PayrollManagementSystem/backend/app/services/authorization_management.py

"""管理员维护授权；审计、版本检查和权限写入在同一业务事务中。"""
from sqlalchemy import delete, select

from app.core.exceptions import BadRequestError, ConflictError, ForbiddenError, NotFoundError
from app.models import Permission, Role, RolePermission, User, UserRole
from app.repositories import user_repository
from app.services import audit_service
from app.services import authorization_service as auth
from app.services.audit_service import AuditRecord
from app.services.permission_catalog import CATALOG


def require_admin(session, actor):
    if actor is None or actor.status != 1 or "admin" not in auth.role_codes(session, actor.id, for_update=True):
        raise ForbiddenError("仅系统管理员可以配置权限")


def lock_policy(session, actor, expected=None):
    policy = auth.setting(session, lock=True)
    require_admin(session, actor)
    if expected is not None and policy.revision != expected:
        raise ConflictError()
    return policy


def bump(policy, actor):
    policy.revision += 1
    policy.updated_by = actor.id


def _user(session, user_id):
    user = session.get(User, user_id)
    if user is None:
        raise NotFoundError("用户不存在")
    return user


def _roles(session, codes, *, existing=()):
    if len(set(codes)) != len(codes):
        raise BadRequestError("角色不能重复")
    rows = list(session.scalars(select(Role).where(Role.role_code.in_(codes))))
    if len(rows) != len(codes) or any(r.status != 1 and r.role_code not in existing for r in rows):
        raise BadRequestError("角色不存在或已停用")
    return rows


def _overrides(payload):
    if payload.overrides:
        raise BadRequestError("已改为角色授权，请在角色管理中配置权限")
    return {}


def user_authorization(session, user_id):
    user = _user(session, user_id)
    result = auth.calculate(session, user)
    return {**result, "id": user.id, "username": user.username,
            "role_codes": [link.role.role_code for link in user.user_roles],
            "overrides": [], "revision": auth.setting(session).revision,
            "is_payroll_maker": auth.is_maker(session, user)}


def preview(session, user_id, payload):
    user = _user(session, user_id)
    _roles(session, payload.role_codes, existing=[link.role.role_code for link in user.user_roles])
    overrides = _overrides(payload)
    if "admin" in payload.role_codes and overrides:
        raise BadRequestError("管理员权限为固定基线，不能设置个人覆盖")
    proposed = auth.calculate(session, user, roles=payload.role_codes, overrides=overrides)
    before = set(auth.calculate(session, user)["permissions"])
    after = set(proposed["permissions"])
    return {**proposed, "added": sorted(after - before), "removed": sorted(before - after)}


def guard_user_change(session, user, actor, *, roles=None, status=None, deleting=False):
    """调用方已持全局授权锁；防止两个管理员并发把系统管理资格撤空。"""
    session.refresh(user, with_for_update=True)
    current = auth.role_codes(session, user.id, for_update=True)
    removes_admin = "admin" in current and (
        deleting or status == 0 or (roles is not None and "admin" not in roles)
    )
    if removes_admin:
        if actor.id == user.id:
            raise ForbiddenError("不能撤销自己的管理员资格或停用自己")
        active = list(session.scalars(select(User.id).join(UserRole).join(Role).where(
            User.status == 1, Role.role_code == "admin", Role.status == 1
        ).with_for_update()))
        if len(active) <= 1:
            raise ForbiddenError("不能移除最后一个启用的管理员")


def save_user(session, user_id, payload, actor, meta=None):
    audit_data = payload.model_dump(mode="json")
    with audit_service.audit(session, operator=actor, meta=meta, record=AuditRecord(
        "权限管理", "用户授权", f"修改用户 #{user_id} 的权限", audit_data
    )):
        policy = lock_policy(session, actor, payload.expected_revision)
        user = _user(session, user_id)
        before = user_authorization(session, user_id)
        changes = preview(session, user_id, payload)
        guard_user_change(session, user, actor, roles=payload.role_codes)
        roles = _roles(session, payload.role_codes, existing=[link.role.role_code for link in user.user_roles])
        user_repository.replace_roles(session, user, roles)
        bump(policy, actor)
        session.flush()
        result = user_authorization(session, user_id)
        result["changes"] = {"added": changes["added"], "removed": changes["removed"],
                             "before_roles": before["role_codes"], "after_roles": result["role_codes"]}
        audit_data["changes"] = result["changes"]
        session.commit()
        return result


def role_permissions(session, role_id):
    role = session.get(Role, role_id)
    if role is None:
        raise NotFoundError("角色不存在")
    codes = sorted(CATALOG) if role.role_code == "admin" else list(session.scalars(
        select(Permission.perm_code).join(RolePermission, RolePermission.permission_id == Permission.id)
        .where(RolePermission.role_id == role.id, Permission.perm_code.in_(CATALOG))
    ))
    return {"role_id": role.id, "role_code": role.role_code, "role_name": role.role_name,
            "permission_codes": codes, "revision": auth.setting(session).revision,
            "fixed": role.role_code == "admin"}


def validate_role_permissions(permission_codes):
    """新建与修改角色共用同一权限目录、管理员边界及查看依赖校验。"""
    codes = set(permission_codes)
    if codes - CATALOG.keys() or len(codes) != len(permission_codes):
        raise BadRequestError("权限未知或重复，请刷新目录")
    if any(CATALOG[c]["admin_only"] for c in codes):
        raise BadRequestError("管理员专用权限不能分配给普通角色")
    if any(CATALOG[c]["view_code"] not in codes for c in codes):
        raise BadRequestError("操作权限必须同时授予相应查看权限")
    return codes


def active_permission_ids(session, codes):
    """核验目录对应的启用记录齐全，避免保存不可生效的授权。"""
    ids = dict(session.execute(select(Permission.perm_code, Permission.id).where(
        Permission.perm_code.in_(codes), Permission.status == 1
    )).all())
    if set(ids) != codes:
        raise BadRequestError("权限目录尚未就绪，请联系管理员")
    return ids


def save_role(session, role_id, payload, actor, meta=None):
    audit_data = payload.model_dump(mode="json")
    with audit_service.audit(session, operator=actor, meta=meta, record=AuditRecord(
        "权限管理", "角色授权", f"修改角色 #{role_id} 的权限", audit_data
    )):
        policy = lock_policy(session, actor, payload.expected_revision)
        role = session.get(Role, role_id)
        if role is None:
            raise NotFoundError("角色不存在")
        if role.role_code == "admin":
            raise ForbiddenError("管理员角色权限固定，不能修改")
        codes = validate_role_permissions(payload.permission_codes)
        ids = active_permission_ids(session, codes)
        audit_data["before"] = role_permissions(session, role.id)["permission_codes"]
        audit_data["after"] = sorted(codes)
        session.execute(delete(RolePermission).where(RolePermission.role_id == role.id))
        session.add_all([RolePermission(role_id=role.id, permission_id=ids[c]) for c in codes])
        bump(policy, actor)
        session.flush()
        result = role_permissions(session, role.id)
        session.commit()
        return result


def settings_out(session):
    policy = auth.setting(session)
    return {"mode": "roles", "revision": policy.revision, "maker_user_id": None,
            "maker_username": None,
            "maker_status": None, "updated_by": policy.updated_by,
            "updated_at": policy.update_time}


def save_settings(session, payload, actor, meta=None):
    raise BadRequestError("已取消单独的制作人绑定，请在角色管理配置权限，再在用户管理分配角色")