perf: 全局组织仅支持删除和查看

apps/locale/zh/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: JumpServer 0.3.3\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2021-03-11 17:54+0800\n"
+"POT-Creation-Date: 2021-03-17 11:21+0800\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: ibuler <ibuler@qq.com>\n"
 "Language-Team: JumpServer team<ibuler@qq.com>\n"
@@ -126,12 +126,12 @@ msgstr "动作"
 #: acls/serializers/login_acl.py:28 assets/models/label.py:15
 #: audits/models.py:36 audits/models.py:56 audits/models.py:69
 #: audits/serializers.py:81 authentication/models.py:44
-#: authentication/models.py:95 orgs/models.py:18 orgs/models.py:403
+#: authentication/models.py:95 orgs/models.py:18 orgs/models.py:420
 #: perms/models/base.py:50 templates/index.html:78
 #: terminal/backends/command/models.py:18
 #: terminal/backends/command/serializers.py:12 terminal/models/session.py:37
 #: tickets/models/comment.py:17 users/models/user.py:159
-#: users/models/user.py:677 users/serializers/group.py:20
+#: users/models/user.py:684 users/serializers/group.py:20
 #: users/templates/users/user_asset_permission.html:38
 #: users/templates/users/user_asset_permission.html:64
 #: users/templates/users/user_database_app_permission.html:37
@@ -156,9 +156,9 @@ msgstr "系统用户"
 #: acls/models/login_asset_acl.py:22
 #: applications/serializers/attrs/application_category/remote_app.py:33
 #: assets/models/asset.py:355 assets/models/authbook.py:26
-#: assets/models/gathered_user.py:14 assets/serializers/admin_user.py:29
+#: assets/models/gathered_user.py:14 assets/serializers/admin_user.py:30
 #: assets/serializers/asset_user.py:47 assets/serializers/asset_user.py:84
-#: assets/serializers/system_user.py:191 audits/models.py:38
+#: assets/serializers/system_user.py:192 audits/models.py:38
 #: perms/models/asset_permission.py:99 templates/index.html:82
 #: terminal/backends/command/models.py:19
 #: terminal/backends/command/serializers.py:13 terminal/models/session.py:39
@@ -192,7 +192,7 @@ msgstr "IP 地址无效: `{}`"
 msgid "IP"
 msgstr "IP"
 
-#: acls/serializers/login_acl.py:41
+#: acls/serializers/login_acl.py:45
 msgid "The user `{}` is not in the current organization: `{}`"
 msgstr "用户 `{}` 不在当前组织: `{}`"
 
@@ -241,12 +241,12 @@ msgstr "协议选项: {}"
 msgid "Unsupported protocols: {}"
 msgstr "不支持的协议: {}"
 
-#: acls/serializers/login_asset_acl.py:78
+#: acls/serializers/login_asset_acl.py:80
 #: tickets/serializers/ticket/ticket.py:109
 msgid "The organization `{}` does not exist"
 msgstr "组织 `{}` 不存在"
 
-#: acls/serializers/login_asset_acl.py:83
+#: acls/serializers/login_asset_acl.py:85
 msgid "None of the reviewers belong to Organization `{}`"
 msgstr "所有复核人都不属于组织 `{}`"
 
@@ -335,7 +335,7 @@ msgstr "目标URL"
 #: applications/serializers/attrs/application_type/vmware_client.py:30
 #: assets/models/base.py:252 assets/serializers/asset_user.py:71
 #: audits/signals_handler.py:46 authentication/forms.py:22
-#: authentication/templates/authentication/login.html:148
+#: authentication/templates/authentication/login.html:155
 #: settings/serializers/settings.py:89 users/forms/profile.py:21
 #: users/templates/users/user_otp_check_password.html:13
 #: users/templates/users/user_password_update.html:43
@@ -394,7 +394,8 @@ msgstr "基础"
 msgid "Charset"
 msgstr "编码"
 
-#: assets/models/asset.py:145 tickets/models/ticket.py:40
+#: assets/models/asset.py:145 assets/serializers/asset.py:171
+#: tickets/models/ticket.py:40
 msgid "Meta"
 msgstr "元数据"
 
@@ -503,7 +504,7 @@ msgstr "标签管理"
 #: assets/models/cluster.py:28 assets/models/cmd_filter.py:26
 #: assets/models/cmd_filter.py:60 assets/models/group.py:21
 #: common/db/models.py:70 common/mixins/models.py:49 orgs/models.py:24
-#: orgs/models.py:407 perms/models/base.py:55 users/models/user.py:571
+#: orgs/models.py:424 perms/models/base.py:55 users/models/user.py:571
 #: users/serializers/group.py:35 users/templates/users/user_detail.html:97
 #: xpack/plugins/change_auth_plan/models.py:81
 #: xpack/plugins/cloud/models.py:104 xpack/plugins/gathered_user/models.py:30
@@ -517,7 +518,7 @@ msgstr "创建者"
 #: assets/models/gathered_user.py:19 assets/models/group.py:22
 #: assets/models/label.py:25 common/db/models.py:72 common/mixins/models.py:50
 #: ops/models/adhoc.py:38 ops/models/command.py:29 orgs/models.py:25
-#: orgs/models.py:405 perms/models/base.py:56 users/models/group.py:18
+#: orgs/models.py:422 perms/models/base.py:56 users/models/group.py:18
 #: users/templates/users/user_group_detail.html:58
 #: xpack/plugins/cloud/models.py:107
 msgid "Date created"
@@ -553,7 +554,7 @@ msgstr "SSH公钥"
 
 #: assets/models/base.py:257 assets/models/gathered_user.py:20
 #: common/db/models.py:73 common/mixins/models.py:51 ops/models/adhoc.py:39
-#: orgs/models.py:406
+#: orgs/models.py:423
 msgid "Date updated"
 msgstr "更新日期"
 
@@ -591,7 +592,7 @@ msgid "Default"
 msgstr "默认"
 
 #: assets/models/cluster.py:36 assets/models/label.py:14
-#: users/models/user.py:689
+#: users/models/user.py:696
 msgid "System"
 msgstr "系统"
 
@@ -664,7 +665,7 @@ msgstr "资产组"
 msgid "Default asset group"
 msgstr "默认资产组"
 
-#: assets/models/label.py:19 assets/models/node.py:575 settings/models.py:30
+#: assets/models/label.py:19 assets/models/node.py:601 settings/models.py:30
 msgid "Value"
 msgstr "值"
 
@@ -672,23 +673,23 @@ msgstr "值"
 msgid "New node"
 msgstr "新节点"
 
-#: assets/models/node.py:467 users/templates/users/_granted_assets.html:130
+#: assets/models/node.py:466 users/templates/users/_granted_assets.html:130
 msgid "empty"
 msgstr "空"
 
-#: assets/models/node.py:574 perms/models/asset_permission.py:156
+#: assets/models/node.py:600 perms/models/asset_permission.py:156
 msgid "Key"
 msgstr "键"
 
-#: assets/models/node.py:576
+#: assets/models/node.py:602
 msgid "Full value"
 msgstr "全称"
 
-#: assets/models/node.py:579 perms/models/asset_permission.py:157
+#: assets/models/node.py:605 perms/models/asset_permission.py:157
 msgid "Parent key"
 msgstr "ssh私钥"
 
-#: assets/models/node.py:588 assets/serializers/system_user.py:190
+#: assets/models/node.py:614 assets/serializers/system_user.py:191
 #: users/templates/users/user_asset_permission.html:41
 #: users/templates/users/user_asset_permission.html:73
 #: users/templates/users/user_asset_permission.html:158
@@ -858,6 +859,17 @@ msgstr "应用数量"
 msgid "Gateways count"
 msgstr "网关数量"
 
+#: assets/serializers/label.py:13 assets/serializers/system_user.py:45
+#: assets/serializers/system_user.py:166
+#: perms/serializers/asset/permission.py:66
+msgid "Assets amount"
+msgstr "资产数量"
+
+#: assets/serializers/label.py:14
+#: tickets/serializers/ticket/meta/ticket_type/apply_application.py:24
+msgid "Category display"
+msgstr "类别 (显示名称)"
+
 #: assets/serializers/node.py:18
 msgid "value"
 msgstr "值"
@@ -870,22 +882,17 @@ msgstr "不能包含: /"
 msgid "The same level node name cannot be the same"
 msgstr "同级别节点名字不能重复"
 
-#: assets/serializers/system_user.py:44 assets/serializers/system_user.py:164
+#: assets/serializers/system_user.py:44 assets/serializers/system_user.py:165
 #: perms/serializers/asset/permission.py:67
 msgid "Nodes amount"
 msgstr "节点数量"
 
-#: assets/serializers/system_user.py:45 assets/serializers/system_user.py:165
-#: perms/serializers/asset/permission.py:66
-msgid "Assets amount"
-msgstr "资产数量"
-
-#: assets/serializers/system_user.py:46 assets/serializers/system_user.py:166
-#: assets/serializers/system_user.py:192
+#: assets/serializers/system_user.py:46 assets/serializers/system_user.py:167
+#: assets/serializers/system_user.py:193
 msgid "Login mode display"
 msgstr "登录模式（显示名称）"
 
-#: assets/serializers/system_user.py:48 assets/serializers/system_user.py:168
+#: assets/serializers/system_user.py:48 assets/serializers/system_user.py:169
 msgid "Ad domain"
 msgstr "Ad 网域"
 
@@ -1165,7 +1172,7 @@ msgstr "用户代理"
 #: authentication/templates/authentication/_mfa_confirm_modal.html:14
 #: authentication/templates/authentication/login_otp.html:6
 #: users/forms/profile.py:64 users/models/user.py:552
-#: users/serializers/profile.py:102 users/templates/users/user_detail.html:77
+#: users/serializers/profile.py:104 users/templates/users/user_detail.html:77
 #: users/templates/users/user_profile.html:87
 msgid "MFA"
 msgstr "多因子认证"
@@ -1349,8 +1356,8 @@ msgid ""
 "after {} minutes)"
 msgstr "账号已被锁定（请联系管理员解锁 或 {}分钟后重试）"
 
-#: authentication/errors.py:55 users/views/profile/otp.py:110
-#: users/views/profile/otp.py:149 users/views/profile/otp.py:169
+#: authentication/errors.py:55 users/views/profile/otp.py:107
+#: users/views/profile/otp.py:146 users/views/profile/otp.py:166
 msgid "MFA code invalid, or ntp sync server time"
 msgstr "MFA验证码不正确，或者服务器端时间不对"
 
@@ -1429,7 +1436,7 @@ msgid "Show"
 msgstr "显示"
 
 #: authentication/templates/authentication/_access_key_modal.html:66
-#: users/models/user.py:445 users/serializers/profile.py:99
+#: users/models/user.py:445 users/serializers/profile.py:101
 #: users/templates/users/user_profile.html:94
 #: users/templates/users/user_profile.html:163
 #: users/templates/users/user_profile.html:166
@@ -1438,7 +1445,7 @@ msgid "Disable"
 msgstr "禁用"
 
 #: authentication/templates/authentication/_access_key_modal.html:67
-#: users/models/user.py:446 users/serializers/profile.py:100
+#: users/models/user.py:446 users/serializers/profile.py:102
 #: users/templates/users/user_profile.html:92
 #: users/templates/users/user_profile.html:170
 msgid "Enable"
@@ -1487,30 +1494,30 @@ msgstr "确认"
 msgid "Code error"
 msgstr "代码错误"
 
-#: authentication/templates/authentication/login.html:141
+#: authentication/templates/authentication/login.html:148
 msgid "Welcome back, please enter username and password to login"
 msgstr "欢迎回来，请输入用户名和密码登录"
 
-#: authentication/templates/authentication/login.html:167
+#: authentication/templates/authentication/login.html:174
 #: users/templates/users/forgot_password.html:15
 #: users/templates/users/forgot_password.html:16
 msgid "Forgot password"
 msgstr "忘记密码"
 
-#: authentication/templates/authentication/login.html:174
+#: authentication/templates/authentication/login.html:181
 #: templates/_header_bar.html:83
 msgid "Login"
 msgstr "登录"
 
-#: authentication/templates/authentication/login.html:181
+#: authentication/templates/authentication/login.html:188
 msgid "More login options"
 msgstr "更多登录方式"
 
-#: authentication/templates/authentication/login.html:184
+#: authentication/templates/authentication/login.html:191
 msgid "OpenID"
 msgstr "OpenID"
 
-#: authentication/templates/authentication/login.html:189
+#: authentication/templates/authentication/login.html:196
 msgid "CAS"
 msgstr ""
 
@@ -1833,15 +1840,15 @@ msgstr "{} 任务结束"
 msgid "Date finished"
 msgstr "结束日期"
 
-#: ops/models/command.py:74
+#: ops/models/command.py:78
 msgid "Task start"
 msgstr "任务开始"
 
-#: ops/models/command.py:96
+#: ops/models/command.py:100
 msgid "Command `{}` is forbidden ........"
 msgstr "命令 `{}` 不允许被执行 ......."
 
-#: ops/models/command.py:109
+#: ops/models/command.py:113
 msgid "Task end"
 msgstr "任务结束"
 
@@ -1865,16 +1872,21 @@ msgstr "更新任务内容: {}"
 msgid "Disk used more than 80%: {} => {}"
 msgstr "磁盘使用率超过 80%: {} => {}"
 
-#: orgs/api.py:64
-msgid "Organization contains undeleted resources"
-msgstr "组织包含未删除的资源"
+#: orgs/api.py:76
+#, python-brace-format
+msgid "Have `{model._meta.verbose_name}` exists, Please delete"
+msgstr "`{model._meta.verbose_name}` 存在数据, 请先删除"
 
-#: orgs/api.py:68
+#: orgs/api.py:80
 msgid "The current organization cannot be deleted"
 msgstr "当前组织不能被删除"
 
+#: orgs/mixins/api.py:46
+msgid "Root organization only allow view and delete"
+msgstr "全局组织仅支持 查看和删除"
+
 #: orgs/mixins/models.py:45 orgs/mixins/serializers.py:25 orgs/models.py:36
-#: orgs/models.py:402 orgs/serializers.py:101
+#: orgs/models.py:419 orgs/serializers.py:101
 #: tickets/serializers/ticket/ticket.py:81
 msgid "Organization"
 msgstr "组织"
@@ -1891,7 +1903,7 @@ msgstr "组织审计员"
 msgid "GLOBAL"
 msgstr "全局组织"
 
-#: orgs/models.py:404 users/models/user.py:540
+#: orgs/models.py:421 users/models/user.py:540
 #: users/templates/users/_select_user_modal.html:15
 #: users/templates/users/user_detail.html:73
 #: users/templates/users/user_list.html:16
@@ -1998,11 +2010,13 @@ msgid ""
 "permission type. ({})"
 msgstr "应用列表中包含与授权类型不同的应用。({})"
 
-#: perms/serializers/asset/permission.py:61 users/serializers/user.py:67
+#: perms/serializers/asset/permission.py:43
+#: perms/serializers/asset/permission.py:61 users/serializers/user.py:34
+#: users/serializers/user.py:69
 msgid "Is expired"
 msgstr "是否过期"
 
-#: perms/serializers/asset/permission.py:62 users/serializers/user.py:66
+#: perms/serializers/asset/permission.py:62 users/serializers/user.py:68
 msgid "Is valid"
 msgstr "账户是否有效"
 
@@ -2022,7 +2036,7 @@ msgstr "系统用户数量"
 msgid "Test mail sent to {}, please check"
 msgstr "邮件已经发送{}, 请检查"
 
-#: settings/api/common.py:110 xpack/plugins/interface/api.py:18
+#: settings/api/common.py:107 xpack/plugins/interface/api.py:18
 #: xpack/plugins/interface/models.py:36
 msgid "Welcome to the JumpServer open source Bastion Host"
 msgstr "欢迎使用JumpServer开源堡垒机"
@@ -3423,10 +3437,6 @@ msgstr "受理人"
 msgid "Assignees display"
 msgstr "受理人 (显示名称)"
 
-#: tickets/serializers/ticket/meta/ticket_type/apply_application.py:24
-msgid "Category display"
-msgstr "类别 (显示名称)"
-
 #: tickets/serializers/ticket/meta/ticket_type/apply_application.py:31
 #: tickets/serializers/ticket/ticket.py:19
 msgid "Type display"
@@ -3558,7 +3568,7 @@ msgstr "工单已处理 - {} ({})"
 msgid "Your ticket has been processed, processor - {}"
 msgstr "你的工单已被处理, 处理人 - {}"
 
-#: users/api/user.py:200
+#: users/api/user.py:212
 msgid "Could not reset self otp, use profile reset instead"
 msgstr "不能在该页面重置多因子认证, 请去个人信息页面重置"
 
@@ -3638,8 +3648,8 @@ msgstr "复制你的公钥到这里"
 msgid "Public key should not be the same as your old one."
 msgstr "不能和原来的密钥相同"
 
-#: users/forms/profile.py:149 users/serializers/profile.py:74
-#: users/serializers/profile.py:147 users/serializers/profile.py:160
+#: users/forms/profile.py:149 users/serializers/profile.py:76
+#: users/serializers/profile.py:149 users/serializers/profile.py:162
 msgid "Not a valid ssh public key"
 msgstr "SSH密钥不合法"
 
@@ -3677,27 +3687,27 @@ msgstr "用户来源"
 msgid "Date password last updated"
 msgstr "最后更新密码日期"
 
-#: users/models/user.py:685
+#: users/models/user.py:692
 msgid "Administrator"
 msgstr "管理员"
 
-#: users/models/user.py:688
+#: users/models/user.py:695
 msgid "Administrator is the super user of system"
 msgstr "Administrator是初始的超级管理员"
 
-#: users/serializers/profile.py:32
+#: users/serializers/profile.py:34
 msgid "The old password is incorrect"
 msgstr "旧密码错误"
 
-#: users/serializers/profile.py:40 users/serializers/user.py:112
+#: users/serializers/profile.py:42 users/serializers/user.py:112
 msgid "Password does not match security rules"
 msgstr "密码不满足安全规则"
 
-#: users/serializers/profile.py:46
+#: users/serializers/profile.py:48
 msgid "The newly set password is inconsistent"
 msgstr "两次密码不一致"
 
-#: users/serializers/profile.py:118 users/serializers/user.py:65
+#: users/serializers/profile.py:120 users/serializers/user.py:67
 msgid "Is first login"
 msgstr "首次登录"
 
@@ -3715,58 +3725,58 @@ msgid "Password strategy"
 msgstr "密码策略"
 
 #: users/serializers/user.py:30
+msgid "MFA enabled"
+msgstr "是否开启多因子认证"
+
+#: users/serializers/user.py:31
+msgid "MFA force enabled"
+msgstr "强制启用多因子认证"
+
+#: users/serializers/user.py:32
 msgid "MFA level for display"
 msgstr "多因子认证等级（显示名称）"
 
-#: users/serializers/user.py:31
+#: users/serializers/user.py:33
 msgid "Login blocked"
 msgstr "登录被阻塞"
 
-#: users/serializers/user.py:32
+#: users/serializers/user.py:35
 msgid "Can update"
 msgstr "是否可更新"
 
-#: users/serializers/user.py:33
+#: users/serializers/user.py:36
 msgid "Can delete"
 msgstr "是否可删除"
 
-#: users/serializers/user.py:35 users/serializers/user.py:72
+#: users/serializers/user.py:38 users/serializers/user.py:74
 msgid "Organization role name"
 msgstr "组织角色名称"
 
-#: users/serializers/user.py:68
+#: users/serializers/user.py:70
 msgid "Avatar url"
 msgstr "头像路径"
 
-#: users/serializers/user.py:70
+#: users/serializers/user.py:72
 msgid "Groups name"
 msgstr "用户组名"
 
-#: users/serializers/user.py:71
+#: users/serializers/user.py:73
 msgid "Source name"
 msgstr "用户来源名"
 
-#: users/serializers/user.py:73
+#: users/serializers/user.py:75
 msgid "Super role name"
 msgstr "超级角色名称"
 
-#: users/serializers/user.py:74
+#: users/serializers/user.py:76
 msgid "Total role name"
 msgstr "汇总角色名称"
 
-#: users/serializers/user.py:75
-msgid "MFA enabled"
-msgstr "是否开启多因子认证"
-
-#: users/serializers/user.py:76
-msgid "MFA force enabled"
-msgstr "强制启用多因子认证"
-
 #: users/serializers/user.py:100
 msgid "Role limit to {}"
 msgstr "角色只能为 {}"
 
-#: users/serializers/user.py:202
+#: users/serializers/user.py:197
 msgid "name not unique"
 msgstr "名称重复"
 
@@ -4591,19 +4601,19 @@ msgstr ""
 "    <br>\n"
 "    "
 
-#: users/views/profile/otp.py:193
+#: users/views/profile/otp.py:190
 msgid "MFA enable success"
 msgstr "多因子认证启用成功"
 
-#: users/views/profile/otp.py:194
+#: users/views/profile/otp.py:191
 msgid "MFA enable success, return login page"
 msgstr "多因子认证启用成功，返回到登录页面"
 
-#: users/views/profile/otp.py:196
+#: users/views/profile/otp.py:193
 msgid "MFA disable success"
 msgstr "多因子认证禁用成功"
 
-#: users/views/profile/otp.py:197
+#: users/views/profile/otp.py:194
 msgid "MFA disable success, return login page"
 msgstr "多因子认证禁用成功，返回登录页面"
 
@@ -5098,7 +5108,7 @@ msgstr "许可证导入成功"
 msgid "License is invalid"
 msgstr "无效的许可证"
 
-#: xpack/plugins/license/meta.py:11 xpack/plugins/license/models.py:124
+#: xpack/plugins/license/meta.py:11 xpack/plugins/license/models.py:127
 msgid "License"
 msgstr "许可证"
 
@@ -5117,3 +5127,6 @@ msgstr "旗舰版"
 #: xpack/plugins/license/models.py:77
 msgid "Community edition"
 msgstr "社区版"
+
+#~ msgid "Organization contains undeleted resources"
+#~ msgstr "组织包含未删除的资源"

apps/orgs/mixins/api.py

@@ -2,6 +2,9 @@
 #
 from rest_framework.viewsets import ModelViewSet, GenericViewSet
 from rest_framework_bulk import BulkModelViewSet
+from rest_framework.exceptions import MethodNotAllowed
+from django.utils.translation import ugettext_lazy as _
+
 from common.mixins import CommonApiMixin, RelationMixin
 from orgs.utils import current_org
 
@@ -39,15 +42,29 @@ class OrgQuerySetMixin:
         return queryset
 
 
-class OrgModelViewSet(CommonApiMixin, OrgQuerySetMixin, ModelViewSet):
+class OrgViewSetMixin(OrgQuerySetMixin):
+    root_org_readonly_msg = _("Root organization only allow view and delete")
+
+    def update(self, request, *args, **kwargs):
+        if current_org.is_root():
+            raise MethodNotAllowed('put', self.root_org_readonly_msg)
+        return super().update(request, *args, **kwargs)
+
+    def create(self, request, *args, **kwargs):
+        if current_org.is_root():
+            raise MethodNotAllowed('post', self.root_org_readonly_msg)
+        return super().update(request, *args, **kwargs)
+
+
+class OrgModelViewSet(CommonApiMixin, OrgViewSetMixin, ModelViewSet):
     pass
 
 
-class OrgGenericViewSet(CommonApiMixin, OrgQuerySetMixin, GenericViewSet):
+class OrgGenericViewSet(CommonApiMixin, OrgViewSetMixin, GenericViewSet):
     pass
 
 
-class OrgBulkModelViewSet(CommonApiMixin, OrgQuerySetMixin, BulkModelViewSet):
+class OrgBulkModelViewSet(CommonApiMixin, OrgViewSetMixin, BulkModelViewSet):
     def allow_bulk_destroy(self, qs, filtered):
         qs_count = qs.count()
         filtered_count = filtered.count()