feat: add system admin account management with RBAC
- AdminUser model: multi-admin accounts with bcrypt hashing (admin_users table) - Three roles: superadmin / admin / viewer with granular permission bits - auth.py: login migrated from env-var single admin to DB-backed accounts; seed_initial_admin() auto-creates first superadmin from SM_ADMIN_PASSWORD - Web UI: /system/admins page (add/edit role/toggle/reset pwd/delete) + change-my-password; sidebar entry; permission-guarded routes - REST API: /api/admins CRUD with protection checks - Protections: cannot delete/disable self; keep >=1 enabled superadmin; disabled accounts fail permission checks immediately - README: document roles, permission bits, API
This commit is contained in:
Your Name
+154
-3
@@ -1,6 +1,6 @@
|
||||
"""Web 管理面板路由。"""
|
||||
from flask import Blueprint, render_template, request, redirect, url_for, flash, current_app
|
||||
from auth import login_required
|
||||
from auth import login_required, permission_required
|
||||
from database import db
|
||||
from models import Instance, User
|
||||
from services import stats_service, backup_service
|
||||
@@ -25,6 +25,8 @@ def inject_nav():
|
||||
page_name = "活跃连接"
|
||||
elif p.startswith("/logs"):
|
||||
page_name = "审计日志"
|
||||
elif p.startswith("/system/admins"):
|
||||
page_name = "管理员账户"
|
||||
elif p.startswith("/system"):
|
||||
page_name = "系统管理"
|
||||
else:
|
||||
@@ -36,7 +38,8 @@ def inject_nav():
|
||||
"users": p.startswith("/users"),
|
||||
"stats": p.startswith("/stats"),
|
||||
"logs": p.startswith("/logs"),
|
||||
"system": p.startswith("/system"),
|
||||
"system": p.startswith("/system") and not p.startswith("/system/admins"),
|
||||
"admins": p.startswith("/system/admins"),
|
||||
},
|
||||
"page_name": page_name,
|
||||
"logged_in": flask_session.get("logged_in", False),
|
||||
@@ -307,18 +310,23 @@ def logs():
|
||||
# ── 系统管理 ───────────────────────────────────────────────────
|
||||
@bp.route("/system")
|
||||
@login_required
|
||||
@permission_required("system:read")
|
||||
def system():
|
||||
import platform, time
|
||||
from auth import current_admin
|
||||
backups = backup_service.list_backups()
|
||||
admin = current_admin()
|
||||
return render_template("system.html", backups=backups,
|
||||
sys_version=platform.python_version(),
|
||||
sys_platform=platform.platform(),
|
||||
sys_hostname=platform.node(),
|
||||
uptime=time.strftime("%Y-%m-%d %H:%M:%S", time.localtime()))
|
||||
uptime=time.strftime("%Y-%m-%d %H:%M:%S", time.localtime()),
|
||||
current_admin=admin)
|
||||
|
||||
|
||||
@bp.route("/system/backup", methods=["POST"])
|
||||
@login_required
|
||||
@permission_required("system:write")
|
||||
def create_backup():
|
||||
backup_service.create_backup()
|
||||
flash("备份已完成", "success")
|
||||
@@ -327,6 +335,7 @@ def create_backup():
|
||||
|
||||
@bp.route("/system/restore/<int:bid>", methods=["POST"])
|
||||
@login_required
|
||||
@permission_required("system:write")
|
||||
def restore_backup(bid):
|
||||
result = backup_service.restore_backup(bid)
|
||||
if "error" in result:
|
||||
@@ -334,3 +343,145 @@ def restore_backup(bid):
|
||||
else:
|
||||
flash("恢复完成，请刷新页面", "success")
|
||||
return redirect(url_for("web.system"))
|
||||
|
||||
|
||||
# ── 管理员账户管理 ────────────────────────────────────────────────
|
||||
@bp.route("/system/admins")
|
||||
@login_required
|
||||
@permission_required("admins:read")
|
||||
def admins():
|
||||
from models import AdminUser
|
||||
from auth import current_admin
|
||||
admin_list = AdminUser.query.order_by(AdminUser.id.asc()).all()
|
||||
return render_template("admins.html", admins=admin_list,
|
||||
current_admin=current_admin())
|
||||
|
||||
|
||||
@bp.route("/system/admins/add", methods=["POST"])
|
||||
@login_required
|
||||
@permission_required("admins:write")
|
||||
def add_admin():
|
||||
from models import AdminUser
|
||||
username = request.form.get("username", "").strip()
|
||||
password = request.form.get("password", "")
|
||||
role = request.form.get("role", "viewer")
|
||||
if not username or not password:
|
||||
flash("用户名和密码不能为空", "danger")
|
||||
return redirect(url_for("web.admins"))
|
||||
if role not in AdminUser.ROLE_LABELS:
|
||||
role = "viewer"
|
||||
if AdminUser.query.filter_by(username=username).first():
|
||||
flash("用户名已存在", "danger")
|
||||
return redirect(url_for("web.admins"))
|
||||
if len(password) < 4:
|
||||
flash("密码至少 4 位", "danger")
|
||||
return redirect(url_for("web.admins"))
|
||||
admin = AdminUser()
|
||||
admin.username = username
|
||||
admin.role = role
|
||||
admin.enabled = True
|
||||
admin.set_password(password)
|
||||
db.session.add(admin)
|
||||
db.session.commit()
|
||||
flash(f"已创建管理员 {username}", "success")
|
||||
return redirect(url_for("web.admins"))
|
||||
|
||||
|
||||
@bp.route("/system/admins/<int:aid>/toggle", methods=["POST"])
|
||||
@login_required
|
||||
@permission_required("admins:write")
|
||||
def toggle_admin(aid):
|
||||
from models import AdminUser
|
||||
from auth import current_admin
|
||||
admin = AdminUser.query.get_or_404(aid)
|
||||
# 不能禁用自己
|
||||
curr = current_admin()
|
||||
if curr and curr.id == admin.id:
|
||||
flash("不能禁用当前登录账户", "danger")
|
||||
return redirect(url_for("web.admins"))
|
||||
admin.enabled = not admin.enabled
|
||||
db.session.commit()
|
||||
flash(f"{'已启用' if admin.enabled else '已禁用'} {admin.username}", "info")
|
||||
return redirect(url_for("web.admins"))
|
||||
|
||||
|
||||
@bp.route("/system/admins/<int:aid>/role", methods=["POST"])
|
||||
@login_required
|
||||
@permission_required("admins:write")
|
||||
def change_admin_role(aid):
|
||||
from models import AdminUser
|
||||
admin = AdminUser.query.get_or_404(aid)
|
||||
role = request.form.get("role", "viewer")
|
||||
if role not in AdminUser.ROLE_LABELS:
|
||||
flash("无效的角色", "danger")
|
||||
return redirect(url_for("web.admins"))
|
||||
admin.role = role
|
||||
db.session.commit()
|
||||
flash(f"{admin.username} 角色已更新为 {admin.role_label}", "success")
|
||||
return redirect(url_for("web.admins"))
|
||||
|
||||
|
||||
@bp.route("/system/admins/<int:aid>/password", methods=["POST"])
|
||||
@login_required
|
||||
@permission_required("admins:write")
|
||||
def reset_admin_password(aid):
|
||||
from models import AdminUser
|
||||
password = request.form.get("password", "")
|
||||
if not password or len(password) < 4:
|
||||
flash("密码至少 4 位", "danger")
|
||||
return redirect(url_for("web.admins"))
|
||||
admin = AdminUser.query.get_or_404(aid)
|
||||
admin.set_password(password)
|
||||
db.session.commit()
|
||||
flash(f"{admin.username} 密码已重置", "success")
|
||||
return redirect(url_for("web.admins"))
|
||||
|
||||
|
||||
@bp.route("/system/admins/<int:aid>/delete", methods=["POST"])
|
||||
@login_required
|
||||
@permission_required("admins:write")
|
||||
def delete_admin(aid):
|
||||
from models import AdminUser
|
||||
from auth import current_admin
|
||||
admin = AdminUser.query.get_or_404(aid)
|
||||
curr = current_admin()
|
||||
if curr and curr.id == admin.id:
|
||||
flash("不能删除当前登录账户", "danger")
|
||||
return redirect(url_for("web.admins"))
|
||||
# 至少保留一个 superadmin
|
||||
if admin.role == "superadmin":
|
||||
super_count = AdminUser.query.filter_by(role="superadmin", enabled=True).count()
|
||||
if super_count <= 1:
|
||||
flash("至少需要保留一个启用的超级管理员", "danger")
|
||||
return redirect(url_for("web.admins"))
|
||||
db.session.delete(admin)
|
||||
db.session.commit()
|
||||
flash(f"已删除管理员 {admin.username}", "warning")
|
||||
return redirect(url_for("web.admins"))
|
||||
|
||||
|
||||
@bp.route("/system/change-password", methods=["POST"])
|
||||
@login_required
|
||||
def change_my_password():
|
||||
"""当前登录用户修改自己的密码。"""
|
||||
from models import AdminUser
|
||||
from auth import current_admin
|
||||
old_pwd = request.form.get("old_password", "")
|
||||
new_pwd = request.form.get("new_password", "")
|
||||
confirm_pwd = request.form.get("confirm_password", "")
|
||||
admin = current_admin()
|
||||
if not admin:
|
||||
return redirect(url_for("auth.logout"))
|
||||
if not admin.check_password(old_pwd):
|
||||
flash("原密码错误", "danger")
|
||||
return redirect(url_for("web.system"))
|
||||
if not new_pwd or len(new_pwd) < 4:
|
||||
flash("新密码至少 4 位", "danger")
|
||||
return redirect(url_for("web.system"))
|
||||
if new_pwd != confirm_pwd:
|
||||
flash("两次输入的新密码不一致", "danger")
|
||||
return redirect(url_for("web.system"))
|
||||
admin.set_password(new_pwd)
|
||||
db.session.commit()
|
||||
flash("密码修改成功", "success")
|
||||
return redirect(url_for("web.system"))
|
||||
|
||||
Reference in New Issue
Block a user