Pine
6bb988cc3e
1. capabilities 写入 JWT，避免每次请求查库 2. 移除 service 账号类型，非 operator/carrier 统一归为 opc_member 3. 前端统一基于 capabilities 判断权限 4. 清理登录接口死代码，恢复账号密码登录 5. 移除 enterprise/provider/government/investor/developer 角色 6. 清理 seed.py 中多余角色和权限定义 7. 重写 rbac_portals.py 只保留 carrier 路由
86 lines
3.2 KiB
Python
86 lines
3.2 KiB
Python
# -*- coding: utf-8 -*-
|
|
"""组织/租户端点：企业 / 载体 / 服务商（按角色 + 组织作用域）。"""
|
|
from __future__ import annotations
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException
|
|
from pydantic import BaseModel
|
|
|
|
from ..dependencies import get_db
|
|
from ..schemas.org import OrgMemberAdd
|
|
from ...rbac import require_roles
|
|
from ...infrastructure.repositories import Database
|
|
|
|
router = APIRouter(tags=["org"])
|
|
|
|
|
|
@router.get("/org/me", summary="当前组织信息")
|
|
async def org_me(
|
|
db: Database = Depends(get_db),
|
|
user: dict = Depends(require_roles("opc_member", "carrier", "operator")),
|
|
):
|
|
org = await db.orgs.get(user["org_id"]) if user.get("org_id") else None
|
|
region = await db.regions.get(user["region_id"]) if user.get("region_id") else None
|
|
return {
|
|
"user_id": user["id"],
|
|
"role": user["role"],
|
|
"sub_role": user["sub_role"],
|
|
"org": org,
|
|
"region": region,
|
|
}
|
|
|
|
|
|
@router.get("/carrier/enterprises", summary="载体下辖企业")
|
|
async def carrier_enterprises(
|
|
db: Database = Depends(get_db),
|
|
user: dict = Depends(require_roles("carrier")),
|
|
):
|
|
"""返回绑定到当前载体（parent_id == 载体 org_id）的企业。"""
|
|
if not user.get("org_id"):
|
|
return []
|
|
return await db.orgs.list_by_parent(user["org_id"])
|
|
|
|
|
|
# ── 机构成员（机构主账号 + 机构内子账号，账号可挂多机构）────────────────────
|
|
|
|
@router.get("/org/{org_id}/members", summary="机构成员列表")
|
|
async def org_members(
|
|
org_id: str,
|
|
db: Database = Depends(get_db),
|
|
user: dict = Depends(require_roles("carrier", "operator")),
|
|
):
|
|
# 机构管理员本人 或 平台运营 可查看
|
|
if user.get("role") not in ("operator",) and not await db.org_members.is_admin(org_id, user["id"]):
|
|
raise HTTPException(status_code=403, detail="Forbidden: not org admin")
|
|
return {"items": await db.org_members.list_for_org(org_id)}
|
|
|
|
|
|
@router.post("/org/{org_id}/members", summary="添加机构成员(子账号)")
|
|
async def org_add_member(
|
|
org_id: str,
|
|
req: OrgMemberAdd,
|
|
db: Database = Depends(get_db),
|
|
user: dict = Depends(require_roles("carrier", "operator")),
|
|
):
|
|
if user.get("role") not in ("operator",) and not await db.org_members.is_admin(org_id, user["id"]):
|
|
raise HTTPException(status_code=403, detail="Forbidden: not org admin")
|
|
target_id = req.user_id
|
|
if not target_id and req.username:
|
|
found = await db.users.get_by_username(req.username)
|
|
if found is None:
|
|
raise HTTPException(status_code=404, detail="账号不存在")
|
|
target_id = found["id"]
|
|
if not target_id:
|
|
raise HTTPException(status_code=400, detail="缺少 user_id 或 username")
|
|
return await db.org_members.add_member(org_id, target_id, req.role, req.is_admin)
|
|
|
|
|
|
@router.get("/me/orgs", summary="我加入的机构")
|
|
async def my_orgs(
|
|
db: Database = Depends(get_db),
|
|
user: dict = Depends(require_roles("opc_member", "carrier", "operator")),
|
|
):
|
|
"""返回当前账号挂靠的所有机构及成员角色（支持一账号多机构）。"""
|
|
from ...services.org_service import OrgService
|
|
|
|
return await OrgService(db).my_orgs(user["id"])
|