[Update] 用户资产添加缓存

apps/jumpserver/conf.py

@@ -311,6 +311,7 @@ defaults = {
     'REDIS_PASSWORD': '',
     'REDIS_DB_CELERY': 3,
     'REDIS_DB_CACHE': 4,
+    'REDIS_DB_SESSION': 5,
     'CAPTCHA_TEST_MODE': None,
     'TOKEN_EXPIRATION': 3600 * 24,
     'DISPLAY_PER_PAGE': 25,
@@ -348,6 +349,7 @@ defaults = {
     'HTTP_BIND_HOST': '0.0.0.0',
     'HTTP_LISTEN_PORT': 8080,
     'LOGIN_LOG_KEEP_DAYS': 90,
+    'ASSETS_PERM_CACHE_TIME': 3600,
 }
 
 

apps/jumpserver/settings.py

@@ -141,6 +141,16 @@ SESSION_COOKIE_DOMAIN = CONFIG.SESSION_COOKIE_DOMAIN
 CSRF_COOKIE_DOMAIN = CONFIG.CSRF_COOKIE_DOMAIN
 SESSION_COOKIE_AGE = CONFIG.SESSION_COOKIE_AGE
 SESSION_EXPIRE_AT_BROWSER_CLOSE = CONFIG.SESSION_EXPIRE_AT_BROWSER_CLOSE
+SESSION_ENGINE = 'redis_sessions.session'
+SESSION_REDIS = {
+    'host': CONFIG.REDIS_HOST,
+    'port': CONFIG.REDIS_PORT,
+    'password': CONFIG.REDIS_PASSWORD,
+    'db': CONFIG.REDIS_DB_SESSION,
+    'prefix': 'auth_session',
+    'socket_timeout': 1,
+    'retry_on_timeout': False
+}
 
 MESSAGE_STORAGE = 'django.contrib.messages.storage.cookie.CookieStorage'
 # Database
@@ -559,3 +569,6 @@ SWAGGER_SETTINGS = {
 # Default email suffix
 EMAIL_SUFFIX = CONFIG.EMAIL_SUFFIX
 LOGIN_LOG_KEEP_DAYS = CONFIG.LOGIN_LOG_KEEP_DAYS
+
+# User or user group permission cache time, default 3600 seconds
+ASSETS_PERM_CACHE_TIME = CONFIG.ASSETS_PERM_CACHE_TIME

apps/perms/api.py

@@ -1,663 +0,0 @@
-# ~*~ coding: utf-8 ~*~
-# 
-
-from django.shortcuts import get_object_or_404
-from django.utils import timezone
-from django.db.models import Q
-from rest_framework.views import APIView, Response
-from rest_framework.generics import (
-    ListAPIView, get_object_or_404, RetrieveUpdateAPIView
-)
-from rest_framework import viewsets
-from rest_framework.pagination import LimitOffsetPagination
-
-from common.permissions import IsValidUser, IsOrgAdmin, IsOrgAdminOrAppUser
-from common.tree import TreeNode, TreeNodeSerializer
-from common.utils import get_object_or_none
-from orgs.mixins import RootOrgViewMixin
-from orgs.utils import set_to_root_org
-from .utils import (
-    AssetPermissionUtil, parse_asset_to_tree_node, parse_node_to_tree_node
-)
-from .models import AssetPermission
-from .hands import (
-    AssetGrantedSerializer, User, UserGroup, Asset, Node,
-    SystemUser, NodeSerializer
-)
-from . import serializers
-from .mixins import AssetsFilterMixin
-
-
-__all__ = [
-    'AssetPermissionViewSet', 'UserGrantedAssetsApi', 'UserGrantedNodesApi',
-    'UserGrantedNodesWithAssetsApi', 'UserGrantedNodeAssetsApi', 'UserGroupGrantedAssetsApi',
-    'UserGroupGrantedNodesApi', 'UserGroupGrantedNodesWithAssetsApi', 'UserGroupGrantedNodeAssetsApi',
-    'ValidateUserAssetPermissionApi', 'AssetPermissionRemoveUserApi', 'AssetPermissionAddUserApi',
-    'AssetPermissionRemoveAssetApi', 'AssetPermissionAddAssetApi', 'UserGrantedNodeChildrenApi',
-    'UserGrantedNodesWithAssetsAsTreeApi',
-]
-
-
-class AssetPermissionViewSet(viewsets.ModelViewSet):
-    """
-    资产授权列表的增删改查api
-    """
-    queryset = AssetPermission.objects.all()
-    serializer_class = serializers.AssetPermissionCreateUpdateSerializer
-    pagination_class = LimitOffsetPagination
-    filter_fields = ['name']
-    permission_classes = (IsOrgAdmin,)
-
-    def get_serializer_class(self):
-        if self.action in ("list", 'retrieve'):
-            return serializers.AssetPermissionListSerializer
-        return self.serializer_class
-
-    def filter_valid(self, queryset):
-        valid = self.request.query_params.get('is_valid', None)
-        if valid is None:
-            return queryset
-        if valid in ['0', 'N', 'false', 'False']:
-            valid = False
-        else:
-            valid = True
-        now = timezone.now()
-        if valid:
-            queryset = queryset.filter(is_active=True).filter(
-                date_start__lt=now, date_expired__gt=now,
-            )
-        else:
-            queryset = queryset.filter(
-                Q(is_active=False) |
-                Q(date_start__gt=now) |
-                Q(date_expired__lt=now)
-            )
-        return queryset
-
-    def filter_system_user(self, queryset):
-        system_user_id = self.request.query_params.get('system_user_id')
-        system_user_name = self.request.query_params.get('system_user')
-        if system_user_id:
-            system_user = get_object_or_none(SystemUser, pk=system_user_id)
-        elif system_user_name:
-            system_user = get_object_or_none(SystemUser, name=system_user_name)
-        else:
-            return queryset
-        if not system_user:
-            return queryset.none()
-        queryset = queryset.filter(system_users=system_user)
-        return queryset
-
-    def filter_node(self, queryset):
-        node_id = self.request.query_params.get('node_id')
-        node_name = self.request.query_params.get('node')
-        if node_id:
-            node = get_object_or_none(Node, pk=node_id)
-        elif node_name:
-            node = get_object_or_none(Node, name=node_name)
-        else:
-            return queryset
-        if not node:
-            return queryset.none()
-        nodes = node.get_ancestor(with_self=True)
-        queryset = queryset.filter(nodes__in=nodes)
-        return queryset
-
-    def filter_asset(self, queryset):
-        asset_id = self.request.query_params.get('asset_id')
-        hostname = self.request.query_params.get('hostname')
-        ip = self.request.query_params.get('ip')
-        if asset_id:
-            assets = Asset.objects.filter(pk=asset_id)
-        elif hostname:
-            assets = Asset.objects.filter(hostname=hostname)
-        elif ip:
-            assets = Asset.objects.filter(ip=ip)
-        else:
-            return queryset
-        if not assets:
-            return queryset.none()
-        inherit_nodes = set()
-        for asset in assets:
-            for node in asset.nodes.all():
-                inherit_nodes.update(set(node.get_ancestor(with_self=True)))
-        queryset = queryset.filter(Q(assets__in=assets) | Q(nodes__in=inherit_nodes))
-        return queryset
-
-    def filter_user(self, queryset):
-        user_id = self.request.query_params.get('user_id')
-        username = self.request.query_params.get('username')
-        if user_id:
-            user = get_object_or_none(User, pk=user_id)
-        elif username:
-            user = get_object_or_none(User, username=username)
-        else:
-            return queryset
-        if not user:
-            return queryset.none()
-
-    def filter_user_group(self, queryset):
-        user_group_id = self.request.query_params.get('user_group_id')
-        user_group_name = self.request.query_params.get('user_group')
-        if user_group_id:
-            group = get_object_or_none(UserGroup, pk=user_group_id)
-        elif user_group_name:
-            group = get_object_or_none(UserGroup, name=user_group_name)
-        else:
-            return queryset
-        if not group:
-            return queryset.none()
-        queryset = queryset.filter(user_groups=group)
-        return queryset
-
-    def filter_keyword(self, queryset):
-        keyword = self.request.query_params.get('search')
-        if not keyword:
-            return queryset
-        queryset = queryset.filter(name__icontains=keyword)
-        return queryset
-
-    def filter_queryset(self, queryset):
-        queryset = super().filter_queryset(queryset)
-        queryset = self.filter_valid(queryset)
-        queryset = self.filter_keyword(queryset)
-        queryset = self.filter_asset(queryset)
-        queryset = self.filter_node(queryset)
-        queryset = self.filter_system_user(queryset)
-        queryset = self.filter_user_group(queryset)
-        return queryset
-
-    def get_queryset(self):
-        return self.queryset.all()
-
-
-class UserGrantedAssetsApi(AssetsFilterMixin, ListAPIView):
-    """
-    用户授权的所有资产
-    """
-    permission_classes = (IsOrgAdminOrAppUser,)
-    serializer_class = AssetGrantedSerializer
-    pagination_class = LimitOffsetPagination
-    
-    def change_org_if_need(self):
-        if self.request.user.is_superuser or \
-                self.request.user.is_app or \
-                self.kwargs.get('pk') is None:
-            set_to_root_org()
-    
-    def get_queryset(self):
-        self.change_org_if_need()
-        user_id = self.kwargs.get('pk', '')
-        queryset = []
-
-        if user_id:
-            user = get_object_or_404(User, id=user_id)
-        else:
-            user = self.request.user
-
-        util = AssetPermissionUtil(user)
-        for k, v in util.get_assets().items():
-            system_users_granted = [s for s in v if s.protocol == k.protocol]
-            k.system_users_granted = system_users_granted
-            queryset.append(k)
-
-        return queryset
-
-    def get_permissions(self):
-        if self.kwargs.get('pk') is None:
-            self.permission_classes = (IsValidUser,)
-        return super().get_permissions()
-
-
-class UserGrantedNodesApi(ListAPIView):
-    """
-    查询用户授权的所有节点的API, 如果是超级用户或者是 app，切换到root org
-    """
-    permission_classes = (IsOrgAdminOrAppUser,)
-    serializer_class = NodeSerializer
-    
-    def change_org_if_need(self):
-        if self.request.user.is_superuser or \
-                self.request.user.is_app or \
-                self.kwargs.get('pk') is None:
-            set_to_root_org()
-
-    def get_queryset(self):
-        self.change_org_if_need()
-        user_id = self.kwargs.get('pk', '')
-        if user_id:
-            user = get_object_or_404(User, id=user_id)
-        else:
-            user = self.request.user
-        util = AssetPermissionUtil(user)
-        nodes = util.get_nodes_with_assets()
-        return nodes.keys()
-
-    def get_permissions(self):
-        if self.kwargs.get('pk') is None:
-            self.permission_classes = (IsValidUser,)
-        return super().get_permissions()
-
-
-class UserGrantedNodesWithAssetsApi(AssetsFilterMixin, ListAPIView):
-    """
-    用户授权的节点并带着节点下资产的api
-    """
-    permission_classes = (IsOrgAdminOrAppUser,)
-    serializer_class = serializers.NodeGrantedSerializer
-    
-    def change_org_if_need(self):
-        if self.request.user.is_superuser or \
-                self.request.user.is_app or \
-                self.kwargs.get('pk') is None:
-            set_to_root_org()
-
-    def get_queryset(self):
-        self.change_org_if_need()
-        user_id = self.kwargs.get('pk', '')
-        queryset = []
-        if not user_id:
-            user = self.request.user
-        else:
-            user = get_object_or_404(User, id=user_id)
-
-        util = AssetPermissionUtil(user)
-        nodes = util.get_nodes_with_assets()
-        for node, _assets in nodes.items():
-            assets = _assets.keys()
-            for k, v in _assets.items():
-                system_users_granted = [s for s in v if s.protocol == k.protocol]
-                k.system_users_granted = system_users_granted
-            node.assets_granted = assets
-            queryset.append(node)
-        return queryset
-
-    def sort_assets(self, queryset):
-        for node in queryset:
-            node.assets_granted = super().sort_assets(node.assets_granted)
-        return queryset
-
-    def get_permissions(self):
-        if self.kwargs.get('pk') is None:
-            self.permission_classes = (IsValidUser,)
-        return super().get_permissions()
-
-
-class UserGrantedNodesWithAssetsAsTreeApi(ListAPIView):
-    serializer_class = TreeNodeSerializer
-    permission_classes = (IsOrgAdminOrAppUser,)
-    show_assets = True
-    system_user_id = None
-
-    def change_org_if_need(self):
-        if self.request.user.is_superuser or \
-                self.request.user.is_app or \
-                self.kwargs.get('pk') is None:
-            set_to_root_org()
-
-    def get(self, request, *args, **kwargs):
-        self.show_assets = request.query_params.get('show_assets', '1') == '1'
-        self.system_user_id = request.query_params.get('system_user')
-        return super().get(request, *args, **kwargs)
-
-    def get_permissions(self):
-        if self.kwargs.get('pk') is None:
-            self.permission_classes = (IsValidUser,)
-        return super().get_permissions()
-
-    def get_queryset(self):
-        self.change_org_if_need()
-        user_id = self.kwargs.get('pk', '')
-        queryset = []
-        if not user_id:
-            user = self.request.user
-        else:
-            user = get_object_or_404(User, id=user_id)
-        util = AssetPermissionUtil(user)
-        if self.system_user_id:
-            util.filter_permission_with_system_user(system_user=self.system_user_id)
-        nodes = util.get_nodes_with_assets()
-        for node, assets in nodes.items():
-            data = parse_node_to_tree_node(node)
-            queryset.append(data)
-            if not self.show_assets:
-                continue
-            for asset, system_users in assets.items():
-                data = parse_asset_to_tree_node(node, asset, system_users)
-                queryset.append(data)
-        queryset = sorted(queryset)
-        return queryset
-
-
-class UserGrantedNodeAssetsApi(AssetsFilterMixin, ListAPIView):
-    """
-    查询用户授权的节点下的资产的api, 与上面api不同的是，只返回某个节点下的资产
-    """
-    permission_classes = (IsOrgAdminOrAppUser,)
-    serializer_class = AssetGrantedSerializer
-    pagination_class = LimitOffsetPagination
-
-    def change_org_if_need(self):
-        if self.request.user.is_superuser or \
-                self.request.user.is_app or \
-                self.kwargs.get('pk') is None:
-            set_to_root_org()
-
-    def get_queryset(self):
-        self.change_org_if_need()
-        user_id = self.kwargs.get('pk', '')
-        node_id = self.kwargs.get('node_id')
-
-        if user_id:
-            user = get_object_or_404(User, id=user_id)
-        else:
-            user = self.request.user
-        util = AssetPermissionUtil(user)
-        node = get_object_or_404(Node, id=node_id)
-        nodes = util.get_nodes_with_assets()
-        assets = nodes.get(node, [])
-        for asset, system_users in assets.items():
-            asset.system_users_granted = system_users
-
-        assets = list(assets.keys())
-        return assets
-
-    def get_permissions(self):
-        if self.kwargs.get('pk') is None:
-            self.permission_classes = (IsValidUser,)
-        return super().get_permissions()
-
-
-class UserGroupGrantedAssetsApi(ListAPIView):
-    permission_classes = (IsOrgAdmin,)
-    serializer_class = AssetGrantedSerializer
-
-    def get_queryset(self):
-        user_group_id = self.kwargs.get('pk', '')
-        queryset = []
-
-        if not user_group_id:
-            return queryset
-
-        user_group = get_object_or_404(UserGroup, id=user_group_id)
-        util = AssetPermissionUtil(user_group)
-        assets = util.get_assets()
-        for k, v in assets.items():
-            k.system_users_granted = v
-            queryset.append(k)
-        return queryset
-
-
-class UserGroupGrantedNodesApi(ListAPIView):
-    permission_classes = (IsOrgAdmin,)
-    serializer_class = NodeSerializer
-
-    def get_queryset(self):
-        group_id = self.kwargs.get('pk', '')
-        queryset = []
-
-        if group_id:
-            group = get_object_or_404(UserGroup, id=group_id)
-            util = AssetPermissionUtil(group)
-            nodes = util.get_nodes_with_assets()
-            return nodes.keys()
-        return queryset
-
-
-class UserGroupGrantedNodesWithAssetsApi(ListAPIView):
-    permission_classes = (IsOrgAdmin,)
-    serializer_class = serializers.NodeGrantedSerializer
-
-    def get_queryset(self):
-        user_group_id = self.kwargs.get('pk', '')
-        queryset = []
-
-        if not user_group_id:
-            return queryset
-
-        user_group = get_object_or_404(UserGroup, id=user_group_id)
-        util = AssetPermissionUtil(user_group)
-        nodes = util.get_nodes_with_assets()
-        for node, _assets in nodes.items():
-            assets = _assets.keys()
-            for asset, system_users in _assets.items():
-                asset.system_users_granted = system_users
-            node.assets_granted = assets
-            queryset.append(node)
-        return queryset
-
-
-class UserGroupGrantedNodesWithAssetsAsTreeApi(ListAPIView):
-    serializer_class = TreeNodeSerializer
-    permission_classes = (IsOrgAdminOrAppUser,)
-    show_assets = True
-    system_user_id = None
-
-    def change_org_if_need(self):
-        if self.request.user.is_superuser or \
-                self.request.user.is_app or \
-                self.kwargs.get('pk') is None:
-            set_to_root_org()
-
-    def get(self, request, *args, **kwargs):
-        self.show_assets = request.query_params.get('show_assets', '1') == '1'
-        self.system_user_id = request.query_params.get('system_user')
-        return super().get(request, *args, **kwargs)
-
-    def get_queryset(self):
-        self.change_org_if_need()
-        user_group_id = self.kwargs.get('pk', '')
-        queryset = []
-        group = get_object_or_404(UserGroup, id=user_group_id)
-        util = AssetPermissionUtil(group)
-        if self.system_user_id:
-            util.filter_permission_with_system_user(system_user=self.system_user_id)
-        nodes = util.get_nodes_with_assets()
-        for node, assets in nodes.items():
-            data = parse_node_to_tree_node(node)
-            queryset.append(data)
-            if not self.show_assets:
-                continue
-            for asset, system_users in assets.items():
-                data = parse_asset_to_tree_node(node, asset, system_users)
-                queryset.append(data)
-        queryset = sorted(queryset)
-        return queryset
-
-
-class UserGroupGrantedNodeAssetsApi(ListAPIView):
-    permission_classes = (IsOrgAdminOrAppUser,)
-    serializer_class = AssetGrantedSerializer
-
-    def get_queryset(self):
-        user_group_id = self.kwargs.get('pk', '')
-        node_id = self.kwargs.get('node_id')
-
-        user_group = get_object_or_404(UserGroup, id=user_group_id)
-        node = get_object_or_404(Node, id=node_id)
-        util = AssetPermissionUtil(user_group)
-        nodes = util.get_nodes_with_assets()
-        assets = nodes.get(node, [])
-        for asset, system_users in assets.items():
-            asset.system_users_granted = system_users
-        return assets
-
-
-class ValidateUserAssetPermissionApi(RootOrgViewMixin, APIView):
-    permission_classes = (IsOrgAdminOrAppUser,)
-
-    @staticmethod
-    def get(request):
-        user_id = request.query_params.get('user_id', '')
-        asset_id = request.query_params.get('asset_id', '')
-        system_id = request.query_params.get('system_user_id', '')
-
-        user = get_object_or_404(User, id=user_id)
-        asset = get_object_or_404(Asset, id=asset_id)
-        system_user = get_object_or_404(SystemUser, id=system_id)
-
-        util = AssetPermissionUtil(user)
-        assets_granted = util.get_assets()
-        if system_user in assets_granted.get(asset, []):
-            return Response({'msg': True}, status=200)
-        else:
-            return Response({'msg': False}, status=403)
-
-
-class AssetPermissionRemoveUserApi(RetrieveUpdateAPIView):
-    """
-    将用户从授权中移除，Detail页面会调用
-    """
-    permission_classes = (IsOrgAdmin,)
-    serializer_class = serializers.AssetPermissionUpdateUserSerializer
-    queryset = AssetPermission.objects.all()
-
-    def update(self, request, *args, **kwargs):
-        perm = self.get_object()
-        serializer = self.serializer_class(data=request.data)
-        if serializer.is_valid():
-            users = serializer.validated_data.get('users')
-            if users:
-                perm.users.remove(*tuple(users))
-            return Response({"msg": "ok"})
-        else:
-            return Response({"error": serializer.errors})
-
-
-class AssetPermissionAddUserApi(RetrieveUpdateAPIView):
-    permission_classes = (IsOrgAdmin,)
-    serializer_class = serializers.AssetPermissionUpdateUserSerializer
-    queryset = AssetPermission.objects.all()
-
-    def update(self, request, *args, **kwargs):
-        perm = self.get_object()
-        serializer = self.serializer_class(data=request.data)
-        if serializer.is_valid():
-            users = serializer.validated_data.get('users')
-            if users:
-                perm.users.add(*tuple(users))
-            return Response({"msg": "ok"})
-        else:
-            return Response({"error": serializer.errors})
-
-
-class AssetPermissionRemoveAssetApi(RetrieveUpdateAPIView):
-    """
-    将用户从授权中移除，Detail页面会调用
-    """
-    permission_classes = (IsOrgAdmin,)
-    serializer_class = serializers.AssetPermissionUpdateAssetSerializer
-    queryset = AssetPermission.objects.all()
-
-    def update(self, request, *args, **kwargs):
-        perm = self.get_object()
-        serializer = self.serializer_class(data=request.data)
-        if serializer.is_valid():
-            assets = serializer.validated_data.get('assets')
-            if assets:
-                perm.assets.remove(*tuple(assets))
-            return Response({"msg": "ok"})
-        else:
-            return Response({"error": serializer.errors})
-
-
-class AssetPermissionAddAssetApi(RetrieveUpdateAPIView):
-    permission_classes = (IsOrgAdmin,)
-    serializer_class = serializers.AssetPermissionUpdateAssetSerializer
-    queryset = AssetPermission.objects.all()
-
-    def update(self, request, *args, **kwargs):
-        perm = self.get_object()
-        serializer = self.serializer_class(data=request.data)
-        if serializer.is_valid():
-            assets = serializer.validated_data.get('assets')
-            if assets:
-                perm.assets.add(*tuple(assets))
-            return Response({"msg": "ok"})
-        else:
-            return Response({"error": serializer.errors})
-
-
-class UserGrantedNodeChildrenApi(ListAPIView):
-    permission_classes = (IsValidUser,)
-    serializer_class = serializers.AssetPermissionNodeSerializer
-
-    def change_org_if_need(self):
-        if self.request.user.is_superuser or \
-                self.request.user.is_app or \
-                self.kwargs.get('pk') is None:
-            set_to_root_org()
-
-    def get_children_queryset(self):
-        util = AssetPermissionUtil(self.request.user)
-        node_id = self.request.query_params.get('id')
-        nodes_granted = util.get_nodes_with_assets()
-        if not nodes_granted:
-            return []
-        root_nodes = [node for node in nodes_granted.keys() if node.is_root()]
-
-        queryset = []
-        if node_id and node_id in [str(node.id) for node in nodes_granted]:
-            node = [node for node in nodes_granted if str(node.id) == node_id][0]
-        elif len(root_nodes) == 1:
-            node = root_nodes[0]
-            node.assets_amount = len(nodes_granted[node])
-            queryset.append(node)
-        else:
-            for node in root_nodes:
-                node.assets_amount = len(nodes_granted[node])
-                queryset.append(node)
-            return queryset
-
-        children = []
-        for child in node.get_children():
-            if child in nodes_granted:
-                child.assets_amount = len(nodes_granted[node])
-                children.append(child)
-        children = sorted(children, key=lambda x: x.value)
-        queryset.extend(children)
-        fake_nodes = []
-        for asset, system_users in nodes_granted[node].items():
-            fake_node = asset.as_node()
-            fake_node.assets_amount = 0
-            system_users = [s for s in system_users if s.protocol == asset.protocol]
-            fake_node.asset.system_users_granted = system_users
-            fake_node.key = node.key + ':0'
-            fake_nodes.append(fake_node)
-        fake_nodes = sorted(fake_nodes, key=lambda x: x.value)
-        queryset.extend(fake_nodes)
-        return queryset
-
-    def get_search_queryset(self, keyword):
-        util = AssetPermissionUtil(self.request.user)
-        nodes_granted = util.get_nodes_with_assets()
-        queryset = []
-        for node, assets in nodes_granted.items():
-            matched_assets = []
-            node_matched = node.value.lower().find(keyword.lower()) >= 0
-            asset_has_matched = False
-            for asset, system_users in assets.items():
-                asset_matched = (asset.hostname.lower().find(keyword.lower()) >= 0) \
-                                or (asset.ip.find(keyword.lower()) >= 0)
-                if node_matched or asset_matched:
-                    asset_has_matched = True
-                    fake_node = asset.as_node()
-                    fake_node.assets_amount = 0
-                    system_users = [s for s in system_users if
-                                    s.protocol == asset.protocol]
-                    fake_node.asset.system_users_granted = system_users
-                    fake_node.key = node.key + ':0'
-                    matched_assets.append(fake_node)
-            if asset_has_matched:
-                node.assets_amount = len(matched_assets)
-                queryset.append(node)
-                queryset.extend(sorted(matched_assets, key=lambda x: x.value))
-        return queryset
-
-    def get_queryset(self):
-        self.change_org_if_need()
-        keyword = self.request.query_params.get('search')
-        if keyword:
-            return self.get_search_queryset(keyword)
-        else:
-            return self.get_children_queryset()

apps/perms/api/__init__.py

@@ -0,0 +1,6 @@
+# -*- coding: utf-8 -*-
+#
+
+from .permission import *
+from .user_permission import *
+from .user_group_permission import *

apps/perms/api/permission.py

@@ -0,0 +1,231 @@
+# -*- coding: utf-8 -*-
+#
+
+from django.utils import timezone
+from django.db.models import Q
+from rest_framework.views import Response
+from rest_framework.generics import RetrieveUpdateAPIView
+from rest_framework import viewsets
+from rest_framework.pagination import LimitOffsetPagination
+
+from common.permissions import IsOrgAdmin
+from common.utils import get_object_or_none
+from ..models import AssetPermission
+from ..hands import (
+    User, UserGroup, Asset, Node, SystemUser,
+)
+from .. import serializers
+
+
+__all__ = [
+    'AssetPermissionViewSet', 'AssetPermissionRemoveUserApi',
+    'AssetPermissionAddUserApi', 'AssetPermissionRemoveAssetApi',
+    'AssetPermissionAddAssetApi',
+]
+
+
+class AssetPermissionViewSet(viewsets.ModelViewSet):
+    """
+    资产授权列表的增删改查api
+    """
+    queryset = AssetPermission.objects.all()
+    serializer_class = serializers.AssetPermissionCreateUpdateSerializer
+    pagination_class = LimitOffsetPagination
+    filter_fields = ['name']
+    permission_classes = (IsOrgAdmin,)
+
+    def get_serializer_class(self):
+        if self.action in ("list", 'retrieve'):
+            return serializers.AssetPermissionListSerializer
+        return self.serializer_class
+
+    def filter_valid(self, queryset):
+        valid = self.request.query_params.get('is_valid', None)
+        if valid is None:
+            return queryset
+        if valid in ['0', 'N', 'false', 'False']:
+            valid = False
+        else:
+            valid = True
+        now = timezone.now()
+        if valid:
+            queryset = queryset.filter(is_active=True).filter(
+                date_start__lt=now, date_expired__gt=now,
+            )
+        else:
+            queryset = queryset.filter(
+                Q(is_active=False) |
+                Q(date_start__gt=now) |
+                Q(date_expired__lt=now)
+            )
+        return queryset
+
+    def filter_system_user(self, queryset):
+        system_user_id = self.request.query_params.get('system_user_id')
+        system_user_name = self.request.query_params.get('system_user')
+        if system_user_id:
+            system_user = get_object_or_none(SystemUser, pk=system_user_id)
+        elif system_user_name:
+            system_user = get_object_or_none(SystemUser, name=system_user_name)
+        else:
+            return queryset
+        if not system_user:
+            return queryset.none()
+        queryset = queryset.filter(system_users=system_user)
+        return queryset
+
+    def filter_node(self, queryset):
+        node_id = self.request.query_params.get('node_id')
+        node_name = self.request.query_params.get('node')
+        if node_id:
+            node = get_object_or_none(Node, pk=node_id)
+        elif node_name:
+            node = get_object_or_none(Node, name=node_name)
+        else:
+            return queryset
+        if not node:
+            return queryset.none()
+        nodes = node.get_ancestor(with_self=True)
+        queryset = queryset.filter(nodes__in=nodes)
+        return queryset
+
+    def filter_asset(self, queryset):
+        asset_id = self.request.query_params.get('asset_id')
+        hostname = self.request.query_params.get('hostname')
+        ip = self.request.query_params.get('ip')
+        if asset_id:
+            assets = Asset.objects.filter(pk=asset_id)
+        elif hostname:
+            assets = Asset.objects.filter(hostname=hostname)
+        elif ip:
+            assets = Asset.objects.filter(ip=ip)
+        else:
+            return queryset
+        if not assets:
+            return queryset.none()
+        inherit_nodes = set()
+        for asset in assets:
+            for node in asset.nodes.all():
+                inherit_nodes.update(set(node.get_ancestor(with_self=True)))
+        queryset = queryset.filter(Q(assets__in=assets) | Q(nodes__in=inherit_nodes))
+        return queryset
+
+    def filter_user(self, queryset):
+        user_id = self.request.query_params.get('user_id')
+        username = self.request.query_params.get('username')
+        if user_id:
+            user = get_object_or_none(User, pk=user_id)
+        elif username:
+            user = get_object_or_none(User, username=username)
+        else:
+            return queryset
+        if not user:
+            return queryset.none()
+
+    def filter_user_group(self, queryset):
+        user_group_id = self.request.query_params.get('user_group_id')
+        user_group_name = self.request.query_params.get('user_group')
+        if user_group_id:
+            group = get_object_or_none(UserGroup, pk=user_group_id)
+        elif user_group_name:
+            group = get_object_or_none(UserGroup, name=user_group_name)
+        else:
+            return queryset
+        if not group:
+            return queryset.none()
+        queryset = queryset.filter(user_groups=group)
+        return queryset
+
+    def filter_keyword(self, queryset):
+        keyword = self.request.query_params.get('search')
+        if not keyword:
+            return queryset
+        queryset = queryset.filter(name__icontains=keyword)
+        return queryset
+
+    def filter_queryset(self, queryset):
+        queryset = super().filter_queryset(queryset)
+        queryset = self.filter_valid(queryset)
+        queryset = self.filter_keyword(queryset)
+        queryset = self.filter_asset(queryset)
+        queryset = self.filter_node(queryset)
+        queryset = self.filter_system_user(queryset)
+        queryset = self.filter_user_group(queryset)
+        return queryset
+
+    def get_queryset(self):
+        return self.queryset.all()
+
+
+class AssetPermissionRemoveUserApi(RetrieveUpdateAPIView):
+    """
+    将用户从授权中移除，Detail页面会调用
+    """
+    permission_classes = (IsOrgAdmin,)
+    serializer_class = serializers.AssetPermissionUpdateUserSerializer
+    queryset = AssetPermission.objects.all()
+
+    def update(self, request, *args, **kwargs):
+        perm = self.get_object()
+        serializer = self.serializer_class(data=request.data)
+        if serializer.is_valid():
+            users = serializer.validated_data.get('users')
+            if users:
+                perm.users.remove(*tuple(users))
+            return Response({"msg": "ok"})
+        else:
+            return Response({"error": serializer.errors})
+
+
+class AssetPermissionAddUserApi(RetrieveUpdateAPIView):
+    permission_classes = (IsOrgAdmin,)
+    serializer_class = serializers.AssetPermissionUpdateUserSerializer
+    queryset = AssetPermission.objects.all()
+
+    def update(self, request, *args, **kwargs):
+        perm = self.get_object()
+        serializer = self.serializer_class(data=request.data)
+        if serializer.is_valid():
+            users = serializer.validated_data.get('users')
+            if users:
+                perm.users.add(*tuple(users))
+            return Response({"msg": "ok"})
+        else:
+            return Response({"error": serializer.errors})
+
+
+class AssetPermissionRemoveAssetApi(RetrieveUpdateAPIView):
+    """
+    将用户从授权中移除，Detail页面会调用
+    """
+    permission_classes = (IsOrgAdmin,)
+    serializer_class = serializers.AssetPermissionUpdateAssetSerializer
+    queryset = AssetPermission.objects.all()
+
+    def update(self, request, *args, **kwargs):
+        perm = self.get_object()
+        serializer = self.serializer_class(data=request.data)
+        if serializer.is_valid():
+            assets = serializer.validated_data.get('assets')
+            if assets:
+                perm.assets.remove(*tuple(assets))
+            return Response({"msg": "ok"})
+        else:
+            return Response({"error": serializer.errors})
+
+
+class AssetPermissionAddAssetApi(RetrieveUpdateAPIView):
+    permission_classes = (IsOrgAdmin,)
+    serializer_class = serializers.AssetPermissionUpdateAssetSerializer
+    queryset = AssetPermission.objects.all()
+
+    def update(self, request, *args, **kwargs):
+        perm = self.get_object()
+        serializer = self.serializer_class(data=request.data)
+        if serializer.is_valid():
+            assets = serializer.validated_data.get('assets')
+            if assets:
+                perm.assets.add(*tuple(assets))
+            return Response({"msg": "ok"})
+        else:
+            return Response({"error": serializer.errors})

apps/perms/api/user_group_permission.py

@@ -0,0 +1,140 @@
+# -*- coding: utf-8 -*-
+#
+
+from django.shortcuts import get_object_or_404
+from rest_framework.generics import (
+    ListAPIView, get_object_or_404,
+)
+
+from common.permissions import IsOrgAdmin, IsOrgAdminOrAppUser
+from common.tree import TreeNodeSerializer
+from orgs.utils import set_to_root_org
+from ..utils import (
+    AssetPermissionUtil, parse_asset_to_tree_node, parse_node_to_tree_node
+)
+from ..hands import (
+    AssetGrantedSerializer, UserGroup,  Node, NodeSerializer
+)
+from .. import serializers
+
+
+__all__ = [
+    'UserGroupGrantedAssetsApi', 'UserGroupGrantedNodesApi',
+    'UserGroupGrantedNodesWithAssetsApi', 'UserGroupGrantedNodeAssetsApi',
+    'UserGroupGrantedNodesWithAssetsAsTreeApi',
+]
+
+
+class UserGroupGrantedAssetsApi(ListAPIView):
+    permission_classes = (IsOrgAdmin,)
+    serializer_class = AssetGrantedSerializer
+
+    def get_queryset(self):
+        user_group_id = self.kwargs.get('pk', '')
+        queryset = []
+
+        if not user_group_id:
+            return queryset
+
+        user_group = get_object_or_404(UserGroup, id=user_group_id)
+        util = AssetPermissionUtil(user_group)
+        assets = util.get_assets()
+        for k, v in assets.items():
+            k.system_users_granted = v
+            queryset.append(k)
+        return queryset
+
+
+class UserGroupGrantedNodesApi(ListAPIView):
+    permission_classes = (IsOrgAdmin,)
+    serializer_class = NodeSerializer
+
+    def get_queryset(self):
+        group_id = self.kwargs.get('pk', '')
+        queryset = []
+
+        if group_id:
+            group = get_object_or_404(UserGroup, id=group_id)
+            util = AssetPermissionUtil(group)
+            nodes = util.get_nodes_with_assets()
+            return nodes.keys()
+        return queryset
+
+
+class UserGroupGrantedNodesWithAssetsApi(ListAPIView):
+    permission_classes = (IsOrgAdmin,)
+    serializer_class = serializers.NodeGrantedSerializer
+
+    def get_queryset(self):
+        user_group_id = self.kwargs.get('pk', '')
+        queryset = []
+
+        if not user_group_id:
+            return queryset
+
+        user_group = get_object_or_404(UserGroup, id=user_group_id)
+        util = AssetPermissionUtil(user_group)
+        nodes = util.get_nodes_with_assets()
+        for node, _assets in nodes.items():
+            assets = _assets.keys()
+            for asset, system_users in _assets.items():
+                asset.system_users_granted = system_users
+            node.assets_granted = assets
+            queryset.append(node)
+        return queryset
+
+
+class UserGroupGrantedNodesWithAssetsAsTreeApi(ListAPIView):
+    serializer_class = TreeNodeSerializer
+    permission_classes = (IsOrgAdminOrAppUser,)
+    show_assets = True
+    system_user_id = None
+
+    def change_org_if_need(self):
+        if self.request.user.is_superuser or \
+                self.request.user.is_app or \
+                self.kwargs.get('pk') is None:
+            set_to_root_org()
+
+    def get(self, request, *args, **kwargs):
+        self.show_assets = request.query_params.get('show_assets', '1') == '1'
+        self.system_user_id = request.query_params.get('system_user')
+        return super().get(request, *args, **kwargs)
+
+    def get_queryset(self):
+        self.change_org_if_need()
+        user_group_id = self.kwargs.get('pk', '')
+        queryset = []
+        group = get_object_or_404(UserGroup, id=user_group_id)
+        util = AssetPermissionUtil(group)
+        if self.system_user_id:
+            util.filter_permission_with_system_user(system_user=self.system_user_id)
+        nodes = util.get_nodes_with_assets()
+        for node, assets in nodes.items():
+            data = parse_node_to_tree_node(node)
+            queryset.append(data)
+            if not self.show_assets:
+                continue
+            for asset, system_users in assets.items():
+                data = parse_asset_to_tree_node(node, asset, system_users)
+                queryset.append(data)
+        queryset = sorted(queryset)
+        return queryset
+
+
+class UserGroupGrantedNodeAssetsApi(ListAPIView):
+    permission_classes = (IsOrgAdminOrAppUser,)
+    serializer_class = AssetGrantedSerializer
+
+    def get_queryset(self):
+        user_group_id = self.kwargs.get('pk', '')
+        node_id = self.kwargs.get('node_id')
+
+        user_group = get_object_or_404(UserGroup, id=user_group_id)
+        node = get_object_or_404(Node, id=node_id)
+        util = AssetPermissionUtil(user_group)
+        nodes = util.get_nodes_with_assets()
+        assets = nodes.get(node, [])
+        for asset, system_users in assets.items():
+            asset.system_users_granted = system_users
+        return assets

apps/perms/api/user_permission.py

@@ -0,0 +1,313 @@
+# -*- coding: utf-8 -*-
+#
+
+from django.shortcuts import get_object_or_404
+from rest_framework.views import APIView, Response
+from rest_framework.generics import (
+    ListAPIView, get_object_or_404,
+)
+from rest_framework.pagination import LimitOffsetPagination
+
+from common.permissions import IsValidUser, IsOrgAdminOrAppUser
+from common.tree import TreeNodeSerializer
+from orgs.utils import set_to_root_org
+from ..utils import (
+    AssetPermissionUtil, parse_asset_to_tree_node, parse_node_to_tree_node
+)
+from ..hands import (
+    AssetGrantedSerializer, User, Asset, Node,
+    SystemUser, NodeSerializer
+)
+from .. import serializers
+from ..mixins import AssetsFilterMixin
+
+
+__all__ = [
+    'UserGrantedAssetsApi', 'UserGrantedNodesApi',
+    'UserGrantedNodesWithAssetsApi', 'UserGrantedNodeAssetsApi',
+    'ValidateUserAssetPermissionApi', 'UserGrantedNodeChildrenApi',
+    'UserGrantedNodesWithAssetsAsTreeApi',
+]
+
+
+class UserPermissionMixin:
+    cache_policy = '0'
+
+    @staticmethod
+    def change_org_if_need(request, kwargs):
+        if request.user.is_superuser or \
+                request.user.is_app or \
+                kwargs.get('pk') is None:
+            set_to_root_org()
+
+    def dispatch(self, request, *args, **kwargs):
+        self.change_org_if_need(request, kwargs)
+        self.cache_policy = request.GET.get('cache_policy', '0')
+        return super().dispatch(request, *args, **kwargs)
+
+
+class UserGrantedAssetsApi(UserPermissionMixin, AssetsFilterMixin, ListAPIView):
+    """
+    用户授权的所有资产
+    """
+    permission_classes = (IsOrgAdminOrAppUser,)
+    serializer_class = AssetGrantedSerializer
+    pagination_class = LimitOffsetPagination
+
+    def get_queryset(self):
+        user_id = self.kwargs.get('pk', '')
+        queryset = []
+
+        if user_id:
+            user = get_object_or_404(User, id=user_id)
+        else:
+            user = self.request.user
+
+        util = AssetPermissionUtil(user, cache_policy=self.cache_policy)
+        assets = util.get_assets()
+        for k, v in assets.items():
+            system_users_granted = [s for s in v if s.protocol == k.protocol]
+            k.system_users_granted = system_users_granted
+            queryset.append(k)
+        return queryset
+
+    def get_permissions(self):
+        if self.kwargs.get('pk') is None:
+            self.permission_classes = (IsValidUser,)
+        return super().get_permissions()
+
+
+class UserGrantedNodesApi(UserPermissionMixin, ListAPIView):
+    """
+    查询用户授权的所有节点的API, 如果是超级用户或者是 app，切换到root org
+    """
+    permission_classes = (IsOrgAdminOrAppUser,)
+    serializer_class = NodeSerializer
+
+    def get_queryset(self):
+        user_id = self.kwargs.get('pk', '')
+        if user_id:
+            user = get_object_or_404(User, id=user_id)
+        else:
+            user = self.request.user
+        util = AssetPermissionUtil(user, cache_policy=self.cache_policy)
+        nodes = util.get_nodes_with_assets()
+        return nodes.keys()
+
+    def get_permissions(self):
+        if self.kwargs.get('pk') is None:
+            self.permission_classes = (IsValidUser,)
+        return super().get_permissions()
+
+
+class UserGrantedNodesWithAssetsApi(UserPermissionMixin, AssetsFilterMixin, ListAPIView):
+    """
+    用户授权的节点并带着节点下资产的api
+    """
+    permission_classes = (IsOrgAdminOrAppUser,)
+    serializer_class = serializers.NodeGrantedSerializer
+
+    def get_queryset(self):
+        user_id = self.kwargs.get('pk', '')
+        queryset = []
+        if not user_id:
+            user = self.request.user
+        else:
+            user = get_object_or_404(User, id=user_id)
+
+        util = AssetPermissionUtil(user, cache_policy=self.cache_policy)
+        nodes = util.get_nodes_with_assets()
+        for node, _assets in nodes.items():
+            assets = _assets.keys()
+            for k, v in _assets.items():
+                system_users_granted = [s for s in v if
+                                        s.protocol == k.protocol]
+                k.system_users_granted = system_users_granted
+            node.assets_granted = assets
+            queryset.append(node)
+        return queryset
+
+    def sort_assets(self, queryset):
+        for node in queryset:
+            node.assets_granted = super().sort_assets(node.assets_granted)
+        return queryset
+
+    def get_permissions(self):
+        if self.kwargs.get('pk') is None:
+            self.permission_classes = (IsValidUser,)
+        return super().get_permissions()
+
+
+class UserGrantedNodesWithAssetsAsTreeApi(UserPermissionMixin, ListAPIView):
+    serializer_class = TreeNodeSerializer
+    permission_classes = (IsOrgAdminOrAppUser,)
+    show_assets = True
+    system_user_id = None
+
+    def get(self, request, *args, **kwargs):
+        self.show_assets = request.query_params.get('show_assets', '1') == '1'
+        self.system_user_id = request.query_params.get('system_user')
+        return super().get(request, *args, **kwargs)
+
+    def get_permissions(self):
+        if self.kwargs.get('pk') is None:
+            self.permission_classes = (IsValidUser,)
+        return super().get_permissions()
+
+    def get_queryset(self):
+        user_id = self.kwargs.get('pk', '')
+        queryset = []
+        if not user_id:
+            user = self.request.user
+        else:
+            user = get_object_or_404(User, id=user_id)
+        util = AssetPermissionUtil(user, cache_policy=self.cache_policy)
+        if self.system_user_id:
+            util.filter_permission_with_system_user(
+                system_user=self.system_user_id)
+        nodes = util.get_nodes_with_assets()
+        for node, assets in nodes.items():
+            data = parse_node_to_tree_node(node)
+            queryset.append(data)
+            if not self.show_assets:
+                continue
+            for asset, system_users in assets.items():
+                data = parse_asset_to_tree_node(node, asset, system_users)
+                queryset.append(data)
+        queryset = sorted(queryset)
+        return queryset
+
+
+class UserGrantedNodeAssetsApi(UserPermissionMixin, AssetsFilterMixin, ListAPIView):
+    """
+    查询用户授权的节点下的资产的api, 与上面api不同的是，只返回某个节点下的资产
+    """
+    permission_classes = (IsOrgAdminOrAppUser,)
+    serializer_class = AssetGrantedSerializer
+    pagination_class = LimitOffsetPagination
+
+    def get_queryset(self):
+        user_id = self.kwargs.get('pk', '')
+        node_id = self.kwargs.get('node_id')
+
+        if user_id:
+            user = get_object_or_404(User, id=user_id)
+        else:
+            user = self.request.user
+        util = AssetPermissionUtil(user, cache_policy=self.cache_policy)
+        node = get_object_or_404(Node, id=node_id)
+        nodes = util.get_nodes_with_assets()
+        assets = nodes.get(node, [])
+        for asset, system_users in assets.items():
+            asset.system_users_granted = system_users
+
+        assets = list(assets.keys())
+        return assets
+
+    def get_permissions(self):
+        if self.kwargs.get('pk') is None:
+            self.permission_classes = (IsValidUser,)
+        return super().get_permissions()
+
+
+class UserGrantedNodeChildrenApi(UserPermissionMixin, ListAPIView):
+    """
+    获取用户自己授权节点下子节点的api
+    """
+    permission_classes = (IsValidUser,)
+    serializer_class = serializers.AssetPermissionNodeSerializer
+
+    def get_children_queryset(self):
+        util = AssetPermissionUtil(self.request.user, cache_policy=self.cache_policy)
+        node_id = self.request.query_params.get('id')
+        nodes_granted = util.get_nodes_with_assets()
+        if not nodes_granted:
+            return []
+        root_nodes = [node for node in nodes_granted.keys() if node.is_root()]
+
+        queryset = []
+        if node_id and node_id in [str(node.id) for node in nodes_granted]:
+            node = [node for node in nodes_granted if str(node.id) == node_id][0]
+        elif len(root_nodes) == 1:
+            node = root_nodes[0]
+            node.assets_amount = len(nodes_granted[node])
+            queryset.append(node)
+        else:
+            for node in root_nodes:
+                node.assets_amount = len(nodes_granted[node])
+                queryset.append(node)
+            return queryset
+
+        children = []
+        for child in node.get_children():
+            if child in nodes_granted:
+                child.assets_amount = len(nodes_granted[node])
+                children.append(child)
+        children = sorted(children, key=lambda x: x.value)
+        queryset.extend(children)
+        fake_nodes = []
+        for asset, system_users in nodes_granted[node].items():
+            fake_node = asset.as_node()
+            fake_node.assets_amount = 0
+            system_users = [s for s in system_users if s.protocol == asset.protocol]
+            fake_node.asset.system_users_granted = system_users
+            fake_node.key = node.key + ':0'
+            fake_nodes.append(fake_node)
+        fake_nodes = sorted(fake_nodes, key=lambda x: x.value)
+        queryset.extend(fake_nodes)
+        return queryset
+
+    def get_search_queryset(self, keyword):
+        util = AssetPermissionUtil(self.request.user, cache_policy=self.cache_policy)
+        nodes_granted = util.get_nodes_with_assets()
+        queryset = []
+        for node, assets in nodes_granted.items():
+            matched_assets = []
+            node_matched = node.value.lower().find(keyword.lower()) >= 0
+            asset_has_matched = False
+            for asset, system_users in assets.items():
+                asset_matched = (asset.hostname.lower().find(keyword.lower()) >= 0) \
+                                or (asset.ip.find(keyword.lower()) >= 0)
+                if node_matched or asset_matched:
+                    asset_has_matched = True
+                    fake_node = asset.as_node()
+                    fake_node.assets_amount = 0
+                    system_users = [s for s in system_users if
+                                    s.protocol == asset.protocol]
+                    fake_node.asset.system_users_granted = system_users
+                    fake_node.key = node.key + ':0'
+                    matched_assets.append(fake_node)
+            if asset_has_matched:
+                node.assets_amount = len(matched_assets)
+                queryset.append(node)
+                queryset.extend(sorted(matched_assets, key=lambda x: x.value))
+        return queryset
+
+    def get_queryset(self):
+        keyword = self.request.query_params.get('search')
+        if keyword:
+            return self.get_search_queryset(keyword)
+        else:
+            return self.get_children_queryset()
+
+
+class ValidateUserAssetPermissionApi(UserPermissionMixin, APIView):
+    permission_classes = (IsOrgAdminOrAppUser,)
+
+    def get(self, request):
+        user_id = request.query_params.get('user_id', '')
+        asset_id = request.query_params.get('asset_id', '')
+        system_id = request.query_params.get('system_user_id', '')
+
+        user = get_object_or_404(User, id=user_id)
+        asset = get_object_or_404(Asset, id=asset_id)
+        system_user = get_object_or_404(SystemUser, id=system_id)
+
+        util = AssetPermissionUtil(user, cache_policy=self.cache_policy)
+        assets_granted = util.get_assets()
+        if system_user in assets_granted.get(asset, []):
+            return Response({'msg': True}, status=200)
+        else:
+            return Response({'msg': False}, status=403)
+
+

apps/perms/utils.py

@@ -3,6 +3,8 @@
 from __future__ import absolute_import, unicode_literals
 from collections import defaultdict
 from django.db.models import Q
+from django.core.cache import cache
+from django.conf import settings
 
 from common.utils import get_logger
 from common.tree import TreeNode
@@ -97,10 +99,15 @@ class AssetPermissionUtil:
         "SystemUser": get_node_permissions,
     }
 
-    def __init__(self, obj):
+    CACHE_KEY = '_ASSET_PERM_CACHE_{}_{}'
+    CACHE_TIME = settings.ASSETS_PERM_CACHE_TIME
+    CACHE_POLICY_MAP = (('0', 'never'), ('1', 'using'), ('2', 'refresh'))
+
+    def __init__(self, obj, cache_policy='0'):
         self.object = obj
         self._permissions = None
         self._assets = None
+        self.cache_policy = cache_policy
 
     @property
     def permissions(self):
@@ -141,7 +148,7 @@ class AssetPermissionUtil:
                 )
         return assets
 
-    def get_assets(self):
+    def get_assets_without_cache(self):
         if self._assets:
             return self._assets
         assets = self.get_assets_direct()
@@ -155,7 +162,26 @@ class AssetPermissionUtil:
         self._assets = assets
         return self._assets
 
-    def get_nodes_with_assets(self):
+    def get_assets_from_cache(self):
+        cache_key = self.CACHE_KEY.format(str(self.object.id), 'ASSETS')
+        cached = cache.get(cache_key)
+        if cached:
+            return cached
+        assets = self.get_assets_without_cache()
+        self.expire_cache()
+        cache.set(cache_key, assets, self.CACHE_TIME)
+        return assets
+
+    def get_assets(self):
+        if self.cache_policy in self.CACHE_POLICY_MAP[1]:
+            return self.get_assets_from_cache()
+        elif self.cache_policy in self.CACHE_POLICY_MAP[2]:
+            self.expire_cache()
+            return self.get_assets_from_cache()
+        else:
+            return self.get_assets_without_cache()
+
+    def get_nodes_with_assets_without_cache(self):
         """
         返回节点并且包含资产
         {"node": {"assets": set("system_user")}}
@@ -167,13 +193,60 @@ class AssetPermissionUtil:
             tree.add_asset(asset, system_users)
         return tree.get_nodes()
 
-    def get_system_users(self):
+    def get_nodes_with_assets_from_cache(self):
+        cache_key = self.CACHE_KEY.format(str(self.object.id), 'NODES_WITH_ASSETS')
+        cached = cache.get(cache_key)
+        if cached:
+            return cached
+        nodes = self.get_nodes_with_assets_without_cache()
+        self.expire_cache()
+        cache.set(cache_key, nodes, self.CACHE_TIME)
+        return nodes
+
+    def get_nodes_with_assets(self):
+        if self.cache_policy in self.CACHE_POLICY_MAP[1]:
+            return self.get_nodes_with_assets_from_cache()
+        elif self.cache_policy in self.CACHE_POLICY_MAP[2]:
+            self.expire_cache()
+            return self.get_nodes_with_assets_from_cache()
+        else:
+            return self.get_nodes_with_assets_without_cache()
+
+    def get_system_user_without_cache(self):
         system_users = set()
         permissions = self.permissions.prefetch_related('system_users')
         for perm in permissions:
             system_users.update(perm.system_users.all())
         return system_users
 
+    def get_system_user_from_cache(self):
+        cache_key = self.CACHE_KEY.format(str(self.object.id), 'SYSTEM_USER')
+        cached = cache.get(cache_key)
+        if cached:
+            return cached
+        self.expire_cache()
+        system_users = self.get_system_user_without_cache()
+        cache.set(cache_key, system_users, self.CACHE_TIME)
+        return system_users
+
+    def get_system_users(self):
+        if self.cache_policy in self.CACHE_POLICY_MAP[1]:
+            return self.get_system_user_from_cache()
+        elif self.cache_policy in self.CACHE_POLICY_MAP[2]:
+            self.expire_cache()
+            return self.get_system_user_from_cache()
+        else:
+            return self.get_system_user_without_cache()
+
+    def expire_cache(self):
+        cache_key = self.CACHE_KEY.format(str(self.object.id), '*')
+        cache.delete_pattern(cache_key)
+
+    @classmethod
+    def expire_all_cache(cls):
+        cache_key = cls.CACHE_KEY.format('*', '*')
+        cache.delete_pattern(cache_key)
+
 
 def is_obj_attr_has(obj, val, attrs=("hostname", "ip", "comment")):
     if not attrs:

apps/users/models/user.py

@@ -310,7 +310,8 @@ class User(AbstractUser):
         if not isinstance(remote_addr, bytes):
             remote_addr = remote_addr.encode("utf-8")
         remote_addr = base64.b16encode(remote_addr)  # .replace(b'=', '')
-        token = cache.get('%s_%s' % (self.id, remote_addr))
+        cache_key = '%s_%s' % (self.id, remote_addr)
+        token = cache.get(cache_key)
         if not token:
             token = uuid.uuid4().hex
         cache.set(token, self.id, expiration)

requirements/requirements.txt

@@ -80,3 +80,4 @@ python-ldap==3.1.0
 tencentcloud-sdk-python==3.0.40
 django-radius==1.3.3
 ipip-ipdb==1.2.1
+django-redis-sessions==0.6.1