diff --git a/video-gen-api/app/api/v1/admin.py b/video-gen-api/app/api/v1/admin.py index b7219a40..604bc6ba 100644 --- a/video-gen-api/app/api/v1/admin.py +++ b/video-gen-api/app/api/v1/admin.py @@ -5,7 +5,7 @@ from fastapi import APIRouter, Depends, HTTPException, Query, status from sqlalchemy import delete, func, select, update from sqlalchemy.ext.asyncio import AsyncSession -from app.dependencies import get_db, get_admin_user, require_menu_access +from app.dependencies import get_db, get_admin_user from app.models.user import User from app.models.project import Project from app.models.generation_record import GenerationRecord @@ -1663,7 +1663,7 @@ async def list_operation_logs( @router.get("/stats", response_model=AdminStatsOut) async def get_stats( - admin: User = Depends(require_menu_access("/")), + admin: User = Depends(get_admin_user), db: AsyncSession = Depends(get_db), start_date: str = Query(None), end_date: str = Query(None), diff --git a/video-gen-api/app/dependencies.py b/video-gen-api/app/dependencies.py index e11d1523..7299a4a5 100644 --- a/video-gen-api/app/dependencies.py +++ b/video-gen-api/app/dependencies.py @@ -98,17 +98,12 @@ async def get_optional_current_user( async def get_admin_user( current_user: User = Depends(get_current_user_allow_password_pending), ) -> User: - if not current_user.is_admin or current_user.user_type != "admin": - raise HTTPException( - status_code=status.HTTP_403_FORBIDDEN, - detail="需要管理员权限", - ) - return current_user + """验证后台用户权限。 - -async def get_backend_user( - current_user: User = Depends(get_current_user_allow_password_pending), -) -> User: + - user_type="admin" 的后台用户即可通过(含非管理员子账号) + - 前端通过 allowed_menus 控制非管理员子账号的菜单可见性 + - 非后台用户: 403 拒绝 + """ if current_user.user_type != "admin": raise HTTPException( status_code=status.HTTP_403_FORBIDDEN, @@ -117,32 +112,13 @@ async def get_backend_user( return current_user -def require_menu_access(menu_path: str): - """检查后台用户是否有指定菜单权限。 - - - 超级管理员 (is_admin=True): 直接放行 - - 非管理员后台用户: 检查 allowed_menus 是否包含 menu_path - - 非后台用户: 403 拒绝 - - 用法: - @router.get("/stats") - async def get_stats(admin: User = Depends(require_menu_access("/")), ...): - """ - async def _dependency( - current_user: User = Depends(get_current_user_allow_password_pending), - ) -> User: - if current_user.user_type != "admin": - raise HTTPException( - status_code=status.HTTP_403_FORBIDDEN, - detail="需要后台用户权限", - ) - if current_user.is_admin: - return current_user - allowed = set(current_user.allowed_menus or []) - if menu_path not in allowed: - raise HTTPException( - status_code=status.HTTP_403_FORBIDDEN, - detail="需要管理员权限", - ) - return current_user - return _dependency +async def get_backend_user( + current_user: User = Depends(get_current_user_allow_password_pending), +) -> User: + """与 get_admin_user 等价: 验证 user_type="admin" 的后台用户。""" + if current_user.user_type != "admin": + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="需要后台用户权限", + ) + return current_user