优化权限控制

web/backend/routers/users.py

@@ -6,7 +6,7 @@ from sqlalchemy.orm import Session
 from ..database import get_db
 from ..models import User, AuditLog
 from ..security import hash_password
-from ..permissions import ROLE_LABELS, get_role_permissions
+from ..permissions import ROLE_LABELS, PERMISSIONS, get_user_permissions
 from ..schemas import UserCreate, UserUpdate, UserInfo
 from ..deps import require_permission, get_current_user
 
@@ -28,7 +28,8 @@ def list_users(
             is_active=u.is_active,
             remark=u.remark or "",
             created_at=u.created_at,
-            permissions=get_role_permissions(u.role),
+            permissions=get_user_permissions(u),
+            custom_permissions=u.custom_permissions,
         ))
     return result
 
@@ -60,7 +61,8 @@ def create_user(
     return UserInfo(
         id=user.id, username=user.username, role=user.role,
         is_active=user.is_active, remark=user.remark or "",
-        permissions=get_role_permissions(user.role),
+        permissions=get_user_permissions(user),
+        custom_permissions=user.custom_permissions,
     )
 
 
@@ -83,6 +85,8 @@ def update_user(
         user.is_active = req.is_active
     if req.remark is not None:
         user.remark = req.remark
+    if req.custom_permissions is not None:
+        user.custom_permissions = req.custom_permissions
 
     db.commit()
     db.refresh(user)
@@ -94,7 +98,8 @@ def update_user(
     return UserInfo(
         id=user.id, username=user.username, role=user.role,
         is_active=user.is_active, remark=user.remark or "",
-        permissions=get_role_permissions(user.role),
+        permissions=get_user_permissions(user),
+        custom_permissions=user.custom_permissions,
     )
 
 
@@ -115,3 +120,13 @@ def delete_user(
     db.delete(user)
     db.commit()
     return {"message": "已删除", "success": True}
+
+
+@router.get("/permissions/list")
+def list_permissions(_: User = Depends(require_permission("user:assign_permissions"))):
+    """返回所有可用权限点及角色默认权限映射。"""
+    from ..permissions import ROLE_PERMISSIONS
+    return {
+        "permissions": PERMISSIONS,
+        "role_permissions": ROLE_PERMISSIONS,
+    }