45 lines
1.6 KiB
Python
45 lines
1.6 KiB
Python
|
# -*- coding: utf-8 -*-
|
||
|
|
"""领域层 · RBAC 判定规则（纯函数，不依赖 HTTP/数据库）。
|
||
|
|
|
||
|
|
四层架构：领域层定义核心业务模型与规则；接口层守卫（rbac.py 的 Depends
|
||
|
|
工厂）只负责调用这些规则并映射为 HTTP 异常，不承载判定语义。
|
||
|
|
"""
|
||
|
|
from __future__ import annotations
|
||
|
|
|
||
|
|
# 数据范围层级（越靠前权限越大）
|
||
|
|
SCOPE_ORDER = ("province", "city", "district")
|
||
|
|
|
||
|
|
|
||
|
|
def role_allowed(user: dict, *roles: str) -> bool:
|
||
|
|
"""当前用户业务角色是否 ∈ 允许角色集合。"""
|
||
|
|
return user.get("role") in set(roles)
|
||
|
|
|
||
|
|
|
||
|
|
def sub_role_allowed(user: dict, *sub_roles: str) -> bool:
|
||
|
|
"""当前用户子角色是否 ∈ 允许子角色集合（如 op_super_admin）。"""
|
||
|
|
return user.get("sub_role") in set(sub_roles)
|
||
|
|
|
||
|
|
|
||
|
|
def permission_granted(user: dict, perm: str) -> bool:
|
||
|
|
"""当前用户是否拥有权限码 perm。"""
|
||
|
|
return perm in user.get("permissions", [])
|
||
|
|
|
||
|
|
|
||
|
|
def is_government(user: dict) -> bool:
|
||
|
|
return user.get("role") == "government"
|
||
|
|
|
||
|
|
|
||
|
|
def scope_level_ok(user: dict, min_level: str | None) -> bool:
|
||
|
|
"""政务数据范围层级校验：不低于 min_level。"""
|
||
|
|
if not user.get("region_id"):
|
||
|
|
return False
|
||
|
|
if not min_level or not user.get("scope_level"):
|
||
|
|
return True
|
||
|
|
cur = user["scope_level"]
|
||
|
|
return cur in SCOPE_ORDER and SCOPE_ORDER.index(cur) <= SCOPE_ORDER.index(min_level)
|
||
|
|
|
||
|
|
|
||
|
|
def region_in_scope(user: dict, region_id: str | None) -> bool:
|
||
|
|
"""目标区域是否落在当前用户数据范围内。"""
|
||
|
|
return bool(region_id) and region_id in user.get("scope_region_ids", [])
|