From 7d3cfe924dffe72204d1091f0aaececca833abdf Mon Sep 17 00:00:00 2001 From: yumoqing Date: Thu, 10 Jul 2025 16:14:09 +0800 Subject: [PATCH] bugfix --- json/userapp.json | 2 +- models/userapp.xlsx | Bin 16514 -> 16578 bytes rbac/check_perm.py | 60 ++++++++++++++++++++++++++------------------ rbac/init.py | 3 ++- 4 files changed, 39 insertions(+), 26 deletions(-) diff --git a/json/userapp.json b/json/userapp.json index 4803a81..a2da0c7 100644 --- a/json/userapp.json +++ b/json/userapp.json @@ -6,7 +6,7 @@ "sortby":"appname", "browserfields": { "exclouded": ["id", "userid"], - "cwidth": {} + "alters": {} }, "editexclouded": [ "id", "userid" diff --git a/models/userapp.xlsx b/models/userapp.xlsx index f20392e8ae504ebd800f2d075582a6805102f536..c03a1bb9129d456b5f78e8fa14e21eaf9876b98b 100644 GIT binary patch delta 2953 zcmV;43wHE^fdRsS0kB{R1Z(}e?~`N+D}NywDyf#F(JF0IwDse$a=-~z4Q95Spk-%R5>*;RV%DZ#b~NC#(zvM zu3b0~pZfn@GQsFyUg)LTi1b-vmhtUW~tJX>c$$KYSzvbqm(dCj0cE6XdL(B3f z&26Owas<`pI^~9?F&e;BZrE|5j~rE%(<YsV5=89$Vt*>G80;O85QGCGO(MF`b80fDQX)q9PD6Znm;b@#4u7i!O>iz# zCN%D-kDg2YKlDcv8$O1R_q6uUr{M!T6*U^08|A?B&Gb9u`8Qod)}glPVN>4NwDum0 zL`CHBdH7{8o&?^tJDmDscT57}j%PE^oen}T==WxmDH*&#Fe;1^Nh^~b3TmNa6hQUP zOh4$hu@En+czUGq>>V!G-hWSq#`aVJrQ-~>470a2QS z15zb!9NJS=p{>11R@iIT-cY!uA3;b>8xGJQprWWiIg~(YpnOE|Ul8k%Q~yH8F>O`P z(yHNR&%Sw{c{8))^zf8zB_^roGlyriRDV)SP;NLTTAQApZoA~{XOF5k69M2{KUcJ2TyB;N`U!YXjmVPIh z9MEmTxRx-SA{X%8)PR;Ka`v=HMnHMdKe>}mVm^4R<7Gg0R+ooLjaduyLaTBPB zY?H()qL@P<5l}u9G7&^5l7td+M+F|gMyZ~>xEIF*N!$d9F@epc9R`Icputg-Fyv~fV7Uo}o~TmHoWgyKdpqwjQ-y;uwB7hY ze~wWLp>vi)uozBJ)u^W0ObwVNOVuR_RZl@@GE-SCS>2J<#rDFPJl>Sswbtj&i^IJ* zuUvoEp05WVOTp^K_hv*s4 z@Na$E{Y4j6sJe4;vLWXx$}1_TZ3HW;NaB^Pi=)?yN(HrpcC8VIGp?4rFV*`ff7N&Q zac?S_jQd1P!R%LbuwQSzI8u~BRx7Q&Q|Qg$FNlAG@We*3xdqsof*E68BIj^1YQnD5 zIun%9xHIDLtJSONf37#xPU%RkoOeN|gz~^}IJz8)KI{t@T_i9f!R$AAJP!|X^+Fe% zA&{t6GjZ7jMQb3U$0X4QqXvtAN|sK!%%kQwTrAOD+NGM5hjQMWN6zhpY5Z>PF5{8w zUxJ0%oAVIZMb98F=0>}?+i=RyFYAY+W9{XcP6fK8`S}m?-|jm6N@jnP@i!H-yCgRW z3N_|b6Ve0#0JjX2fe#sfGA?*+Y@Czbj+-zLh3_l%9W37`#)PFw6tZf!TJ7FcRkuIa zjv0a#8&liaWLx#!J0_4siquAnz#a_en=^P=-0qDg&)~eWO+ooMp#&OfOVz9k`t9re zXiA9>qA7*84HWbRJiT4MeY4nExA8SVAV_F@LF*9OIb&YdV1yrk+ZGypQdwt2z+1Ow zzI7nVPGmGolO$(GsD>U0b9W8HR+W498tdNkOh~eKc&2zwhBV#!MJA)9v))!=jAVB3d|CdC&6to! z(q;WuVR*(IJgc~WfhSb@I!pZK$VyMJ$tz*`5f(p}n{QQF(BDaajBw_0NJa^d!`bnN zE*GW39gbBI2US7e^ZCP+vgM-dpYIBG{wyXzte!xF41hT}CBLjSPg2CKODEXW$NNvQ zA$7kRn|NjICgL7Zm|$MtVPak(gL;NL(D?d?8U6=9J0}=_q78QRaUKtz?z^`C?8r)Z zxU>3)DnpIN&`AlE*y?avL~_6O#qJ(Jt?PhqW-*Dh8i_a(qvG$0T`BhHoswM-%*Q;> zl03bkL~ebsX2{gb55lY$;yeiX_}`Mem*6}|(*H=_^%9&1Np_Vzj{VUU7K2_o#qhEs z)_sw`0001g|Nj600RR7lR9kMtAP~Gt#04C`afOirZj)cV$-TP|8oX% zCFU&T8q7_QYccl;xejw*kn1sbgq+0O335Z^3Ric3EWTokcW5lWBW{deGK%4a#KQF@ zNpGq`rgg;|s#!xG#b@>;T*F96R@O;kS(&Yx+6r@Ud~7RWwP{-vWy3o6C~;0&Zx{*b zq|GIn|0eh!p7gn8&3TlVquqWlvAHBO*9LRVKFtD(u4CPK6uXo3CNdIwA)O>P{n^m< z?D-xuCF!Je!*rNjBGX(4iFJ~<=ezM@o*<8s`fKtMF%ohw>_Y-wNHTzvfAuz9W!)*# zWBCWOBr)O!1l`u=%(DtOH35HPn}oIll|4BW+)#WA$?X=_CLxJ-`}d~ZRyPzMZ_c?N z=UkG{_f4IAf%D4f0?`pc320%Y(whRUSBvxxB|dO1d2KWl=l~wg%iEh=SSE~v7iTQE zpui`Qq&*Y1K-&;3!`O>0G~AD(Lr1YPuHhk$Zi6isJH7#&5i-RM1TKGh;J5>(b|9h? zQi=g-KV97eq`*)^13Gw2M-=~f1GvWjxzH;Y&PIiUjh#+$FWFKY#lgMzYB08KJ8H*$ zjF_L|_vO=TUo};_yOjV`=29@>fCuBsUEAjPV(xBNb03!R%#{Lpe<+tqIO9zflIN;Y z0+O`{m*d~Y$n9$!;UGVg7>pfjoRzon!{cg!%8bxSN~S5zR&>Vblo9gL<+$4Kf*v25 zQ<{H?StQO*gXvW!hGiDy9B=f3_N*^^`mD}Rs{l~irgX_dAq+WPTWIp74V22mg>aTkX)enIkrNL&tW0Ib%SD3jZoj#w$kB$D85Oc* z3ED7?E=FI!oUf#Mno0TO06?h|lp9mU80$1=1=T0AVkKDSQWey|R4uTs6r-8W8Gkc{ zz`o~2xS+g5TZCA>2Sd*1JY^G^)&(og7DO>Y4bay)uXKx6r0;<%sCud^HWOC&{-?^Mervc41W71FdcoW;Hi>Y&dmux<1Oi<_=$%Jd6RV(fOPUcE6RbL#yf+ zEo`L(as<`pI^%|A2^zvwuGoGdM2@PftC|b265{!%2#-2BPZdm{_LssiRZ_#ovNRyI z9re%3s=*%T5=89$X3sTO4E7F42*QDprZJuADK)uME0G|4ry)MPDV}k)!GCH-Q(VZ5 z35|Q|qsLPJ5B<^9hL0iSEv@bIVfesK#jVDsMmg|&Gx-5|{zI3Lb*OE&+mtspt%Juh zRWW&d35UUO7)HK(9Y$mKngkQ~EI1pwB)al~;n<6U%d=MqMn!QdX>IadK`nHG0;t}R z=_g&c7UIP<&-OH4yxry6`+vdE+FotIwsqZew$l63+o`jD;AJLP5Q0ZMh-%Z$2Ln4@ zHP#27nLI)M&|gB2TtZ;2-84Z+El;5WEjJG>!?dkmYN z2~3;2Q#Lx+bphRL1Krs+)F$a5?AU%p-DJeZ*ms|ECNk)boj3Ha&Pm%p^j=cIv!dwA#_9enT)XE?;ER0K5s4XdxVbK~EDw6uz7IA2xg71Z*pb zQEbbB#KfBiJsCsB-Dx{vcXr*KC2(t02#IJpfF+1QA|MB85dj4n_%DRnr6>P_Z@Z1g zeS;=&>%RBRH}8G#y?HH+OggqULH&Tayr|~~bGk;k=~|3eiu&V6_XqCiS|A9wi0yJ( z)Td~mkCbkI-Y5it(BLc&ih5NDZ`d#bvq~Kj47wiW;3>PlLj-*K6(jI`O01wtsc>xL zRxWqja0uhNX1XC4aBqG{*Fw&ohjcWx+!@kKg@Ba`qQr?q3x+5ajO07D2_|f0^nB(J ze=3VLiJ-PyK@?LSVz4Q%i0UxoB8#@DsWS7>w#hSp9EwHDB(xEW={gSOBFM4_!q1vO zMP!>Gc8Fq5fJ8v~P{>3Op-2)+$Xyk9>=LE=D&k%i42;;gEc4 zEAvXiDIx`{u8)hxK<%Wnv*;u!L;($snuMXFwhC4rSLlf<#jHu($GEpEKC@If7(>U) zI?9ZH+6Y~?U4q4MLsg?%YBM!qmTXm*XsVuq&SaLdTC(1f^`*|@sXW@0+l~0k=J}7^ zEU#RD*I8&rpK8(S#?SVgoIa4XwmhBgtR2ght<-z5wiPeG>W%>LM9uwZaR*Qrb1&ul zJvlRtIhT95#zDNWbyiye=Cj%dIXffUHH2<|E+;Ww7GQZi`q-B3I;u-D{KMU#hLvwp zyt*AN?m?)ia6QJ0)?T#qR>=z)%lS817lf&1Or_~63A%t*Y5G8+X1SE8n@F!DODFOA z5uA@d@BF4qDpYTsA8*L{IpvcSH8!G^RV4As*7@OUMWv#~L8q~og)^>}d?4TdBtLL} z_i2AVm&=|>nWEWm$g$syUmPmRAnSAS?g{i}^bf@UL3m=**t{xiO~K5EzE*a*cwoV< z)4LN?)VVwA^4{vzjlb8MYNvFiR?fSilS1h*U5*}yFo1pGp@#%UB%1v$j~3uZR=wm1 z&JajctC@IgoT4?5(qoeJ!nDD%*V0KTkNMOZgNG%3ORuOV<%yiv=aKWRB#l4KeZ_d> z`qyZ2_BuQU{QD~X0+SFb6tmqVHwg+D;2q_(1ONaV43mKm8GkY^cx`N)lU;9{FcgOG zC+$C2zE6w^rA-u4ZJnz2W}4Q0Ts!6vtk^iSohIGX|Gr}aBvPa;Dgygpc%Snge3;+v zjV90Fys}L}`8c5j8fi<_tP1-5+x_T<5+6iU3T+!G=nHsyyLkU@zO!!aYk)wI(D;JZ zA#7%hd0B%Iet&E?(BPBGIwJz!x)t*q2cm36Mzb_Ya%O~T=z%bEmoRKqDG8sf+!|=Y z0pdW5fc|~0Hom7Bc?r%4x880>(wYq-mP)Je(n2XQa`w1ttP@L(b?umyGCO!aFMrCWOvr(BUjIcHo-qf{Dt~U^5tY8p62BT)=@B-0BP<_a z@pHM^R+R<)lXS-jXC8-Sl<+v59ItdSFBR@^tcp0O3i^T19qClB9Ub^-(QOc`UEjxC zW%p5K$A3;kuE3muT#dO2at-FbAlG8<8*&}yX2?m*{Xnh{TxRPI#g}aH77fL>#Eo`a z2GPHe7=O6GAn8q|&$KFeLltYtq4>^@gsT||$;wzsC@Zm5QCofv=I5~zRvV8+QP!+; zhZ5(c^_r28PMTDb_^-YHey7h3YtEs>9PRddiAg1ixyGBT^EeAAx|Vh4Q0z|9m&i!y zgS3*+^u3|$*!vwy(uwK%>CmY}#<}(qVJDG2#XUtA+^qvr0HM0e{0y zLfe7Lo*W8J6yHK}yM;ALNuu5Uy=lAE4aLWsbMD7Em*k7Ru9GitURhHhIw2?lBdkTmWQH{aE`NF8xC5rmNJK}Z6eF_vbafAq0z(ZNOz@aaDE{#V zaN7U5&?{$7t-_&+osMzO*-{MR=-zuZ8r!y=w9`ID%un(A>hYzonkv)XN&qTzDVT7; zgLUPuZF77!ceks#536|QN`bsPlq)5i^|lJhQ&lMe$*TvKIx8T?;ER0K5s4Sw2z$t&^-iIs)=2 zlQ1bIlMO#A0`w`9e?JwIPCpeK7~mb{v;+VE8w>yd7ytkO00000000000087IlYc)% z0?sm%#Xmm*3X=suBOI%S2>Db2003zM000pH000000000000000_&1Y8Ks^G3I+Ncz PDU+-~5C*3^00000uvKLO diff --git a/rbac/check_perm.py b/rbac/check_perm.py index 1978369..f4d899c 100644 --- a/rbac/check_perm.py +++ b/rbac/check_perm.py @@ -7,6 +7,7 @@ from appPublic.rc4 import password, unpassword from appPublic.jsonConfig import getConfig from appPublic.log import debug, exception from appPublic.dictObject import DictObject +from appPublic.timeUtils import curDateString from appPublic.uniqueID import getID from ahserver.auth_api import AuthAPI, user_login from ahserver.globalEnv import password_encode @@ -137,30 +138,34 @@ async def checkUserPassword(request, username, password): return True return False +async def basic_auth(sor, auth): + auther = BasicAuth('x') + m = auther.decode(auth) + username = m.login + password = password_encode(m.password) + sql = "select * from users where username=${username}$ and password=${password}$" + recs = await sor.sqlExe(sql, {'username':username,'password':password}) + if len(recs) < 1: + return None + return recs[0].id + +async def bearer_auth(sor, auth): + # apikey = get_apikey_from_token(auth[7:]) + apikey = auth[7:] + if apikey is None: + return None + sql = "select * from userapp where apikey=${apikey}$ and expired_date > ${today}$" + recs = await sor.sqlExe(sql, {"apikey":apikey, 'today': curDateString()}) + if len(recs) < 1: + return None + return recs[0].userid + async def getAuthenticationUserid(sor, request): auth = request.headers.get('Authentication') - if auth is None: - return None - if auth.startswith('Basic '): - auther = BasicAuth('x') - m = auther.decode(auth) - username = m.login - password = password_encode(m.password) - sql = "select * from users where username=${username}$ and password=${password}$" - recs = await sor.sqlExe(sql, {'username':username,'password':password}) - if len(recs) < 1: - return None - return recs[0].id - - if auth.startswith('Bearer '): - apikey = get_apikey_from_token(auth[7:]) - if apikey is None: - return None - sql = "select * from userapp where apikey=${apikey}$" - recs = await sor.sqlExe(sql, {"apikey":apikey}) - if len(recs) < 1: - return None - return recs[0].userid + for h,f in registered_auth_methods.items(): + if auth.startswith(h): + return await f(auth) + return None async def objcheckperm(obj, request, userid, path): debug(f'check permission: {userid=}, {path=}') @@ -175,12 +180,12 @@ where c.userid = ${userid}$ dbname = await get_dbname() db = DBPools() async with db.sqlorContext(dbname) as sor: + if userid is None: + userid = await getAuthenticationUserid(sor, request) perms = await sor.R('permission', {'path':path}) if len(perms) == 0: debug(f'{path=} not found in permission, can access') return True - if userid is None: - userid = await getAuthenticationUserid(sor, request) if userid is None: debug(f'{userid=} is None, can not access {path=}') return False @@ -196,3 +201,10 @@ where c.userid = ${userid}$ debug(f'error happened {userid}, {path}') return False +registered_auth_methods = { + "Basic ": basic_auth, + "Bearer ": bearer_auth +} +register_auth_method(heading, func): + registered_auth_methods[heading] = func + diff --git a/rbac/init.py b/rbac/init.py index 804c782..383ec85 100644 --- a/rbac/init.py +++ b/rbac/init.py @@ -1,6 +1,6 @@ from ahserver.auth_api import AuthAPI from ahserver.serverenv import ServerEnv -from rbac.check_perm import objcheckperm, get_user_roles, checkUserPassword, register_user +from rbac.check_perm import objcheckperm, get_user_roles, checkUserPassword, register_user, register_auth_method from rbac.set_role_perms import set_role_perm, set_role_perms def load_rbac(): @@ -11,4 +11,5 @@ def load_rbac(): env.register_user = register_user env.set_role_perm = set_role_perm env.set_role_perms = set_role_perms + env.register_auth_method = register_auth_method