From c69f620aef24126750682119fd3fe314d01189a1 Mon Sep 17 00:00:00 2001 From: wxg0103 <727495428@qq.com> Date: Wed, 11 Nov 2026 17:11:22 +0800 Subject: [PATCH] refactor: update workspace manage role usage in permissions --- .../tests/test_user_workspace_permission.py | 32 +++++++++++++++++++ apps/users/views/system_user_group.py | 24 ++++++++++---- apps/users/views/user.py | 8 ++--- 3 files changed, 54 insertions(+), 10 deletions(-) create mode 100644 apps/users/tests/test_user_workspace_permission.py diff --git a/apps/users/tests/test_user_workspace_permission.py b/apps/users/tests/test_user_workspace_permission.py new file mode 100644 index 00000000000..3d831d4a614 --- /dev/null +++ b/apps/users/tests/test_user_workspace_permission.py @@ -0,0 +1,32 @@ +from types import SimpleNamespace +from unittest.mock import patch + +from django.test import SimpleTestCase + +from common.auth.struct.auth import Auth +from common.exception.app_exception import AppUnauthorizedFailed +from users.views.user import WorkspaceUserListView + + +class WorkspaceUserListPermissionTests(SimpleTestCase): + def _request(self, roles): + return SimpleNamespace( + auth=Auth(roles=set(roles), permissions={}), + user=SimpleNamespace(id="user-1"), + query_params=SimpleNamespace(get=lambda *args, **kwargs: None), + ) + + def test_workspace_scoped_manage_role_can_access_user_list(self): + request = self._request(["WORKSPACE_MANAGE:w:workspace-1"]) + with patch("users.views.user.UserManageSerializer.get_user_list", return_value=[]): + try: + result = WorkspaceUserListView().get(request, workspace_id="workspace-1") + except AppUnauthorizedFailed as exc: + self.fail(f"workspace user denied despite matching workspace role: {exc}") + self.assertEqual(result.status_code, 200) + + def test_global_workspace_role_alone_cannot_access_workspace_user_list(self): + request = self._request(["WORKSPACE_MANAGE"]) + with patch("users.views.user.UserManageSerializer.get_user_list", return_value=[]): + with self.assertRaises(AppUnauthorizedFailed): + WorkspaceUserListView().get(request, workspace_id="workspace-1") diff --git a/apps/users/views/system_user_group.py b/apps/users/views/system_user_group.py index 5f704168c2c..0ce74f4722d 100644 --- a/apps/users/views/system_user_group.py +++ b/apps/users/views/system_user_group.py @@ -61,7 +61,7 @@ class SystemUserGroupView(APIView): PermissionConstants.SYSTEM_USER_GROUP_CREATE, PermissionConstants.SYSTEM_USER_GROUP_EDIT, RoleConstants.ADMIN, - RoleConstants.WORKSPACE_MANAGE, + RoleConstants.WORKSPACE_MANAGE.get_workspace_role(), ) @log( menu="IAM/System User Group", @@ -87,7 +87,11 @@ def post(self, request: Request, workspace_id: str): responses=UserGroupListApi.get_response(), tags=["IAM/System User Group"], ) - @has_permissions(PermissionConstants.SYSTEM_USER_GROUP_READ, RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE) + @has_permissions( + PermissionConstants.SYSTEM_USER_GROUP_READ, + RoleConstants.ADMIN, + RoleConstants.WORKSPACE_MANAGE.get_workspace_role(), + ) def get(self, request: Request, workspace_id: str): return result.success(SystemUserGroupCreateSerializer.Query(data={"workspace_id": workspace_id}).list()) @@ -104,7 +108,9 @@ class Delete(APIView): tags=["IAM/System User Group"], ) @has_permissions( - PermissionConstants.SYSTEM_USER_GROUP_DELETE, RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE + PermissionConstants.SYSTEM_USER_GROUP_DELETE, + RoleConstants.ADMIN, + RoleConstants.WORKSPACE_MANAGE.get_workspace_role(), ) @log( menu="IAM/System User Group", @@ -132,7 +138,9 @@ class AddMember(APIView): tags=["IAM/System User Group"], ) @has_permissions( - PermissionConstants.SYSTEM_USER_GROUP_ADD_MEMBER, RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE + PermissionConstants.SYSTEM_USER_GROUP_ADD_MEMBER, + RoleConstants.ADMIN, + RoleConstants.WORKSPACE_MANAGE.get_workspace_role(), ) @log( menu="IAM/System User Group", @@ -163,7 +171,9 @@ class RemoveMember(APIView): tags=["IAM/System User Group"], ) @has_permissions( - PermissionConstants.SYSTEM_USER_GROUP_REMOVE_MEMBER, RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE + PermissionConstants.SYSTEM_USER_GROUP_REMOVE_MEMBER, + RoleConstants.ADMIN, + RoleConstants.WORKSPACE_MANAGE.get_workspace_role(), ) @log( menu="IAM/System User Group", @@ -193,7 +203,9 @@ class UserList(APIView): responses=SystemUserGroupUserListPageResponse, ) @has_permissions( - PermissionConstants.SYSTEM_USER_GROUP_READ, RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE + PermissionConstants.SYSTEM_USER_GROUP_READ, + RoleConstants.ADMIN, + RoleConstants.WORKSPACE_MANAGE.get_workspace_role(), ) def get(self, request: Request, workspace_id: str, user_group_id: str, current_page: int, page_size: int): d = UserGroupListPageSerializer.Query( diff --git a/apps/users/views/user.py b/apps/users/views/user.py index 27f95007b8f..803f64338c6 100644 --- a/apps/users/views/user.py +++ b/apps/users/views/user.py @@ -180,12 +180,12 @@ class WorkspaceUserListView(APIView): responses=WorkspaceUserAPI.get_response(), ) @has_permissions( - RoleConstants.WORKSPACE_MANAGE, + RoleConstants.WORKSPACE_MANAGE.get_workspace_role(), RoleConstants.ADMIN, RoleConstants.EXTENDS_ADMIN, - RoleConstants.EXTENDS_WORKSPACE_MANAGE, - RoleConstants.USER, - RoleConstants.EXTENDS_USER, + RoleConstants.EXTENDS_WORKSPACE_MANAGE.get_workspace_role(), + RoleConstants.USER.get_workspace_role(), + RoleConstants.EXTENDS_USER.get_workspace_role(), ) def get(self, request: Request, workspace_id): nick_name = request.query_params.get("nick_name", None)