新增

backend/auth/dependencies.py

@@ -7,9 +7,21 @@ from models.database import get_db
 from models.models import User
 from .jwt_utils import decode_access_token
 from .permissions import (
+    ACCOUNTS_COOKIE,
+    ACCOUNTS_CREATE,
+    ACCOUNTS_DELETE,
+    ACCOUNTS_START,
+    ACCOUNTS_STOP,
+    ACCOUNTS_UPDATE,
     ACCOUNTS_WRITE,
+    ACCOUNTS_WRITE_GRANULAR,
+    LINK_CARDS_WRITE,
     MESSAGES_WRITE,
+    ORDERS_CREATE,
+    ROLES_MANAGE,
     RULES_WRITE,
+    SETTINGS_DATABASE,
+    SYSTEM_LOGS_CLEAR,
     USERS_MANAGE,
     WRITE_PERMISSIONS,
 )
@@ -71,34 +83,43 @@ async def require_write(user: User = Depends(get_current_user)) -> User:
     )
 
 
-async def require_accounts_write(user: User = Depends(get_current_user)) -> User:
-    if has_permission(user.role, ACCOUNTS_WRITE):
-        return user
-    raise HTTPException(
-        status_code=status.HTTP_403_FORBIDDEN,
-        detail="缺少权限：accounts.write",
-    )
+def _require_any(*codes: str, detail: str):
+    async def _checker(user: User = Depends(get_current_user)) -> User:
+        if any(has_permission(user.role, code) for code in codes):
+            return user
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=detail)
+
+    return _checker
 
 
-async def require_messages_write(user: User = Depends(get_current_user)) -> User:
-    if has_permission(user.role, MESSAGES_WRITE):
-        return user
-    raise HTTPException(
-        status_code=status.HTTP_403_FORBIDDEN,
-        detail="缺少权限：messages.write",
-    )
+# Backward-compatible: any account write capability.
+require_accounts_write = _require_any(
+    ACCOUNTS_WRITE,
+    *ACCOUNTS_WRITE_GRANULAR,
+    detail="缺少账号写权限",
+)
+require_accounts_create = require_permission(ACCOUNTS_CREATE)
+require_accounts_update = require_permission(ACCOUNTS_UPDATE)
+require_accounts_delete = require_permission(ACCOUNTS_DELETE)
+require_accounts_start = require_permission(ACCOUNTS_START)
+require_accounts_stop = require_permission(ACCOUNTS_STOP)
+require_accounts_cookie = require_permission(ACCOUNTS_COOKIE)
 
-
-async def require_rules_write(user: User = Depends(get_current_user)) -> User:
-    if has_permission(user.role, RULES_WRITE):
-        return user
-    raise HTTPException(
-        status_code=status.HTTP_403_FORBIDDEN,
-        detail="缺少权限：rules.write",
-    )
+require_messages_write = require_permission(MESSAGES_WRITE)
+require_rules_write = require_permission(RULES_WRITE)
+require_link_cards_write = require_permission(LINK_CARDS_WRITE)
+require_system_logs_clear = require_permission(SYSTEM_LOGS_CLEAR)
+require_settings_database = require_permission(SETTINGS_DATABASE)
+require_orders_create = require_permission(ORDERS_CREATE)
 
 
 async def require_user_manager(user: User = Depends(get_current_user)) -> User:
     if has_permission(user.role, USERS_MANAGE):
         return user
     raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="需要用户管理权限")
+
+
+async def require_role_manager(user: User = Depends(get_current_user)) -> User:
+    if has_permission(user.role, ROLES_MANAGE):
+        return user
+    raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="需要角色管理权限")