diff --git a/app/.env b/app/.env index 991dfad..8a4270d 100644 --- a/app/.env +++ b/app/.env @@ -12,8 +12,8 @@ zn_username=%E8%87%AA%E5%8A%A8%E5%8C%96_Robot client_name=ShuFuAI -java_api_base=http://47.111.163.154:18080 +# java_api_base=http://47.111.163.154:18080 # java_api_base=http://127.0.0.1:18080 -# java_api_base=http://8.136.19.173:18080 +java_api_base=http://8.136.19.173:18080 diff --git a/backend/__pycache__/config.cpython-312.pyc b/backend/__pycache__/config.cpython-312.pyc index 8a02d24..a42abff 100644 Binary files a/backend/__pycache__/config.cpython-312.pyc and b/backend/__pycache__/config.cpython-312.pyc differ diff --git a/backend/blueprints/__pycache__/auth.cpython-312.pyc b/backend/blueprints/__pycache__/auth.cpython-312.pyc index cd1faab..20f6081 100644 Binary files a/backend/blueprints/__pycache__/auth.cpython-312.pyc and b/backend/blueprints/__pycache__/auth.cpython-312.pyc differ diff --git a/backend/blueprints/__pycache__/main.cpython-312.pyc b/backend/blueprints/__pycache__/main.cpython-312.pyc index bc4d2ca..35db3ff 100644 Binary files a/backend/blueprints/__pycache__/main.cpython-312.pyc and b/backend/blueprints/__pycache__/main.cpython-312.pyc differ diff --git a/backend/blueprints/auth.py b/backend/blueprints/auth.py index 5a459c1..479918b 100644 --- a/backend/blueprints/auth.py +++ b/backend/blueprints/auth.py @@ -5,7 +5,7 @@ from flask import Blueprint, request, redirect, url_for, session, jsonify from werkzeug.security import check_password_hash from utils.db import get_db -from utils.auth import login_required, is_session_user_valid +from utils.auth import login_required, is_session_user_valid, is_current_user_admin from utils.render import render_html auth = Blueprint('auth', __name__, url_prefix='') @@ -13,7 +13,7 @@ auth = Blueprint('auth', __name__, url_prefix='') @auth.route('/login', methods=['GET', 'POST']) def login(): - if session.get('user_id') and is_session_user_valid(): + if session.get('user_id') and is_session_user_valid() and is_current_user_admin(): return redirect(url_for('main.admin_page')) if request.method == 'POST': data = request.get_json() if request.is_json else request.form @@ -35,6 +35,11 @@ def login(): session.permanent = True session['user_id'] = row['id'] session['username'] = username + if not row.get('is_admin'): + session.clear() + if request.is_json: + return jsonify({'success': False, 'error': '需要管理员权限'}), 403 + return render_html('login.html', error='需要管理员权限') if request.is_json: return jsonify({'success': True, 'redirect': url_for('main.admin_page')}) return redirect(url_for('main.admin_page')) @@ -61,7 +66,7 @@ def api_auth_check(): cur.execute("SELECT machine, is_admin FROM users WHERE id = %s", (session['user_id'],)) row = cur.fetchone() conn.close() - if not row: + if not row or not row.get('is_admin'): return jsonify({'logged_in': False}) except Exception: return jsonify({'logged_in': False}) diff --git a/backend/blueprints/main.py b/backend/blueprints/main.py index 7bbcdfc..1781403 100644 --- a/backend/blueprints/main.py +++ b/backend/blueprints/main.py @@ -4,7 +4,7 @@ import os from flask import Blueprint, redirect, url_for, send_file, session -from utils.auth import login_required, admin_required, is_session_user_valid +from utils.auth import login_required, admin_required, is_session_user_valid, is_current_user_admin from utils.render import render_html main = Blueprint('main', __name__, url_prefix='') @@ -15,7 +15,7 @@ STATIC_DIR = os.path.join(BASE_DIR, 'static') @main.route('/') def index(): - if session.get('user_id') and is_session_user_valid(): + if session.get('user_id') and is_session_user_valid() and is_current_user_admin(): return redirect(url_for('main.admin_page')) return redirect(url_for('auth.login')) diff --git a/backend/config.py b/backend/config.py index 97a3eb7..6692838 100644 --- a/backend/config.py +++ b/backend/config.py @@ -23,8 +23,8 @@ bucket_path = "nanri-image/" file_url_pre = f"https://{bucket}.oss-cn-hangzhou.aliyuncs.com/" import os -backend_java_base_url = os.environ.get('BACKEND_JAVA_BASE_URL', 'http://127.0.0.1:18080').rstrip('/') -# backend_java_base_url = os.environ.get('BACKEND_JAVA_BASE_URL', 'http://8.136.19.173:18080').rstrip('/') +# backend_java_base_url = os.environ.get('BACKEND_JAVA_BASE_URL', 'http://127.0.0.1:18080').rstrip('/') +backend_java_base_url = os.environ.get('BACKEND_JAVA_BASE_URL', 'http://8.136.19.173:18080').rstrip('/') os.environ['OSS_ACCESS_KEY_ID'] = accessKeyId os.environ['OSS_ACCESS_KEY_SECRET'] = accessKeySecret os.environ['SECRET_KEY'] = "ddffc7c1d02121d9554d7b080b2511b6" diff --git a/backend/utils/__pycache__/auth.cpython-312.pyc b/backend/utils/__pycache__/auth.cpython-312.pyc index 680ff01..b681092 100644 Binary files a/backend/utils/__pycache__/auth.cpython-312.pyc and b/backend/utils/__pycache__/auth.cpython-312.pyc differ diff --git a/backend/utils/auth.py b/backend/utils/auth.py index efe8eb3..d81fff1 100644 --- a/backend/utils/auth.py +++ b/backend/utils/auth.py @@ -2,13 +2,14 @@ 认证装饰器与 session 校验 """ from functools import wraps + from flask import request, redirect, url_for, session, jsonify from utils.db import get_db def is_session_user_valid(): - """校验 session 中的 user_id 是否在数据库中仍存在；不存在则清除 session 并返回 False""" + """校验 session 中的 user_id 是否仍存在；不存在则清空 session。""" uid = session.get('user_id') if not uid: return False @@ -28,28 +29,41 @@ def is_session_user_valid(): def get_current_admin_role(): - """获取当前登录用户的管理角色：super_admin / admin / None（非管理员）""" + """返回当前登录用户的管理角色：super_admin / admin / None。""" + uid = session.get('user_id') + if not uid: + return None, None try: conn = get_db() with conn.cursor() as cur: cur.execute( "SELECT id, username, is_admin, role, created_by_id FROM users WHERE id = %s", - (session['user_id'],) + (uid,) ) row = cur.fetchone() conn.close() if not row or not row.get('is_admin'): - return None, None - return row.get('role') or ('super_admin' if row.get('created_by_id') is None else 'admin'), row + return None, row + role = row.get('role') or ('super_admin' if row.get('created_by_id') is None else 'admin') + return role, row except Exception: return None, None +def is_current_user_admin(): + role, _ = get_current_admin_role() + return role in ('super_admin', 'admin') + + +def _is_ajax_request(): + return request.headers.get('X-Requested-With') == 'XMLHttpRequest' + + def login_required(f): @wraps(f) def decorated(*args, **kwargs): if not session.get('user_id') or not is_session_user_valid(): - if request.headers.get('X-Requested-With') == 'XMLHttpRequest': + if _is_ajax_request(): return jsonify({'success': False, 'error': '未登录'}), 401 return redirect(url_for('auth.login')) return f(*args, **kwargs) @@ -59,23 +73,20 @@ def login_required(f): def admin_required(f): @wraps(f) def decorated(*args, **kwargs): - if not session.get('user_id'): - if request.headers.get('X-Requested-With') == 'XMLHttpRequest': + if not session.get('user_id') or not is_session_user_valid(): + if _is_ajax_request(): return jsonify({'success': False, 'error': '未登录'}), 401 return redirect(url_for('auth.login')) + try: - conn = get_db() - with conn.cursor() as cur: - cur.execute("SELECT is_admin, role FROM users WHERE id = %s", (session['user_id'],)) - row = cur.fetchone() - conn.close() - if not row or not row.get('is_admin'): - if request.headers.get('X-Requested-With') == 'XMLHttpRequest': + role, _ = get_current_admin_role() + if role not in ('super_admin', 'admin'): + if _is_ajax_request(): return jsonify({'success': False, 'error': '需要管理员权限'}), 403 - return redirect(url_for('main.admin_page')) - except Exception as e: - if request.headers.get('X-Requested-With') == 'XMLHttpRequest': - return jsonify({'success': False, 'error': str(e)}), 500 - return redirect(url_for('main.admin_page')) + return redirect(url_for('auth.login')) + except Exception as exc: + if _is_ajax_request(): + return jsonify({'success': False, 'error': str(exc)}), 500 + return redirect(url_for('auth.login')) return f(*args, **kwargs) return decorated