更新

backend/auth/scopes.py

@@ -5,7 +5,8 @@ from sqlalchemy import or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from models.models import Account, AutoReplyRule, MessageLog, ReceivedMessageLog, SystemLog, User
-from .roles import is_admin
+from .permissions import ACCOUNTS_WRITE, RULES_WRITE
+from .roles import has_permission, is_admin
 
 
 async def get_owned_account(
@@ -23,7 +24,7 @@ async def get_owned_account(
         return account
     if account.owner_id != user.id:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="无权访问该账号")
-    if write and user.role == "viewer":
+    if write and not has_permission(user.role, ACCOUNTS_WRITE):
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="只读用户无法修改")
     return account
 
@@ -79,17 +80,15 @@ async def get_accessible_rule(db: AsyncSession, user: User, rule_id: int, *, wri
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="规则不存在")
 
     if is_admin(user.role):
-        if write and user.role == "viewer":
-            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="只读用户无法修改")
         return rule
 
     if rule.account_id is None:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="无权访问全局规则")
 
-    account = await get_owned_account(db, user, rule.account_id, write=write)
+    account = await get_owned_account(db, user, rule.account_id, write=False)
     if rule.owner_id and rule.owner_id != user.id and account.owner_id != user.id:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="无权访问该规则")
-    if write and user.role == "viewer":
+    if write and not has_permission(user.role, RULES_WRITE):
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="只读用户无法修改")
     return rule