33 lines
1.2 KiB
Python
33 lines
1.2 KiB
Python
from typing import Any
|
|
|
|
from django.contrib.auth import get_user_model
|
|
from mcp.server.auth.middleware.auth_context import get_access_token
|
|
|
|
from apps.utils.permission import has_perm
|
|
|
|
|
|
def authenticated_user_claims() -> dict[str, Any]:
|
|
"""返回当前请求中经过 Factory JWT 校验的用户摘要。"""
|
|
access_token = get_access_token()
|
|
claims = access_token.claims if access_token else None
|
|
user = claims.get("factory_user") if claims else None
|
|
if not isinstance(user, dict):
|
|
raise RuntimeError("当前 MCP 请求缺少有效的 Factory 用户身份")
|
|
return user
|
|
|
|
|
|
def authenticated_factory_user():
|
|
"""加载当前 JWT 对应的 Django 用户，供权限和数据范围逻辑复用。"""
|
|
claims = authenticated_user_claims()
|
|
try:
|
|
return get_user_model().objects.select_related("belong_dept").get(
|
|
pk=claims["id"]
|
|
)
|
|
except (KeyError, get_user_model().DoesNotExist) as exc:
|
|
raise RuntimeError("当前 JWT 对应的 Factory 用户不存在") from exc
|
|
|
|
|
|
def require_permission(user, permission_code: str) -> None:
|
|
if not has_perm(user, [permission_code]):
|
|
raise PermissionError(f"当前用户缺少权限：{permission_code}")
|