nas/MoviePilot
1
0
Fork 0
mirror of https://github.com/jxxghp/MoviePilot.git synced 2026-04-04 11:18:31 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix permissions

Browse Source
This commit is contained in:
jxxghp
2024-07-07 08:09:26 +08:00
parent a567a8644b
commit bb4355fbe0
8 changed files with 49 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
app/api/endpoints/download.py
View File

@@ -9,7 +9,7 @@ from app.core.context import MediaInfo, Context, TorrentInfo
from app.core.metainfo import MetaInfo
from app.core.security import verify_token
from app.db.models.user import User
from app.db.user_oper import get_current_active_user
from app.db.user_oper import get_current_active_user, check_user_permission
router = APIRouter()
@@ -95,22 +95,22 @@ def start(
@router.get("/stop/{hashString}", summary="暂停任务", response_model=schemas.Response)
def stop(
hashString: str,
_: schemas.TokenPayload = Depends(verify_token)) -> Any:
def stop(hashString: str) -> Any:
"""
暂停下载任务
"""
# 检查用户权限
check_user_permission(permission='downloading.manage')
ret = DownloadChain().set_downloading(hashString, "stop")
return schemas.Response(success=True if ret else False)
@router.delete("/{hashString}", summary="删除下载任务", response_model=schemas.Response)
def info(
hashString: str,
_: schemas.TokenPayload = Depends(verify_token)) -> Any:
def delete(hashString: str) -> Any:
"""
删除下载任务
"""
# 检查用户权限
check_user_permission(permission='downloading.manage')
ret = DownloadChain().remove_downloading(hashString)
return schemas.Response(success=True if ret else False)

2
app/api/endpoints/history.py
View File

@@ -77,7 +77,7 @@ def delete_transfer_history(history_in: schemas.TransferHistory,
deletesrc: bool = False,
deletedest: bool = False,
db: Session = Depends(get_db),
_: schemas.TokenPayload = Depends(verify_token)) -> Any:
_: schemas.TokenPayload = Depends(get_current_active_superuser)) -> Any:
"""
删除转移历史记录
"""

22
app/api/endpoints/plugin.py
View File

@@ -6,6 +6,7 @@ from app import schemas
from app.core.plugin import PluginManager
from app.core.security import verify_token
from app.db.systemconfig_oper import SystemConfigOper
from app.db.user_oper import get_current_active_superuser
from app.helper.plugin import PluginHelper
from app.scheduler import Scheduler
from app.schemas.types import SystemConfigKey
@@ -37,7 +38,8 @@ def remove_plugin_api(plugin_id: str):
@router.get("/", summary="所有插件", response_model=List[schemas.Plugin])
def all_plugins(_: schemas.TokenPayload = Depends(verify_token), state: str = "all") -> List[schemas.Plugin]:
def all_plugins(_: schemas.TokenPayload = Depends(get_current_active_superuser),
state: str = "all") -> List[schemas.Plugin]:
"""
查询所有插件清单，包括本地插件和在线插件，插件状态：installed, market, all
"""
@@ -83,7 +85,7 @@ def all_plugins(_: schemas.TokenPayload = Depends(verify_token), state: str = "a
@router.get("/installed", summary="已安装插件", response_model=List[str])
def installed(_: schemas.TokenPayload = Depends(verify_token)) -> Any:
def installed(_: schemas.TokenPayload = Depends(get_current_active_superuser)) -> Any:
"""
查询用户已安装插件清单
"""
@@ -102,7 +104,7 @@ def statistic(_: schemas.TokenPayload = Depends(verify_token)) -> Any:
def install(plugin_id: str,
repo_url: str = "",
force: bool = False,
_: schemas.TokenPayload = Depends(verify_token)) -> Any:
_: schemas.TokenPayload = Depends(get_current_active_superuser)) -> Any:
"""
安装插件
"""
@@ -131,7 +133,7 @@ def install(plugin_id: str,
@router.get("/form/{plugin_id}", summary="获取插件表单页面")
def plugin_form(plugin_id: str,
_: schemas.TokenPayload = Depends(verify_token)) -> dict:
_: schemas.TokenPayload = Depends(get_current_active_superuser)) -> dict:
"""
根据插件ID获取插件配置表单
"""
@@ -143,7 +145,7 @@ def plugin_form(plugin_id: str,
@router.get("/page/{plugin_id}", summary="获取插件数据页面")
def plugin_page(plugin_id: str, _: schemas.TokenPayload = Depends(verify_token)) -> List[dict]:
def plugin_page(plugin_id: str, _: schemas.TokenPayload = Depends(get_current_active_superuser)) -> List[dict]:
"""
根据插件ID获取插件数据页面
"""
@@ -177,7 +179,8 @@ def plugin_dashboard(plugin_id: str, key: str, user_agent: Annotated[str | None,
@router.get("/reset/{plugin_id}", summary="重置插件配置及数据", response_model=schemas.Response)
def reset_plugin(plugin_id: str, _: schemas.TokenPayload = Depends(verify_token)) -> Any:
def reset_plugin(plugin_id: str,
_: schemas.TokenPayload = Depends(get_current_active_superuser)) -> Any:
"""
根据插件ID重置插件配置及数据
"""
@@ -198,7 +201,8 @@ def reset_plugin(plugin_id: str, _: schemas.TokenPayload = Depends(verify_token)
@router.get("/{plugin_id}", summary="获取插件配置")
def plugin_config(plugin_id: str, _: schemas.TokenPayload = Depends(verify_token)) -> dict:
def plugin_config(plugin_id: str,
_: schemas.TokenPayload = Depends(get_current_active_superuser)) -> dict:
"""
根据插件ID获取插件配置信息
"""
@@ -207,7 +211,7 @@ def plugin_config(plugin_id: str, _: schemas.TokenPayload = Depends(verify_token
@router.put("/{plugin_id}", summary="更新插件配置", response_model=schemas.Response)
def set_plugin_config(plugin_id: str, conf: dict,
_: schemas.TokenPayload = Depends(verify_token)) -> Any:
_: schemas.TokenPayload = Depends(get_current_active_superuser)) -> Any:
"""
更新插件配置
"""
@@ -224,7 +228,7 @@ def set_plugin_config(plugin_id: str, conf: dict,
@router.delete("/{plugin_id}", summary="卸载插件", response_model=schemas.Response)
def uninstall_plugin(plugin_id: str,
_: schemas.TokenPayload = Depends(verify_token)) -> Any:
_: schemas.TokenPayload = Depends(get_current_active_superuser)) -> Any:
"""
卸载插件
"""

8
app/api/endpoints/search.py
View File

@@ -7,6 +7,7 @@ from app.chain.media import MediaChain
from app.chain.search import SearchChain
from app.core.config import settings
from app.core.security import verify_token
from app.db.user_oper import check_user_permission
from app.schemas.types import MediaType
router = APIRouter()
@@ -25,11 +26,12 @@ def search_latest(_: schemas.TokenPayload = Depends(verify_token)) -> Any:
def search_by_id(mediaid: str,
mtype: str = None,
area: str = "title",
season: str = None,
_: schemas.TokenPayload = Depends(verify_token)) -> Any:
season: str = None) -> Any:
"""
根据TMDBID/豆瓣ID精确搜索站点资源 tmdb:/douban:/bangumi:
"""
# 检查用户权限
check_user_permission(permission='resource.search')
if mtype:
mtype = MediaType(mtype)
if season:
@@ -95,6 +97,8 @@ def search_by_title(keyword: str = None,
"""
根据名称模糊搜索站点资源，支持分页，关键词为空是返回首页资源
"""
# 检查用户权限
check_user_permission(permission='resource.search')
torrents = SearchChain().search_by_title(title=keyword, page=page, site=site)
if not torrents:
return schemas.Response(success=False, message="未搜索到任何资源")

19
app/api/endpoints/site.py
View File

@@ -26,7 +26,7 @@ router = APIRouter()
@router.get("/", summary="所有站点", response_model=List[schemas.Site])
def read_sites(db: Session = Depends(get_db),
_: schemas.TokenPayload = Depends(verify_token)) -> List[dict]:
_: schemas.TokenPayload = Depends(get_current_active_superuser)) -> List[dict]:
"""
获取站点列表
"""
@@ -38,7 +38,7 @@ def add_site(
*,
db: Session = Depends(get_db),
site_in: schemas.Site,
_: schemas.TokenPayload = Depends(verify_token)
_: schemas.TokenPayload = Depends(get_current_active_superuser)
) -> Any:
"""
新增站点
@@ -75,7 +75,7 @@ def update_site(
*,
db: Session = Depends(get_db),
site_in: schemas.Site,
_: schemas.TokenPayload = Depends(verify_token)
_: schemas.TokenPayload = Depends(get_current_active_superuser)
) -> Any:
"""
更新站点信息
@@ -96,7 +96,7 @@ def update_site(
@router.get("/cookiecloud", summary="CookieCloud同步", response_model=schemas.Response)
def cookie_cloud_sync(background_tasks: BackgroundTasks,
_: schemas.TokenPayload = Depends(verify_token)) -> Any:
_: schemas.TokenPayload = Depends(get_current_active_superuser)) -> Any:
"""
运行CookieCloud同步站点信息
"""
@@ -127,7 +127,7 @@ def reset(db: Session = Depends(get_db),
def update_sites_priority(
priorities: List[dict],
db: Session = Depends(get_db),
_: schemas.TokenPayload = Depends(verify_token)) -> Any:
_: schemas.TokenPayload = Depends(get_current_active_superuser)) -> Any:
"""
批量更新站点优先级
"""
@@ -145,7 +145,7 @@ def update_cookie(
password: str,
code: str = None,
db: Session = Depends(get_db),
_: schemas.TokenPayload = Depends(verify_token)) -> Any:
_: schemas.TokenPayload = Depends(get_current_active_superuser)) -> Any:
"""
使用用户密码更新站点Cookie
"""
@@ -205,7 +205,7 @@ def site_icon(site_id: int,
@router.get("/resource/{site_id}", summary="站点资源", response_model=List[schemas.TorrentInfo])
def site_resource(site_id: int,
db: Session = Depends(get_db),
_: schemas.TokenPayload = Depends(verify_token)) -> Any:
_: schemas.TokenPayload = Depends(get_current_active_superuser)) -> Any:
"""
浏览站点资源
"""
@@ -257,7 +257,8 @@ def read_site_by_domain(
@router.get("/rss", summary="所有订阅站点", response_model=List[schemas.Site])
def read_rss_sites(db: Session = Depends(get_db)) -> List[dict]:
def read_rss_sites(db: Session = Depends(get_db),
_: schemas.TokenPayload = Depends(verify_token)) -> List[dict]:
"""
获取站点列表
"""
@@ -278,7 +279,7 @@ def read_rss_sites(db: Session = Depends(get_db)) -> List[dict]:
def read_site(
site_id: int,
db: Session = Depends(get_db),
_: schemas.TokenPayload = Depends(verify_token)
_: schemas.TokenPayload = Depends(get_current_active_superuser)
) -> Any:
"""
通过ID获取站点信息

9
app/api/endpoints/storage.py
View File

@@ -10,6 +10,7 @@ from app.chain.transfer import TransferChain
from app.core.config import settings
from app.core.metainfo import MetaInfoPath
from app.core.security import verify_token, verify_uri_token
from app.db.user_oper import get_current_active_superuser
from app.helper.progress import ProgressHelper
from app.schemas.types import ProgressKey
@@ -41,7 +42,7 @@ def check(_: schemas.TokenPayload = Depends(verify_token)) -> Any:
@router.post("/list", summary="所有目录和文件", response_model=List[schemas.FileItem])
def list(fileitem: schemas.FileItem,
sort: str = 'updated_at',
_: schemas.TokenPayload = Depends(verify_token)) -> Any:
_: schemas.TokenPayload = Depends(get_current_active_superuser)) -> Any:
"""
查询当前目录下所有目录和文件
:param fileitem: 文件项
@@ -60,7 +61,7 @@ def list(fileitem: schemas.FileItem,
@router.post("/mkdir", summary="创建目录", response_model=schemas.Response)
def mkdir(fileitem: schemas.FileItem,
name: str,
_: schemas.TokenPayload = Depends(verify_token)) -> Any:
_: schemas.TokenPayload = Depends(get_current_active_superuser)) -> Any:
"""
创建目录
:param fileitem: 文件项
@@ -77,7 +78,7 @@ def mkdir(fileitem: schemas.FileItem,
@router.post("/delete", summary="删除文件或目录", response_model=schemas.Response)
def delete(fileitem: schemas.FileItem,
_: schemas.TokenPayload = Depends(verify_token)) -> Any:
_: schemas.TokenPayload = Depends(get_current_active_superuser)) -> Any:
"""
删除文件或目录
:param fileitem: 文件项
@@ -109,7 +110,7 @@ def download(fileitem: schemas.FileItem,
def rename(fileitem: schemas.FileItem,
new_name: str,
recursive: bool = False,
_: schemas.TokenPayload = Depends(verify_token)) -> Any:
_: schemas.TokenPayload = Depends(get_current_active_superuser)) -> Any:
"""
重命名文件或目录
:param fileitem: 文件项

3
app/api/endpoints/transfer.py
View File

@@ -12,6 +12,7 @@ from app.core.metainfo import MetaInfoPath
from app.core.security import verify_token, verify_apitoken
from app.db import get_db
from app.db.models.transferhistory import TransferHistory
from app.db.user_oper import get_current_active_superuser
from app.schemas import MediaType, FileItem
router = APIRouter()
@@ -63,7 +64,7 @@ def manual_transfer(fileitem: FileItem = None,
min_filesize: int = 0,
scrape: bool = None,
db: Session = Depends(get_db),
_: schemas.TokenPayload = Depends(verify_token)) -> Any:
_: schemas.TokenPayload = Depends(get_current_active_superuser)) -> Any:
"""
手动转移，文件或历史记录，支持自定义剧集识别格式
:param fileitem: 文件信息

6
app/db/user_oper.py
View File

@@ -48,7 +48,7 @@ def get_current_active_superuser(
return current_user
def get_current_active_permission_user(
def check_user_permission(
permission: str,
current_user: User = Depends(get_current_user)
) -> User:
@@ -57,9 +57,13 @@ def get_current_active_permission_user(
"""
if not current_user.is_active:
raise HTTPException(status_code=403, detail="用户未激活")
if current_user.is_superuser:
return current_user
if not current_user.permissions:
raise HTTPException(status_code=400, detail="用户权限不足")
permission_dict = json.loads(current_user.permissions)
if permission_dict.get("admin"):
return current_user
for key in permission.split("."):
if key not in permission_dict or not permission_dict[key]:
raise HTTPException(status_code=400, detail="用户权限不足")