UnisKB/apps/common/constants/permission_constants.py

"""
    @project: qabot
    @Author：虎虎
    @file： permission_constants.py
    @date：2023/9/13 18:23
    @desc: 权限,角色 常量
"""
from enum import Enum
from functools import reduce
from typing import List

from django.db import models


class Group(Enum):
    """
    权限组 一个组一般对应前端一个菜单
    """
    USER = "USER"

    APPLICATION = "APPLICATION"

    KNOWLEDGE = "KNOWLEDGE"

    MODEL = "MODEL"

    TOOL = "TOOL"

    WORKSPACE_USER_RESOURCE_PERMISSION = "WORKSPACE_USER_RESOURCE_PERMISSION"


class Operate(Enum):
    """
     一个权限组的操作权限
    """
    READ = 'READ'
    EDIT = "EDIT"
    CREATE = "CREATE"
    DELETE = "DELETE"
    """
    使用权限
    """
    USE = "USE"


class RoleGroup(Enum):
    # 系统用户
    SYSTEM_USER = "SYSTEM_USER"
    # 对话用户
    CHAT_USER = "CHAT_USER"


class ResourcePermissionRole(models.TextChoices):
    """
    资源权限根据角色
    """
    ROLE = "ROLE"

    def __eq__(self, other):
        return str(self) == str(other)


class ResourcePermissionGroup(models.TextChoices):
    """
    资源权限组
    """
    # 查看
    VIEW = "VIEW"
    # 管理
    MANAGE = "MANAGE"

    def __eq__(self, other):
        return str(self) == str(other)


class ResourceAuthType(models.TextChoices):
    """
    资源授权类型
    """
    "当授权类型是Role时候"
    ROLE = "ROLE"

    """资源权限组"""
    RESOURCE_PERMISSION_GROUP = "RESOURCE_PERMISSION_GROUP"


class Role:
    def __init__(self, name: str, decs: str, group: RoleGroup, resource_path=None):
        self.name = name
        self.decs = decs
        self.group = group
        self.resource_path = resource_path

    def __str__(self):
        return self.name + (
            (":" + self.resource_path) if self.resource_path is not None else '')

    def __eq__(self, other):
        return str(self) == str(other)


class RoleConstants(Enum):
    ADMIN = Role("ADMIN", '超级管理员', RoleGroup.SYSTEM_USER)
    WORKSPACE_MANAGE = Role("WORKSPACE_MANAGE", '工作空间管理员', RoleGroup.SYSTEM_USER)
    USER = Role("USER", '普通用户', RoleGroup.SYSTEM_USER)

    def get_workspace_role(self):
        return lambda r, kwargs: Role(name=self.value.name,
                                      decs=self.value.decs,
                                      group=self.value.group,
                                      resource_path=
                                      f"/WORKSPACE/{kwargs.get('workspace_id')}")


class Permission:
    """
    权限信息
    """

    def __init__(self, group: Group, operate: Operate, resource_path=None, role_list=None,
                 resource_permission_group_list=None):
        if role_list is None:
            role_list = []
        if resource_permission_group_list is None:
            resource_permission_group_list = []
        self.group = group
        self.operate = operate
        self.resource_path = resource_path
        # 用于获取角色与权限的关系,只适用于没有权限管理的
        self.role_list = role_list
        # 用于资源权限权限分组
        self.resource_permission_group_list = resource_permission_group_list

    @staticmethod
    def new_instance(permission_str: str):
        permission_split = permission_str.split(":")
        group = Group[permission_split[0]]
        operate = Operate[permission_split[2]]
        if len(permission_split) > 2:
            dynamic_tag = ":".join(permission_split[2:])
            return Permission(group, operate, dynamic_tag)
        return Permission(group, operate)

    def __str__(self):
        return self.group.value + ":" + self.operate.value + (
            (":" + self.resource_path) if self.resource_path is not None else '')

    def __eq__(self, other):
        return str(self) == str(other)


class PermissionConstants(Enum):
    """
     权限枚举
    """
    USER_READ = Permission(group=Group.USER, operate=Operate.READ, role_list=[RoleConstants.ADMIN,
                                                                              RoleConstants.USER])
    USER_CREATE = Permission(group=Group.USER, operate=Operate.CREATE,
                             role_list=[RoleConstants.ADMIN])
    USER_EDIT = Permission(group=Group.USER, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN])
    USER_DELETE = Permission(group=Group.USER, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN])

    MODEL_CREATE = Permission(group=Group.MODEL, operate=Operate.CREATE, role_list=[RoleConstants.ADMIN,
                                                                                    RoleConstants.USER])
    MODEL_READ = Permission(group=Group.MODEL, operate=Operate.READ, role_list=[RoleConstants.ADMIN,
                                                                                RoleConstants.USER])
    MODEL_EDIT = Permission(group=Group.MODEL, operate=Operate.EDIT,
                            role_list=[RoleConstants.ADMIN, RoleConstants.USER])
    MODEL_DELETE = Permission(group=Group.MODEL, operate=Operate.DELETE,
                              role_list=[RoleConstants.ADMIN, RoleConstants.USER])
    TOOL_FOLDER_CREATE = Permission(group=Group.TOOL, operate=Operate.CREATE, role_list=[RoleConstants.ADMIN,
                                                                                         RoleConstants.USER])
    TOOL_FOLDER_READ = Permission(group=Group.TOOL, operate=Operate.READ, role_list=[RoleConstants.ADMIN,
                                                                                     RoleConstants.USER])
    TOOL_FOLDER_EDIT = Permission(group=Group.TOOL, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN,
                                                                                     RoleConstants.USER])
    TOOL_FOLDER_DELETE = Permission(group=Group.TOOL, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN,
                                                                                         RoleConstants.USER])

    TOOL_CREATE = Permission(group=Group.TOOL, operate=Operate.CREATE, role_list=[RoleConstants.ADMIN,
                                                                                  RoleConstants.USER])
    TOOL_EDIT = Permission(group=Group.TOOL, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN,
                                                                              RoleConstants.USER])
    TOOL_READ = Permission(group=Group.TOOL, operate=Operate.READ, role_list=[RoleConstants.ADMIN,
                                                                              RoleConstants.USER])
    TOOL_DELETE = Permission(group=Group.TOOL, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN,
                                                                                  RoleConstants.USER])
    TOOL_DEBUG = Permission(group=Group.TOOL, operate=Operate.USE, role_list=[RoleConstants.ADMIN,
                                                                              RoleConstants.USER])
    TOOL_IMPORT = Permission(group=Group.TOOL, operate=Operate.USE, role_list=[RoleConstants.ADMIN,
                                                                               RoleConstants.USER])
    TOOL_EXPORT = Permission(group=Group.TOOL, operate=Operate.USE, role_list=[RoleConstants.ADMIN,
                                                                               RoleConstants.USER])

    KNOWLEDGE_FOLDER_CREATE = Permission(group=Group.KNOWLEDGE, operate=Operate.CREATE, role_list=[RoleConstants.ADMIN,
                                                                                                   RoleConstants.USER])
    KNOWLEDGE_FOLDER_READ = Permission(group=Group.KNOWLEDGE, operate=Operate.READ, role_list=[RoleConstants.ADMIN,
                                                                                               RoleConstants.USER],
                                       resource_permission_group_list=[
                                           ResourcePermissionGroup.VIEW
                                       ])
    KNOWLEDGE_FOLDER_EDIT = Permission(group=Group.KNOWLEDGE, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN,
                                                                                               RoleConstants.USER],
                                       resource_permission_group_list=[
                                           ResourcePermissionGroup.MANAGE
                                       ]
                                       )
    KNOWLEDGE_FOLDER_DELETE = Permission(group=Group.KNOWLEDGE, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN,
                                                                                                   RoleConstants.USER],
                                         resource_permission_group_list=[
                                             ResourcePermissionGroup.MANAGE
                                         ]
                                         )
    KNOWLEDGE_READ = Permission(group=Group.KNOWLEDGE, operate=Operate.READ, role_list=[RoleConstants.ADMIN,
                                                                                        RoleConstants.USER],
                                resource_permission_group_list=[ResourcePermissionGroup.VIEW])
    KNOWLEDGE_CREATE = Permission(group=Group.KNOWLEDGE, operate=Operate.CREATE, role_list=[RoleConstants.ADMIN,
                                                                                            RoleConstants.USER])
    KNOWLEDGE_EDIT = Permission(group=Group.KNOWLEDGE, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN,
                                                                                        RoleConstants.USER])
    KNOWLEDGE_DELETE = Permission(group=Group.KNOWLEDGE, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN,
                                                                                            RoleConstants.USER])
    DOCUMENT_READ = Permission(group=Group.KNOWLEDGE, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN,
                                                                                         RoleConstants.USER])
    DOCUMENT_CREATE = Permission(group=Group.KNOWLEDGE, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN,
                                                                                           RoleConstants.USER])
    DOCUMENT_EDIT = Permission(group=Group.KNOWLEDGE, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN,
                                                                                         RoleConstants.USER])
    DOCUMENT_DELETE = Permission(group=Group.KNOWLEDGE, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN,
                                                                                           RoleConstants.USER])

    WORKSPACE_USER_RESOURCE_PERMISSION_READ = Permission(group=Group.WORKSPACE_USER_RESOURCE_PERMISSION,
                                                         operate=Operate.READ,
                                                         role_list=[RoleConstants.ADMIN,
                                                                    RoleConstants.WORKSPACE_MANAGE])

    EMAIL_SETTING_READ = Permission(group=Group.USER, operate=Operate.READ,
                                    role_list=[RoleConstants.ADMIN])
    EMAIL_SETTING_EDIT = Permission(group=Group.USER, operate=Operate.EDIT,
                                    role_list=[RoleConstants.ADMIN])

    def get_workspace_application_permission(self):
        return lambda r, kwargs: Permission(group=self.value.group, operate=self.value.operate,
                                            resource_path=
                                            f"/WORKSPACE/{kwargs.get('workspace_id')}/APPLICATION/{kwargs.get('application_id')}")

    def get_workspace_knowledge_permission(self):
        return lambda r, kwargs: Permission(group=self.value.group, operate=self.value.operate,
                                            resource_path=
                                            f"/WORKSPACE/{kwargs.get('workspace_id')}/KNOWLEDGE/{kwargs.get('knowledge_id')}")

    def get_workspace_permission(self):
        return lambda r, kwargs: Permission(group=self.value.group, operate=self.value.operate,
                                            resource_path=
                                            f"/WORKSPACE/{kwargs.get('workspace_id')}")

    def __eq__(self, other):
        if isinstance(other, PermissionConstants):
            return other == self
        else:
            return self.value == other


def get_default_permission_list_by_role(role: RoleConstants):
    """
    根据角色 获取角色对应的权限
    :param role: 角色
    :return: 权限
    """
    return list(map(lambda k: PermissionConstants[k],
                    list(filter(lambda k: PermissionConstants[k].value.role_list.__contains__(role),
                                PermissionConstants.__members__))))


class RolePermissionMapping:
    def __init__(self, role_id, permission_id):
        self.role_id = role_id
        self.permission_id = permission_id


class WorkspaceUserRoleMapping:
    def __init__(self, workspace_id, role_id, user_id):
        self.workspace_id = workspace_id
        self.role_id = role_id
        self.user_id = user_id


def get_default_role_permission_mapping_list():
    role_permission_mapping_list = [
        [RolePermissionMapping(role.value.name, PermissionConstants[k].value.__str__()) for role in
         PermissionConstants[k].value.role_list] for k in PermissionConstants.__members__]
    return reduce(lambda x, y: [*x, *y], role_permission_mapping_list, [])


def get_default_workspace_user_role_mapping_list(user_role_list: list):
    return [WorkspaceUserRoleMapping('default', role.value.name, 'default') for role in RoleConstants if
            user_role_list.__contains__(role.value.name)]


def get_permission_list_by_resource_group(resource_group: ResourcePermissionGroup):
    """
    根据资源组获取权限
    """
    return [PermissionConstants[k] for k in PermissionConstants.__members__ if
            PermissionConstants[k].value.resource_permission_group_list.__contains__(resource_group)]


class Auth:
    """
     用于存储当前用户的角色和权限
    """

    def __init__(self,
                 current_role_list: List[Role],
                 permission_list: List[PermissionConstants | Permission],
                 **keywords):
        # 权限列表
        self.permission_list = permission_list
        # 角色列表
        self.role_list = current_role_list
        self.keywords = keywords


class CompareConstants(Enum):
    # 或者
    OR = "OR"
    # 并且
    AND = "AND"


class ViewPermission:
    def __init__(self, roleList: List[RoleConstants], permissionList: List[PermissionConstants | object],
                 compare=CompareConstants.OR):
        self.roleList = roleList
        self.permissionList = permissionList
        self.compare = compare