Feature/permission NEW permission system

apps/core/migrations/0058_remove_board_comment_access_mask_and_more.py

@@ -0,0 +1,99 @@
+# Generated by Django 4.2.3 on 2024-01-10 17:16
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+from apps.core.models import BoardAccessPermissionType
+
+
+def move_board_permissions(apps, schema_editor):
+    Board = apps.get_model("core", "Board")
+    BoardPermission = apps.get_model("core", "BoardPermission")
+    Group = apps.get_model("user", "Group")
+    for board in Board.objects.all():
+        read_access_mask = board.read_access_mask
+        write_access_mask = board.write_access_mask
+        comment_access_mask = board.comment_access_mask
+
+        for group in Group.objects.all():
+            read = bool((read_access_mask & (1 << (group.group_id - 1))) > 0)
+            write = bool((write_access_mask & (1 << (group.group_id - 1))) > 0)
+            comment = bool((comment_access_mask & (1 << (group.group_id - 1))) > 0)
+
+            if read:
+                BoardPermission.objects.create(
+                    board=board,
+                    group=group,
+                    permission=BoardAccessPermissionType.READ,
+                )
+            if write:
+                BoardPermission.objects.create(
+                    board=board,
+                    group=group,
+                    permission=BoardAccessPermissionType.WRITE,
+                )
+            if comment:
+                BoardPermission.objects.create(
+                    board=board,
+                    group=group,
+                    permission=BoardAccessPermissionType.COMMENT,
+                )
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("user", "0022_group_remove_userprofile_group_and_more"),
+        ("core", "0057_alter_article_name_type_and_more"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="BoardPermission",
+            fields=[
+                (
+                    "id",
+                    models.AutoField(
+                        auto_created=True,
+                        primary_key=True,
+                        serialize=False,
+                        verbose_name="ID",
+                    ),
+                ),
+                ("permission", models.SmallIntegerField(verbose_name="permission")),
+                (
+                    "board",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        to="core.board",
+                        verbose_name="board slug",
+                    ),
+                ),
+                (
+                    "group",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        to="user.group",
+                        verbose_name="group",
+                    ),
+                ),
+            ],
+            options={
+                "verbose_name": "BoardPermission",
+                "verbose_name_plural": "BoardPermissions",
+                "unique_together": {("group", "board", "permission")},
+            },
+        ),
+        migrations.RunPython(move_board_permissions),
+        migrations.RemoveField(
+            model_name="board",
+            name="comment_access_mask",
+        ),
+        migrations.RemoveField(
+            model_name="board",
+            name="read_access_mask",
+        ),
+        migrations.RemoveField(
+            model_name="board",
+            name="write_access_mask",
+        ),
+    ]

apps/core/models/__init__.py

@@ -7,6 +7,7 @@
 from .block import *
 from .board import *
 from .board_group import *
+from .board_permission import *
 from .comment import *
 from .comment_log import *
 from .communication_article import *

apps/core/models/article.py

@@ -21,7 +21,7 @@
 )
 
 from .block import Block
-from .board import BoardAccessPermissionType, NameType
+from .board import Board, NameType
 from .comment import Comment
 from .communication_article import SchoolResponseStatus
 from .report import Report
@@ -111,7 +111,7 @@ class Article(MetaDataModel):
         db_index=True,
         default=None,
     )
-    parent_board = models.ForeignKey(
+    parent_board: Board = models.ForeignKey(
         verbose_name="게시판",
         to="core.Board",
         on_delete=models.CASCADE,
@@ -315,9 +315,7 @@ def hidden_reasons(self, user: User) -> list:
         if self.is_content_social and not user.profile.see_social:
             reasons.append(ArticleHiddenReason.SOCIAL_CONTENT)
         # 혹시 몰라 여기 두기는 하는데 여기 오기전에 Permission에서 막혀야 함
-        if not self.parent_board.group_has_access_permission(
-            BoardAccessPermissionType.READ, user.profile.group
-        ):
+        if not self.parent_board.permission_list_by_user(user).READ:
             reasons.append(ArticleHiddenReason.ACCESS_DENIED_CONTENT)
 
         return reasons

apps/core/models/board.py

@@ -1,10 +1,17 @@
-from enum import IntEnum, IntFlag, auto
+from enum import IntFlag, auto
 
 from django.db import models
 from django_extensions.db.fields import AutoSlugField
 
+from apps.user.models import Group
 from ara.db.models import MetaDataModel
+
 from .board_group import BoardGroup
+from .board_permission import (
+    DEFAULT_PERMISSIONS,
+    BoardAccessPermission,
+    BoardPermission,
+)
 
 
 class NameType(IntFlag):
@@ -13,12 +20,6 @@ class NameType(IntFlag):
     REALNAME = auto()
 
 
-class BoardAccessPermissionType(IntEnum):
-    READ = 0
-    WRITE = 1
-    COMMENT = 2
-
-
 class Board(MetaDataModel):
     slug = AutoSlugField(
         populate_from=["en_name"],
@@ -32,24 +33,6 @@ class Board(MetaDataModel):
         verbose_name="게시판 영문 이름",
         max_length=32,
     )
-    # 사용자 그룹에 대해 접근 권한을 제어하는 bit mask 입니다.
-    # access_mask & (1 << user.group) > 0 일 때 접근이 가능합니다.
-    # 사용자 그룹의 값들은 `UserGroup`을 참고하세요.
-    read_access_mask = models.SmallIntegerField(
-        # UNAUTHORIZED, EXTERNAL_ORG 제외 모든 사용자 읽기 권한 부여
-        verbose_name="읽기 권한",
-        default=0b011011110,
-    )
-    write_access_mask = models.SmallIntegerField(
-        # UNAUTHORIZED, STORE_EMPLOYEE, EXTERNAL_ORG 제외 모든 사용자 쓰기 권한 부여
-        verbose_name="쓰기 권한",
-        default=0b011011010,
-    )
-    comment_access_mask = models.SmallIntegerField(
-        # UNAUTHORIZED 제외 모든 사용자 댓글 권한 부여
-        verbose_name="댓글 권한",
-        default=0b011111110,
-    )
     is_readonly = models.BooleanField(
         verbose_name="읽기 전용 게시판",
         default=False,
@@ -113,18 +96,11 @@ class Meta(MetaDataModel.Meta):
     def __str__(self) -> str:
         return self.ko_name
 
-    def group_has_access_permission(
-        self, access_type: BoardAccessPermissionType, group: int
-    ) -> bool:
-        mask = None
-        if access_type == BoardAccessPermissionType.READ:
-            mask = self.read_access_mask
-        elif access_type == BoardAccessPermissionType.WRITE:
-            mask = self.write_access_mask
-        elif access_type == BoardAccessPermissionType.COMMENT:
-            mask = self.comment_access_mask
-        else:
-            # TODO: Handle error
-            return False
+    def permission_list_by_group(self, group: Group) -> BoardAccessPermission:
+        return BoardPermission.permission_list_by_group(group, self)
+
+    def permission_list_by_user(self, user) -> BoardAccessPermission:
+        return BoardPermission.permission_list_by_user(user, self)
 
-        return (mask & (1 << group)) > 0
+    def set_default_permission(self):
+        BoardPermission.add_permission_bulk_by_board(self, DEFAULT_PERMISSIONS)