@@ -33,6 +33,7 @@ def get(self):
3333 def _get_one (self ,key ):
3434 modelname = key
3535 params = self .request_data [key ]
36+ params_role = params .get ("@role" )
3637
3738 try :
3839 model = getattr (models ,modelname )
@@ -43,14 +44,12 @@ def _get_one(self,key):
4344 model_column_set = None
4445 q = model .all ()
4546
46- #rbac check begin
4747 GET = model_setting .get ("GET" ,{})
4848 if not GET :
49- return json ({"code" :401 ,"msg" :"'%s' not accessible by apijson " % (modelname )})
49+ return json ({"code" :401 ,"msg" :"'%s' not accessible" % (modelname )})
5050
5151 roles = GET .get ("roles" )
5252 perms = GET .get ("perms" )
53- params_role = params .get ("@role" )
5453 permission_check_ok = False
5554 user_role = None
5655 if params_role :
@@ -76,7 +75,6 @@ def _get_one(self,key):
7675
7776 if not permission_check_ok :
7877 return json ({"code" :401 ,"msg" :"no permission" })
79- #rbac check end
8078
8179 filtered = False
8280
@@ -252,6 +250,64 @@ def _filter_owner(self,model,model_setting,q):
252250 owner_filtered = True
253251 return owner_filtered ,q
254252
253+ def head (self ):
254+ for key in self .request_data :
255+ rsp = self ._head (key )
256+ if rsp : return rsp
257+
258+ return json (self .rdict )
259+
260+ def _head (self ,key ):
261+ modelname = key
262+ params = self .request_data [key ]
263+ params_role = params .get ("@role" )
264+
265+ try :
266+ model = getattr (models ,modelname )
267+ model_setting = settings .APIJSON_MODELS .get (modelname ,{})
268+ except ModelNotFound as e :
269+ log .error ("try to find model '%s' but not found: '%s'" % (modelname ,e ))
270+ return json ({"code" :400 ,"msg" :"model '%s' not found" % (modelname )})
271+
272+ q = model .all ()
273+
274+ HEAD = model_setting .get ("HEAD" ,{})
275+ if not HEAD :
276+ return json ({"code" :401 ,"msg" :"'%s' not accessible" % (modelname )})
277+
278+ roles = HEAD .get ("roles" )
279+ permission_check_ok = False
280+ if not params_role :
281+ if request .user :
282+ params_role = "LOGIN"
283+ else :
284+ params_role = "UNKNOWN"
285+ if params_role not in roles :
286+ return json ({"code" :401 ,"msg" :"'%s' not accessible by role '%s'" % (modelname ,params_role )})
287+ if functions .has_role (request .user ,params_role ):
288+ permission_check_ok = True
289+ else :
290+ return json ({"code" :401 ,"msg" :"user doesn't have role '%s'" % (params_role )})
291+ if params_role == "OWNER" :
292+ owner_filtered ,q = self ._filter_owner (model ,model_setting ,q )
293+ if not owner_filtered :
294+ return json ({"code" :400 ,"msg" :"'%s' cannot filter with owner" % (modelname )})
295+ for n in params :
296+ if n [0 ]== "@" :
297+ pass
298+ else :
299+ param = params [n ]
300+ if not hasattr (model .c ,n ):
301+ return json ({"code" :400 ,"msg" :"'%s' don't have field '%s'" % (modelname ,n )})
302+ q = model .filter (getattr (model .c ,n )== param )
303+ rdict = {
304+ "code" :200 ,
305+ "msg" :"success" ,
306+ "count" :q .count (),
307+ }
308+
309+ self .rdict [key ] = rdict
310+
255311 def post (self ):
256312 tag = self .request_data .get ("@tag" )
257313 if not tag :
@@ -274,15 +330,17 @@ def _post_one(self,key,tag):
274330 try :
275331 model = getattr (models ,modelname )
276332 model_setting = settings .APIJSON_MODELS .get (modelname ,{})
277- request_setting_tag = settings .APIJSON_REQUESTS .get (tag ,{})
278333 user_id_field = model_setting .get ("user_id_field" )
279334 except ModelNotFound as e :
280335 log .error ("try to find model '%s' but not found: '%s'" % (modelname ,e ))
281336 return json ({"code" :400 ,"msg" :"model '%s' not found" % (modelname )})
282337
283- request_setting_model = request_setting_tag .get (modelname ,{})
284- request_setting_POST = request_setting_model .get ("POST" ,{})
285- ADD = request_setting_POST .get ("ADD" )
338+ request_tag = settings .APIJSON_REQUESTS .get (tag ,{})
339+ request_tag_tag = request_tag .get (tag ,{})
340+ if not request_tag_tag :
341+ return json ({"code" :400 ,"msg" :"tag '%s' not found" % (tag )})
342+ tag_POST = request_tag_tag .get ("POST" ,{})
343+ ADD = tag_POST .get ("ADD" )
286344 if ADD :
287345 ADD_role = ADD .get ("@role" )
288346 if ADD_role and not params_role :
@@ -371,16 +429,17 @@ def _put_one(self,key,tag):
371429 try :
372430 model = getattr (models ,modelname )
373431 model_setting = settings .APIJSON_MODELS .get (modelname ,{})
374- request_setting_tag = settings .APIJSON_REQUESTS .get (tag ,{})
375432 user_id_field = model_setting .get ("user_id_field" )
376433 except ModelNotFound as e :
377434 log .error ("try to find model '%s' but not found: '%s'" % (modelname ,e ))
378435 return json ({"code" :400 ,"msg" :"model '%s' not found" % (modelname )})
379436
380- request_setting_model = request_setting_tag .get (modelname ,{})
381- request_setting_PUT = request_setting_model .get ("PUT" ,{})
382-
383- ADD = request_setting_PUT .get ("ADD" )
437+ request_tag = settings .APIJSON_REQUESTS .get (tag ,{})
438+ request_tag_tag = request_tag .get (tag ,{})
439+ if not request_tag_tag :
440+ return json ({"code" :400 ,"msg" :"tag '%s' not found" % (tag )})
441+ tag_PUT = request_tag_tag .get ("PUT" ,{})
442+ ADD = tag_PUT .get ("ADD" )
384443 if ADD :
385444 ADD_role = ADD .get ("@role" )
386445 if ADD_role and not params_role :
@@ -468,16 +527,17 @@ def _delete_one(self,key,tag):
468527 try :
469528 model = getattr (models ,modelname )
470529 model_setting = settings .APIJSON_MODELS .get (modelname ,{})
471- request_setting_tag = settings .APIJSON_REQUESTS .get (tag ,{})
472530 user_id_field = model_setting .get ("user_id_field" )
473531 except ModelNotFound as e :
474532 log .error ("try to find model '%s' but not found: '%s'" % (modelname ,e ))
475533 return json ({"code" :400 ,"msg" :"model '%s' not found" % (modelname )})
476534
477- request_setting_model = request_setting_tag .get (modelname ,{})
478- request_setting_DELETE = request_setting_model .get ("DELETE" ,{})
479-
480- ADD = request_setting_DELETE .get ("ADD" )
535+ request_tag = settings .APIJSON_REQUESTS .get (tag ,{})
536+ request_tag_tag = request_tag .get (tag ,{})
537+ if not request_tag_tag :
538+ return json ({"code" :400 ,"msg" :"tag '%s' not found" % (tag )})
539+ tag_DELETE = request_tag_tag .get ("DELETE" ,{})
540+ ADD = tag_DELETE .get ("ADD" )
481541 if ADD :
482542 ADD_role = ADD .get ("@role" )
483543 if ADD_role and not params_role :
0 commit comments