jumpserver/apps/perms/utils/asset/user_permission.py

from collections import defaultdict
from typing import List, Tuple
import time

from django.core.cache import cache
from django.conf import settings
from django.db.models import Q, QuerySet

from common.db.models import output_as_string, UnionQuerySet
from common.utils.common import lazyproperty, timeit
from assets.utils import NodeAssetsUtil
from common.utils import get_logger
from common.decorator import on_transaction_commit
from orgs.utils import tmp_to_org, current_org, ensure_in_real_or_default_org, tmp_to_root_org
from assets.models import (
    Asset, FavoriteAsset, AssetQuerySet, NodeQuerySet
)
from orgs.models import Organization
from perms.models import (
    AssetPermission, PermNode, UserAssetGrantedTreeNodeRelation,
)
from users.models import User
from perms.locks import UserGrantedTreeRebuildLock

NodeFrom = UserAssetGrantedTreeNodeRelation.NodeFrom
NODE_ONLY_FIELDS = ('id', 'key', 'parent_key', 'org_id')

logger = get_logger(__name__)


def get_user_all_asset_perm_ids(user) -> set:
    asset_perm_ids = set()
    user_perm_id = AssetPermission.users.through.objects\
        .filter(user_id=user.id) \
        .values_list('assetpermission_id', flat=True) \
        .distinct()
    asset_perm_ids.update(user_perm_id)

    group_ids = user.groups.through.objects \
        .filter(user_id=user.id) \
        .values_list('usergroup_id', flat=True) \
        .distinct()
    group_ids = list(group_ids)
    groups_perm_id = AssetPermission.user_groups.through.objects\
        .filter(usergroup_id__in=group_ids)\
        .values_list('assetpermission_id', flat=True) \
        .distinct()
    asset_perm_ids.update(groups_perm_id)

    asset_perm_ids = AssetPermission.objects.filter(
        id__in=asset_perm_ids).valid().values_list('id', flat=True)
    asset_perm_ids = set(asset_perm_ids)
    return asset_perm_ids


class QuerySetStage:
    def __init__(self):
        self._prefetch_related = set()
        self._only = ()
        self._filters = []
        self._querysets_and = []
        self._querysets_or = []
        self._order_by = None
        self._annotate = []
        self._before_union_merge_funs = set()
        self._after_union_merge_funs = set()

    def annotate(self, *args, **kwargs):
        self._annotate.append((args, kwargs))
        self._before_union_merge_funs.add(self._merge_annotate)
        return self

    def prefetch_related(self, *lookups):
        self._prefetch_related.update(lookups)
        self._before_union_merge_funs.add(self._merge_prefetch_related)
        return self

    def only(self, *fields):
        self._only = fields
        self._before_union_merge_funs.add(self._merge_only)
        return self

    def order_by(self, *field_names):
        self._order_by = field_names
        self._after_union_merge_funs.add(self._merge_order_by)
        return self

    def filter(self, *args, **kwargs):
        self._filters.append((args, kwargs))
        self._before_union_merge_funs.add(self._merge_filters)
        return self

    def and_with_queryset(self, qs: QuerySet):
        assert isinstance(qs, QuerySet), f'Must be `QuerySet`'
        self._order_by = qs.query.order_by
        self._after_union_merge_funs.add(self._merge_order_by)
        self._querysets_and.append(qs.order_by())
        self._before_union_merge_funs.add(self._merge_querysets_and)
        return self

    def or_with_queryset(self, qs: QuerySet):
        assert isinstance(qs, QuerySet), f'Must be `QuerySet`'
        self._order_by = qs.query.order_by
        self._after_union_merge_funs.add(self._merge_order_by)
        self._querysets_or.append(qs.order_by())
        self._before_union_merge_funs.add(self._merge_querysets_or)
        return self

    def merge_multi_before_union(self, *querysets):
        ret = []
        for qs in querysets:
            qs = self.merge_before_union(qs)
            ret.append(qs)
        return ret

    def _merge_only(self, qs: QuerySet):
        if self._only:
            qs = qs.only(*self._only)
        return qs

    def _merge_filters(self, qs: QuerySet):
        if self._filters:
            for args, kwargs in self._filters:
                qs = qs.filter(*args, **kwargs)
        return qs

    def _merge_querysets_and(self, qs: QuerySet):
        if self._querysets_and:
            for qs_and in self._querysets_and:
                qs &= qs_and
        return qs

    def _merge_annotate(self, qs: QuerySet):
        if self._annotate:
            for args, kwargs in self._annotate:
                qs = qs.annotate(*args, **kwargs)
        return qs

    def _merge_querysets_or(self, qs: QuerySet):
        if self._querysets_or:
            for qs_or in self._querysets_or:
                qs |= qs_or
        return qs

    def _merge_prefetch_related(self, qs: QuerySet):
        if self._prefetch_related:
            qs = qs.prefetch_related(*self._prefetch_related)
        return qs

    def _merge_order_by(self,  qs: QuerySet):
        if self._order_by is not None:
            qs = qs.order_by(*self._order_by)
        return qs

    def merge_before_union(self, qs: QuerySet) -> QuerySet:
        assert isinstance(qs, QuerySet), f'Must be `QuerySet`'
        for fun in self._before_union_merge_funs:
            qs = fun(qs)
        return qs

    def merge_after_union(self, qs: QuerySet) -> QuerySet:
        for fun in self._after_union_merge_funs:
            qs = fun(qs)
        return qs

    def merge(self, qs: QuerySet) -> QuerySet:
        qs = self.merge_before_union(qs)
        qs = self.merge_after_union(qs)
        return qs


class UserGrantedTreeRefreshController:
    key_template = 'perms.user.node_tree.builded_orgs.user_id:{user_id}'

    def __init__(self, user):
        self.user = user
        self.key = self.key_template.format(user_id=user.id)
        self.client = self.get_redis_client()

    @classmethod
    def get_redis_client(cls):
        return cache.client.get_client(write=True)

    def get_need_refresh_org_ids(self):
        org_ids = self.client.smembers(self.key)
        return {org_id.decode() for org_id in org_ids}

    def set_all_orgs_as_builed(self):
        self.client.sadd(self.key, *self.orgs_id)

    def have_need_refresh_orgs(self):
        builded_org_ids = self.client.smembers(self.key)
        builded_org_ids = {org_id.decode() for org_id in builded_org_ids}
        have = self.orgs_id - builded_org_ids
        return have

    def get_need_refresh_orgs_and_fill_up(self):
        orgs_id = self.orgs_id

        with self.client.pipeline() as p:
            p.smembers(self.key)
            p.sadd(self.key, *orgs_id)
            ret = p.execute()
            builded_orgs_id = {org_id.decode() for org_id in ret[0]}
            ids = orgs_id - builded_orgs_id
            orgs = {*Organization.objects.filter(id__in=ids)}
            logger.info(f'Need rebuild orgs are {orgs}, builed orgs are {ret[0]}, all orgs are {orgs_id}')
            return orgs

    @classmethod
    @on_transaction_commit
    def remove_builed_orgs_from_users(cls, orgs_id, users_id):
        client = cls.get_redis_client()
        org_ids = [str(org_id) for org_id in orgs_id]

        with client.pipeline() as p:
            for user_id in users_id:
                key = cls.key_template.format(user_id=user_id)
                p.srem(key, *org_ids)
            p.execute()
        logger.info(f'Remove orgs from users builded tree: users:{users_id} orgs:{orgs_id}')

    @classmethod
    def add_need_refresh_orgs_for_users(cls, orgs_id, users_id):
        cls.remove_builed_orgs_from_users(orgs_id, users_id)

    @classmethod
    @ensure_in_real_or_default_org
    def add_need_refresh_on_nodes_assets_relate_change(cls, node_ids, asset_ids):
        """
        1，计算与这些资产有关的授权
        2，计算与这些节点以及祖先节点有关的授权
        """

        node_ids = set(node_ids)
        ancestor_node_keys = set()
        asset_perm_ids = set()

        nodes = PermNode.objects.filter(id__in=node_ids).only('id', 'key')
        for node in nodes:
            ancestor_node_keys.update(node.get_ancestor_keys())

        ancestor_id = PermNode.objects.filter(key__in=ancestor_node_keys).values_list('id', flat=True)
        node_ids.update(ancestor_id)

        assets_related_perms_id = AssetPermission.nodes.through.objects.filter(
            node_id__in=node_ids
        ).values_list('assetpermission_id', flat=True)
        asset_perm_ids.update(assets_related_perms_id)

        nodes_related_perms_id = AssetPermission.assets.through.objects.filter(
            asset_id__in=asset_ids
        ).values_list('assetpermission_id', flat=True)
        asset_perm_ids.update(nodes_related_perms_id)

        cls.add_need_refresh_by_asset_perm_ids(asset_perm_ids)

    @classmethod
    def add_need_refresh_by_asset_perm_ids_cross_orgs(cls, asset_perm_ids):
        org_id_perm_ids_mapper = defaultdict(set)
        pairs = AssetPermission.objects.filter(id__in=asset_perm_ids).values_list('org_id', 'id')
        for org_id, perm_id in pairs:
            org_id_perm_ids_mapper[org_id].add(perm_id)
        for org_id, perm_ids in org_id_perm_ids_mapper.items():
            with tmp_to_org(org_id):
                cls.add_need_refresh_by_asset_perm_ids(perm_ids)

    @classmethod
    @ensure_in_real_or_default_org
    def add_need_refresh_by_asset_perm_ids(cls, asset_perm_ids):

        group_ids = AssetPermission.user_groups.through.objects.filter(
            assetpermission_id__in=asset_perm_ids
        ).values_list('usergroup_id', flat=True)

        user_ids = set()
        direct_user_id = AssetPermission.users.through.objects.filter(
            assetpermission_id__in=asset_perm_ids
        ).values_list('user_id', flat=True)
        user_ids.update(direct_user_id)

        group_user_ids = User.groups.through.objects.filter(
            usergroup_id__in=group_ids
        ).values_list('user_id', flat=True)
        user_ids.update(group_user_ids)

        cls.remove_builed_orgs_from_users(
            [current_org.id], user_ids
        )

    @lazyproperty
    def orgs_id(self):
        ret = {str(org.id) for org in self.orgs}
        return ret

    @lazyproperty
    def orgs(self):
        orgs = {*self.user.orgs.all().distinct()}
        return orgs

    @timeit
    def refresh_if_need(self, force=False):
        user = self.user

        with tmp_to_root_org():
            UserAssetGrantedTreeNodeRelation.objects.filter(user=user).exclude(org_id__in=self.orgs_id).delete()

        if force or self.have_need_refresh_orgs():
            with UserGrantedTreeRebuildLock(user_id=user.id):
                if force:
                    orgs = self.orgs
                    self.set_all_orgs_as_builed()
                else:
                    orgs = self.get_need_refresh_orgs_and_fill_up()

                for org in orgs:
                    with tmp_to_org(org):
                        t_start = time.time()
                        logger.info(f'Rebuild user tree: user={self.user} org={current_org}')
                        utils = UserGrantedTreeBuildUtils(user)
                        utils.rebuild_user_granted_tree()
                        logger.info(f'Rebuild user tree ok: cost={time.time() - t_start} user={self.user} org={current_org}')


class UserGrantedUtilsBase:
    user: User

    def __init__(self, user, asset_perm_ids=None):
        self.user = user
        self._asset_perm_ids = asset_perm_ids and set(asset_perm_ids)

    @lazyproperty
    def asset_perm_ids(self) -> set:
        if self._asset_perm_ids:
            return self._asset_perm_ids

        asset_perm_ids = get_user_all_asset_perm_ids(self.user)
        return asset_perm_ids


class UserGrantedTreeBuildUtils(UserGrantedUtilsBase):

    def get_direct_granted_nodes(self) -> NodeQuerySet:
        # 查询直接授权节点
        nodes = PermNode.objects.filter(
            granted_by_permissions__id__in=self.asset_perm_ids
        ).distinct()
        return nodes

    @lazyproperty
    def direct_granted_asset_ids(self) -> list:
        # 3.15
        asset_ids = AssetPermission.assets.through.objects.filter(
            assetpermission_id__in=self.asset_perm_ids
        ).annotate(
            asset_id_str=output_as_string('asset_id')
        ).values_list(
            'asset_id_str', flat=True
        ).distinct()

        asset_ids = list(asset_ids)
        return asset_ids

    @ensure_in_real_or_default_org
    def rebuild_user_granted_tree(self):
        """
        注意：调用该方法一定要被 `UserGrantedTreeRebuildLock` 锁住
        """
        user = self.user

        # 先删除旧的授权树🌲
        UserAssetGrantedTreeNodeRelation.objects.filter(user=user).delete()

        if not self.asset_perm_ids:
            # 没有授权直接返回
            return

        nodes = self.compute_perm_nodes_tree()
        self.compute_node_assets_amount(nodes)
        if not nodes:
            return
        self.create_mapping_nodes(nodes)

    @timeit
    def compute_perm_nodes_tree(self, node_only_fields=NODE_ONLY_FIELDS) -> list:

        # 查询直接授权节点
        nodes = self.get_direct_granted_nodes().only(*node_only_fields)
        nodes = list(nodes)

        # 授权的节点 key 集合
        granted_key_set = {_node.key for _node in nodes}

        def _has_ancestor_granted(node: PermNode):
            """
            判断一个节点是否有授权过的祖先节点
            """
            ancestor_keys = set(node.get_ancestor_keys())
            return ancestor_keys & granted_key_set

        key2leaf_nodes_mapper = {}

        # 给授权节点设置 granted 标识，同时去重
        for node in nodes:
            node: PermNode
            if _has_ancestor_granted(node):
                continue
            node.node_from = NodeFrom.granted
            key2leaf_nodes_mapper[node.key] = node

        # 查询授权资产关联的节点设置
        def process_direct_granted_assets():
            # 查询直接授权资产
            nodes_id = {node_id_str for node_id_str, _ in self.direct_granted_asset_id_node_id_str_pairs}
            # 查询授权资产关联的节点设置 2.80
            granted_asset_nodes = PermNode.objects.filter(
                id__in=nodes_id
            ).distinct().only(*node_only_fields)
            granted_asset_nodes = list(granted_asset_nodes)

            # 给资产授权关联的节点设置 is_asset_granted 标识，同时去重
            for node in granted_asset_nodes:
                if _has_ancestor_granted(node):
                    continue
                if node.key in key2leaf_nodes_mapper:
                    continue
                node.node_from = NodeFrom.asset
                key2leaf_nodes_mapper[node.key] = node

        if not settings.PERM_SINGLE_ASSET_TO_UNGROUP_NODE:
            process_direct_granted_assets()

        leaf_nodes = key2leaf_nodes_mapper.values()

        # 计算所有祖先节点
        ancestor_keys = set()
        for node in leaf_nodes:
            ancestor_keys.update(node.get_ancestor_keys())

        # 从祖先节点 key 中去掉同时也是叶子节点的 key
        ancestor_keys -= key2leaf_nodes_mapper.keys()
        # 查出祖先节点
        ancestors = PermNode.objects.filter(key__in=ancestor_keys).only(*node_only_fields)
        ancestors = list(ancestors)
        for node in ancestors:
            node.node_from = NodeFrom.child
        result = [*leaf_nodes, *ancestors]
        return result

    @timeit
    def create_mapping_nodes(self, nodes):
        user = self.user
        to_create = []

        for node in nodes:
            to_create.append(UserAssetGrantedTreeNodeRelation(
                user=user,
                node=node,
                node_key=node.key,
                node_parent_key=node.parent_key,
                node_from=node.node_from,
                node_assets_amount=node.assets_amount,
                org_id=node.org_id
            ))

        UserAssetGrantedTreeNodeRelation.objects.bulk_create(to_create)

    @timeit
    def _fill_direct_granted_node_assets_id_from_mem(self, nodes_key, mapper):
        org_id = current_org.id
        for key in nodes_key:
            assets_id = PermNode.get_all_assets_id_by_node_key(org_id, key)
            mapper[key].update(assets_id)

    @lazyproperty
    def direct_granted_asset_id_node_id_str_pairs(self):
        node_asset_pairs = Asset.nodes.through.objects.filter(
            asset_id__in=self.direct_granted_asset_ids
        ).annotate(
            asset_id_str=output_as_string('asset_id'),
            node_id_str=output_as_string('node_id')
        ).values_list(
            'node_id_str', 'asset_id_str'
        )
        node_asset_pairs = list(node_asset_pairs)
        return node_asset_pairs

    @timeit
    def compute_node_assets_amount(self, nodes: List[PermNode]):
        """
        这里计算的是一个组织的
        """
        # 直接授权了根节点，直接计算
        if len(nodes) == 1:
            node = nodes[0]
            if node.node_from == NodeFrom.granted and node.key.isdigit():
                with tmp_to_org(node.org):
                    node.granted_assets_amount = len(node.get_all_assets_id())
                    return

        direct_granted_nodes_key = []
        node_id_key_mapper = {}
        for node in nodes:
            if node.node_from == NodeFrom.granted:
                direct_granted_nodes_key.append(node.key)
            node_id_key_mapper[node.id.hex] = node.key

        # 授权的节点和直接资产的映射
        nodekey_assetsid_mapper = defaultdict(set)
        # 直接授权的节点，资产从完整树过来
        self._fill_direct_granted_node_assets_id_from_mem(
            direct_granted_nodes_key, nodekey_assetsid_mapper
        )

        # 处理直接授权资产
        # 直接授权资产，取节点与资产的关系
        node_asset_pairs = self.direct_granted_asset_id_node_id_str_pairs
        node_asset_pairs = list(node_asset_pairs)

        for node_id, asset_id in node_asset_pairs:
            if node_id not in node_id_key_mapper:
                continue
            nkey = node_id_key_mapper[node_id]
            nodekey_assetsid_mapper[nkey].add(asset_id)

        util = NodeAssetsUtil(nodes, nodekey_assetsid_mapper)
        util.generate()

        for node in nodes:
            assets_amount = util.get_assets_amount(node.key)
            node.assets_amount = assets_amount

    def get_whole_tree_nodes(self) -> list:
        node_only_fields = NODE_ONLY_FIELDS + ('value', 'full_value')
        nodes = self.compute_perm_nodes_tree(node_only_fields=node_only_fields)
        self.compute_node_assets_amount(nodes)

        # 查询直接授权节点的子节点
        q = Q()
        for node in self.get_direct_granted_nodes().only('key'):
            q |= Q(key__startswith=f'{node.key}:')

        if q:
            descendant_nodes = PermNode.objects.filter(q).distinct()
        else:
            descendant_nodes = PermNode.objects.none()

        nodes.extend(descendant_nodes)
        return nodes


class UserGrantedAssetsQueryUtils(UserGrantedUtilsBase):

    def get_favorite_assets(self) -> QuerySet:
        favorite_asset_ids = FavoriteAsset.objects.filter(
            user=self.user
        ).values_list('asset_id', flat=True)
        favorite_asset_ids = list(favorite_asset_ids)
        assets = self.get_all_granted_assets()
        assets = assets.filter(id__in=favorite_asset_ids)
        return assets

    def get_ungroup_assets(self) -> AssetQuerySet:
        return self.get_direct_granted_assets()

    def get_direct_granted_assets(self) -> AssetQuerySet:
        queryset = Asset.objects.order_by().filter(
            granted_by_permissions__id__in=self.asset_perm_ids
        ).distinct()
        return queryset

    def get_direct_granted_nodes_assets(self) -> AssetQuerySet:
        granted_node_ids = AssetPermission.nodes.through.objects.filter(
            assetpermission_id__in=self.asset_perm_ids
        ).values_list('node_id', flat=True).distinct()
        granted_node_ids = list(granted_node_ids)
        granted_nodes = PermNode.objects.filter(id__in=granted_node_ids).only('id', 'key')
        queryset = PermNode.get_nodes_all_assets(*granted_nodes)
        return queryset

    def get_all_granted_assets(self) -> QuerySet:
        nodes_assets = self.get_direct_granted_nodes_assets()
        assets = self.get_direct_granted_assets()
        queryset = UnionQuerySet(nodes_assets, assets)
        return queryset

    def get_node_all_assets(self, id) -> Tuple[PermNode, QuerySet]:
        node = PermNode.objects.get(id=id)
        granted_status = node.get_granted_status(self.user)
        if granted_status == NodeFrom.granted:
            assets = PermNode.get_nodes_all_assets(node)
            return node, assets
        elif granted_status in (NodeFrom.asset, NodeFrom.child):
            node.use_granted_assets_amount()
            assets = self._get_indirect_granted_node_all_assets(node)
            return node, assets
        else:
            node.assets_amount = 0
            return node, Asset.objects.none()

    def get_node_assets(self, key) -> AssetQuerySet:
        node = PermNode.objects.get(key=key)
        granted_status = node.get_granted_status(self.user)

        if granted_status == NodeFrom.granted:
            assets = Asset.objects.order_by().filter(nodes__id=node.id)
            return assets
        elif granted_status == NodeFrom.asset:
            return self._get_indirect_granted_node_assets(node.id)
        else:
            return Asset.objects.none()

    def _get_indirect_granted_node_assets(self, id) -> AssetQuerySet:
        assets = Asset.objects.order_by().filter(nodes__id=id).distinct() & self.get_direct_granted_assets()
        return assets

    def _get_indirect_granted_node_all_assets(self, node) -> QuerySet:
        """
        此算法依据 `UserAssetGrantedTreeNodeRelation` 的数据查询
        1. 查询该节点下的直接授权节点
        2. 查询该节点下授权资产关联的节点
        """
        user = self.user

        # 查询该节点下的授权节点
        granted_nodes = UserAssetGrantedTreeNodeRelation.objects.filter(
            user=user, node_from=NodeFrom.granted
        ).filter(
            Q(node_key__startswith=f'{node.key}:')
        ).only('node_id', 'node_key')

        for n in granted_nodes:
            n.id = n.node_id

        node_assets = PermNode.get_nodes_all_assets(*granted_nodes)

        # 查询该节点下的资产授权节点
        only_asset_granted_node_ids = UserAssetGrantedTreeNodeRelation.objects.filter(
            user=user, node_from=NodeFrom.asset
        ).filter(
            Q(node_key__startswith=f'{node.key}:')
        ).values_list('node_id', flat=True)

        only_asset_granted_node_ids = list(only_asset_granted_node_ids)
        if node.node_from == NodeFrom.asset:
            only_asset_granted_node_ids.append(node.id)

        assets = Asset.objects.filter(
            nodes__id__in=only_asset_granted_node_ids,
            granted_by_permissions__id__in=self.asset_perm_ids
        ).distinct().order_by()
        granted_assets = UnionQuerySet(node_assets, assets)
        return granted_assets


class UserGrantedNodesQueryUtils(UserGrantedUtilsBase):
    def get_node_children(self, key):
        if not key:
            return self.get_top_level_nodes()

        node = PermNode.objects.get(key=key)
        granted_status = node.get_granted_status(self.user)
        if granted_status == NodeFrom.granted:
            return PermNode.objects.filter(parent_key=key)
        elif granted_status in (NodeFrom.asset, NodeFrom.child):
            return self.get_indirect_granted_node_children(key)
        else:
            return PermNode.objects.none()

    def get_indirect_granted_node_children(self, key):
        """
        获取用户授权树中未授权节点的子节点
        只匹配在 `UserAssetGrantedTreeNodeRelation` 中存在的节点
        """
        user = self.user
        nodes = PermNode.objects.filter(
            granted_node_rels__user=user,
            parent_key=key
        ).annotate(
            **PermNode.annotate_granted_node_rel_fields
        ).distinct()

        # 设置节点授权资产数量
        for node in nodes:
            node.use_granted_assets_amount()
        return nodes

    def get_top_level_nodes(self):
        nodes = self.get_special_nodes()
        nodes.extend(self.get_indirect_granted_node_children(''))
        return nodes

    def get_ungrouped_node(self):
        assets_util = UserGrantedAssetsQueryUtils(self.user, self.asset_perm_ids)
        assets_amount = assets_util.get_direct_granted_assets().count()
        return PermNode.get_ungrouped_node(assets_amount)

    def get_favorite_node(self):
        assets_query_utils = UserGrantedAssetsQueryUtils(self.user, self.asset_perm_ids)
        assets_amount = assets_query_utils.get_favorite_assets().values_list('id').count()
        return PermNode.get_favorite_node(assets_amount)

    def get_special_nodes(self):
        nodes = []
        if settings.PERM_SINGLE_ASSET_TO_UNGROUP_NODE:
            ungrouped_node = self.get_ungrouped_node()
            nodes.append(ungrouped_node)
        favorite_node = self.get_favorite_node()
        nodes.append(favorite_node)
        return nodes

    @timeit
    def get_whole_tree_nodes(self, with_special=True):
        """
        这里的 granted nodes, 是整棵树需要的node，推算出来的也算
        :param user:
        :return:
        """
        nodes = PermNode.objects.filter(
            granted_node_rels__user=self.user
        ).annotate(
            **PermNode.annotate_granted_node_rel_fields
        ).distinct()

        key_to_node_mapper = {}
        nodes_descendant_q = Q()

        for node in nodes:
            node.use_granted_assets_amount()

            if node.node_from == NodeFrom.granted:
                # 直接授权的节点
                # 增加查询后代节点的过滤条件
                nodes_descendant_q |= Q(key__startswith=f'{node.key}:')
                key_to_node_mapper[node.key] = node

        if nodes_descendant_q:
            descendant_nodes = PermNode.objects.filter(
                nodes_descendant_q
            )
            for node in descendant_nodes:
                key_to_node_mapper[node.key] = node

        all_nodes = []
        if with_special:
            special_nodes = self.get_special_nodes()
            all_nodes.extend(special_nodes)
        all_nodes.extend(key_to_node_mapper.values())
        return all_nodes