36 lines
1.0 KiB
Python
36 lines
1.0 KiB
Python
|
"""通用 FastAPI 依赖"""
|
|||
|
|
from __future__ import annotations
|
|||
|
|
|
|||
|
|
from fastapi import Depends, HTTPException, status
|
|||
|
|
|
|||
|
|
from app.core.roles import ADMIN_ROLES
|
|||
|
|
from app.services.auth_service import get_current_user
|
|||
|
|
|
|||
|
|
|
|||
|
|
def require_roles(*roles: str):
|
|||
|
|
"""生成「限定角色」依赖，避免同一个内联判断被复制到每个端点。
|
|||
|
|
|
|||
|
|
用法::
|
|||
|
|
|
|||
|
|
@router.get("/x")
|
|||
|
|
async def x(current_user: dict = Depends(require_admin)):
|
|||
|
|
...
|
|||
|
|
|
|||
|
|
失败一律 403 且不透露允许的角色集合（避免给探测者提供线索）。
|
|||
|
|
"""
|
|||
|
|
allowed = frozenset(roles)
|
|||
|
|
|
|||
|
|
async def _guard(current_user: dict = Depends(get_current_user)) -> dict:
|
|||
|
|
if (current_user or {}).get("role") not in allowed:
|
|||
|
|
raise HTTPException(
|
|||
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|||
|
|
detail="当前角色无权访问该接口",
|
|||
|
|
)
|
|||
|
|
return current_user
|
|||
|
|
|
|||
|
|
return _guard
|
|||
|
|
|
|||
|
|
|
|||
|
|
# 审计日志等高权限接口复用同一实例
|
|||
|
|
require_admin = require_roles(*ADMIN_ROLES)
|