344 lines
12 KiB
Python
Executable File
344 lines
12 KiB
Python
Executable File
"""
|
|
Role-Based Access Control (RBAC) System
|
|
Hierarchical permission structure: Pages → Sections → Actions
|
|
"""
|
|
|
|
# Permission Actions
|
|
ACTIONS = {
|
|
'view': 'View/Read Access',
|
|
'create': 'Create/Add New',
|
|
'edit': 'Edit/Modify',
|
|
'delete': 'Delete/Remove',
|
|
'upload': 'Upload Files',
|
|
'download': 'Download Files',
|
|
'export': 'Export Data',
|
|
'import': 'Import Data'
|
|
}
|
|
|
|
# Application Structure with Hierarchical Permissions
|
|
APP_PERMISSIONS = {
|
|
'dashboard': {
|
|
'name': 'Dashboard',
|
|
'sections': {
|
|
'overview': {
|
|
'name': 'Overview Statistics',
|
|
'actions': ['view']
|
|
},
|
|
'recent_activity': {
|
|
'name': 'Recent Activity Feed',
|
|
'actions': ['view']
|
|
},
|
|
'quick_actions': {
|
|
'name': 'Quick Action Buttons',
|
|
'actions': ['view']
|
|
}
|
|
}
|
|
},
|
|
'settings': {
|
|
'name': 'Settings & Administration',
|
|
'sections': {
|
|
'user_management': {
|
|
'name': 'User Management',
|
|
'actions': ['view', 'create', 'edit', 'delete']
|
|
},
|
|
'role_permissions': {
|
|
'name': 'Role & Permissions',
|
|
'actions': ['view', 'edit']
|
|
},
|
|
'external_database': {
|
|
'name': 'External Database Config',
|
|
'actions': ['view', 'edit']
|
|
},
|
|
'system_settings': {
|
|
'name': 'System Configuration',
|
|
'actions': ['view', 'edit']
|
|
}
|
|
}
|
|
},
|
|
'warehouse': {
|
|
'name': 'Warehouse Management',
|
|
'sections': {
|
|
'inventory': {
|
|
'name': 'Inventory Management',
|
|
'actions': ['view', 'create', 'edit', 'delete', 'export']
|
|
},
|
|
'stock_movements': {
|
|
'name': 'Stock Movements',
|
|
'actions': ['view', 'create', 'edit', 'delete']
|
|
},
|
|
'receiving': {
|
|
'name': 'Goods Receiving',
|
|
'actions': ['view', 'create', 'edit', 'upload']
|
|
},
|
|
'shipping': {
|
|
'name': 'Goods Shipping',
|
|
'actions': ['view', 'create', 'edit', 'delete']
|
|
},
|
|
'locations': {
|
|
'name': 'Storage Locations',
|
|
'actions': ['view', 'create', 'edit', 'delete']
|
|
},
|
|
'reports': {
|
|
'name': 'Warehouse Reports',
|
|
'actions': ['view', 'export', 'download']
|
|
}
|
|
}
|
|
},
|
|
'quality': {
|
|
'name': 'Quality Control',
|
|
'sections': {
|
|
'inspections': {
|
|
'name': 'Quality Inspections',
|
|
'actions': ['view', 'create', 'edit', 'delete']
|
|
},
|
|
'test_results': {
|
|
'name': 'Test Results',
|
|
'actions': ['view', 'create', 'edit', 'upload']
|
|
},
|
|
'certificates': {
|
|
'name': 'Quality Certificates',
|
|
'actions': ['view', 'create', 'edit', 'delete', 'upload', 'download']
|
|
},
|
|
'compliance': {
|
|
'name': 'Compliance Management',
|
|
'actions': ['view', 'create', 'edit']
|
|
},
|
|
'quality_reports': {
|
|
'name': 'Quality Reports',
|
|
'actions': ['view', 'export', 'download']
|
|
}
|
|
}
|
|
},
|
|
'production': {
|
|
'name': 'Production Management',
|
|
'sections': {
|
|
'work_orders': {
|
|
'name': 'Work Orders',
|
|
'actions': ['view', 'create', 'edit', 'delete']
|
|
},
|
|
'production_lines': {
|
|
'name': 'Production Lines',
|
|
'actions': ['view', 'create', 'edit', 'delete']
|
|
},
|
|
'scheduling': {
|
|
'name': 'Production Scheduling',
|
|
'actions': ['view', 'create', 'edit', 'delete']
|
|
},
|
|
'equipment': {
|
|
'name': 'Equipment Management',
|
|
'actions': ['view', 'create', 'edit', 'delete']
|
|
},
|
|
'maintenance': {
|
|
'name': 'Maintenance Records',
|
|
'actions': ['view', 'create', 'edit', 'delete', 'upload']
|
|
}
|
|
}
|
|
},
|
|
'traceability': {
|
|
'name': 'Product Traceability',
|
|
'sections': {
|
|
'batch_tracking': {
|
|
'name': 'Batch Tracking',
|
|
'actions': ['view', 'create', 'edit']
|
|
},
|
|
'lot_genealogy': {
|
|
'name': 'Lot Genealogy',
|
|
'actions': ['view', 'export']
|
|
},
|
|
'recall_management': {
|
|
'name': 'Product Recall',
|
|
'actions': ['view', 'create', 'edit', 'delete']
|
|
},
|
|
'chain_of_custody': {
|
|
'name': 'Chain of Custody',
|
|
'actions': ['view', 'create', 'edit']
|
|
}
|
|
}
|
|
},
|
|
'reports': {
|
|
'name': 'Reports & Analytics',
|
|
'sections': {
|
|
'standard_reports': {
|
|
'name': 'Standard Reports',
|
|
'actions': ['view', 'export', 'download']
|
|
},
|
|
'custom_reports': {
|
|
'name': 'Custom Reports',
|
|
'actions': ['view', 'create', 'edit', 'delete', 'export']
|
|
},
|
|
'dashboards': {
|
|
'name': 'Analytics Dashboards',
|
|
'actions': ['view', 'create', 'edit', 'delete']
|
|
},
|
|
'data_export': {
|
|
'name': 'Data Export Tools',
|
|
'actions': ['view', 'export', 'download']
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
# Role Hierarchy and Default Permissions
|
|
ROLE_HIERARCHY = {
|
|
'superadmin': {
|
|
'name': 'Super Administrator',
|
|
'description': 'Full system access - can manage all aspects including system configuration',
|
|
'level': 100,
|
|
'default_permissions': 'ALL' # Gets all permissions by default
|
|
},
|
|
'admin': {
|
|
'name': 'Administrator',
|
|
'description': 'Administrative access - can manage users and most system functions',
|
|
'level': 90,
|
|
'default_sections': [
|
|
'dashboard',
|
|
'settings.user_management',
|
|
'settings.system_settings.view',
|
|
'warehouse',
|
|
'quality',
|
|
'production',
|
|
'reports',
|
|
'traceability'
|
|
],
|
|
'restrictions': [
|
|
'settings.role_permissions.edit', # Cannot modify role permissions
|
|
'settings.external_database.edit', # Cannot modify external DB config
|
|
]
|
|
},
|
|
'manager': {
|
|
'name': 'Manager',
|
|
'description': 'Management level access - can view and manage operational data',
|
|
'level': 70,
|
|
'default_sections': [
|
|
'dashboard',
|
|
'warehouse.inventory.view',
|
|
'warehouse.reports.view',
|
|
'quality.inspections.view',
|
|
'quality.quality_reports.view',
|
|
'production.work_orders',
|
|
'reports.standard_reports'
|
|
]
|
|
},
|
|
'warehouse_manager': {
|
|
'name': 'Warehouse Manager',
|
|
'description': 'Full warehouse access with limited system access',
|
|
'level': 60,
|
|
'default_sections': [
|
|
'dashboard.overview.view',
|
|
'warehouse', # Full warehouse access
|
|
'traceability.batch_tracking',
|
|
'reports.standard_reports.view'
|
|
]
|
|
},
|
|
'warehouse_worker': {
|
|
'name': 'Warehouse Worker',
|
|
'description': 'Limited warehouse operations access',
|
|
'level': 50,
|
|
'default_sections': [
|
|
'dashboard.overview.view',
|
|
'warehouse.inventory.view',
|
|
'warehouse.stock_movements',
|
|
'warehouse.receiving',
|
|
'warehouse.shipping.view'
|
|
]
|
|
},
|
|
'quality_manager': {
|
|
'name': 'Quality Manager',
|
|
'description': 'Full quality control access',
|
|
'level': 60,
|
|
'default_sections': [
|
|
'dashboard.overview.view',
|
|
'quality', # Full quality access
|
|
'traceability',
|
|
'reports.standard_reports.view'
|
|
]
|
|
},
|
|
'quality_worker': {
|
|
'name': 'Quality Worker',
|
|
'description': 'Limited quality control operations',
|
|
'level': 50,
|
|
'default_sections': [
|
|
'dashboard.overview.view',
|
|
'quality.inspections',
|
|
'quality.test_results',
|
|
'quality.certificates.view'
|
|
]
|
|
}
|
|
}
|
|
|
|
def get_permission_key(page, section, action):
|
|
"""Generate a standardized permission key"""
|
|
return f"{page}.{section}.{action}"
|
|
|
|
def parse_permission_key(permission_key):
|
|
"""Parse a permission key into its components"""
|
|
parts = permission_key.split('.')
|
|
if len(parts) == 3:
|
|
return parts[0], parts[1], parts[2]
|
|
return None, None, None
|
|
|
|
def get_all_permissions():
|
|
"""Get a flat list of all possible permissions"""
|
|
permissions = []
|
|
for page_key, page_data in APP_PERMISSIONS.items():
|
|
for section_key, section_data in page_data['sections'].items():
|
|
for action in section_data['actions']:
|
|
permissions.append({
|
|
'key': get_permission_key(page_key, section_key, action),
|
|
'page': page_key,
|
|
'page_name': page_data['name'],
|
|
'section': section_key,
|
|
'section_name': section_data['name'],
|
|
'action': action,
|
|
'action_name': ACTIONS.get(action, action)
|
|
})
|
|
return permissions
|
|
|
|
def get_default_permissions_for_role(role):
|
|
"""Get default permissions for a specific role"""
|
|
if role not in ROLE_HIERARCHY:
|
|
return []
|
|
|
|
role_config = ROLE_HIERARCHY[role]
|
|
|
|
# Superadmin gets everything
|
|
if role_config.get('default_permissions') == 'ALL':
|
|
return [p['key'] for p in get_all_permissions()]
|
|
|
|
# Other roles get specific sections
|
|
permissions = []
|
|
default_sections = role_config.get('default_sections', [])
|
|
|
|
for section_pattern in default_sections:
|
|
if section_pattern == 'dashboard':
|
|
# Full dashboard access
|
|
for section_key in APP_PERMISSIONS['dashboard']['sections'].keys():
|
|
for action in APP_PERMISSIONS['dashboard']['sections'][section_key]['actions']:
|
|
permissions.append(get_permission_key('dashboard', section_key, action))
|
|
elif '.' in section_pattern:
|
|
# Specific page.section or page.section.action
|
|
parts = section_pattern.split('.')
|
|
if len(parts) == 2: # page.section - all actions
|
|
page, section = parts
|
|
if page in APP_PERMISSIONS and section in APP_PERMISSIONS[page]['sections']:
|
|
for action in APP_PERMISSIONS[page]['sections'][section]['actions']:
|
|
permissions.append(get_permission_key(page, section, action))
|
|
elif len(parts) == 3: # page.section.action - specific action
|
|
page, section, action = parts
|
|
if (page in APP_PERMISSIONS and
|
|
section in APP_PERMISSIONS[page]['sections'] and
|
|
action in APP_PERMISSIONS[page]['sections'][section]['actions']):
|
|
permissions.append(get_permission_key(page, section, action))
|
|
else:
|
|
# Full page access
|
|
page = section_pattern
|
|
if page in APP_PERMISSIONS:
|
|
for section_key, section_data in APP_PERMISSIONS[page]['sections'].items():
|
|
for action in section_data['actions']:
|
|
permissions.append(get_permission_key(page, section_key, action))
|
|
|
|
# Remove any restricted permissions
|
|
restrictions = role_config.get('restrictions', [])
|
|
permissions = [p for p in permissions if p not in restrictions]
|
|
|
|
return permissions |