xiaoxia-saas/packages/domain/permissions.py

"""
权限验证辅助函数
用于检查用户在工作空间中的权限
"""

from typing import Optional

from packages.domain.entities import WorkspaceMemberRole


class PermissionChecker:
    """权限检查器"""

    def __init__(self, workspace_member_repository):
        self.workspace_member_repository = workspace_member_repository

    def check_workspace_access(
        self,
        workspace_id: str,
        user_id: str,
    ) -> tuple[bool, Optional[str]]:
        """
        检查用户是否可以访问工作空间

        Args:
            workspace_id: 工作空间 ID
            user_id: 用户 ID

        Returns:
            (是否有权限, 用户角色)
        """
        member = self.workspace_member_repository.find_by_workspace_and_user(
            workspace_id,
            user_id,
        )

        if not member:
            return False, None

        return True, member.role

    def check_is_owner(
        self,
        workspace_id: str,
        user_id: str,
    ) -> bool:
        """
        检查用户是否是工作空间 Owner

        Args:
            workspace_id: 工作空间 ID
            user_id: 用户 ID

        Returns:
            是否是 Owner
        """
        member = self.workspace_member_repository.find_by_workspace_and_user(
            workspace_id,
            user_id,
        )

        return member is not None and member.role == WorkspaceMemberRole.OWNER

    def check_is_admin_or_owner(
        self,
        workspace_id: str,
        user_id: str,
    ) -> bool:
        """
        检查用户是否是工作空间 Admin 或 Owner

        Args:
            workspace_id: 工作空间 ID
            user_id: 用户 ID

        Returns:
            是否是 Admin 或 Owner
        """
        member = self.workspace_member_repository.find_by_workspace_and_user(
            workspace_id,
            user_id,
        )

        return member is not None and member.role in [
            WorkspaceMemberRole.OWNER,
            WorkspaceMemberRole.ADMIN,
        ]

    def check_can_manage_members(
        self,
        workspace_id: str,
        user_id: str,
    ) -> bool:
        """
        检查用户是否可以管理成员（邀请、移除、修改角色）

        Args:
            workspace_id: 工作空间 ID
            user_id: 用户 ID

        Returns:
            是否可以管理成员
        """
        return self.check_is_admin_or_owner(workspace_id, user_id)

    def check_can_edit_workspace(
        self,
        workspace_id: str,
        user_id: str,
    ) -> bool:
        """
        检查用户是否可以编辑工作空间（修改名称、设置等）

        Args:
            workspace_id: 工作空间 ID
            user_id: 用户 ID

        Returns:
            是否可以编辑工作空间
        """
        return self.check_is_admin_or_owner(workspace_id, user_id)

    def check_can_create_project(
        self,
        workspace_id: str,
        user_id: str,
    ) -> bool:
        """
        检查用户是否可以创建项目

        Args:
            workspace_id: 工作空间 ID
            user_id: 用户 ID

        Returns:
            是否可以创建项目
        """
        member = self.workspace_member_repository.find_by_workspace_and_user(
            workspace_id,
            user_id,
        )

        # Owner, Admin, Member 可以创建项目，Viewer 不可以
        return member is not None and member.role in [
            WorkspaceMemberRole.OWNER,
            WorkspaceMemberRole.ADMIN,
            WorkspaceMemberRole.MEMBER,
        ]

    def check_can_edit_project(
        self,
        workspace_id: str,
        user_id: str,
    ) -> bool:
        """
        检查用户是否可以编辑项目

        Args:
            workspace_id: 工作空间 ID
            user_id: 用户 ID

        Returns:
            是否可以编辑项目
        """
        # 与创建项目权限相同
        return self.check_can_create_project(workspace_id, user_id)

    def check_can_delete_project(
        self,
        workspace_id: str,
        user_id: str,
    ) -> bool:
        """
        检查用户是否可以删除项目

        Args:
            workspace_id: 工作空间 ID
            user_id: 用户 ID

        Returns:
            是否可以删除项目
        """
        # 只有 Owner 和 Admin 可以删除项目
        return self.check_is_admin_or_owner(workspace_id, user_id)

    def check_can_view_workspace(
        self,
        workspace_id: str,
        user_id: str,
    ) -> bool:
        """
        检查用户是否可以查看工作空间

        Args:
            workspace_id: 工作空间 ID
            user_id: 用户 ID

        Returns:
            是否可以查看工作空间
        """
        has_access, _ = self.check_workspace_access(workspace_id, user_id)
        return has_access


# 权限级别定义
class Permission:
    """权限常量"""

    # 工作空间权限
    WORKSPACE_VIEW = "workspace:view"
    WORKSPACE_EDIT = "workspace:edit"
    WORKSPACE_DELETE = "workspace:delete"
    WORKSPACE_MANAGE_SUBSCRIPTION = "workspace:manage_subscription"

    # 成员权限
    MEMBER_VIEW = "member:view"
    MEMBER_INVITE = "member:invite"
    MEMBER_REMOVE = "member:remove"
    MEMBER_UPDATE_ROLE = "member:update_role"

    # 项目权限
    PROJECT_VIEW = "project:view"
    PROJECT_CREATE = "project:create"
    PROJECT_EDIT = "project:edit"
    PROJECT_DELETE = "project:delete"

    # 资产权限
    ASSET_VIEW = "asset:view"
    ASSET_UPLOAD = "asset:upload"
    ASSET_EDIT = "asset:edit"
    ASSET_DELETE = "asset:delete"


# 角色权限映射
ROLE_PERMISSIONS = {
    WorkspaceMemberRole.OWNER: [
        # 所有权限
        Permission.WORKSPACE_VIEW,
        Permission.WORKSPACE_EDIT,
        Permission.WORKSPACE_DELETE,
        Permission.WORKSPACE_MANAGE_SUBSCRIPTION,
        Permission.MEMBER_VIEW,
        Permission.MEMBER_INVITE,
        Permission.MEMBER_REMOVE,
        Permission.MEMBER_UPDATE_ROLE,
        Permission.PROJECT_VIEW,
        Permission.PROJECT_CREATE,
        Permission.PROJECT_EDIT,
        Permission.PROJECT_DELETE,
        Permission.ASSET_VIEW,
        Permission.ASSET_UPLOAD,
        Permission.ASSET_EDIT,
        Permission.ASSET_DELETE,
    ],
    WorkspaceMemberRole.ADMIN: [
        Permission.WORKSPACE_VIEW,
        Permission.WORKSPACE_EDIT,
        Permission.MEMBER_VIEW,
        Permission.MEMBER_INVITE,
        Permission.MEMBER_REMOVE,
        Permission.MEMBER_UPDATE_ROLE,
        Permission.PROJECT_VIEW,
        Permission.PROJECT_CREATE,
        Permission.PROJECT_EDIT,
        Permission.PROJECT_DELETE,
        Permission.ASSET_VIEW,
        Permission.ASSET_UPLOAD,
        Permission.ASSET_EDIT,
        Permission.ASSET_DELETE,
    ],
    WorkspaceMemberRole.MEMBER: [
        Permission.WORKSPACE_VIEW,
        Permission.MEMBER_VIEW,
        Permission.PROJECT_VIEW,
        Permission.PROJECT_CREATE,
        Permission.PROJECT_EDIT,
        Permission.ASSET_VIEW,
        Permission.ASSET_UPLOAD,
        Permission.ASSET_EDIT,
        Permission.ASSET_DELETE,
    ],
    WorkspaceMemberRole.VIEWER: [
        Permission.WORKSPACE_VIEW,
        Permission.MEMBER_VIEW,
        Permission.PROJECT_VIEW,
        Permission.ASSET_VIEW,
    ],
}


def has_permission(role: str, permission: str) -> bool:
    """
    检查角色是否有指定权限

    Args:
        role: 用户角色
        permission: 权限标识

    Returns:
        是否有权限
    """
    permissions = ROLE_PERMISSIONS.get(role, [])
    return permission in permissions