feat(后端): 添加授权体系、系统监控与试用期计提
按 2026-11-02 需求补齐计划交付后端能力： - 角色授权：权限目录化，接口统一准入校验，未登记默认拒绝； 管理员判断改为按数据库角色重新判定，防止权限码持有者绕过 - 系统监控：单进程采集资源、请求与异常指标，分钟级聚合， 阈值配置化；敏感配置增加 repr 保护，Redis 密码 URL 转义 - 试用期计提：按回款日判定并写入快照，年度结清与调整单联动； 人员模型补试用期、离职日期与工资版本历史字段 - 计提模板：公式骨架受控，页面维护名称与参数绑定 - T+ 采集：自动化配置表与进度查询 内置角色禁停用保护对齐模块注释；核算规则版本提为常量并 补充批量核算失败堆栈日志。 影响范围：后端全部模块、数据库迁移 V22-V28 验证：uv run ruff check 通过；922 个单元测试全部通过； 集成测试因本机 MySQL 数据卷被其他容器锁定暂未运行
This commit is contained in:
liuwenxin committed
1 parent
02fb06e0af
commit
1461a8d113
149 files changed
+8736
-368
No files matched your search
@@ -0,0 +1,56 @@
|
||||
"""角色权限配置与用户角色分配；旧制作人设置只保留兼容提示。"""
|
||||
from fastapi import APIRouter
|
||||
|
||||
from app.api.deps import AdminUser, DbSession, RequestMetaDep
|
||||
from app.core.response import ok
|
||||
from app.schemas.authorization import (
|
||||
AuthorizationPreviewIn,
|
||||
AuthorizationSettingsIn,
|
||||
RolePermissionsIn,
|
||||
UserAuthorizationIn,
|
||||
)
|
||||
from app.services import authorization_management as service
|
||||
from app.services.permission_catalog import CATALOG
|
||||
|
||||
router = APIRouter(prefix="/system", tags=["系统管理 · 权限"])
|
||||
|
||||
|
||||
@router.get("/permissions/catalog")
|
||||
def catalog(session: DbSession, actor: AdminUser):
|
||||
service.require_admin(session, actor)
|
||||
return ok(list(CATALOG.values()))
|
||||
|
||||
|
||||
@router.get("/roles/{role_id}/permissions")
|
||||
def role_permissions(role_id: int, session: DbSession, actor: AdminUser):
|
||||
return ok(service.role_permissions(session, role_id))
|
||||
|
||||
|
||||
@router.put("/roles/{role_id}/permissions")
|
||||
def save_role(role_id: int, payload: RolePermissionsIn, session: DbSession, actor: AdminUser, meta: RequestMetaDep):
|
||||
return ok(service.save_role(session, role_id, payload, actor, meta))
|
||||
|
||||
|
||||
@router.get("/users/{user_id}/authorization")
|
||||
def user_authorization(user_id: int, session: DbSession, actor: AdminUser):
|
||||
return ok(service.user_authorization(session, user_id))
|
||||
|
||||
|
||||
@router.post("/users/{user_id}/authorization/preview")
|
||||
def preview(user_id: int, payload: AuthorizationPreviewIn, session: DbSession, actor: AdminUser):
|
||||
return ok(service.preview(session, user_id, payload))
|
||||
|
||||
|
||||
@router.put("/users/{user_id}/authorization")
|
||||
def save_user(user_id: int, payload: UserAuthorizationIn, session: DbSession, actor: AdminUser, meta: RequestMetaDep):
|
||||
return ok(service.save_user(session, user_id, payload, actor, meta))
|
||||
|
||||
|
||||
@router.get("/authorization-settings")
|
||||
def settings(session: DbSession, actor: AdminUser):
|
||||
return ok(service.settings_out(session))
|
||||
|
||||
|
||||
@router.put("/authorization-settings")
|
||||
def save_settings(payload: AuthorizationSettingsIn, session: DbSession, actor: AdminUser, meta: RequestMetaDep):
|
||||
return ok(service.save_settings(session, payload, actor, meta))
|
||||
@@ -60,7 +60,7 @@ def list_template_options(session: DbSession, _: AdminUser) -> ApiResponse[list[
|
||||
|
||||
定义在 `/{role_id}` 之前：静态路径优先，避免 "meta" 被当作路径参数解析。
|
||||
"""
|
||||
return ok(business_role_service.list_template_options())
|
||||
return ok(business_role_service.list_template_options(session))
|
||||
|
||||
|
||||
@router.get("/{role_id}", response_model=ApiResponse[BusinessRoleOut], summary="岗位详情")
|
||||
|
||||
@@ -0,0 +1,70 @@
|
||||
"""计提公式模板管理接口（管理员）。"""
|
||||
|
||||
from typing import Annotated
|
||||
|
||||
from fastapi import APIRouter, Path
|
||||
|
||||
from app.api.deps import AdminUser, DbSession, RequestMetaDep
|
||||
from app.core.response import ApiResponse, ok
|
||||
from app.schemas.calc_template import (
|
||||
CalcTemplateCreateIn,
|
||||
CalcTemplateOut,
|
||||
CalcTemplateUpdateIn,
|
||||
FormulaOptionOut,
|
||||
)
|
||||
from app.services import calc_template_service
|
||||
|
||||
router = APIRouter(prefix="/calc-templates", tags=["系统管理 · 公式模板"])
|
||||
|
||||
|
||||
@router.get("", response_model=ApiResponse[list[CalcTemplateOut]], summary="模板列表")
|
||||
def list_templates(session: DbSession, _: AdminUser) -> ApiResponse[list[CalcTemplateOut]]:
|
||||
"""取全部模板（含停用与岗位引用计数）。"""
|
||||
return ok(calc_template_service.list_templates(session).records)
|
||||
|
||||
|
||||
@router.get("/meta/formulas", response_model=ApiResponse[list[FormulaOptionOut]], summary="公式骨架下拉")
|
||||
def list_formula_options(_: AdminUser) -> ApiResponse[list[FormulaOptionOut]]:
|
||||
"""取受控公式骨架集合（新增模板时选择）。"""
|
||||
return ok([FormulaOptionOut.model_validate(row) for row in calc_template_service.list_formula_options()])
|
||||
|
||||
|
||||
@router.post("", response_model=ApiResponse[CalcTemplateOut], summary="新增模板")
|
||||
def create_template(
|
||||
session: DbSession,
|
||||
current_user: AdminUser,
|
||||
payload: CalcTemplateCreateIn,
|
||||
meta: RequestMetaDep,
|
||||
) -> ApiResponse[CalcTemplateOut]:
|
||||
"""新增公式模板。编码唯一、骨架受控、参数绑定按骨架角色校验。"""
|
||||
return ok(
|
||||
calc_template_service.create_template(session, payload, operator=current_user, meta=meta),
|
||||
message="模板已创建",
|
||||
)
|
||||
|
||||
|
||||
@router.put("/{template_id}", response_model=ApiResponse[CalcTemplateOut], summary="编辑模板")
|
||||
def update_template(
|
||||
session: DbSession,
|
||||
current_user: AdminUser,
|
||||
template_id: Annotated[int, Path(ge=1)],
|
||||
payload: CalcTemplateUpdateIn,
|
||||
meta: RequestMetaDep,
|
||||
) -> ApiResponse[CalcTemplateOut]:
|
||||
"""编辑模板名称/说明/排序；自定义模板可调整参数绑定。"""
|
||||
return ok(
|
||||
calc_template_service.update_template(session, template_id, payload, operator=current_user, meta=meta),
|
||||
message="已保存",
|
||||
)
|
||||
|
||||
|
||||
@router.delete("/{template_id}", response_model=ApiResponse[None], summary="删除模板")
|
||||
def delete_template(
|
||||
session: DbSession,
|
||||
current_user: AdminUser,
|
||||
template_id: Annotated[int, Path(ge=1)],
|
||||
meta: RequestMetaDep,
|
||||
) -> ApiResponse[None]:
|
||||
"""删除模板。系统模板禁删；被岗位引用禁删。"""
|
||||
calc_template_service.delete_template(session, template_id, operator=current_user, meta=meta)
|
||||
return ok(message="模板已删除")
|
||||
@@ -0,0 +1,37 @@
|
||||
"""系数表查询、维护与工作簿导入导出，复用计提参数权限。"""
|
||||
|
||||
from datetime import date
|
||||
|
||||
from fastapi import APIRouter, File, UploadFile
|
||||
from fastapi.responses import Response
|
||||
|
||||
from app.api.deps import DbSession, LoginUser, RequestMetaDep
|
||||
from app.core.response import ok
|
||||
from app.schemas.coefficient import CoefficientChangeIn
|
||||
from app.services import coefficient_service
|
||||
|
||||
router = APIRouter(prefix="/coefficients", tags=["计提系数表"])
|
||||
|
||||
|
||||
@router.get("")
|
||||
def catalog(session: DbSession, _: LoginUser, as_of: date | None = None):
|
||||
return ok(coefficient_service.catalog(session, as_of))
|
||||
|
||||
|
||||
@router.put("")
|
||||
def save(payload: CoefficientChangeIn, session: DbSession, actor: LoginUser, meta: RequestMetaDep):
|
||||
return ok(coefficient_service.save(session, payload, actor, meta))
|
||||
|
||||
|
||||
@router.get("/export")
|
||||
def export(session: DbSession, _: LoginUser, as_of: date | None = None):
|
||||
return Response(
|
||||
coefficient_service.workbook(session, as_of),
|
||||
media_type="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
|
||||
headers={"Content-Disposition": 'attachment; filename="coefficients.xlsx"'},
|
||||
)
|
||||
|
||||
|
||||
@router.post("/import-preview")
|
||||
def import_preview(session: DbSession, _: LoginUser, file: UploadFile = File(...)):
|
||||
return ok(coefficient_service.import_preview(session, file.file.read(2 * 1024 * 1024 + 1)))
|
||||
@@ -0,0 +1,56 @@
|
||||
"""系统监控只读接口；全部复用管理员依赖，不提供运维写操作。"""
|
||||
|
||||
from typing import Annotated
|
||||
|
||||
from fastapi import APIRouter, Path, Query, Request
|
||||
from fastapi.encoders import jsonable_encoder
|
||||
from fastapi.responses import JSONResponse
|
||||
|
||||
from app.api.deps import AdminUser, DbSession
|
||||
from app.core.response import ApiResponse, PageResult, ok
|
||||
from app.schemas.monitor import EventOut, EventQuery, MonitorWindow, OverviewOut
|
||||
from app.services import monitor_service
|
||||
|
||||
router = APIRouter(prefix="/monitor", tags=["系统管理 · 系统监控"])
|
||||
|
||||
|
||||
@router.get("/overview", response_model=ApiResponse[OverviewOut], summary="健康总览")
|
||||
def overview(request: Request, session: DbSession, _: AdminUser):
|
||||
return ok(monitor_service.overview(session, request.app.state.monitor))
|
||||
|
||||
|
||||
@router.get("/trends", response_model=ApiResponse[dict], summary="分钟级监控趋势")
|
||||
def trends(
|
||||
request: Request, session: DbSession, _: AdminUser, query: Annotated[MonitorWindow, Query()]
|
||||
):
|
||||
return ok(monitor_service.trends(session, request.app.state.monitor, query))
|
||||
|
||||
|
||||
@router.get("/interfaces", response_model=ApiResponse[dict], summary="接口性能排行")
|
||||
def interfaces(
|
||||
request: Request, session: DbSession, _: AdminUser, query: Annotated[MonitorWindow, Query()]
|
||||
):
|
||||
return ok(monitor_service.interfaces(session, request.app.state.monitor, query))
|
||||
|
||||
|
||||
@router.get("/events", response_model=ApiResponse[PageResult[EventOut]], summary="诊断事件")
|
||||
def events(session: DbSession, _: AdminUser, query: Annotated[EventQuery, Query()]):
|
||||
return ok(monitor_service.events(session, query))
|
||||
|
||||
|
||||
@router.get("/events/{event_id}", response_model=ApiResponse[EventOut], summary="诊断事件详情")
|
||||
def event(session: DbSession, _: AdminUser, event_id: Annotated[int, Path(ge=1)]):
|
||||
return ok(monitor_service.event(session, event_id))
|
||||
|
||||
|
||||
@router.get("/diagnostic", summary="下载脱敏诊断摘要")
|
||||
def diagnostic(
|
||||
request: Request, session: DbSession, _: AdminUser, query: Annotated[EventQuery, Query()]
|
||||
):
|
||||
return JSONResponse(
|
||||
jsonable_encoder(monitor_service.diagnostic(session, request.app.state.monitor, query)),
|
||||
headers={
|
||||
"Content-Disposition": 'attachment; filename="monitor-diagnostic.json"',
|
||||
"Cache-Control": "no-store",
|
||||
},
|
||||
)
|
||||
@@ -8,6 +8,8 @@ from app.api.deps import DbSession, PayrollWriter, RequestMetaDep, WorkbenchRead
|
||||
from app.api.v1.system.tplus_workbench import router as workbench_router
|
||||
from app.core.response import ApiResponse, PageResult, ok
|
||||
from app.schemas.tplus import (
|
||||
TPlusAutomationOverview,
|
||||
TPlusAutomationUpdate,
|
||||
TPlusBatchDetailOut,
|
||||
TPlusBatchOut,
|
||||
TPlusBatchQuery,
|
||||
@@ -17,7 +19,7 @@ from app.schemas.tplus import (
|
||||
TPlusOverviewOut,
|
||||
TPlusRetryIn,
|
||||
)
|
||||
from app.services.tplus import query_service, task_service
|
||||
from app.services.tplus import automation_config, query_service, task_service
|
||||
|
||||
router = APIRouter(prefix="/tplus", tags=["系统管理 · T+ 数据同步"])
|
||||
router.include_router(workbench_router)
|
||||
@@ -30,6 +32,13 @@ def overview(session: DbSession, _: WorkbenchReader):
|
||||
return ok(query_service.overview(session))
|
||||
|
||||
|
||||
@router.put("/automation", response_model=ApiResponse[TPlusAutomationOverview])
|
||||
def update_automation(session: DbSession, admin: PayrollWriter, meta: RequestMetaDep,
|
||||
payload: TPlusAutomationUpdate):
|
||||
"""保存自动排队开关；既有活动任务继续执行。"""
|
||||
return ok(automation_config.save(session, payload, task_service.TaskActor(admin, meta)))
|
||||
|
||||
|
||||
@router.get("/batches", response_model=ApiResponse[PageResult[TPlusBatchOut]])
|
||||
def batches(session: DbSession, _: WorkbenchReader, query: Annotated[TPlusBatchQuery, Query()]):
|
||||
"""分页查询批次元数据。"""
|
||||
|
||||
Reference in new issue
Block a user