST": os.environ.get("AUDIT_DB_HOST") or os.environ.get("MYSQL_HOST"), + "PORT": os.environ.get("AUDIT_DB_PORT") or os.environ.get("MYSQL_PORT"), + }, + } + ) + + # for vue + LOGIN_SERVICE_URL = os.environ.get("BK_LOGIN_URL") + LOGIN_SERVICE_PLAIN_URL = LOGIN_SERVICE_URL + "plain/" + APP_URL = get_app_service_url(APP_CODE) + APP_API_URL = APP_URL -# for vue -LOGIN_SERVICE_URL = BK_PAAS_HOST.rstrip("/") + "/login/" -LOGIN_SERVICE_PLAIN_URL = LOGIN_SERVICE_URL + "plain/" -APP_URL = BK_PAAS_HOST.rstrip("/") + "/o/" + APP_CODE -APP_API_URL = BK_PAAS_INNER_HOST.rstrip("/") + "/o/" + APP_CODE + # cache + REDIS_HOST = os.environ.get("REDIS_HOST") + REDIS_PORT = os.environ.get("REDIS_PORT") + REDIS_PASSWORD = os.environ.get("REDIS_PASSWORD") + REDIS_DB = os.environ.get("REDIS_DB", 0) -BK_PAAS_HOST_PARSE_URL = urlparse(BK_PAAS_HOST) + # itsm saas url + BK_ITSM_APP_URL = get_app_service_url("bk_itsm") + +# V2 Smart 配置 +else: + # 正式环境数据库可以在这里配置 + DATABASES.update( + { + "default": { + "ENGINE": "django.db.backends.mysql", + "NAME": os.environ.get("DB_NAME"), + "USER": os.environ.get("DB_USERNAME"), + "PASSWORD": os.environ.get("DB_PASSWORD"), + "HOST": os.environ.get("DB_HOST"), + "PORT": os.environ.get("DB_PORT"), + }, + "audit": { + "ENGINE": "django.db.backends.mysql", + "NAME": os.environ.get("AUDIT_DB_NAME") or os.environ.get("DB_NAME"), + "USER": os.environ.get("AUDIT_DB_USERNAME") or os.environ.get("DB_USERNAME"), + "PASSWORD": os.environ.get("AUDIT_DB_PASSWORD") or os.environ.get("DB_PASSWORD"), + "HOST": os.environ.get("AUDIT_DB_HOST") or os.environ.get("DB_HOST"), + "PORT": os.environ.get("AUDIT_DB_PORT") or os.environ.get("DB_PORT"), + }, + } + ) + + # for vue + LOGIN_SERVICE_URL = BK_PAAS_HOST.rstrip("/") + "/login/" + LOGIN_SERVICE_PLAIN_URL = LOGIN_SERVICE_URL + "plain/" + APP_URL = BK_PAAS_HOST.rstrip("/") + "/o/" + APP_CODE + APP_API_URL = BK_PAAS_INNER_HOST.rstrip("/") + "/o/" + APP_CODE + + # cache + REDIS_HOST = os.environ.get("BKAPP_REDIS_HOST") + REDIS_PORT = os.environ.get("BKAPP_REDIS_PORT") + REDIS_PASSWORD = os.environ.get("BKAPP_REDIS_PASSWORD") + REDIS_DB = os.environ.get("BKAPP_REDIS_DB", 0) + + # itsm saas url + BK_ITSM_APP_URL = BK_PAAS_HOST.rstrip("/") + "/o/bk_itsm" + + +BK_PAAS_HOST_PARSE_URL = urlparse(APP_URL) _BK_PAAS_HOSTNAME = BK_PAAS_HOST_PARSE_URL.hostname # 去除端口的域名 _BK_PAAS_NETLOC = BK_PAAS_HOST_PARSE_URL.netloc # 若有端口，则会带上对应端口 _BK_PAAS_IS_SPECIAL_PORT = BK_PAAS_HOST_PARSE_URL.port in [None, 80, 443] @@ -81,12 +144,6 @@ else [f"{_BK_PAAS_SCHEME}://{_BK_PAAS_NETLOC}"] ) -# cache -REDIS_HOST = os.environ.get("BKAPP_REDIS_HOST") -REDIS_PORT = os.environ.get("BKAPP_REDIS_PORT") -REDIS_PASSWORD = os.environ.get("BKAPP_REDIS_PASSWORD") -REDIS_DB = os.environ.get("BKAPP_REDIS_DB", 0) - CACHE_REDIS_URL = f"redis://{REDIS_HOST}:{REDIS_PORT}/{REDIS_DB}" CACHES = { @@ -102,4 +159,5 @@ } } -BK_ITSM_APP_URL = BK_PAAS_HOST.rstrip("/") + "/o/bk_itsm" +# iam backend host +BK_IAM_HOST = os.environ.get("BK_IAM_V3_INNER_HOST", "http://bkiam.service.consul:9081") diff --git a/saas/poetry.lock b/saas/poetry.lock index 04927eee6..6c030a41e 100644 --- a/saas/poetry.lock +++ b/saas/poetry.lock @@ -525,11 +525,11 @@ MarkupSafe = ">=0.9.2" [[package]] name = "markupsafe" -version = "1.0" -description = "Implements a XML/HTML/XHTML Markup safe string for Python" +version = "1.1.1" +description = "Safely add untrusted strings to HTML/XML markup." category = "main" optional = false -python-versions = "*" +python-versions = ">=2.7,!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*" [[package]] name = "mccabe" @@ -985,7 +985,7 @@ testing = ["pytest (>=4.6)", "pytest-checkdocs (>=2.4)", "pytest-flake8", "pytes [metadata] lock-version = "1.1" python-versions = "3.6.6" -content-hash = "7dd28a7b16f57e8c5bac7c55c6da9e80dff95cf8d43233676f7539a6903441ae" +content-hash = "c0283eb3661c85d1346d9ded6f59786ddb7b986292cfaaa6a2bacc741799dd91" [metadata.files] aenum = [ @@ -1230,7 +1230,58 @@ mako = [ {file = "Mako-1.0.6.tar.gz", hash = "sha256:48559ebd872a8e77f92005884b3d88ffae552812cdf17db6768e5c3be5ebbe0d"}, ] markupsafe = [ - {file = "MarkupSafe-1.0.tar.gz", hash = "sha256:a6be69091dac236ea9c6bc7d012beab42010fa914c459791d627dad4910eb665"}, + {file = "MarkupSafe-1.1.1-cp27-cp27m-macosx_10_6_intel.whl", hash = "sha256:09027a7803a62ca78792ad89403b1b7a73a01c8cb65909cd876f7fcebd79b161"}, + {file = "MarkupSafe-1.1.1-cp27-cp27m-manylinux1_i686.whl", hash = "sha256:e249096428b3ae81b08327a63a485ad0878de3fb939049038579ac0ef61e17e7"}, + {file = "MarkupSafe-1.1.1-cp27-cp27m-manylinux1_x86_64.whl", hash = "sha256:500d4957e52ddc3351cabf489e79c91c17f6e0899158447047588650b5e69183"}, + {file = "MarkupSafe-1.1.1-cp27-cp27m-win32.whl", hash = "sha256:b2051432115498d3562c084a49bba65d97cf251f5a331c64a12ee7e04dacc51b"}, + {file = "MarkupSafe-1.1.1-cp27-cp27m-win_amd64.whl", hash = "sha256:98c7086708b163d425c67c7a91bad6e466bb99d797aa64f965e9d25c12111a5e"}, + {file = "MarkupSafe-1.1.1-cp27-cp27mu-manylinux1_i686.whl", hash = "sha256:cd5df75523866410809ca100dc9681e301e3c27567cf498077e8551b6d20e42f"}, + {file = "MarkupSafe-1.1.1-cp27-cp27mu-manylinux1_x86_64.whl", hash = "sha256:43a55c2930bbc139570ac2452adf3d70cdbb3cfe5912c71cdce1c2c6bbd9c5d1"}, + {file = "MarkupSafe-1.1.1-cp34-cp34m-macosx_10_6_intel.whl", hash = "sha256:1027c282dad077d0bae18be6794e6b6b8c91d58ed8a8d89a89d59693b9131db5"}, + {file = "MarkupSafe-1.1.1-cp34-cp34m-manylinux1_i686.whl", hash = "sha256:62fe6c95e3ec8a7fad637b7f3d372c15ec1caa01ab47926cfdf7a75b40e0eac1"}, + {file = "MarkupSafe-1.1.1-cp34-cp34m-manylinux1_x86_64.whl", hash = "sha256:88e5fcfb52ee7b911e8bb6d6aa2fd21fbecc674eadd44118a9cc3863f938e735"}, + {file = "MarkupSafe-1.1.1-cp34-cp34m-win32.whl", hash = "sha256:ade5e387d2ad0d7ebf59146cc00c8044acbd863725f887353a10df825fc8ae21"}, + {file = "MarkupSafe-1.1.1-cp34-cp34m-win_amd64.whl", hash = "sha256:09c4b7f37d6c648cb13f9230d847adf22f8171b1ccc4d5682398e77f40309235"}, + {file = "MarkupSafe-1.1.1-cp35-cp35m-macosx_10_6_intel.whl", hash = "sha256:79855e1c5b8da654cf486b830bd42c06e8780cea587384cf6545b7d9ac013a0b"}, + {file = "MarkupSafe-1.1.1-cp35-cp35m-manylinux1_i686.whl", hash = "sha256:c8716a48d94b06bb3b2524c2b77e055fb313aeb4ea620c8dd03a105574ba704f"}, + {file = "MarkupSafe-1.1.1-cp35-cp35m-manylinux1_x86_64.whl", hash = "sha256:7c1699dfe0cf8ff607dbdcc1e9b9af1755371f92a68f706051cc8c37d447c905"}, + {file = "MarkupSafe-1.1.1-cp35-cp35m-win32.whl", hash = "sha256:6dd73240d2af64df90aa7c4e7481e23825ea70af4b4922f8ede5b9e35f78a3b1"}, + {file = "MarkupSafe-1.1.1-cp35-cp35m-win_amd64.whl", hash = "sha256:9add70b36c5666a2ed02b43b335fe19002ee5235efd4b8a89bfcf9005bebac0d"}, + {file = "MarkupSafe-1.1.1-cp36-cp36m-macosx_10_6_intel.whl", hash = "sha256:24982cc2533820871eba85ba648cd53d8623687ff11cbb805be4ff7b4c971aff"}, + {file = "MarkupSafe-1.1.1-cp36-cp36m-macosx_10_9_x86_64.whl", hash = "sha256:d53bc011414228441014aa71dbec320c66468c1030aae3a6e29778a3382d96e5"}, + {file = "MarkupSafe-1.1.1-cp36-cp36m-manylinux1_i686.whl", hash = "sha256:00bc623926325b26bb9605ae9eae8a215691f33cae5df11ca5424f06f2d1f473"}, + {file = "MarkupSafe-1.1.1-cp36-cp36m-manylinux1_x86_64.whl", hash = "sha256:717ba8fe3ae9cc0006d7c451f0bb265ee07739daf76355d06366154ee68d221e"}, + {file = "MarkupSafe-1.1.1-cp36-cp36m-manylinux2010_i686.whl", hash = "sha256:3b8a6499709d29c2e2399569d96719a1b21dcd94410a586a18526b143ec8470f"}, + {file = "MarkupSafe-1.1.1-cp36-cp36m-manylinux2010_x86_64.whl", hash = "sha256:84dee80c15f1b560d55bcfe6d47b27d070b4681c699c572af2e3c7cc90a3b8e0"}, + {file = "MarkupSafe-1.1.1-cp36-cp36m-manylinux2014_aarch64.whl", hash = "sha256:b1dba4527182c95a0db8b6060cc98ac49b9e2f5e64320e2b56e47cb2831978c7"}, + {file = "MarkupSafe-1.1.1-cp36-cp36m-win32.whl", hash = "sha256:535f6fc4d397c1563d08b88e485c3496cf5784e927af890fb3c3aac7f933ec66"}, + {file = "MarkupSafe-1.1.1-cp36-cp36m-win_amd64.whl", hash = "sha256:b1282f8c00509d99fef04d8ba936b156d419be841854fe901d8ae224c59f0be5"}, + {file = "MarkupSafe-1.1.1-cp37-cp37m-macosx_10_6_intel.whl", hash = "sha256:8defac2f2ccd6805ebf65f5eeb132adcf2ab57aa11fdf4c0dd5169a004710e7d"}, + {file = "MarkupSafe-1.1.1-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:bf5aa3cbcfdf57fa2ee9cd1822c862ef23037f5c832ad09cfea57fa846dec193"}, + {file = "MarkupSafe-1.1.1-cp37-cp37m-manylinux1_i686.whl", hash = "sha256:46c99d2de99945ec5cb54f23c8cd5689f6d7177305ebff350a58ce5f8de1669e"}, + {file = "MarkupSafe-1.1.1-cp37-cp37m-manylinux1_x86_64.whl", hash = "sha256:ba59edeaa2fc6114428f1637ffff42da1e311e29382d81b339c1817d37ec93c6"}, + {file = "MarkupSafe-1.1.1-cp37-cp37m-manylinux2010_i686.whl", hash = "sha256:6fffc775d90dcc9aed1b89219549b329a9250d918fd0b8fa8d93d154918422e1"}, + {file = "MarkupSafe-1.1.1-cp37-cp37m-manylinux2010_x86_64.whl", hash = "sha256:a6a744282b7718a2a62d2ed9d993cad6f5f585605ad352c11de459f4108df0a1"}, + {file = "MarkupSafe-1.1.1-cp37-cp37m-manylinux2014_aarch64.whl", hash = "sha256:195d7d2c4fbb0ee8139a6cf67194f3973a6b3042d742ebe0a9ed36d8b6f0c07f"}, + {file = "MarkupSafe-1.1.1-cp37-cp37m-win32.whl", hash = "sha256:b00c1de48212e4cc9603895652c5c410df699856a2853135b3967591e4beebc2"}, + {file = "MarkupSafe-1.1.1-cp37-cp37m-win_amd64.whl", hash = "sha256:9bf40443012702a1d2070043cb6291650a0841ece432556f784f004937f0f32c"}, + {file = "MarkupSafe-1.1.1-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:6788b695d50a51edb699cb55e35487e430fa21f1ed838122d722e0ff0ac5ba15"}, + {file = "MarkupSafe-1.1.1-cp38-cp38-manylinux1_i686.whl", hash = "sha256:cdb132fc825c38e1aeec2c8aa9338310d29d337bebbd7baa06889d09a60a1fa2"}, + {file = "MarkupSafe-1.1.1-cp38-cp38-manylinux1_x86_64.whl", hash = "sha256:13d3144e1e340870b25e7b10b98d779608c02016d5184cfb9927a9f10c689f42"}, + {file = "MarkupSafe-1.1.1-cp38-cp38-manylinux2010_i686.whl", hash = "sha256:acf08ac40292838b3cbbb06cfe9b2cb9ec78fce8baca31ddb87aaac2e2dc3bc2"}, + {file = "MarkupSafe-1.1.1-cp38-cp38-manylinux2010_x86_64.whl", hash = "sha256:d9be0ba6c527163cbed5e0857c451fcd092ce83947944d6c14bc95441203f032"}, + {file = "MarkupSafe-1.1.1-cp38-cp38-manylinux2014_aarch64.whl", hash = "sha256:caabedc8323f1e93231b52fc32bdcde6db817623d33e100708d9a68e1f53b26b"}, + {file = "MarkupSafe-1.1.1-cp38-cp38-win32.whl", hash = "sha256:596510de112c685489095da617b5bcbbac7dd6384aeebeda4df6025d0256a81b"}, + {file = "MarkupSafe-1.1.1-cp38-cp38-win_amd64.whl", hash = "sha256:e8313f01ba26fbbe36c7be1966a7b7424942f670f38e666995b88d012765b9be"}, + {file = "MarkupSafe-1.1.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:d73a845f227b0bfe8a7455ee623525ee656a9e2e749e4742706d80a6065d5e2c"}, + {file = "MarkupSafe-1.1.1-cp39-cp39-manylinux1_i686.whl", hash = "sha256:98bae9582248d6cf62321dcb52aaf5d9adf0bad3b40582925ef7c7f0ed85fceb"}, + {file = "MarkupSafe-1.1.1-cp39-cp39-manylinux1_x86_64.whl", hash = "sha256:2beec1e0de6924ea551859edb9e7679da6e4870d32cb766240ce17e0a0ba2014"}, + {file = "MarkupSafe-1.1.1-cp39-cp39-manylinux2010_i686.whl", hash = "sha256:7fed13866cf14bba33e7176717346713881f56d9d2bcebab207f7a036f41b850"}, + {file = "MarkupSafe-1.1.1-cp39-cp39-manylinux2010_x86_64.whl", hash = "sha256:6f1e273a344928347c1290119b493a1f0303c52f5a5eae5f16d74f48c15d4a85"}, + {file = "MarkupSafe-1.1.1-cp39-cp39-manylinux2014_aarch64.whl", hash = "sha256:feb7b34d6325451ef96bc0e36e1a6c0c1c64bc1fbec4b854f4529e51887b1621"}, + {file = "MarkupSafe-1.1.1-cp39-cp39-win32.whl", hash = "sha256:22c178a091fc6630d0d045bdb5992d2dfe14e3259760e713c490da5323866c39"}, + {file = "MarkupSafe-1.1.1-cp39-cp39-win_amd64.whl", hash = "sha256:b7d644ddb4dbd407d31ffb699f1d140bc35478da613b441c582aeb7c43838dd8"}, + {file = "MarkupSafe-1.1.1.tar.gz", hash = "sha256:29872e92839765e546828bb7754a68c418d927cd064fd4708fab9fe9c8bb116b"}, ] mccabe = [ {file = "mccabe-0.6.1-py2.py3-none-any.whl", hash = "sha256:ab8a6258860da4b6677da4bd2fe5dc2c659cff31b3ee4f7f5d64e79735b80d42"}, diff --git a/saas/pyproject.toml b/saas/pyproject.toml index 453ca9f5b..e696e8682 100644 --- a/saas/pyproject.toml +++ b/saas/pyproject.toml @@ -71,7 +71,7 @@ python = "3.6.6" # blueapps requirement Django = "2.2.24" mysqlclient = "2.0.1" -MarkupSafe = "1.0" +MarkupSafe = "1.1.1" Mako = "1.0.6" requests = "2.26.0" celery = "3.1.25" diff --git a/saas/requirements.txt b/saas/requirements.txt index 65a5c1ec7..7116f4d78 100644 --- a/saas/requirements.txt +++ b/saas/requirements.txt @@ -29,7 +29,7 @@ itypes==1.2.0; python_version >= "2.7" and python_full_version < "3.0.0" or pyth jinja2==2.11.3; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" kombu==3.0.37 mako==1.0.6 -markupsafe==1.0 +markupsafe==1.1.1; (python_version >= "2.7" and python_full_version < "3.0.0") or (python_full_version >= "3.4.0") mysqlclient==2.0.1; python_version >= "3.5" packaging==21.0; python_version >= "3.6" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" and python_version >= "3.6" prometheus-client==0.11.0; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.4.0" diff --git a/saas/requirements_dev.txt b/saas/requirements_dev.txt index eaf8a88e4..f816e7341 100644 --- a/saas/requirements_dev.txt +++ b/saas/requirements_dev.txt @@ -42,7 +42,7 @@ itypes==1.2.0; python_version >= "2.7" and python_full_version < "3.0.0" or pyth jinja2==2.11.3; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" kombu==3.0.37 mako==1.0.6 -markupsafe==1.0 +markupsafe==1.1.1; (python_version >= "2.7" and python_full_version < "3.0.0") or (python_full_version >= "3.4.0") mccabe==0.6.1; python_version >= "2.7" and python_full_version < "3.0.0" or python_full_version >= "3.5.0" mock==1.0.1 mypy-extensions==0.4.3; python_full_version >= "3.6.2" and python_version >= "3.5" diff --git a/saas/urls.py b/saas/urls.py index 863f81386..2cb9c5a99 100644 --- a/saas/urls.py +++ b/saas/urls.py @@ -8,8 +8,6 @@ an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. """ -import os - from django.conf import settings from django.conf.urls import include, url from django.views.decorators.cache import never_cache @@ -74,10 +72,8 @@ url(r"^swagger/$", schema_view.with_ui("swagger", cache_timeout=0), name="schema-swagger-ui"), ] -# 非前后端独立部署的，则需要静态文件输出 -if os.getenv("BKPAAS_ENVIRONMENT") is None: - # static file - urlpatterns += [ - url(r"^login_success/", never_cache(LoginSuccessView.as_view())), - url(r"^.*$", never_cache(VueTemplateView.as_view())), - ] +# static file +urlpatterns += [ + url(r"^login_success/", never_cache(LoginSuccessView.as_view())), + url(r"^.*$", never_cache(VueTemplateView.as_view())), +] From cc5aa924bdc6a85e0d612f77c912f9a6d9ef7ffc Mon Sep 17 00:00:00 2001 From: ielgnaw Date: Tue, 24 Aug 2021 15:46:06 +0800 Subject: [PATCH 15/33] =?UTF-8?q?update:=20=E7=94=B3=E8=AF=B7=E8=87=AA?= =?UTF-8?q?=E5=AE=9A=E4=B9=89=E6=9D=83=E9=99=90=E5=8F=82=E6=95=B0=E7=94=B1?= =?UTF-8?q?=20tid=20=E6=94=B9=E4=B8=BA=20cache=5Fid=20(#75)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../perm-apply/apply-custom-perm/index.vue | 28 +++++++++++-------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/frontend/src/views/perm-apply/apply-custom-perm/index.vue b/frontend/src/views/perm-apply/apply-custom-perm/index.vue index 8307c3050..6e5f22707 100644 --- a/frontend/src/views/perm-apply/apply-custom-perm/index.vue +++ b/frontend/src/views/perm-apply/apply-custom-perm/index.vue @@ -536,6 +536,8 @@ checkRadio: 'userGroup', tableLoading: false, gradeMembers: [], + + // route.query 里的 tid 参数改变名字为 cache_id sysAndtid: false, routerValue: {}, newTableList: [] @@ -550,7 +552,7 @@ }, // 无权限组时 isNoPermissionsSet () { - return this.routerQuery.tid + return this.routerQuery.cache_id }, isShowGroupAction () { return (item) => { @@ -590,17 +592,17 @@ watch: { '$route': { handler (value) { - if (value.query.system_id && value.query.tid) { - const { system_id, tid } = value.query + if (value.query.system_id && value.query.cache_id) { + const { system_id, cache_id } = value.query this.routerQuery = Object.assign({}, { system_id, - tid + cache_id }) this.sysAndtid = true } else { this.routerQuery = Object.assign({}, { system_id: '', - tid: '' + cache_id: '' }) } }, @@ -650,7 +652,7 @@ async fetchUserGroupList () { this.tableLoading = true const params = { - tid: this.routerQuery.tid + cache_id: this.routerQuery.cache_id } try { const res = await this.$store.dispatch('userGroup/getUserGroupList', params) @@ -1775,14 +1777,18 @@ const params = { system_id: systemId } - if (this.routerQuery.tid) { - params.tid = this.routerQuery.tid + if (this.routerQuery.cache_id) { + params.cache_id = this.routerQuery.cache_id } try { const res = await this.$store.dispatch('permApply/getPolicies', params) const data = res.data.map(item => { const relatedActions = this.linearActionList.find(sub => sub.id === item.id).related_actions - return new Policy({ ...item, related_actions: relatedActions, tid: this.routerQuery.tid ? this.routerQuery.tid : '' }) + return new Policy({ + ...item, + related_actions: relatedActions, + tid: this.routerQuery.cache_id ? this.routerQuery.cache_id : '' + }) }) this.tableData = data this.tableData.forEach(item => { @@ -1825,8 +1831,8 @@ system_id: systemId, user_id: this.user.username } - if (this.routerQuery.tid) { - params.tid = this.routerQuery.tid + if (this.routerQuery.cache_id) { + params.cache_id = this.routerQuery.cache_id } try { const res = await this.$store.dispatch('permApply/getActions', params) From 384ce9f933361ab864ffea5603aaf2d9bfc74a9b Mon Sep 17 00:00:00 2001 From: ielgnaw Date: Fri, 27 Aug 2021 16:28:35 +0800 Subject: [PATCH 16/33] feat: merge prev version (#84) * feat: merge prev version --- frontend/.husky/commit-msg | 4 + frontend/commitlint.config.js | 59 ++++ frontend/package.json | 26 +- frontend/src/components/choose-ip/grade.vue | 10 +- .../src/components/choose-ip/grade/index.vue | 31 ++- frontend/src/components/choose-ip/index.vue | 10 +- .../src/components/choose-ip/view/index.vue | 2 +- .../iam-search-select/search-select/index.vue | 4 +- frontend/src/language/lang/en.js | 14 +- frontend/src/language/lang/zh.js | 37 ++- frontend/src/model/compare-condition.js | 35 +-- frontend/src/store/index.js | 10 +- frontend/src/store/modules/access.js | 18 +- .../components/render-resource.vue | 3 +- .../src/views/grading-admin/create/index.vue | 84 +++--- .../views/group/components/iam-add-member.vue | 6 +- .../components/render-instance-table.vue | 6 +- .../group/components/render-resource.vue | 4 +- frontend/src/views/group/create/index.vue | 1 + .../src/views/group/detail/group-perm-new.vue | 31 ++- .../apply-join-user-group/index.vue | 1 + .../perm-apply/components/render-resource.vue | 3 +- .../components/render-content.vue | 17 +- .../components/render-resource.vue | 3 +- .../views/system-access/access/basic-info.vue | 38 ++- .../src/views/system-access/access/index.vue | 33 ++- .../system-access/common/before-stepchange.js | 62 +++++ .../views/system-access/complete/index.vue | 28 +- frontend/src/views/system-access/index.vue | 7 +- .../optimize/add-common-dialog.vue | 4 +- .../views/system-access/optimize/index.vue | 18 +- .../system-access/registry/basic-info.vue | 44 ++- .../views/system-access/registry/index.css | 24 +- .../views/system-access/registry/index.vue | 262 ++++++++++++++---- .../instance-selection-sideslider.vue | 85 ++++-- .../registry/resource-type-sideslider.vue | 84 ++++-- 36 files changed, 858 insertions(+), 250 deletions(-) create mode 100755 frontend/.husky/commit-msg create mode 100644 frontend/commitlint.config.js create mode 100644 frontend/src/views/system-access/common/before-stepchange.js diff --git a/frontend/.husky/commit-msg b/frontend/.husky/commit-msg new file mode 100755 index 000000000..5c49f2632 --- /dev/null +++ b/frontend/.husky/commit-msg @@ -0,0 +1,4 @@ +#!/bin/sh +. "$(dirname "$0")/_/husky.sh" + +cd frontend && npx --no-install commitlint --edit "$1" diff --git a/frontend/commitlint.config.js b/frontend/commitlint.config.js new file mode 100644 index 000000000..0917ed561 --- /dev/null +++ b/frontend/commitlint.config.js @@ -0,0 +1,59 @@ +/* + * Tencent is pleased to support the open source community by making + * 蓝鲸智云-权限中心(BlueKing-IAM) available. + * + * Copyright (C) 2021 THL A29 Limited, a Tencent company. All rights reserved. + * + * 蓝鲸智云-权限中心(BlueKing-IAM) is licensed under the MIT License. + * + * License for 蓝鲸智云-权限中心(BlueKing-IAM): + * + * --------------------------------------------------- + * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated + * documentation files (the "Software"), to deal in the Software without restriction, including without limitation + * the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and + * to permit persons to whom the Software is furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice shall be included in all copies or substantial portions of + * the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO + * THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF + * CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS + * IN THE SOFTWARE. +*/ + +module.exports = { + // commit message 格式 + // type(scope?): subject + // example: + // docs(input,radio): 输入框和单选框文档更新 + // Common types: [build,ci,chore,docs,feat,fix,perf,refactor,revert,style,test] + extends: ['@commitlint/config-conventional'], + // Available rules: https://commitlint.js.org/#/reference-rules + // Level [0, 1, 2]: 0 disables the rule. For 1 it will be considered a warning for 2 an error. + // Applicable [always,never]: never inverts the rule. + // Value: value to use for this rule. + rules: { + // scope 建议写上修改内容涉及的组件，不写 scope 会抛出警告 + 'scope-empty': [1, 'never'], + 'type-enum': [ + 2, + 'always', + [ + 'feat', // 新增功能 + 'fix', // bug 修复 + 'docs', // 文档示例(documentation) + 'style', // 不影响代码含义的更改(空格、格式、缺少分号等) + 'refactor', // 重构代码(既没有新增功能，也没有修复 bug) + 'perf', // 性能优化 + 'test', // 新增测试用例或是更新现有测试 + 'chore' // 不属于以上类型的其他类型 + ] + ], + 'subject-case': [ + 0 + ] + } +} diff --git a/frontend/package.json b/frontend/package.json index ffb9b47c0..498946f59 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -19,7 +19,10 @@ "server": "babel-node build/paas-server.js", "add-license": "babel-node build/add-license", "lint": "eslint ./src ./build --ext .js,.ts,.tsx,.vue", - "lint:fix": "eslint --fix ./src ./build --ext .js,.ts,.tsx,.vue" + "lint:fix": "eslint --fix ./src ./build --ext .js,.ts,.tsx,.vue", + "postinstall1": "cd ../ && husky install && npx husky add .husky/commit-msg 'npx --no-install commitlint --edit \"$1\"'", + "prepare1": "cd .. && husky install frontend/.husky", + "postinstall": "cd .. && husky install frontend/.husky && cd frontend && npx husky add .husky/commit-msg 'npx --no-install commitlint --edit \"$1\"'" }, "keywords": [], "license": "ISC", @@ -84,22 +87,24 @@ "@babel/register": "~7.4.4", "@babel/runtime": "~7.4.5", "@blueking/user-selector": "1.0.6", - "babel-plugin-import-bk-magic-vue": "latest", + "@commitlint/cli": "~13.1.0", + "@commitlint/config-conventional": "~13.1.0", "@icon-cool/bk-icon-bk-iam": "^0.0.2", - "bk-magic-vue": "2.3.3", "@vue/babel-sugar-v-on": "^1.1.2", "acorn": "~6.4.2", "art-template": "^4.13.2", - "axios": "~0.18.0", + "axios": "~0.21.1", "babel-core": "^7.0.0-bridge.0", "babel-eslint": "~10.0.1", "babel-helper-vue-jsx-merge-props": "^2.0.3", "babel-loader": "~8.0.6", + "babel-plugin-import-bk-magic-vue": "latest", "babel-plugin-istanbul": "~5.1.4", "babel-plugin-lodash": "~3.3.4", "babel-plugin-syntax-jsx": "^6.18.0", "babel-plugin-transform-vue-jsx": "^3.7.0", "better-npm-run": "~0.1.1", + "bk-magic-vue": "2.3.3", "body-parser": "~1.19.0", "chalk": "~2.4.2", "cheerio": "~1.0.0-rc.3", @@ -128,9 +133,9 @@ "file-loader": "~3.0.1", "friendly-errors-webpack-plugin": "~1.7.0", "fs-extra": "~8.0.1", - "highlight.js": "~9.15.6", "html-webpack-plugin": "~3.2.0", "http-proxy-middleware": "~0.19.1", + "husky": "~7.0.2", "js-cookie": "~2.2.1", "jsonp": "~0.2.1", "lodash": "^4.17.10", @@ -142,7 +147,7 @@ "marked": "^0.8.0", "mini-css-extract-plugin": "~0.6.0", "moment": "~2.24.0", - "npm": "~6.9.0", + "npm": "6.14.6", "open": "~6.3.0", "opencollective": "~1.0.3", "optimize-css-assets-webpack-plugin": "5.0.6", @@ -165,7 +170,7 @@ "terser-webpack-plugin": "~1.2.4", "transliteration": "~2.1.3", "url-loader": "~1.1.2", - "url-parse": "~1.4.7", + "url-parse": "~1.5.3", "vue": "~2.5.22", "vue-content-loader": "~0.2.3", "vue-i18n": "^8.11.2", @@ -183,8 +188,13 @@ "webpack-merge": "~4.2.1" }, "devDependencies": {}, + "husky": { + "hooks": { + "commit-msg": "commitlint -E HUSKY_GIT_PARAMS" + } + }, "engines": { "node": ">= 10.10.0", - "npm": "6.9.2" + "npm": "6.14.6" } } diff --git a/frontend/src/components/choose-ip/grade.vue b/frontend/src/components/choose-ip/grade.vue index 117cff79e..b48aa91c4 100644 --- a/frontend/src/components/choose-ip/grade.vue +++ b/frontend/src/components/choose-ip/grade.vue @@ -671,20 +671,22 @@ // 判断是否忽略路径 // const isNeedIgnore = this.ignorePathFlag && !isNeedAny - const isNeedIgnore = this.ignorePathFlag + // const isNeedIgnore = this.ignorePathFlag const params = [{ type: id, name, - path: isNeedIgnore ? [parentChain.slice(parentChain.length - 1)] : [parentChain], + // path: isNeedIgnore ? [parentChain.slice(parentChain.length - 1)] : [parentChain], + path: [parentChain], paths: [parentChain] }] if (node.isExistNoCarryLimit) { + const p = [parentChain.slice(0, parentChain.length - 1)] params.push({ type: id, name, - path: [parentChain.slice(0, parentChain.length - 1)], - paths: [parentChain.slice(0, parentChain.length - 1)] + path: p, + paths: p }) } diff --git a/frontend/src/components/choose-ip/grade/index.vue b/frontend/src/components/choose-ip/grade/index.vue index 08635090f..b873d3f3c 100644 --- a/frontend/src/components/choose-ip/grade/index.vue +++ b/frontend/src/components/choose-ip/grade/index.vue @@ -837,8 +837,27 @@ handleTreeSelect (value, node) { const parentChain = _.cloneDeep(node.parentChain) let isNeedAny = false + // 用户组以及权限模板这里，除了子节点没有“无限制”，其他节点，包括顶级节点和中间节点都有“无限制” + // 如果顶级节点无数据，那么也有“无限制” if (this.isTemplateMode) { - isNeedAny = node.async + // 没有中间节点以及子节点，例如 业务访问 + if (this.curChain.length === 1) { + isNeedAny = node.async + } else { + // 有父节点 + if (node.parentChain && node.parentChain.length && node.parentId) { + isNeedAny = node.async + } else { + isNeedAny = node.async + // 没有子节点并且已经点过展开了 + if (!node.children.length && !node.async) { + isNeedAny = true + // 这里需要把 node.async 设置为 true + // 下面的 if (node.level === 0 && !node.async) 这个逻辑需要 + node.async = isNeedAny + } + } + } } else { if (node.parentChain && node.parentChain.length && node.parentId) { isNeedAny = node.async @@ -937,20 +956,22 @@ } // 判断是否忽略路径 - const isNeedIgnore = this.ignorePathFlag && !isNeedAny + // const isNeedIgnore = this.ignorePathFlag && !isNeedAny const params = [{ type: id, name, - path: isNeedIgnore ? [parentChain.slice(parentChain.length - 1)] : [parentChain], + // path: isNeedIgnore ? [parentChain.slice(parentChain.length - 1)] : [parentChain], + path: [parentChain], paths: [parentChain] }] if (node.isExistNoCarryLimit) { + const p = [parentChain.slice(0, parentChain.length - 1)] params.push({ type: id, name, - path: [parentChain.slice(0, parentChain.length - 1)], - paths: [parentChain.slice(0, parentChain.length - 1)] + path: p, + paths: p }) } diff --git a/frontend/src/components/choose-ip/index.vue b/frontend/src/components/choose-ip/index.vue index 1c2d2a1fe..83fbe7fb5 100644 --- a/frontend/src/components/choose-ip/index.vue +++ b/frontend/src/components/choose-ip/index.vue @@ -671,20 +671,22 @@ } // 判断是否忽略路径 - const isNeedIgnore = this.ignorePathFlag && !isNeedAny + // const isNeedIgnore = this.ignorePathFlag && !isNeedAny const params = [{ type: id, name, - path: isNeedIgnore ? [parentChain.slice(parentChain.length - 1)] : [parentChain], + // path: isNeedIgnore ? [parentChain.slice(parentChain.length - 1)] : [parentChain], + path: [parentChain], paths: [parentChain] }] if (node.isExistNoCarryLimit) { + const p = [parentChain.slice(0, parentChain.length - 1)] params.push({ type: id, name, - path: [parentChain.slice(0, parentChain.length - 1)], - paths: [parentChain.slice(0, parentChain.length - 1)] + path: p, + paths: p }) } diff --git a/frontend/src/components/choose-ip/view/index.vue b/frontend/src/components/choose-ip/view/index.vue index d9684e50a..2635f512f 100644 --- a/frontend/src/components/choose-ip/view/index.vue +++ b/frontend/src/components/choose-ip/view/index.vue @@ -23,7 +23,7 @@ text size="small" :style="buttonStyle" - :disabled="child.disabled" + :disabled="child.disabled && item.path[childIndex][0].disabled" @click="handleRemove(child, index, childIndex)"> {{ $t(`m.common['移除']`) }} diff --git a/frontend/src/components/iam-search-select/search-select/index.vue b/frontend/src/components/iam-search-select/search-select/index.vue index 1735bbeed..f6af5e46a 100644 --- a/frontend/src/components/iam-search-select/search-select/index.vue +++ b/frontend/src/components/iam-search-select/search-select/index.vue @@ -290,8 +290,8 @@ this.calcTextareaWidth = _.throttle(this._calcTextareaWidth, 30) this.showPopper = _.throttle(this._showMenu, 50) this.remoteExecuteImmediate() - this.chipList = [] - this.triggerChange() + // this.chipList = [] + // this.triggerChange() }, beforeDestroy () { diff --git a/frontend/src/language/lang/en.js b/frontend/src/language/lang/en.js index 7ab5043e0..3d4674a61 100644 --- a/frontend/src/language/lang/en.js +++ b/frontend/src/language/lang/en.js @@ -240,7 +240,11 @@ export const m = { '内容格式不正确': 'The content format is incorrect', '未设置任何条件': 'No Condition Setted', '只允许小写字母开头、包含小写字母、数字、下划线(_)和连接符(-)': 'Only lowercase letters, digits, underscores (_), and hyphens (-) are allowed', - '操作ID已被占用': '操作ID已被占用' + '操作ID已被占用': '操作ID已被占用', + '请输入正确的系统回调接口': 'Please enter the correct system callback interface', + '请输入正确的系统健康检查地址': 'Please enter the correct system health check address', + '资源类型ID已被占用': 'The resource type ID has been occupied', + '只允许输入英文': 'Only English is allowed' }, info: { '加入用户组申请成功': 'Apply to join the group successfully', @@ -721,7 +725,13 @@ export const m = { '访问': 'Visit', '创建者': 'Creator', '系统名称': 'System Name', - '系统ID': 'System ID' + '系统ID': 'System ID', + '实例视图ID': 'Instance View ID', + '请输入实例视图ID': 'Please enter the instance view ID', + '实例视图中文名': 'Instance view Chinese name', + '请输入实例视图中文名': 'Please enter the Instance view Chinese name', + '实例视图英文名': 'English name of the instance view', + '请输入实例视图英文名': 'Please enter the English name of the instance view' } } export default { diff --git a/frontend/src/language/lang/zh.js b/frontend/src/language/lang/zh.js index f03e694a5..36026b154 100644 --- a/frontend/src/language/lang/zh.js +++ b/frontend/src/language/lang/zh.js @@ -206,7 +206,8 @@ export const m = { '确定退出分级管理员': '确定退出分级管理员', '用户组': '用户组', '是否删除该自定义权限': '是否删除该自定义权限', - '确认删除': '确认删除' + '确认删除': '确认删除', + '只允许输入英文': '只允许输入英文' }, // 校验 verify: { @@ -239,10 +240,10 @@ export const m = { '可授权人员范围不可为空': '可授权人员范围不可为空', '内容格式不正确': '内容格式不正确', '未设置任何条件': '未设置任何条件', - '系统ID必填': '系统ID必填', - '系统ID已被占用': '系统ID已被占用', - '系统中文名称必填': '系统中文名称必填', - '系统英文名称必填': '系统英文名称必填', + '实例视图ID必填': '实例视图ID必填', + '实例视图ID已被占用': '实例视图ID已被占用', + '实例视图中文名称必填': '实例视图中文名称必填', + '实例视图英文名称必填': '实例视图英文名称必填', '系统回调地址必填': '系统回调地址必填', '系统健康检查地址必填': '系统健康检查地址必填', '请输入系统回调地址': '请输入系统回调地址', @@ -264,7 +265,11 @@ export const m = { '系统中文描述必填': '系统中文描述必填', '系统英文描述必填': '系统英文描述必填', '只允许小写字母开头、包含小写字母、数字、下划线(_)和连接符(-)': '只允许小写字母开头、包含小写字母、数字、下划线(_)和连接符(-)', - '操作ID已被占用': 'The operation ID has been occupied. Procedure', + '操作ID已被占用': '操作ID已被占用', + '请输入正确的系统回调接口': '请输入正确的系统回调接口', + '请输入正确的系统健康检查地址': '请输入正确的系统健康检查地址', + '资源类型ID已被占用': '资源类型ID已被占用', + '只允许输入英文': '只允许输入英文', /* eslint-disable no-dupe-keys */ '111': '111', '111': '111', @@ -824,6 +829,7 @@ export const m = { '请输入操作英文描述': '请输入操作英文描述', '资源类型': '资源类型', '实例视图': '实例视图', + '资源实例选择方式': '资源实例选择方式', '新增资源类型': '新增资源类型', '请选择资源类型': '请选择资源类型', '无匹配数据': '无匹配数据', @@ -841,12 +847,12 @@ export const m = { '请输入回调接口': '请输入回调接口', '保存资源类型成功': '保存资源类型成功', '新增实例视图': '新增实例视图', - '实例ID': '实例ID', - '请输入实例ID': '请输入实例ID', - '实例中文名': '实例中文名', - '请输入实例中文名': '请输入实例中文名', - '实例英文名': '实例英文名', - '请输入实例英文名': '请输入实例英文名', + '实例视图ID': '实例视图ID', + '请输入实例视图ID': '请输入实例视图ID', + '实例视图中文名': '实例视图中文名', + '请输入实例视图中文名': '请输入实例视图中文名', + '实例视图英文名': '实例视图英文名', + '请输入实例视图英文名': '请输入实例视图英文名', '选择资源实例层级': '选择资源实例层级', '请选择资源实例层级': '请选择资源实例层级', '操作分组': '操作分组', @@ -900,12 +906,13 @@ export const m = { '请输入常用操作英文名称': '请输入常用操作英文名称', '操作': '操作', '请选择操作': '请选择操作', - /* eslint-disable no-dupe-keys */ '确认删除常用操作？': '确认删除常用操作？', '删除常用操作成功': '删除常用操作成功', '编辑常用操作': '编辑常用操作', - '111': '111', - '111': '111', + '删除资源类型成功': '删除资源类型成功', + '资源实例选择方式至少选择一个': '资源实例选择方式至少选择一个', + '通过拓扑选择时必须要选择实例视图': '通过拓扑选择时必须要选择实例视图', + /* eslint-disable no-dupe-keys */ '111': '111', '111': '111', '111': '111', diff --git a/frontend/src/model/compare-condition.js b/frontend/src/model/compare-condition.js index 86f040791..74ae99d8d 100644 --- a/frontend/src/model/compare-condition.js +++ b/frontend/src/model/compare-condition.js @@ -51,22 +51,25 @@ class Instance { } const tempList = [] this.path.forEach(item => { - // const len = item.chain.length - // const displayName = item.chain.map(sub => sub.name).join('/') - // tempList.push({ - // name: displayName, - // id: item.chain[len - 1].id, - // level: len - 1, - // status: item.tag - // }) - const len = item.length - const displayName = item.map(sub => sub.name).join('/') - tempList.push({ - name: displayName, - id: item[len - 1].id, - level: len - 1, - status: item[len - 1].tag - }) + if (item.chain) { + const len = item.chain.length + const displayName = item.chain.map(sub => sub.name).join('/') + tempList.push({ + name: displayName, + id: item.chain[len - 1].id, + level: len - 1, + status: item.tag + }) + } else { + const len = item.length + const displayName = item.map(sub => sub.name).join('/') + tempList.push({ + name: displayName, + id: item[len - 1].id, + level: len - 1, + status: item[len - 1].tag + }) + } }) return tempList } diff --git a/frontend/src/store/index.js b/frontend/src/store/index.js index cbc3fed6c..5df4c4dab 100644 --- a/frontend/src/store/index.js +++ b/frontend/src/store/index.js @@ -250,7 +250,9 @@ const store = new Vuex.Store({ speed: 2, primaryColor: '#f5f6fa', secondaryColor: '#FAFAFC' - } + }, + // 系统回调地址 + host: '' }, getters: { mainContentLoading: state => state.mainContentLoading, @@ -268,9 +270,13 @@ const store = new Vuex.Store({ roleList: state => state.roleList, routerDiff: state => state.routerDiff, noviceGuide: state => state.noviceGuide, - loadingConf: state => state.loadingConf + loadingConf: state => state.loadingConf, + host: state => state.host }, mutations: { + updateHost (state, params) { + state.host = params + }, updateGroup (state, obj) { if (obj.hasOwnProperty('hasPerm')) { state.group.hasPerm = obj.hasPerm diff --git a/frontend/src/store/modules/access.js b/frontend/src/store/modules/access.js index 3a9f7421d..f6544f10c 100644 --- a/frontend/src/store/modules/access.js +++ b/frontend/src/store/modules/access.js @@ -70,7 +70,7 @@ export default { }, /** - * 获取用户页面接入构建模型数据 + * 校验系统ID唯一性 * * @param {Function} commit store commit mutation handler * @param {Object} state store state @@ -84,6 +84,22 @@ export default { return http.get(`${AJAX_URL_PREFIX}/modeling/is_id_exists/?${json2Query(params)}`, config) }, + /** + * 检查模型中的某种资源的id是否已存在 + * + * @param {Function} commit store commit mutation handler + * @param {Object} state store state + * @param {Function} dispatch store dispatch action handler + * @param {Object} params 请求参数 + * @param {Object?} config http config + * + * @return {Promise} promise 对象 + */ + checkResourceId ({ commit, state, dispatch }, params, config) { + const { id, data = {} } = params + return http.get(`${AJAX_URL_PREFIX}/modeling/${id}/is_id_exists/?${json2Query(data)}`, config) + }, + /** * 新建模型系统 * diff --git a/frontend/src/views/grading-admin/components/render-resource.vue b/frontend/src/views/grading-admin/components/render-resource.vue index 3f4ed0be2..21e3fc919 100644 --- a/frontend/src/views/grading-admin/components/render-resource.vue +++ b/frontend/src/views/grading-admin/components/render-resource.vue @@ -305,7 +305,7 @@ }, handleDragMouseup (e) { - this.dragWidth = this.dragRealityWidth + // this.dragWidth = this.dragRealityWidth this.isDrag = false document.removeEventListener('mousemove', this.handleDragMousemove) document.removeEventListener('mouseup', this.handleDragMouseup) @@ -324,6 +324,7 @@ return } this.dragRealityWidth = offsetX + this.dragWidth = offsetX }, async fetchInstanceSelection (params = {}) { diff --git a/frontend/src/views/grading-admin/create/index.vue b/frontend/src/views/grading-admin/create/index.vue index a6cbbf209..b18b1c47f 100644 --- a/frontend/src/views/grading-admin/create/index.vue +++ b/frontend/src/views/grading-admin/create/index.vue @@ -5,7 +5,7 @@ - - + --> + v-if="isSelectSystem || isSelectSystemShow">
@@ -31,35 +31,43 @@ class="info-icon" v-bk-tooltips.top="{ content: tips, width: 236, extCls: 'iam-tooltips-cls' }" />
-
-

{{ infoText }}

-
- - - {{ expandedText }} -
+
+ {{ $t(`m.common['共']`) }} + 0 + {{ $t(`m.common['个']`) }} + {{ $t(`m.perm['操作权限']`) }}
-
- +
+
+

{{ infoText }}

+
+ + + {{ expandedText }} +
+
+
+ +
@@ -213,12 +221,15 @@ aggregationsBackup: [], aggregationsTableData: [], curSystemId: [], - isAll: false + isAll: true } }, computed: { ...mapGetters(['user']), isSelectSystem () { + return this.originalList.length === 0 + }, + isSelectSystemShow () { return this.originalList.length > 0 }, defaultValue () { @@ -882,6 +893,15 @@ } } } + .sub-title { + margin-top:10px; + margin-left:10px; + font-size:14px; + color: #979ba5; + .number { + font-weight: 600; + } + } .info-wrapper { display: flex; justify-content: space-between; diff --git a/frontend/src/views/group/components/iam-add-member.vue b/frontend/src/views/group/components/iam-add-member.vue index 3d5d7b2eb..d42838294 100644 --- a/frontend/src/views/group/components/iam-add-member.vue +++ b/frontend/src/views/group/components/iam-add-member.vue @@ -467,6 +467,11 @@ immediate: true } }, + created () { + if (this.$route.name === 'gradingAdminCreate') { + this.handleSave() + } + }, methods: { handleSearchInput () { this.isSerachFocus = true @@ -1014,7 +1019,6 @@ }, 300) } }, - handleDelete (item, type) { if (this.isAll) { return diff --git a/frontend/src/views/group/components/render-instance-table.vue b/frontend/src/views/group/components/render-instance-table.vue index a85c77a5e..b49fc7a23 100644 --- a/frontend/src/views/group/components/render-instance-table.vue +++ b/frontend/src/views/group/components/render-instance-table.vue @@ -955,12 +955,12 @@ this.curCopyKey = `${payload.system_id}${payload.type}` this.curCopyData = _.cloneDeep(payload.condition) this.curCopyMode = 'normal' - this.curCopyParams = this.getBacthCopyParms(action, payload) + this.curCopyParams = this.getBatchCopyParms(action, payload) this.showMessage(this.$t(`m.info['实例复制']`)) this.$refs[`condition_${index}_${subIndex}_ref`][0] && this.$refs[`condition_${index}_${subIndex}_ref`][0].setImmediatelyShow(true) }, - getBacthCopyParms (payload, content) { + getBatchCopyParms (payload, content) { const actions = [] this.tableList.forEach(item => { if (!item.isAggregate) { @@ -993,6 +993,7 @@ }, handlerOnPaste (payload, content, $index, contentIndex) { + // debugger let tempCurData = ['none'] if (this.curCopyMode === 'normal') { if (!payload.flag) { @@ -1048,6 +1049,7 @@ }, handlerOnBatchPaste (payload, content, index, subIndex) { + // debugger let tempCurData = ['none'] let tempArrgegateData = [] if (this.curCopyMode === 'normal') { diff --git a/frontend/src/views/group/components/render-resource.vue b/frontend/src/views/group/components/render-resource.vue index 13ccea9da..8b3070cdb 100644 --- a/frontend/src/views/group/components/render-resource.vue +++ b/frontend/src/views/group/components/render-resource.vue @@ -387,7 +387,7 @@ }, handleDragMouseup (e) { - this.dragWidth = this.dragRealityWidth + // this.dragWidth = this.dragRealityWidth this.isDrag = false document.removeEventListener('mousemove', this.handleDragMousemove) document.removeEventListener('mouseup', this.handleDragMouseup) @@ -406,6 +406,7 @@ return } this.dragRealityWidth = offsetX + this.dragWidth = offsetX }, async fetchInstanceSelection (params = {}) { @@ -908,7 +909,6 @@ }, handlePathSelect (value, node, payload, index) { - // debugger window.changeAlert = true const { type, path, paths } = payload[0] const tempPath = path[0] diff --git a/frontend/src/views/group/create/index.vue b/frontend/src/views/group/create/index.vue index f9f0320d0..818a6bd96 100644 --- a/frontend/src/views/group/create/index.vue +++ b/frontend/src/views/group/create/index.vue @@ -706,6 +706,7 @@ } this.submitLoading = true window.changeDialog = false + // debugger const params = { ...this.formData, members: this.members, diff --git a/frontend/src/views/group/detail/group-perm-new.vue b/frontend/src/views/group/detail/group-perm-new.vue index 32810e068..ab558e62c 100644 --- a/frontend/src/views/group/detail/group-perm-new.vue +++ b/frontend/src/views/group/detail/group-perm-new.vue @@ -271,8 +271,18 @@ id: this.groupId, templateId: item.id }) - const tableData = res.data.actions.map(item => new GroupPolicy({ ...item, policy_id: 1 }, 'detail', 'template', { system: res.data.system })) - const tableDataBackup = res.data.actions.map(item => new GroupPolicy({ ...item, policy_id: 1 }, 'detail', 'template', { system: res.data.system })) + const tableData = res.data.actions.map(row => new GroupPolicy( + { ...row, policy_id: 1 }, + 'detail', + 'template', + { system: res.data.system } + )) + const tableDataBackup = res.data.actions.map(row => new GroupPolicy( + { ...row, policy_id: 1 }, + 'detail', + 'template', + { system: res.data.system } + )) this.$set(item, 'tableData', tableData) this.$set(item, 'tableDataBackup', tableDataBackup) } catch (e) { @@ -294,8 +304,21 @@ id: this.groupId, systemId: item.system.id }) - const tableData = res.data.map(item => new GroupPolicy(item, 'detail', 'custom', { system: item.system })) - const tableDataBackup = res.data.map(item => new GroupPolicy(item, 'detail', 'custom'), { system: item.system }) + + const tableData = res.data.map(row => { + return new GroupPolicy( + row, + 'detail', + 'custom', + { system: item.system } + ) + }) + const tableDataBackup = res.data.map(row => new GroupPolicy( + row, + 'detail', + 'custom', + { system: item.system } + )) this.$set(item, 'tableData', tableData) this.$set(item, 'tableDataBackup', tableDataBackup) } catch (e) { diff --git a/frontend/src/views/perm-apply/apply-join-user-group/index.vue b/frontend/src/views/perm-apply/apply-join-user-group/index.vue index e53a52309..a41796196 100644 --- a/frontend/src/views/perm-apply/apply-join-user-group/index.vue +++ b/frontend/src/views/perm-apply/apply-join-user-group/index.vue @@ -177,6 +177,7 @@ } }, created () { + this.searchParams = this.$route.params this.curRole = this.user.role.type this.searchData = [ { diff --git a/frontend/src/views/perm-apply/components/render-resource.vue b/frontend/src/views/perm-apply/components/render-resource.vue index 566ad1698..7d85c0d04 100644 --- a/frontend/src/views/perm-apply/components/render-resource.vue +++ b/frontend/src/views/perm-apply/components/render-resource.vue @@ -304,7 +304,7 @@ }, handleDragMouseup (e) { - this.dragWidth = this.dragRealityWidth + // this.dragWidth = this.dragRealityWidth this.isDrag = false document.removeEventListener('mousemove', this.handleDragMousemove) document.removeEventListener('mouseup', this.handleDragMouseup) @@ -323,6 +323,7 @@ return } this.dragRealityWidth = offsetX + this.dragWidth = offsetX }, async fetchInstanceSelection (params = {}) { diff --git a/frontend/src/views/perm-template/components/render-content.vue b/frontend/src/views/perm-template/components/render-content.vue index 1d19764dc..5a558f9d1 100644 --- a/frontend/src/views/perm-template/components/render-content.vue +++ b/frontend/src/views/perm-template/components/render-content.vue @@ -425,8 +425,8 @@ }) this.systemList = res.data || [] this.systemValue = res.data[0].id || '' - this.fetchActions(this.systemValue) - this.fetchCommonActions(this.systemValue) + await this.fetchActions(this.systemValue) + await this.fetchCommonActions(this.systemValue) } catch (e) { console.error(e) this.bkMessageInstance = this.$bkMessage({ @@ -502,10 +502,17 @@ async fetchCommonActions (systemId) { try { const res = await this.$store.dispatch('permTemplate/getCommonAction', { systemId }) - this.commonActions.splice(0, this.commonActions.length, ...(res.data || [])) - this.commonActions.forEach(item => { - item.$id = guid() + const list = res.data || [] + + const linearActionIdList = this.linearAction.map(la => la.id) + const commonActions = [] + list.forEach(ca => { + ca.$id = guid() + if (ca.action_ids.every(aId => linearActionIdList.indexOf(aId) > -1)) { + commonActions.push(ca) + } }) + this.commonActions.splice(0, this.commonActions.length, ...commonActions) } catch (e) { console.error(e) this.bkMessageInstance = this.$bkMessage({ diff --git a/frontend/src/views/perm-template/components/render-resource.vue b/frontend/src/views/perm-template/components/render-resource.vue index 93882f1fd..69044c611 100644 --- a/frontend/src/views/perm-template/components/render-resource.vue +++ b/frontend/src/views/perm-template/components/render-resource.vue @@ -481,7 +481,7 @@ }, handleDragMouseup (e) { - this.dragWidth = this.dragRealityWidth + // this.dragWidth = this.dragRealityWidth this.isDrag = false document.removeEventListener('mousemove', this.handleDragMousemove) document.removeEventListener('mouseup', this.handleDragMouseup) @@ -500,6 +500,7 @@ return } this.dragRealityWidth = offsetX + this.dragWidth = offsetX }, async fetchInstanceSelection (params = {}) { diff --git a/frontend/src/views/system-access/access/basic-info.vue b/frontend/src/views/system-access/access/basic-info.vue index 4aee6faa1..613dfa64b 100644 --- a/frontend/src/views/system-access/access/basic-info.vue +++ b/frontend/src/views/system-access/access/basic-info.vue @@ -19,7 +19,11 @@ - + + +
- + +
@@ -31,7 +37,8 @@ -->
- + {{ $t(`m.common['下一步']`) }} {{ $t(`m.common['取消']`) }} @@ -43,12 +50,14 @@