加了用户权限
This commit is contained in:
jlj
parent
50c2191a65
commit
4a2e7f1222
@ -2202,18 +2202,35 @@ def get_private_pools(request):
|
||||
from .models import PrivateCreatorPool
|
||||
import json
|
||||
|
||||
# 获取用户ID
|
||||
user_id = request.GET.get('user_id')
|
||||
|
||||
if not user_id:
|
||||
# 获取当前认证用户
|
||||
current_user = request.user
|
||||
if not current_user.is_authenticated:
|
||||
return JsonResponse({
|
||||
'code': 400,
|
||||
'message': '缺少必要参数: user_id',
|
||||
'code': 401,
|
||||
'message': '用户未认证',
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
|
||||
# 查询用户的所有私有库
|
||||
pools = PrivateCreatorPool.objects.filter(user=user_id)
|
||||
# 检查是否传入了user_id参数，如果传入且与当前用户不匹配，拒绝访问
|
||||
requested_user_id = request.GET.get('user_id')
|
||||
if requested_user_id:
|
||||
try:
|
||||
requested_user_id = int(requested_user_id)
|
||||
if requested_user_id != current_user.id:
|
||||
return JsonResponse({
|
||||
'code': 403,
|
||||
'message': '无权限访问其他用户的私有达人库',
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
except (ValueError, TypeError):
|
||||
return JsonResponse({
|
||||
'code': 400,
|
||||
'message': 'user_id参数格式错误',
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
|
||||
# 查询当前用户的所有私有库
|
||||
pools = PrivateCreatorPool.objects.filter(user_id=current_user.id)
|
||||
|
||||
pool_list = []
|
||||
for pool in pools:
|
||||
@ -2258,57 +2275,53 @@ def create_private_pool(request):
|
||||
from apps.user.models import User
|
||||
import json
|
||||
|
||||
# 获取当前认证用户
|
||||
current_user = request.user
|
||||
if not current_user.is_authenticated:
|
||||
return JsonResponse({
|
||||
'code': 401,
|
||||
'message': '用户未认证',
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
|
||||
data = json.loads(request.body)
|
||||
logger.info(f"创建私有达人库请求数据: {data}")
|
||||
|
||||
# 获取必要参数
|
||||
user_id = data.get('user_id')
|
||||
# 检查是否传入了user_id参数，如果传入且与当前用户不匹配，拒绝访问
|
||||
requested_user_id = data.get('user_id')
|
||||
if requested_user_id:
|
||||
try:
|
||||
requested_user_id = int(requested_user_id)
|
||||
if requested_user_id != current_user.id:
|
||||
return JsonResponse({
|
||||
'code': 403,
|
||||
'message': '无权限为其他用户创建私有达人库',
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
except (ValueError, TypeError):
|
||||
return JsonResponse({
|
||||
'code': 400,
|
||||
'message': 'user_id参数格式错误',
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
|
||||
# 获取必要参数（不再需要user_id参数）
|
||||
name = data.get('name')
|
||||
description = data.get('description')
|
||||
is_default = data.get('is_default', False)
|
||||
|
||||
logger.info(f"解析后的参数: user_id={user_id}, name={name}, description={description}, is_default={is_default}")
|
||||
logger.info(f"解析后的参数: user_id={current_user.id}, name={name}, description={description}, is_default={is_default}")
|
||||
|
||||
if not user_id or not name:
|
||||
if not name:
|
||||
return JsonResponse({
|
||||
'code': 400,
|
||||
'message': '缺少必要参数: user_id 或 name',
|
||||
'message': '缺少必要参数: name',
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
|
||||
# 查询用户信息
|
||||
try:
|
||||
logger.info(f"尝试查询用户ID: {user_id}")
|
||||
# 确保user_id是整数
|
||||
user_id = int(user_id)
|
||||
user = User.objects.get(id=user_id)
|
||||
logger.info(f"查询到的用户信息: {user}")
|
||||
|
||||
# 验证user是否是User实例
|
||||
if not isinstance(user, User):
|
||||
raise ValueError(f"查询结果不是User实例: {type(user)}")
|
||||
|
||||
except ValueError as e:
|
||||
logger.error(f"用户ID格式错误: {str(e)}")
|
||||
return JsonResponse({
|
||||
'code': 400,
|
||||
'message': f'用户ID格式错误: {str(e)}',
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
except User.DoesNotExist:
|
||||
logger.error(f"用户不存在: {user_id}")
|
||||
return JsonResponse({
|
||||
'code': 404,
|
||||
'message': f'找不到ID为 {user_id} 的用户',
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
except Exception as e:
|
||||
logger.error(f"查询用户时发生错误: {str(e)}")
|
||||
raise
|
||||
|
||||
# 检查是否已存在同名私有库
|
||||
try:
|
||||
existing_pool = PrivateCreatorPool.objects.filter(user_id=user.id, name=name).first()
|
||||
existing_pool = PrivateCreatorPool.objects.filter(user_id=current_user.id, name=name).first()
|
||||
if existing_pool:
|
||||
return JsonResponse({
|
||||
'code': 409,
|
||||
@ -2321,12 +2334,12 @@ def create_private_pool(request):
|
||||
|
||||
# 如果设置为默认库，则将其他库设为非默认
|
||||
if is_default:
|
||||
PrivateCreatorPool.objects.filter(user_id=user.id, is_default=True).update(is_default=False)
|
||||
PrivateCreatorPool.objects.filter(user_id=current_user.id, is_default=True).update(is_default=False)
|
||||
|
||||
# 创建私有库
|
||||
try:
|
||||
private_pool = PrivateCreatorPool.objects.create(
|
||||
user_id=user.id, # 使用user.id而不是user实例
|
||||
user_id=current_user.id,
|
||||
name=name,
|
||||
description=description,
|
||||
is_default=is_default
|
||||
@ -2368,6 +2381,15 @@ def get_private_pool_creators(request, pool_id=None):
|
||||
from .models import PrivateCreatorPool, PrivateCreatorRelation
|
||||
import json
|
||||
|
||||
# 获取当前认证用户
|
||||
current_user = request.user
|
||||
if not current_user.is_authenticated:
|
||||
return JsonResponse({
|
||||
'code': 401,
|
||||
'message': '用户未认证',
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
|
||||
# 检查pool_id是否提供
|
||||
if not pool_id:
|
||||
pool_id = request.GET.get('pool_id')
|
||||
@ -2386,13 +2408,16 @@ def get_private_pool_creators(request, pool_id=None):
|
||||
status = request.GET.get('status', 'active') # 默认只获取活跃状态的达人
|
||||
keyword = request.GET.get('keyword')
|
||||
|
||||
# 查询私有库信息
|
||||
# 查询私有库信息并验证所有权
|
||||
try:
|
||||
private_pool = PrivateCreatorPool.objects.get(id=pool_id)
|
||||
private_pool = PrivateCreatorPool.objects.get(
|
||||
id=pool_id,
|
||||
user_id=current_user.id # 确保只能访问当前用户的私有库
|
||||
)
|
||||
except PrivateCreatorPool.DoesNotExist:
|
||||
return JsonResponse({
|
||||
'code': 404,
|
||||
'message': f'找不到ID为 {pool_id} 的私有库',
|
||||
'message': f'找不到ID为 {pool_id} 的私有库或无权限访问',
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
|
||||
@ -2516,6 +2541,15 @@ def add_creator_to_private_pool(request):
|
||||
from .models import PrivateCreatorPool, PrivateCreatorRelation, CreatorProfile, PublicCreatorPool
|
||||
import json
|
||||
|
||||
# 获取当前认证用户
|
||||
current_user = request.user
|
||||
if not current_user.is_authenticated:
|
||||
return JsonResponse({
|
||||
'code': 401,
|
||||
'message': '用户未认证',
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
|
||||
data = json.loads(request.body)
|
||||
|
||||
# 获取必要参数
|
||||
@ -2535,19 +2569,22 @@ def add_creator_to_private_pool(request):
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
|
||||
# 查询私有库信息
|
||||
# 查询私有库信息并验证所有权
|
||||
try:
|
||||
private_pool = PrivateCreatorPool.objects.get(id=pool_id)
|
||||
private_pool = PrivateCreatorPool.objects.get(
|
||||
id=pool_id,
|
||||
user_id=current_user.id # 确保只能操作当前用户的私有库
|
||||
)
|
||||
except PrivateCreatorPool.DoesNotExist:
|
||||
return JsonResponse({
|
||||
'code': 404,
|
||||
'message': f'找不到ID为 {pool_id} 的私有库',
|
||||
'message': f'找不到ID为 {pool_id} 的私有库或无权限访问',
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
|
||||
# 添加达人到私有库
|
||||
added_creators = []
|
||||
skipped_creators = []
|
||||
already_exists_count = 0
|
||||
|
||||
for cid in creator_ids:
|
||||
try:
|
||||
@ -2564,7 +2601,7 @@ def add_creator_to_private_pool(request):
|
||||
).exists()
|
||||
|
||||
if exists:
|
||||
# 如果已存在，则更新信息
|
||||
# 如果已存在，则更新信息但不显示在响应中
|
||||
relation = PrivateCreatorRelation.objects.get(
|
||||
private_pool=private_pool,
|
||||
creator=creator
|
||||
@ -2579,11 +2616,8 @@ def add_creator_to_private_pool(request):
|
||||
|
||||
relation.save()
|
||||
|
||||
added_creators.append({
|
||||
'id': creator.id,
|
||||
'name': creator.name,
|
||||
'action': '更新'
|
||||
})
|
||||
# 计数已存在的达人，但不添加到响应列表中
|
||||
already_exists_count += 1
|
||||
else:
|
||||
# 创建新的关联
|
||||
relation = PrivateCreatorRelation.objects.create(
|
||||
@ -2601,17 +2635,15 @@ def add_creator_to_private_pool(request):
|
||||
})
|
||||
|
||||
except CreatorProfile.DoesNotExist:
|
||||
skipped_creators.append({
|
||||
'id': cid,
|
||||
'reason': '达人不存在或已失效'
|
||||
})
|
||||
# 如果达人不存在，直接跳过，不在响应中显示
|
||||
continue
|
||||
|
||||
return JsonResponse({
|
||||
'code': 200,
|
||||
'message': '操作成功',
|
||||
'data': {
|
||||
'added': added_creators,
|
||||
'skipped': skipped_creators,
|
||||
'already_exists_count': already_exists_count,
|
||||
'pool': {
|
||||
'id': private_pool.id,
|
||||
'name': private_pool.name
|
||||
@ -2640,6 +2672,15 @@ def update_creator_in_private_pool(request):
|
||||
from .models import PrivateCreatorRelation
|
||||
import json
|
||||
|
||||
# 获取当前认证用户
|
||||
current_user = request.user
|
||||
if not current_user.is_authenticated:
|
||||
return JsonResponse({
|
||||
'code': 401,
|
||||
'message': '用户未认证',
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
|
||||
data = json.loads(request.body)
|
||||
|
||||
# 获取必要参数
|
||||
@ -2656,7 +2697,7 @@ def update_creator_in_private_pool(request):
|
||||
|
||||
# 查询关联信息
|
||||
try:
|
||||
relation = PrivateCreatorRelation.objects.get(id=relation_id)
|
||||
relation = PrivateCreatorRelation.objects.select_related('private_pool').get(id=relation_id)
|
||||
except PrivateCreatorRelation.DoesNotExist:
|
||||
return JsonResponse({
|
||||
'code': 404,
|
||||
@ -2664,6 +2705,14 @@ def update_creator_in_private_pool(request):
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
|
||||
# 验证当前用户是否有权限操作此私有库
|
||||
if relation.private_pool.user_id != current_user.id:
|
||||
return JsonResponse({
|
||||
'code': 403,
|
||||
'message': '无权限操作其他用户的私有达人库',
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
|
||||
# 更新信息
|
||||
if status:
|
||||
relation.status = status
|
||||
@ -2703,9 +2752,18 @@ def update_creator_in_private_pool(request):
|
||||
def remove_creator_from_private_pool(request):
|
||||
"""从私有库中移除达人"""
|
||||
try:
|
||||
from .models import PrivateCreatorRelation
|
||||
from .models import PrivateCreatorRelation, PrivateCreatorPool
|
||||
import json
|
||||
|
||||
# 获取当前认证用户
|
||||
current_user = request.user
|
||||
if not current_user.is_authenticated:
|
||||
return JsonResponse({
|
||||
'code': 401,
|
||||
'message': '用户未认证',
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
|
||||
data = json.loads(request.body)
|
||||
|
||||
# 方式1：通过关联ID删除
|
||||
@ -2723,13 +2781,39 @@ def remove_creator_from_private_pool(request):
|
||||
|
||||
# 检查参数有效性
|
||||
if relation_ids:
|
||||
# 通过关联ID删除
|
||||
query = PrivateCreatorRelation.objects.filter(id__in=relation_ids)
|
||||
# 通过关联ID删除 - 需要验证每个关联的权限
|
||||
relations = PrivateCreatorRelation.objects.select_related('private_pool').filter(id__in=relation_ids)
|
||||
|
||||
# 验证权限
|
||||
for relation in relations:
|
||||
if relation.private_pool.user_id != current_user.id:
|
||||
return JsonResponse({
|
||||
'code': 403,
|
||||
'message': '无权限操作其他用户的私有达人库',
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
|
||||
query = relations
|
||||
result_type = 'relation_ids'
|
||||
result_value = relation_ids
|
||||
|
||||
elif pool_id and creator_ids:
|
||||
# 通过私有库ID和达人ID删除
|
||||
# 通过私有库ID和达人ID删除 - 先验证私有库权限
|
||||
try:
|
||||
private_pool = PrivateCreatorPool.objects.get(id=pool_id)
|
||||
if private_pool.user_id != current_user.id:
|
||||
return JsonResponse({
|
||||
'code': 403,
|
||||
'message': '无权限操作其他用户的私有达人库',
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
except PrivateCreatorPool.DoesNotExist:
|
||||
return JsonResponse({
|
||||
'code': 404,
|
||||
'message': f'找不到ID为 {pool_id} 的私有库',
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
|
||||
query = PrivateCreatorRelation.objects.filter(
|
||||
private_pool_id=pool_id,
|
||||
creator_id__in=creator_ids
|
||||
|
||||
@ -152,17 +152,9 @@ def update_user_info(request):
|
||||
company = data.get('company')
|
||||
name = data.get('name')
|
||||
|
||||
# 获取当前认证用户
|
||||
# 获取当前认证用户（通过token验证）
|
||||
user = request.user
|
||||
|
||||
# 如果请求中包含 user_id 且与当前用户不匹配，返回错误
|
||||
if 'user_id' in data and int(data['user_id']) != user.id:
|
||||
return JsonResponse({
|
||||
'code': 403,
|
||||
'message': '您只能修改自己的信息',
|
||||
'data': None
|
||||
}, json_dumps_params={'ensure_ascii': False})
|
||||
|
||||
# 如果是首次登录，需要填写公司和姓名
|
||||
if not company or not name:
|
||||
return JsonResponse({
|
||||
|
||||
Loading…
Reference in New Issue
Block a user