daren/apps/common/services/permission_service.py

# # apps/common/services/permission_service.py
# import logging
# from django.db import transaction
# from django.db.models import Q
# from django.utils import timezone
# from rest_framework.exceptions import ValidationError
# from apps.user.models import User
# from apps.knowledge_base.models import KnowledgeBase
# from apps.permissions.models import Permission, KnowledgeBasePermission as KBPermissionModel

# logger = logging.getLogger(__name__)

# class PermissionService:
#     def can_manage_knowledge_base(self, user, knowledge_base):
#         """检查用户是否是知识库的创建者"""
#         return str(knowledge_base.user_id) == str(user.id)

#     def check_extend_permission(self, permission, user):
#         """检查是否有权限延长权限有效期"""
#         knowledge_base = permission.knowledge_base
#         if knowledge_base.type == 'private':
#             return knowledge_base.user_id == user.id
#         if knowledge_base.type == 'leader':
#             return user.role == 'admin'
#         if knowledge_base.type == 'member':
#             return user.role == 'admin' or (
#                 user.role == 'leader' and user.department == knowledge_base.department
#             )
#         return False

#     def create_permission_request(self, user, validated_data, notification_service):
#         """创建权限申请并发送通知"""
#         knowledge_base = validated_data['knowledge_base']
#         if str(knowledge_base.user_id) == str(user.id):
#             raise ValidationError({
#                 "code": 400,
#                 "message": "您是此知识库的创建者，无需申请权限",
#                 "data": None
#             })

#         approver = User.objects.get(id=knowledge_base.user_id)
#         requested_permissions = validated_data.get('permissions', {})
#         expires_at = validated_data.get('expires_at')

#         if not any([requested_permissions.get('can_read'),
#                    requested_permissions.get('can_edit'),
#                    requested_permissions.get('can_delete')]):
#             raise ValidationError("至少需要申请一种权限（读/改/删）")

#         if not expires_at:
#             raise ValidationError("请指定权限到期时间")

#         existing_request = Permission.objects.filter(
#             knowledge_base=knowledge_base,
#             applicant=user,
#             status='pending'
#         ).first()
#         if existing_request:
#             raise ValidationError("您已有一个待处理的权限申请")

#         existing_permission = Permission.objects.filter(
#             knowledge_base=knowledge_base,
#             applicant=user,
#             status='approved',
#             expires_at__gt=timezone.now()
#         ).first()
#         if existing_permission:
#             raise ValidationError("您已有此知识库的访问权限")

#         with transaction.atomic():
#             permission = Permission.objects.create(
#                 knowledge_base=knowledge_base,
#                 applicant=user,
#                 approver=approver,
#                 permissions=requested_permissions,
#                 expires_at=expires_at,
#                 status='pending'
#             )

#             permission_types = []
#             if requested_permissions.get('can_read'):
#                 permission_types.append('读取')
#             if requested_permissions.get('can_edit'):
#                 permission_types.append('编辑')
#             if requested_permissions.get('can_delete'):
#                 permission_types.append('删除')
#             permission_str = '、'.join(permission_types)

#             notification_service.send_notification(
#                 user=approver,
#                 title="新的权限申请",
#                 content=f"用户 {user.name} 申请了知识库 '{knowledge_base.name}' 的{permission_str}权限",
#                 notification_type="permission_request",
#                 related_object_id=str(permission.id)
#             )

#         return permission

#     def approve_permission(self, user, permission, response_message, notification_service):
#         """审批权限申请"""
#         if not self.can_manage_knowledge_base(user, permission.knowledge_base):
#             raise ValidationError({
#                 'code': 403,
#                 'message': '只有知识库创建者可以审批此申请',
#                 'data': None
#             })

#         with transaction.atomic():
#             permission.status = 'approved'
#             permission.approver = user
#             permission.response_message = response_message
#             permission.save()

#             kb_permission = KBPermissionModel.objects.filter(
#                 knowledge_base=permission.knowledge_base,
#                 user=permission.applicant
#             ).first()

#             if kb_permission:
#                 kb_permission.can_read = permission.permissions.get('can_read', False)
#                 kb_permission.can_edit = permission.permissions.get('can_edit', False)
#                 kb_permission.can_delete = permission.permissions.get('can_delete', False)
#                 kb_permission.granted_by = user
#                 kb_permission.status = 'active'
#                 kb_permission.expires_at = permission.expires_at
#                 kb_permission.save()
#                 logger.info(f"更新知识库权限记录: {kb_permission.id}")
#             else:
#                 kb_permission = KBPermissionModel.objects.create(
#                     knowledge_base=permission.knowledge_base,
#                     user=permission.applicant,
#                     can_read=permission.permissions.get('can_read', False),
#                     can_edit=permission.permissions.get('can_edit', False),
#                     can_delete=permission.permissions.get('can_delete', False),
#                     granted_by=user,
#                     status='active',
#                     expires_at=permission.expires_at
#                 )
#                 logger.info(f"创建新的知识库权限记录: {kb_permission.id}")

#             notification_service.send_notification(
#                 user=permission.applicant,
#                 title="权限申请已通过",
#                 content=f"您对知识库 '{permission.knowledge_base.name}' 的权限申请已通过",
#                 notification_type="permission_approved",
#                 related_object_id=str(permission.id)
#             )

#         return permission

#     def reject_permission(self, user, permission, response_message, notification_service):
#         """拒绝权限申请"""
#         if not self.can_manage_knowledge_base(user, permission.knowledge_base):
#             raise ValidationError({
#                 'code': 403,
#                 'message': '只有知识库创建者可以审批此申请',
#                 'data': None
#             })

#         if permission.status != 'pending':
#             raise ValidationError({
#                 'code': 400,
#                 'message': '该申请已被处理',
#                 'data': None
#             })

#         if not response_message:
#             raise ValidationError({
#                 'code': 400,
#                 'message': '请填写拒绝原因',
#                 'data': None
#             })

#         with transaction.atomic():
#             permission.status = 'rejected'
#             permission.approver = user
#             permission.response_message = response_message
#             permission.save()

#             notification_service.send_notification(
#                 user=permission.applicant,
#                 title="权限申请已拒绝",
#                 content=f"您对知识库 '{permission.knowledge_base.name}' 的权限申请已被拒绝\n拒绝原因：{response_message}",
#                 notification_type="permission_rejected",
#                 related_object_id=str(permission.id)
#             )

#         return permission

#     def extend_permission(self, user, permission, new_expires_at, notification_service):
#         """延长权限有效期"""
#         if not self.check_extend_permission(permission, user):
#             raise ValidationError({
#                 "code": 403,
#                 "message": "您没有权限延长此权限",
#                 "data": None
#             })

#         if not new_expires_at:
#             raise ValidationError({
#                 "code": 400,
#                 "message": "请设置新的过期时间",
#                 "data": None
#             })

#         try:
#             new_expires_at = timezone.datetime.strptime(new_expires_at, '%Y-%m-%dT%H:%M:%SZ')
#             new_expires_at = timezone.make_aware(new_expires_at)
#             if new_expires_at <= timezone.now():
#                 raise ValidationError({
#                     "code": 400,
#                     "message": "过期时间不能早于或等于当前时间",
#                     "data": None
#                 })
#         except ValueError:
#             raise ValidationError({
#                 "code": 400,
#                 "message": "过期时间格式错误，应为 ISO 格式 (YYYY-MM-DDThh:mm:ssZ)",
#                 "data": None
#             })

#         with transaction.atomic():
#             permission.expires_at = new_expires_at
#             permission.save()

#             kb_permission = KBPermissionModel.objects.get(
#                 knowledge_base=permission.knowledge_base,
#                 user=permission.applicant
#             )
#             kb_permission.expires_at = new_expires_at
#             kb_permission.save()

#             notification_service.send_notification(
#                 user=permission.applicant,
#                 title="权限有效期延长",
#                 content=f"您对知识库 '{permission.knowledge_base.name}' 的权限有效期已延长至 {new_expires_at.strftime('%Y-%m-%d %H:%M:%S')}",
#                 notification_type="permission_extended",
#                 related_object_id=str(permission.id)
#             )

#         return permission

#     def update_user_permission(self, admin_user, user_id, knowledge_base_id, permissions, expires_at_str, notification_service):
#         """管理员更新用户权限"""
#         if admin_user.role != 'admin':
#             raise ValidationError({
#                 'code': 403,
#                 'message': '只有管理员可以直接修改权限',
#                 'data': None
#             })

#         if not all([user_id, knowledge_base_id, permissions]):
#             raise ValidationError({
#                 'code': 400,
#                 'message': '缺少必要参数',
#                 'data': None
#             })

#         required_permission_fields = ['can_read', 'can_edit', 'can_delete']
#         if not all(field in permissions for field in required_permission_fields):
#             raise ValidationError({
#                 'code': 400,
#                 'message': '权限参数格式错误，必须包含 can_read、can_edit、can_delete',
#                 'data': None
#             })

#         try:
#             user = User.objects.get(id=user_id)
#             knowledge_base = KnowledgeBase.objects.get(id=knowledge_base_id)
#         except User.DoesNotExist:
#             raise ValidationError({
#                 'code': 404,
#                 'message': f'用户ID {user_id} 不存在',
#                 'data': None
#             })
#         except KnowledgeBase.DoesNotExist:
#             raise ValidationError({
#                 'code': 404,
#                 'message': f'知识库ID {knowledge_base_id} 不存在',
#                 'data': None
#             })

#         if knowledge_base.type == 'private' and str(knowledge_base.user_id) != str(user.id):
#             raise ValidationError({
#                 'code': 403,
#                 'message': '不能修改其他用户的私有知识库权限',
#                 'data': None
#             })

#         if user.role == 'member' and permissions.get('can_delete'):
#             raise ValidationError({
#                 'code': 400,
#                 'message': '普通成员不能获得删除权限',
#                 'data': None
#             })

#         expires_at = None
#         if expires_at_str:
#             try:
#                 expires_at = timezone.datetime.strptime(expires_at_str, '%Y-%m-%dT%H:%M:%SZ')
#                 expires_at = timezone.make_aware(expires_at)
#                 if expires_at <= timezone.now():
#                     raise ValidationError({
#                         'code': 400,
#                         'message': '过期时间不能早于或等于当前时间',
#                         'data': None
#                     })
#             except ValueError:
#                 raise ValidationError({
#                     'code': 400,
#                     'message': '过期时间格式错误，应为 ISO 格式 (YYYY-MM-DDThh:mm:ssZ)',
#                     'data': None
#                 })

#         with transaction.atomic():
#             permission, created = KBPermissionModel.objects.update_or_create(
#                 user=user,
#                 knowledge_base=knowledge_base,
#                 defaults={
#                     'can_read': permissions.get('can_read', False),
#                     'can_edit': permissions.get('can_edit', False),
#                     'can_delete': permissions.get('can_delete', False),
#                     'granted_by': admin_user,
#                     'status': 'active',
#                     'expires_at': expires_at
#                 }
#             )

#             notification_service.send_notification(
#                 user=user,
#                 title="知识库权限更新",
#                 content=f"管理员已{created and '授予' or '更新'}您对知识库 '{knowledge_base.name}' 的权限",
#                 notification_type="permission_updated",
#                 related_object_id=str(permission.id)
#             )

#         return permission, created