用户权限管理活动

from flask import Flask, request, jsonify

app = Flask(__name__)

# 模拟用户数据库
users = {
    'admin': {'password': 'admin123', 'roles': ['admin']},
    'user1': {'password': 'user123', 'roles': ['user']}
}

# 模拟角色权限数据库
roles = {
    'admin': ['create', 'read', 'update', 'delete'],
    'user': ['read']
}

@app.route('/login', methods=['POST'])
def login():
    username = request.json.get('username')
    password = request.json.get('password')
    user = users.get(username)
    if user and user['password'] == password:
        return jsonify({'message': 'Login successful', 'roles': user['roles']})
    return jsonify({'message': 'Invalid credentials'}), 401

@app.route('/check_permission', methods=['POST'])
def check_permission():
    username = request.json.get('username')
    action = request.json.get('action')
    user = users.get(username)
    if user:
        for role in user['roles']:
            if action in roles[role]:
                return jsonify({'message': 'Permission granted'})
    return jsonify({'message': 'Permission denied'}), 403

if __name__ == '__main__':
    app.run(debug=True)