security.py

from flask_login import current_user
import logging
import jwt

from flask_babel import lazy_gettext
import pysnooper
from flask import current_app
from flask_appbuilder.security.sqla import models as ab_models
from flask_appbuilder.security.sqla.manager import SecurityManager
from flask_babel import lazy_gettext as _
from flask_appbuilder.security.views import (
    PermissionModelView,
    PermissionViewModelView,
    RoleModelView,
    UserModelView
)
from werkzeug.security import generate_password_hash,check_password_hash
from flask_appbuilder.security.sqla.models import assoc_user_role

from flask_appbuilder.security.decorators import has_access
from flask_appbuilder.models.sqla.interface import SQLAInterface
from flask_appbuilder.widgets import ListWidget
from sqlalchemy import or_

from flask_appbuilder.security.views import expose

from flask import g, flash, request

from flask_appbuilder.security.sqla.models import assoc_permissionview_role
from sqlalchemy import select
from flask_appbuilder.const import (
    AUTH_DB,
    AUTH_LDAP,
    AUTH_OAUTH,
    AUTH_OID,
    AUTH_REMOTE_USER,
    LOGMSG_WAR_SEC_LOGIN_FAILED
)




# user list page template
class MyappSecurityListWidget(ListWidget):
    """
        Redeclaring to avoid circular imports
    """
    template = "myapp/fab_overrides/list.html"


# role list page template
class MyappRoleListWidget(ListWidget):
    """
        Role model view from FAB already uses a custom list widget override
        So we override the override
    """
    template = "myapp/fab_overrides/list_role.html"
    def __init__(self, **kwargs):
        kwargs["appbuilder"] = current_app.appbuilder
        super().__init__(**kwargs)



# customize list,add,edit page
UserModelView.list_columns= ["username", "active", "roles"]
UserModelView.edit_columns= ["first_name", "last_name", "username", "active", "email"]
UserModelView.add_columns= ["first_name", "last_name", "username", "email", "active", "roles"]



UserModelView.list_widget = MyappSecurityListWidget
RoleModelView.list_widget = MyappRoleListWidget
PermissionViewModelView.list_widget = MyappSecurityListWidget
PermissionModelView.list_widget = MyappSecurityListWidget


# expand user
from flask_appbuilder.security.sqla.models import User,Role
from sqlalchemy import Column, String



class MyUser(User):
    __tablename__ = 'ab_user'
    org = Column(String(200))   # Organization
    quota = Column(String(2000))  # 资源配额


    def get_full_name(self):
        return self.username

    def __repr__(self):
        return self.username

    def is_admin(self):
        user_roles = [role.name.lower() for role in list(self.roles)]
        if "admin" in user_roles:
            return True
        return False

    @property
    def secret(self):
        if self.changed_on:
            pass
            # help(self.changed_on)
            # timestamp = int(func.date_format(self.changed_on))
            timestamp = int(self.changed_on.timestamp())
            payload = {
                "iss": "cube-studio",
                "sub":self.username
                # "iat": timestamp,  # Issue period
                # "nbf": timestamp,  # Effective Date
                # "exp": timestamp + 60 * 60 * 24 * 30 * 12,  # Valid for 12 months
            }

            from myapp import conf
            global_password = conf.get('JWT_PASSWORD','cube-studio')
            encoded_jwt = jwt.encode(payload, global_password, algorithm='HS256')
            return encoded_jwt
        return ''


# customize role view
class MyRoleModelView(RoleModelView):

    datamodel = SQLAInterface(Role)
    order_columns = ["id"]
    route_base = "/roles"
    list_columns = ["name", "permissions"]


class MyUserRemoteUserModelView_Base():
    datamodel = SQLAInterface(MyUser)

    base_permissions = ['can_list', 'can_edit', 'can_add', 'can_show','can_userinfo']

    list_columns = ["username", "active", "roles", ]

    edit_columns = ["first_name", "last_name", "username",'password', "active", "email", "roles", 'org', 'quota' ]
    add_columns = ["first_name", "last_name", "username",'password', "active", "email", "roles", 'org', 'quota']
    show_columns = ["username", "active", "roles", "login_count"]
    describe_columns={
        "org":"组织架构，自行填写",
        "quota": '资源限额，额度填写方式 $集群名,$资源组名,$命名空间,$资源类型,$限制类型,$限制值，其中$命名空间包含all,jupyter,pipeline,service,automl,aihub,$资源类型包含cpu,memory,gpu,$限制类型包含single,concurrent,total'
    }
    list_widget = MyappSecurityListWidget
    label_columns = {
        "get_full_name": lazy_gettext("Full Name"),
        "first_name": lazy_gettext("First Name"),
        "last_name": lazy_gettext("Last Name"),
        "username": lazy_gettext("User Name"),
        "password": lazy_gettext("Password"),
        "active": lazy_gettext("Is Active?"),
        "email": lazy_gettext("Email"),
        "roles": lazy_gettext("Role"),
        "last_login": lazy_gettext("Last login"),
        "login_count": lazy_gettext("Login count"),
        "fail_login_count": lazy_gettext("Failed login count"),
        "created_on": lazy_gettext("Created on"),
        "created_by": lazy_gettext("Created by"),
        "changed_on": lazy_gettext("Changed on"),
        "changed_by": lazy_gettext("Changed by"),
        "secret": lazy_gettext("Authorization"),
        "quota": lazy_gettext("quota"),
    }
    # 用户show页面
    show_fieldsets = [
        (
            lazy_gettext("User info"),
            {"fields": ["username", "active", "roles", "login_count",'secret']},
        ),
        (
            lazy_gettext("Personal Info"),
            {"fields": ["first_name", "last_name", "email",'org','quota'], "expanded": True},
        ),
        (
            lazy_gettext("Audit Info"),
            {
                "fields": [
                    "last_login",
                    "fail_login_count",
                    "created_on",
                    "created_by",
                    "changed_on",
                    "changed_by",
                ],
                "expanded": False,
            },
        ),
    ]
    # 个人查看详情额展示的信息
    user_show_fieldsets = [
        (
            lazy_gettext("User info"),
            {"fields": ["username", "active", "roles", "login_count",'secret']},
        ),
        (
            lazy_gettext("Personal Info"),
            {"fields": ["first_name", "last_name", "email",'org','quota'], "expanded": True},
        ),
    ]


    @expose("/userinfo/")
    @has_access
    def userinfo(self):
        item = self.datamodel.get(g.user.id, self._base_filters)
        widgets = self._get_show_widget(
            g.user.id, item, show_fieldsets=self.user_show_fieldsets
        )
        self.update_redirect()
        return self.render_template(
            self.show_template,
            title=self.user_info_title,
            widgets=widgets,
            appbuilder=self.appbuilder,
        )

    # 添加默认gamma角色
    # @pysnooper.snoop()
    def post_add(self,user):
        from myapp import security_manager,db
        gamma_role = security_manager.find_role('Gamma')
        if gamma_role not in user.roles:
            user.roles.append(gamma_role)
            db.session.commit()

        # 添加到public项目组
        try:
            from myapp.models.model_team import Project_User, Project
            public_project = db.session.query(Project).filter(Project.name == "public").filter(Project.type == "org").first()
            if public_project:
                project_user = Project_User()
                project_user.project = public_project
                project_user.role = 'dev'
                project_user.user_id = user.id
                db.session.add(project_user)
                db.session.commit()
        except Exception:
            db.session.rollback()



class MyUserRemoteUserModelView(MyUserRemoteUserModelView_Base,UserModelView):
    datamodel = SQLAInterface(MyUser)

from flask_appbuilder.security.views import SimpleFormView
from flask_appbuilder._compat import as_unicode
from flask_babel import lazy_gettext
from wtforms import StringField
from wtforms.validators import DataRequired

from flask_appbuilder.fieldwidgets import BS3TextFieldWidget
from flask_appbuilder.forms import DynamicForm


class UserInfoEditView(SimpleFormView):

    class UserInfoEdit(DynamicForm):
        first_name = StringField(
            lazy_gettext("First Name"),
            validators=[DataRequired()],
            widget=BS3TextFieldWidget(),
            description=lazy_gettext("Write the user first name or names"),
        )
        last_name = StringField(
            lazy_gettext("Last Name"),
            validators=[DataRequired()],
            widget=BS3TextFieldWidget(),
            description=lazy_gettext("Write the user last name"),
        )
        username = StringField(
            lazy_gettext("User Name"),
            validators=[DataRequired()],
            widget=BS3TextFieldWidget(),
            description=lazy_gettext("Write the Username"),
        )
        password = StringField(
            lazy_gettext("Password"),
            validators=[DataRequired()],
            widget=BS3TextFieldWidget(),
            description=lazy_gettext("Password"),
        )
        email = StringField(
            lazy_gettext("Email"),
            validators=[DataRequired()],
            widget=BS3TextFieldWidget(),
            description=lazy_gettext("Write the Email"),
        )
        org = StringField(
            lazy_gettext("Org"),
            widget=BS3TextFieldWidget(),
            description=lazy_gettext("organization name"),
        )

    form = UserInfoEdit
    form_title = lazy_gettext("Edit User Information")
    redirect_url = "/"
    message = lazy_gettext("User information changed")

    def form_get(self, form):
        item = self.appbuilder.sm.get_user_by_id(g.user.id)
        # fills the form generic solution
        for key, value in form.data.items():
            if key == "csrf_token":
                continue
            form_field = getattr(form, key)
            form_field.data = getattr(item, key)

    def form_post(self, form):
        form = self.form.refresh(request.form)
        item = self.appbuilder.sm.get_user_by_id(g.user.id)
        form.populate_obj(item)
        self.appbuilder.sm.update_user(item)
        flash(as_unicode(self.message), "info")



from myapp.project import MyCustomRemoteUserView
from myapp.project import Myauthdbview
# myapp自带的角色和角色权限，自定义了各种权限
# 基础类fab-Security-Manager中 def load_user(self, pk):  是用来认证用户的
# before_request是user赋值给g.user
# @pysnooper.snoop()
class MyappSecurityManager(SecurityManager):

    user_model = MyUser
    rolemodelview = MyRoleModelView  #

    # Remote Authentication
    userremoteusermodelview = MyUserRemoteUserModelView
    authremoteuserview = MyCustomRemoteUserView

    # Account password authentication
    userdbmodelview = MyUserRemoteUserModelView
    authdbview = Myauthdbview

    # userinfo edit view
    userinfoeditview = UserInfoEditView

    # 构建启动前工作，认证
    @staticmethod
    def before_request():
        g.user = current_user

    def __init__(self, appbuilder):
        super(MyappSecurityManager, self).__init__(appbuilder)
        # 添加从header中进行认证的方式
        self.lm.header_loader(self.load_user_from_header)

    # 使用header 认证，通过username名获取用户
    # @pysnooper.snoop()
    def load_user_from_header(self, authorization_value):
        # token=None
        # if 'token' in request.headers:
        #     token = request.headers['token']
        if authorization_value:
            # username 免认证
            if len(authorization_value) < 40:
                username = authorization_value
                if username:
                    user = self.find_user(username)
                    g.user = user
                    return user
            else:  # token 认证
                encoded_jwt = authorization_value.encode('utf-8')
                from myapp import conf
                payload = jwt.decode(encoded_jwt, conf.get('JWT_PASSWORD','cube-studio'), algorithms=['HS256'])
                # if payload['iat'] > time.time():
                #     return
                # elif payload['exp'] < time.time():
                #     return
                # else:
                user = self.find_user(payload['sub'])
                g.user = user
                return user

    # 自定义登录用户
    def load_user(self, pk):
        user = self.get_user_by_id(int(pk))
        # set cookie
        return user


    # 注册security菜单栏下的子菜单和链接
    # @pysnooper.snoop()
    def register_views(self):
        if not self.appbuilder.app.config.get('FAB_ADD_SECURITY_VIEWS', True):
            return
        # Security APIs
        self.appbuilder.add_api(self.security_api)

        if self.auth_user_registration:
            if self.auth_type == AUTH_DB:
                self.registeruser_view = self.registeruserdbview()
            elif self.auth_type == AUTH_OID:
                self.registeruser_view = self.registeruseroidview()
            elif self.auth_type == AUTH_OAUTH:
                self.registeruser_view = self.registeruseroauthview()
            if self.registeruser_view:
                self.appbuilder.add_view_no_menu(self.registeruser_view)

        self.appbuilder.add_view_no_menu(self.resetpasswordview())
        self.appbuilder.add_view_no_menu(self.resetmypasswordview())
        self.appbuilder.add_view_no_menu(self.userinfoeditview())



        if self.auth_type == AUTH_DB:
            self.user_view = self.userdbmodelview
            self.auth_view = self.authdbview()

        elif self.auth_type == AUTH_LDAP:
            self.user_view = self.userldapmodelview
            self.auth_view = self.authldapview()
        elif self.auth_type == AUTH_OAUTH:
            self.user_view = self.useroauthmodelview
            self.auth_view = self.authoauthview()
        elif self.auth_type == AUTH_REMOTE_USER:
            self.user_view = self.userremoteusermodelview
            self.auth_view = self.authremoteuserview()
        else:
            self.user_view = self.useroidmodelview
            self.auth_view = self.authoidview()
            if self.auth_user_registration:
                pass
                self.registeruser_view = self.registeruseroidview()
                self.appbuilder.add_view_no_menu(self.registeruser_view)


        self.appbuilder.add_view_no_menu(self.auth_view)

        self.user_view = self.appbuilder.add_view(
            self.user_view,
            "List Users",
            icon="fa-user",
            href="/users/list/?_flt_2_username=",
            label=_("List Users"),
            category="Security",
            category_icon="fa-cogs",
            category_label=_("Security"),
        )
        role_view = self.appbuilder.add_view(
            self.rolemodelview,
            "List Roles",
            icon="fa-group",
            href="/roles/list/?_flt_2_name=",
            label=_("List Roles"),
            category="Security",
            category_icon="fa-cogs",
        )
        role_view.related_views = [self.user_view.__class__]

        if self.userstatschartview:
            self.appbuilder.add_view(
                self.userstatschartview,
                "User's Statistics",
                icon="fa-bar-chart-o",
                label=_("User's Statistics"),
                category="Security",
            )
        if self.auth_user_registration:
            self.appbuilder.add_view(
                self.registerusermodelview,
                "User's Statistics",
                icon="fa-user-plus",
                label=_("User Registrations"),
                category="Security",
            )
        self.appbuilder.menu.add_separator("Security")
        self.appbuilder.add_view(
            self.permissionmodelview,
            "Base Permissions",
            icon="fa-lock",
            label=_("Base Permissions"),
            category="Security",
        )
        self.appbuilder.add_view(
            self.viewmenumodelview,
            "Views/Menus",
            icon="fa-list-alt",
            label=_("Views/Menus"),
            category="Security",
        )
        self.appbuilder.add_view(
            self.permissionviewmodelview,
            "Permission on Views/Menus",
            icon="fa-link",
            label=_("Permission on Views/Menus"),
            category="Security",
        )


    # @pysnooper.snoop()
    def add_org_user(self,username,first_name,last_name,org,email,roles,password="",hashed_password=""):
        """
            Generic function to create user
        """
        try:
            user = self.user_model()
            user.first_name = first_name
            user.org = org
            user.last_name = last_name
            user.username = username
            user.email = email
            user.active = True
            user.roles+=roles   # 添加默认注册角色
            if password:
                user.password=password
            if hashed_password:
                user.password = generate_password_hash(hashed_password)
            self.get_session.add(user)
            self.get_session.commit()
            # 在项目组中添加用户
            try:
                from myapp.models.model_team import Project_User, Project
                public_project = self.get_session.query(Project).filter(Project.name == "public").filter(Project.type == "org").first()
                if public_project:
                    project_user = Project_User()
                    project_user.project = public_project
                    project_user.role = 'dev'
                    project_user.user_id = user.id
                    self.get_session.add(project_user)
                    self.get_session.commit()
            except Exception:
                self.get_session.rollback()

            return user
        except Exception:
            self.get_session.rollback()
            return False

        # 添加public项目组



    # 添加注册远程用户
    # @pysnooper.snoop()
    def auth_user_remote_org_user(self, username,org_name='',password='',email='',first_name='',last_name=''):
        if not username:
            return None
        # 查找用户
        from myapp import conf
        user = self.find_user(username=username)
        # 添加以组织同名的角色，同时添加上级角色

        # 如果用户不存在就注册用户
        if user is None:
            user = self.add_org_user(
                username=username,
                first_name=first_name if first_name else username,
                last_name=last_name if last_name else username,
                password=password,
                org=org_name,               # 添加组织架构
                email=username + f"@{conf.get('APP_NAME','cube-studio').replace(' ','').lower()}.com" if not email else email,
                roles=[self.find_role(self.auth_user_registration_role)] if self.find_role(self.auth_user_registration_role) else []  #  org_role   添加gamma默认角色,    组织架构角色先不自动添加
            )
        elif not user.is_active:  # 如果用户未激活不允许接入
            print(LOGMSG_WAR_SEC_LOGIN_FAILED.format(username))
            return None
        if user:
            user.org = org_name if org_name else user.org
            user.email = email if email else user.email
            user.first_name = first_name if first_name else user.first_name
            user.last_name = last_name if last_name else user.last_name

            gamma_role = self.find_role(self.auth_user_registration_role)
            if gamma_role and gamma_role not in user.roles:
                user.roles.append(gamma_role)

            # 更新用户信息
            if org_name:
                user.org = org_name    # 更新组织架构字段
                # org_role = self.add_role(org_name)
                # if org_role not in user.roles:
                #     user.roles.append(org_role)

            self.update_user_auth_stat(user)

        return user



    READ_ONLY_MODEL_VIEWS = {
        'link','Minio','Kubernetes Dashboard','Granfana','Wiki'
    }


    USER_MODEL_VIEWS = {
        "UserDBModelView",
        "UserLDAPModelView",
        "UserOAuthModelView",
        "UserOIDModelView",
        "UserRemoteUserModelView",
    }


    # 只有admin才能看到的menu
    ADMIN_ONLY_VIEW_MENUS = {
        "ResetPasswordView",
        "RoleModelView",
        "List Users",
        "List Roles",
        "UserStatsChartView",
        "Base Permissions",
        "Permission on Views/Menus",
        "Action Log",
        "Views/Menus",
        "ViewMenuModelView",
        "User's Statistics",
        "Security",
    } | USER_MODEL_VIEWS

    ALPHA_ONLY_VIEW_MENUS = {}
    # 只有admin才有的权限
    ADMIN_ONLY_PERMISSIONS = {
        "can_override_role_permissions",
        "can_override_role_permissions",
        # "can_approve",   # db owner需要授权approve 权限后才能授权
        "can_update_role",
    }

    READ_ONLY_PERMISSION = {"can_show", "can_list",'can_add'}

    ALPHA_ONLY_PERMISSIONS = {
        "muldelete"
    }

    # 用户创建menu才有的权限
    OBJECT_SPEC_PERMISSIONS = {
        "can_only_access_owned_queries",
    }

    # 所有人都可以有的基本权限
    ACCESSIBLE_PERMS = {"can_userinfo","can_request_access","can_approve"}

    # 获取用户是否有在指定视图上的指定权限名
    # @pysnooper.snoop()
    def can_access(self, permission_name, view_name):
        """Protecting from has_access failing from missing perms/view"""
        user = g.user
        if user.is_anonymous:
            return self.is_item_public(permission_name, view_name)
        return self._has_view_access(user, permission_name, view_name)



    # 获取用户具有指定权限的视图
    def user_view_menu_names(self, permission_name: str):
        from myapp import db
        base_query = (
            db.session.query(self.viewmenu_model.name)
                .join(self.permissionview_model)
                .join(self.permission_model)
                .join(assoc_permissionview_role)
                .join(self.role_model)
        )

        # 非匿名用户
        if not g.user.is_anonymous:
            # filter by user id
            view_menu_names = (
                base_query.join(assoc_user_role)
                    .join(self.user_model)
                    .filter(self.user_model.id == g.user.id)
                    .filter(self.permission_model.name == permission_name)
            ).all()
            return set([s.name for s in view_menu_names])

        # Properly treat anonymous user 匿名用户
        public_role = self.get_public_role()
        if public_role:
            # filter by public role
            view_menu_names = (
                base_query.filter(self.role_model.id == public_role.id).filter(
                    self.permission_model.name == permission_name
                )
            ).all()
            return set([s.name for s in view_menu_names])
        return set()


    # 在视图上添加权限
    def merge_perm(self, permission_name, view_menu_name):
        logging.warning(
            "This method 'merge_perm' is deprecated use add_permission_view_menu"
        )
        self.add_permission_view_menu(permission_name, view_menu_name)

    # 判断权限是否是user自定义权限
    def is_user_defined_permission(self, perm):
        return perm.permission.name in self.OBJECT_SPEC_PERMISSIONS




    # 初始化自定义角色，将对应的权限加到对应的角色上
    # @pysnooper.snoop()
    def sync_role_definitions(self):
        """Inits the Myapp application with security roles and such"""

        logging.info("Syncing role definition")

        # Creating default roles
        self.set_role("Admin", self.is_admin_pvm)
        self.set_role("Gamma", self.is_gamma_pvm)


        # commit role and view menu updates
        self.get_session.commit()
        self.clean_perms()

    # 清理权限
    def clean_perms(self):
        """FAB leaves faulty permissions that need to be cleaned up"""
        logging.info("Cleaning faulty perms")
        sesh = self.get_session
        pvms = sesh.query(ab_models.PermissionView).filter(
            or_(
                ab_models.PermissionView.permission == None,  # NOQA
                ab_models.PermissionView.view_menu == None,  # NOQA
            )
        )
        deleted_count = pvms.delete()
        sesh.commit()
        if deleted_count:
            logging.info("Deleted {} faulty permissions".format(deleted_count))

    # 为角色添加权限，pvm_check为自定义权限校验函数。这样变量权限，就能通过pvm_check函数知道时候应该把权限加到角色上
    def set_role(self, role_name, pvm_check):
        logging.info("Syncing {} perms".format(role_name))
        sesh = self.get_session
        # 获取所有的pv记录
        pvms = sesh.query(ab_models.PermissionView).all()
        # 获取权限和视图都有值的pv
        pvms = [p for p in pvms if p.permission and p.view_menu]
        # 添加或者获取role
        role = self.add_role(role_name)
        # 检查pv是否归属于该role
        role_pvms = [p for p in pvms if pvm_check(p)]
        role.permissions = role_pvms
        # 添加pv-role记录
        sesh.merge(role)
        sesh.commit()

    # 看一个权限是否是只有admin角色该有的权限
    def is_admin_only(self, pvm):
        # not readonly operations on read only model views allowed only for admins
        if (
            pvm.view_menu.name in self.READ_ONLY_MODEL_VIEWS
            and pvm.permission.name not in self.READ_ONLY_PERMISSION
        ):
            return True
        return (
            pvm.view_menu.name in self.ADMIN_ONLY_VIEW_MENUS
            or pvm.permission.name in self.ADMIN_ONLY_PERMISSIONS
        )


    # 校验权限是否是默认所有人可接受的
    def is_accessible_to_all(self, pvm):
        return pvm.permission.name in self.ACCESSIBLE_PERMS

    # 看一个权限是否是admin角色该有的权限
    def is_admin_pvm(self, pvm):
        return not self.is_user_defined_permission(pvm)

    # 看一个权限是否是gamma角色该有的权限
    def is_gamma_pvm(self, pvm):
        return not (
            self.is_user_defined_permission(pvm)
            or self.is_admin_only(pvm)
        ) or self.is_accessible_to_all(pvm)


    # 创建视图，创建权限，创建视图-权限绑定记录。
    def set_perm(self, mapper, connection, target,permission_name):  # noqa
        #
        # connection is sql
        # target is tables/db  model

        if target.perm != target.get_perm():
            link_table = target.__table__
            connection.execute(
                link_table.update()
                .where(link_table.c.id == target.id)
                .values(perm=target.get_perm())
            )

        # add to view menu if not already exists
        permission_name = permission_name
        view_menu_name = target.get_perm()
        permission = self.find_permission(permission_name)
        view_menu = self.find_view_menu(view_menu_name)
        pv = None
        # 如果权限不存存在就创建
        if not permission:
            permission_table = (
                self.permission_model.__table__  # pylint: disable=no-member
            )
            connection.execute(permission_table.insert().values(name=permission_name))
            permission = self.find_permission(permission_name)

        # 如果视图不存在就创建
        if not view_menu:
            view_menu_table = self.viewmenu_model.__table__  # pylint: disable=no-member
            connection.execute(view_menu_table.insert().values(name=view_menu_name))
            view_menu = self.find_view_menu(view_menu_name)

        # 获取是否存在 视图-权限绑定  记录
        if permission and view_menu:
            pv = (
                self.get_session.query(self.permissionview_model)
                .filter_by(permission=permission, view_menu=view_menu)
                .first()
            )

        # 如果没有视图-权限绑定 记录，就创建
        if not pv and permission and view_menu:
            permission_view_table = (
                self.permissionview_model.__table__  # pylint: disable=no-member
            )
            connection.execute(
                permission_view_table.insert().values(
                    permission_id=permission.id, view_menu_id=view_menu.id
                )
            )
            # 重新获取权限视图绑定记录
            pv = (
                self.get_session.query(self.permissionview_model)
                    .filter_by(permission=permission, view_menu=view_menu)
                    .first()
            )
        return pv



    # 根据权限，视图，添加到相关pv-role
    @classmethod
    def add_pv_role(self,permission_name,view_menu_name,session):
        permission = session.query(self.permission_model).filter_by(name=permission_name).first()
        view_menu = session.query(self.viewmenu_model).filter_by(name=view_menu_name).first()
        # 获取是否存在 视图-权限绑定  记录
        if permission and view_menu:
            pv = (
                session.query(self.permissionview_model)
                    .filter_by(permission=permission, view_menu=view_menu)
                    .first()
            )
            try:
                # 为用户所属组织架构都添加该pv
                if pv and g.user and g.user.org:
                    roles = session.query(self.role_model).all()  # 获取所有角色，自动在相应角色下面添加pv
                    if roles:
                        for role in roles:
                            if role.name in g.user.org:
                                # 为pvm-role表中添加记录
                                pv_role = session.execute(select([assoc_permissionview_role.c.id]).where(assoc_permissionview_role.c.permission_view_id==pv.id)
                                                          .where(assoc_permissionview_role.c.role_id==role.id)
                                                          .limit(1)
                                                          ).fetchall()
                                if not pv_role:
                                    session.execute(assoc_permissionview_role.insert().values(
                                        permission_view_id=pv.id, role_id=role.id
                                        )
                                    )
            except Exception as e:
                logging.error(e)



    @classmethod
    def get_join_projects_id(self,session):
        from myapp.models.model_team import Project_User
        if g.user:
            projects_id = session.query(Project_User.project_id).filter(Project_User.user_id == User.get_user_id()).all()
            projects_id = [project_id[0] for project_id in projects_id]
            return projects_id
        else:
            return []


    @classmethod
    def get_create_pipeline_ids(self,session):
        from myapp.models.model_job import Pipeline
        if g.user:
            pipeline_ids = session.query(Pipeline.id).filter(Pipeline.created_by_fk == User.get_user_id()).all()
            pipeline_ids = [pipeline_id[0] for pipeline_id in pipeline_ids]
            return pipeline_ids
        else:
            return []