231 lines
9.6 KiB
Python
231 lines
9.6 KiB
Python
from rest_framework import viewsets, filters, status
|
|
from rest_framework.decorators import action, api_view, permission_classes
|
|
from rest_framework.permissions import IsAuthenticated, AllowAny
|
|
from rest_framework.response import Response
|
|
from django_filters.rest_framework import DjangoFilterBackend
|
|
from drf_spectacular.utils import extend_schema
|
|
|
|
from config.exceptions import AppError
|
|
from .auth import TRIAL_INSTITUTION_NAME
|
|
from .models import User, Role, TeacherStudentRelation, Institution, Department
|
|
from .serializers import (
|
|
UserSerializer, UserCreateSerializer, UserUpdateSerializer,
|
|
RoleSerializer,
|
|
TeacherStudentRelationSerializer, InstitutionSerializer, DepartmentSerializer
|
|
)
|
|
from .permissions import IsUserListPermitted, IsUserDetailPermitted
|
|
from .utils.password import validate_password_strength
|
|
from .utils.jwt_redis import invalidate_user_tokens
|
|
from .audit import log_password_change, log_password_reset, log_user_list
|
|
|
|
|
|
class UserViewSet(viewsets.ModelViewSet):
|
|
"""用户管理
|
|
|
|
list: 获取用户列表（支持过滤、搜索、排序）— U9 角色分级权限
|
|
create: 创建用户
|
|
retrieve: 获取用户详情 — U10 对象级权限
|
|
update: 更新用户信息
|
|
destroy: 删除用户
|
|
"""
|
|
queryset = User.objects.all() # 保留供 DRF router basename 检测
|
|
filter_backends = [DjangoFilterBackend, filters.SearchFilter, filters.OrderingFilter]
|
|
filterset_fields = ['role_type', 'status', 'institution', 'department', 'gender']
|
|
search_fields = ['username', 'real_name', 'phone']
|
|
ordering_fields = ['created_at', 'last_login_time', 'total_training_count']
|
|
|
|
# ── 权限分派 ──────────────────────────────────────────────────────────────
|
|
|
|
def get_permissions(self):
|
|
if self.action == 'list':
|
|
return [IsAuthenticated(), IsUserListPermitted()]
|
|
elif self.action == 'retrieve':
|
|
return [IsAuthenticated(), IsUserDetailPermitted()]
|
|
return super().get_permissions()
|
|
|
|
# ── 序列化器分派 ──────────────────────────────────────────────────────────
|
|
|
|
def get_serializer_class(self):
|
|
if self.action == 'create':
|
|
return UserCreateSerializer
|
|
elif self.action in ['update', 'partial_update']:
|
|
return UserUpdateSerializer
|
|
return UserSerializer
|
|
|
|
# ── 查询集：U9 角色分级 + N+1 优化 ───────────────────────────────────────
|
|
|
|
def get_queryset(self):
|
|
qs = User.objects.select_related('institution', 'department')
|
|
user = self.request.user
|
|
|
|
if not user.is_authenticated:
|
|
return qs.none()
|
|
|
|
# list 动作按角色限制可见范围
|
|
if self.action == 'list':
|
|
if user.role_type in ('super_admin', 'content_admin') or user.is_staff:
|
|
return qs # 管理员：全员
|
|
elif user.role_type == 'teacher':
|
|
# 教师：仅自己名下活跃学生
|
|
student_ids = TeacherStudentRelation.objects.filter(
|
|
teacher=user, status=1
|
|
).values_list('student_id', flat=True)
|
|
return qs.filter(id__in=student_ids, role_type='student')
|
|
else:
|
|
return qs.none() # 兜底（被 IsUserListPermitted 拦截在前）
|
|
|
|
return qs
|
|
|
|
# ── U9 list 审计 ─────────────────────────────────────────────────────────
|
|
|
|
def list(self, request, *args, **kwargs):
|
|
filters_dict = {k: v for k, v in request.query_params.items()
|
|
if k in ('role_type', 'status', 'search', 'ordering', 'page')}
|
|
log_user_list(request.user.id, filters=filters_dict)
|
|
return super().list(request, *args, **kwargs)
|
|
|
|
# ── U6 修改密码（已登录） ─────────────────────────────────────────────────
|
|
|
|
@action(detail=False, methods=['post'], url_path='change-password')
|
|
def change_password(self, request):
|
|
"""U6 修改当前用户密码"""
|
|
old_password = request.data.get('old_password', '')
|
|
new_password = request.data.get('new_password', '')
|
|
|
|
if not old_password or not new_password:
|
|
raise AppError('VALIDATION_ERROR', '请提供旧密码和新密码')
|
|
|
|
user = request.user
|
|
|
|
# 1. 校验旧密码
|
|
if not user.check_password(old_password):
|
|
raise AppError('AUTH_BAD_OLD_PASSWORD', '原密码错误')
|
|
|
|
# 2. 新密码不得与旧密码相同
|
|
if user.check_password(new_password):
|
|
raise AppError('AUTH_PASSWORD_SAME_AS_OLD', '新密码不能与旧密码相同')
|
|
|
|
# 3. 密码强度校验
|
|
pwd_errors = validate_password_strength(
|
|
new_password,
|
|
phone=user.phone,
|
|
real_name=user.real_name,
|
|
)
|
|
if pwd_errors:
|
|
raise AppError('AUTH_PASSWORD_WEAK', pwd_errors[0], details=pwd_errors)
|
|
|
|
# 4. 改密 + 全设备登出
|
|
user.set_password(new_password)
|
|
user.save(update_fields=['password'])
|
|
invalidate_user_tokens(user.id)
|
|
|
|
# 5. 审计
|
|
log_password_change(user.id)
|
|
|
|
return Response({'message': '密码修改成功，请重新登录'})
|
|
|
|
# ── 管理员重置用户密码 ────────────────────────────────────────────────────
|
|
|
|
@action(detail=True, methods=['post'], url_path='reset-password')
|
|
def reset_password(self, request, pk=None):
|
|
"""重置用户密码（管理员操作）"""
|
|
user = self.get_object()
|
|
new_password = request.data.get('password', '')
|
|
|
|
if not new_password:
|
|
raise AppError('VALIDATION_ERROR', '请提供新密码')
|
|
|
|
# 密码强度校验
|
|
pwd_errors = validate_password_strength(new_password, phone=user.phone, real_name=user.real_name)
|
|
if pwd_errors:
|
|
raise AppError('AUTH_PASSWORD_WEAK', pwd_errors[0], details=pwd_errors)
|
|
|
|
user.set_password(new_password)
|
|
user.save(update_fields=['password'])
|
|
invalidate_user_tokens(user.id)
|
|
|
|
log_password_reset(user.id)
|
|
|
|
return Response({'message': '密码重置成功'})
|
|
|
|
# ── 当前用户信息 ─────────────────────────────────────────────────────────
|
|
|
|
@action(detail=False, methods=['get'], url_path='me')
|
|
def me(self, request):
|
|
"""获取当前登录用户信息"""
|
|
serializer = self.get_serializer(request.user)
|
|
return Response(serializer.data)
|
|
|
|
|
|
class RoleViewSet(viewsets.ModelViewSet):
|
|
"""角色管理"""
|
|
queryset = Role.objects.all()
|
|
serializer_class = RoleSerializer
|
|
filter_backends = [filters.SearchFilter]
|
|
search_fields = ['role_code', 'role_name']
|
|
|
|
|
|
class TeacherStudentRelationViewSet(viewsets.ModelViewSet):
|
|
"""师生关系管理"""
|
|
queryset = TeacherStudentRelation.objects.all()
|
|
serializer_class = TeacherStudentRelationSerializer
|
|
filter_backends = [DjangoFilterBackend, filters.OrderingFilter]
|
|
filterset_fields = ['teacher', 'student', 'relation_type', 'status']
|
|
ordering_fields = ['start_time', 'end_time', 'created_at']
|
|
|
|
|
|
class InstitutionViewSet(viewsets.ModelViewSet):
|
|
"""机构管理（医院/学校）"""
|
|
queryset = Institution.objects.all()
|
|
serializer_class = InstitutionSerializer
|
|
filter_backends = [DjangoFilterBackend, filters.SearchFilter]
|
|
filterset_fields = ['type', 'province', 'city']
|
|
search_fields = ['name']
|
|
|
|
@action(detail=True, methods=['get'])
|
|
def departments(self, request, pk=None):
|
|
"""获取机构下的科室列表"""
|
|
institution = self.get_object()
|
|
departments = institution.department_set.all()
|
|
serializer = DepartmentSerializer(departments, many=True)
|
|
return Response(serializer.data)
|
|
|
|
|
|
class DepartmentViewSet(viewsets.ModelViewSet):
|
|
"""科室管理"""
|
|
queryset = Department.objects.all()
|
|
serializer_class = DepartmentSerializer
|
|
filter_backends = [DjangoFilterBackend, filters.SearchFilter]
|
|
filterset_fields = ['institution', 'category']
|
|
search_fields = ['name']
|
|
|
|
|
|
# ── 移动端机构列表（不分页，登录前可调用）─────────────────────────────────────
|
|
|
|
@extend_schema(
|
|
summary='移动端机构列表（不分页）',
|
|
description='返回当前可选的全部机构，供移动端学生登录时选择所属机构。'
|
|
f'is_trial=true 标识预留试用机构（{TRIAL_INSTITUTION_NAME}）。',
|
|
responses={200: None},
|
|
tags=['机构'],
|
|
)
|
|
@api_view(['GET'])
|
|
@permission_classes([AllowAny])
|
|
def institution_list(request):
|
|
"""移动端机构列表 — 全部机构、不分页"""
|
|
institutions = Institution.objects.all().order_by('name')
|
|
data = [
|
|
{
|
|
'id': inst.id,
|
|
'code': inst.code,
|
|
'name': inst.name,
|
|
'type': inst.type,
|
|
'level': inst.level,
|
|
'province': inst.province,
|
|
'city': inst.city,
|
|
'is_trial': inst.name == TRIAL_INSTITUTION_NAME,
|
|
}
|
|
for inst in institutions
|
|
]
|
|
return Response(data)
|