init

src/api/auth_routes.py

@@ -1,40 +1,33 @@
 from fastapi import APIRouter, Depends, HTTPException, status
 from fastapi.security import OAuth2PasswordRequestForm
 from sqlalchemy.ext.asyncio import AsyncSession
-from pydantic import BaseModel, EmailStr
-from typing import Optional
+from pydantic import BaseModel
+from typing import Optional, List
 from datetime import timedelta
+from sqlalchemy import select
 
 from database.database import get_db_session
 from services.auth_service import (
     authenticate_user,
     create_access_token,
-    create_user,
-    get_user_by_username,
-    get_user_by_email,
     get_current_active_user,
-    get_current_admin_user
+    get_password_hash
 )
-from models.database import User
+from models.database import User, Role, Permission, UserRole, RolePermission
 from config.settings import settings
+from utils.logger import get_logger
 
+logger = get_logger(__name__)
 router = APIRouter(prefix="/api/auth", tags=["认证"])
 
 
-class UserCreate(BaseModel):
-    username: str
-    email: EmailStr
-    password: str
-    full_name: Optional[str] = None
-
-
 class UserResponse(BaseModel):
     id: int
     username: str
     email: str
     full_name: Optional[str]
     is_active: bool
-    is_superuser: bool
+    roles: List[str]
 
     class Config:
         from_attributes = True
@@ -51,6 +44,63 @@ class LoginRequest(BaseModel):
     password: str
 
 
+class RoleCreate(BaseModel):
+    code: str
+    name: str
+    description: Optional[str] = None
+
+
+class RoleResponse(BaseModel):
+    id: int
+    code: str
+    name: str
+    description: Optional[str]
+    is_system: bool
+    permissions: List[str]
+
+    class Config:
+        from_attributes = True
+
+
+class PermissionCreate(BaseModel):
+    code: str
+    name: str
+    module: Optional[str] = None
+    description: Optional[str] = None
+
+
+class PermissionResponse(BaseModel):
+    id: int
+    code: str
+    name: str
+    module: Optional[str]
+    description: Optional[str]
+
+    class Config:
+        from_attributes = True
+
+
+class UserCreate(BaseModel):
+    username: str
+    email: str
+    password: str
+    full_name: Optional[str] = None
+    role_ids: List[int] = []
+
+
+class UserUpdate(BaseModel):
+    email: Optional[str] = None
+    full_name: Optional[str] = None
+    is_active: Optional[bool] = None
+    role_ids: Optional[List[int]] = None
+
+
+def check_admin(user: User) -> bool:
+    if not user.is_superuser:
+        raise HTTPException(status_code=403, detail="需要管理员权限")
+    return True
+
+
 @router.post("/login", response_model=Token)
 async def login(
     form_data: OAuth2PasswordRequestForm = Depends(),
@@ -72,7 +122,14 @@ async def login(
     return Token(
         access_token=access_token,
         token_type="bearer",
-        user=UserResponse.from_orm(user)
+        user=UserResponse(
+            id=user.id,
+            username=user.username,
+            email=user.email,
+            full_name=user.full_name,
+            is_active=user.is_active,
+            roles=[r.code for r in user.roles]
+        )
     )
 
 
@@ -96,39 +153,29 @@ async def login_json(
     return Token(
         access_token=access_token,
         token_type="bearer",
-        user=UserResponse.from_orm(user)
+        user=UserResponse(
+            id=user.id,
+            username=user.username,
+            email=user.email,
+            full_name=user.full_name,
+            is_active=user.is_active,
+            roles=[r.code for r in user.roles]
+        )
     )
 
 
-@router.post("/register", response_model=UserResponse, status_code=201)
-async def register(
-    user_data: UserCreate,
-    db_session: AsyncSession = Depends(get_db_session)
-):
-    existing_user = await get_user_by_username(db_session, user_data.username)
-    if existing_user:
-        raise HTTPException(status_code=400, detail="用户名已存在")
-    
-    existing_email = await get_user_by_email(db_session, user_data.email)
-    if existing_email:
-        raise HTTPException(status_code=400, detail="邮箱已被注册")
-    
-    user = await create_user(
-        db_session=db_session,
-        username=user_data.username,
-        email=user_data.email,
-        password=user_data.password,
-        full_name=user_data.full_name
-    )
-    
-    return UserResponse.from_orm(user)
-
-
 @router.get("/me", response_model=UserResponse)
 async def get_current_user_info(
     current_user: User = Depends(get_current_active_user)
 ):
-    return UserResponse.from_orm(current_user)
+    return UserResponse(
+        id=current_user.id,
+        username=current_user.username,
+        email=current_user.email,
+        full_name=current_user.full_name,
+        is_active=current_user.is_active,
+        roles=[r.code for r in current_user.roles]
+    )
 
 
 @router.post("/logout")
@@ -136,58 +183,368 @@ async def logout():
     return {"message": "已登出"}
 
 
-@router.get("/users", response_model=list[UserResponse])
+@router.get("/users", response_model=List[UserResponse])
 async def list_users(
     db_session: AsyncSession = Depends(get_db_session),
-    admin_user: User = Depends(get_current_admin_user)
+    current_user: User = Depends(get_current_active_user)
 ):
-    from sqlalchemy import select
-    result = await db_session.execute(select(User))
+    check_admin(current_user)
+    result = await db_session.execute(
+        select(User).options(
+            select(User).options()
+        )
+    )
     users = result.scalars().all()
-    return [UserResponse.from_orm(u) for u in users]
+    return [
+        UserResponse(
+            id=u.id,
+            username=u.username,
+            email=u.email,
+            full_name=u.full_name,
+            is_active=u.is_active,
+            roles=[r.code for r in u.roles]
+        ) for u in users
+    ]
 
 
-@router.put("/users/{user_id}/toggle-active", response_model=UserResponse)
-async def toggle_user_active(
-    user_id: int,
+@router.post("/users", response_model=UserResponse, status_code=201)
+async def create_user(
+    user_data: UserCreate,
     db_session: AsyncSession = Depends(get_db_session),
-    admin_user: User = Depends(get_current_admin_user)
+    current_user: User = Depends(get_current_active_user)
 ):
-    from sqlalchemy import select
-    result = await db_session.execute(select(User).where(User.id == user_id))
-    user = result.scalar_one_or_none()
+    check_admin(current_user)
     
-    if not user:
-        raise HTTPException(status_code=404, detail="用户不存在")
+    existing = await db_session.execute(
+        select(User).where(User.username == user_data.username)
+    )
+    if existing.scalar_one_or_none():
+        raise HTTPException(status_code=400, detail="用户名已存在")
     
-    if user.id == admin_user.id:
-        raise HTTPException(status_code=400, detail="不能禁用自己的账户")
+    existing_email = await db_session.execute(
+        select(User).where(User.email == user_data.email)
+    )
+    if existing_email.scalar_one_or_none():
+        raise HTTPException(status_code=400, detail="邮箱已存在")
+    
+    user = User(
+        username=user_data.username,
+        email=user_data.email,
+        hashed_password=get_password_hash(user_data.password),
+        full_name=user_data.full_name,
+        is_active=True
+    )
+    db_session.add(user)
+    await db_session.flush()
+    
+    for role_id in user_data.role_ids:
+        user_role = UserRole(user_id=user.id, role_id=role_id)
+        db_session.add(user_role)
     
-    user.is_active = not user.is_active
     await db_session.commit()
     await db_session.refresh(user)
     
-    return UserResponse.from_orm(user)
+    logger.info(f"管理员 {current_user.username} 创建了用户 {user.username}")
+    
+    return UserResponse(
+        id=user.id,
+        username=user.username,
+        email=user.email,
+        full_name=user.full_name,
+        is_active=user.is_active,
+        roles=[r.code for r in user.roles]
+    )
 
 
-@router.put("/users/{user_id}/toggle-admin", response_model=UserResponse)
-async def toggle_user_admin(
+@router.put("/users/{user_id}", response_model=UserResponse)
+async def update_user(
     user_id: int,
+    user_data: UserUpdate,
     db_session: AsyncSession = Depends(get_db_session),
-    admin_user: User = Depends(get_current_admin_user)
+    current_user: User = Depends(get_current_active_user)
 ):
-    from sqlalchemy import select
+    check_admin(current_user)
+    
     result = await db_session.execute(select(User).where(User.id == user_id))
     user = result.scalar_one_or_none()
-    
     if not user:
         raise HTTPException(status_code=404, detail="用户不存在")
     
-    if user.id == admin_user.id:
-        raise HTTPException(status_code=400, detail="不能修改自己的管理员权限")
+    if user_data.email is not None:
+        user.email = user_data.email
+    if user_data.full_name is not None:
+        user.full_name = user_data.full_name
+    if user_data.is_active is not None:
+        user.is_active = user_data.is_active
+    
+    if user_data.role_ids is not None:
+        await db_session.execute(
+            select(UserRole).where(UserRole.user_id == user_id)
+        )
+        for ur in (await db_session.execute(select(UserRole).where(UserRole.user_id == user_id))).scalars().all():
+            await db_session.delete(ur)
+        
+        for role_id in user_data.role_ids:
+            user_role = UserRole(user_id=user.id, role_id=role_id)
+            db_session.add(user_role)
     
-    user.is_superuser = not user.is_superuser
     await db_session.commit()
     await db_session.refresh(user)
     
-    return UserResponse.from_orm(user)
+    logger.info(f"管理员 {current_user.username} 更新了用户 {user.username}")
+    
+    return UserResponse(
+        id=user.id,
+        username=user.username,
+        email=user.email,
+        full_name=user.full_name,
+        is_active=user.is_active,
+        roles=[r.code for r in user.roles]
+    )
+
+
+@router.delete("/users/{user_id}")
+async def delete_user(
+    user_id: int,
+    db_session: AsyncSession = Depends(get_db_session),
+    current_user: User = Depends(get_current_active_user)
+):
+    check_admin(current_user)
+    
+    result = await db_session.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+    if not user:
+        raise HTTPException(status_code=404, detail="用户不存在")
+    
+    if user.id == current_user.id:
+        raise HTTPException(status_code=400, detail="不能删除自己的账户")
+    
+    username = user.username
+    await db_session.delete(user)
+    await db_session.commit()
+    
+    logger.info(f"管理员 {current_user.username} 删除了用户 {username}")
+    
+    return {"message": "用户已删除"}
+
+
+@router.put("/users/{user_id}/reset-password")
+async def reset_user_password(
+    user_id: int,
+    new_password: str,
+    db_session: AsyncSession = Depends(get_db_session),
+    current_user: User = Depends(get_current_active_user)
+):
+    check_admin(current_user)
+    
+    result = await db_session.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+    if not user:
+        raise HTTPException(status_code=404, detail="用户不存在")
+    
+    user.hashed_password = get_password_hash(new_password)
+    await db_session.commit()
+    
+    logger.info(f"管理员 {current_user.username} 重置了用户 {user.username} 的密码")
+    
+    return {"message": "密码已重置"}
+
+
+@router.get("/roles", response_model=List[RoleResponse])
+async def list_roles(
+    db_session: AsyncSession = Depends(get_db_session),
+    current_user: User = Depends(get_current_active_user)
+):
+    check_admin(current_user)
+    result = await db_session.execute(select(Role))
+    roles = result.scalars().all()
+    return [
+        RoleResponse(
+            id=r.id,
+            code=r.code,
+            name=r.name,
+            description=r.description,
+            is_system=r.is_system,
+            permissions=[p.code for p in r.permissions]
+        ) for r in roles
+    ]
+
+
+@router.post("/roles", response_model=RoleResponse, status_code=201)
+async def create_role(
+    role_data: RoleCreate,
+    db_session: AsyncSession = Depends(get_db_session),
+    current_user: User = Depends(get_current_active_user)
+):
+    check_admin(current_user)
+    
+    existing = await db_session.execute(
+        select(Role).where(Role.code == role_data.code)
+    )
+    if existing.scalar_one_or_none():
+        raise HTTPException(status_code=400, detail="角色编码已存在")
+    
+    role = Role(
+        code=role_data.code,
+        name=role_data.name,
+        description=role_data.description
+    )
+    db_session.add(role)
+    await db_session.commit()
+    await db_session.refresh(role)
+    
+    logger.info(f"管理员 {current_user.username} 创建了角色 {role.code}")
+    
+    return RoleResponse(
+        id=role.id,
+        code=role.code,
+        name=role.name,
+        description=role.description,
+        is_system=role.is_system,
+        permissions=[]
+    )
+
+
+@router.put("/roles/{role_id}", response_model=RoleResponse)
+async def update_role(
+    role_id: int,
+    role_data: RoleCreate,
+    db_session: AsyncSession = Depends(get_db_session),
+    current_user: User = Depends(get_current_active_user)
+):
+    check_admin(current_user)
+    
+    result = await db_session.execute(select(Role).where(Role.id == role_id))
+    role = result.scalar_one_or_none()
+    if not role:
+        raise HTTPException(status_code=404, detail="角色不存在")
+    
+    if role.is_system:
+        raise HTTPException(status_code=400, detail="系统角色不能修改")
+    
+    role.name = role_data.name
+    role.description = role_data.description
+    await db_session.commit()
+    await db_session.refresh(role)
+    
+    return RoleResponse(
+        id=role.id,
+        code=role.code,
+        name=role.name,
+        description=role.description,
+        is_system=role.is_system,
+        permissions=[p.code for p in role.permissions]
+    )
+
+
+@router.delete("/roles/{role_id}")
+async def delete_role(
+    role_id: int,
+    db_session: AsyncSession = Depends(get_db_session),
+    current_user: User = Depends(get_current_active_user)
+):
+    check_admin(current_user)
+    
+    result = await db_session.execute(select(Role).where(Role.id == role_id))
+    role = result.scalar_one_or_none()
+    if not role:
+        raise HTTPException(status_code=404, detail="角色不存在")
+    
+    if role.is_system:
+        raise HTTPException(status_code=400, detail="系统角色不能删除")
+    
+    await db_session.delete(role)
+    await db_session.commit()
+    
+    logger.info(f"管理员 {current_user.username} 删除了角色 {role.code}")
+    
+    return {"message": "角色已删除"}
+
+
+@router.put("/roles/{role_id}/permissions")
+async def set_role_permissions(
+    role_id: int,
+    permission_ids: List[int],
+    db_session: AsyncSession = Depends(get_db_session),
+    current_user: User = Depends(get_current_active_user)
+):
+    check_admin(current_user)
+    
+    result = await db_session.execute(select(Role).where(Role.id == role_id))
+    role = result.scalar_one_or_none()
+    if not role:
+        raise HTTPException(status_code=404, detail="角色不存在")
+    
+    for rp in (await db_session.execute(select(RolePermission).where(RolePermission.role_id == role_id))).scalars().all():
+        await db_session.delete(rp)
+    
+    for perm_id in permission_ids:
+        rp = RolePermission(role_id=role_id, permission_id=perm_id)
+        db_session.add(rp)
+    
+    await db_session.commit()
+    
+    logger.info(f"管理员 {current_user.username} 更新了角色 {role.code} 的权限")
+    
+    return {"message": "权限已更新"}
+
+
+@router.get("/permissions", response_model=List[PermissionResponse])
+async def list_permissions(
+    db_session: AsyncSession = Depends(get_db_session),
+    current_user: User = Depends(get_current_active_user)
+):
+    check_admin(current_user)
+    result = await db_session.execute(select(Permission))
+    permissions = result.scalars().all()
+    return [PermissionResponse.from_orm(p) for p in permissions]
+
+
+@router.post("/permissions", response_model=PermissionResponse, status_code=201)
+async def create_permission(
+    perm_data: PermissionCreate,
+    db_session: AsyncSession = Depends(get_db_session),
+    current_user: User = Depends(get_current_active_user)
+):
+    check_admin(current_user)
+    
+    existing = await db_session.execute(
+        select(Permission).where(Permission.code == perm_data.code)
+    )
+    if existing.scalar_one_or_none():
+        raise HTTPException(status_code=400, detail="权限编码已存在")
+    
+    permission = Permission(
+        code=perm_data.code,
+        name=perm_data.name,
+        module=perm_data.module,
+        description=perm_data.description
+    )
+    db_session.add(permission)
+    await db_session.commit()
+    await db_session.refresh(permission)
+    
+    logger.info(f"管理员 {current_user.username} 创建了权限 {permission.code}")
+    
+    return PermissionResponse.from_orm(permission)
+
+
+@router.delete("/permissions/{permission_id}")
+async def delete_permission(
+    permission_id: int,
+    db_session: AsyncSession = Depends(get_db_session),
+    current_user: User = Depends(get_current_active_user)
+):
+    check_admin(current_user)
+    
+    result = await db_session.execute(select(Permission).where(Permission.id == permission_id))
+    permission = result.scalar_one_or_none()
+    if not permission:
+        raise HTTPException(status_code=404, detail="权限不存在")
+    
+    await db_session.delete(permission)
+    await db_session.commit()
+    
+    logger.info(f"管理员 {current_user.username} 删除了权限 {permission.code}")
+    
+    return {"message": "权限已删除"}

src/database/init_db.py

@@ -1,42 +1,108 @@
-# database/init_db.py
 import asyncio
-from database.database import db_manager
-from utils.logger import get_logger
 from sqlalchemy import select
-from models.database import User
+from database.database import db_manager
+from models.database import User, Role, Permission, UserRole, RolePermission
 from services.auth_service import get_password_hash
+from config.settings import settings
+from utils.logger import get_logger
 
 logger = get_logger(__name__)
 
+DEFAULT_PERMISSIONS = [
+    {"code": "view_dashboard", "name": "查看仪表盘", "module": "dashboard"},
+    {"code": "view_moldinsight", "name": "使用模具分析", "module": "moldinsight"},
+    {"code": "upload_file", "name": "上传文件", "module": "moldinsight"},
+    {"code": "view_history", "name": "查看历史记录", "module": "moldinsight"},
+    {"code": "view_inventory", "name": "查看库存", "module": "inventory"},
+    {"code": "manage_inventory", "name": "管理库存", "module": "inventory"},
+    {"code": "view_products", "name": "查看产品", "module": "inventory"},
+    {"code": "manage_products", "name": "管理产品", "module": "inventory"},
+    {"code": "view_suppliers", "name": "查看供应商", "module": "inventory"},
+    {"code": "manage_suppliers", "name": "管理供应商", "module": "inventory"},
+    {"code": "view_customers", "name": "查看客户", "module": "inventory"},
+    {"code": "manage_customers", "name": "管理客户", "module": "inventory"},
+    {"code": "view_users", "name": "查看用户", "module": "admin"},
+    {"code": "manage_users", "name": "管理用户", "module": "admin"},
+    {"code": "manage_roles", "name": "管理角色", "module": "admin"},
+]
 
-async def create_default_admin():
-    """创建默认管理员账户"""
-    try:
-        async with db_manager.session() as session:
-            result = await session.execute(
-                select(User).where(User.username == "admin")
-            )
-            existing_admin = result.scalar_one_or_none()
-            
-            if existing_admin:
-                logger.info("管理员账户已存在")
-                return
-            
-            admin = User(
-                username="admin",
-                email="admin@gemold.com",
-                hashed_password=get_password_hash("admin123"),
-                full_name="系统管理员",
-                is_active=True,
-                is_superuser=True
-            )
-            
-            session.add(admin)
-            await session.commit()
-            logger.info("默认管理员账户创建成功 (用户名: admin, 密码: admin123)")
-            
-    except Exception as e:
-        logger.error(f"创建默认管理员失败: {e}")
+DEFAULT_ROLES = [
+    {"code": "admin", "name": "管理员", "description": "系统管理员，拥有所有权限", "is_system": True, "permissions": ["view_dashboard", "view_moldinsight", "upload_file", "view_history", "view_inventory", "manage_inventory", "view_products", "manage_products", "view_suppliers", "manage_suppliers", "view_customers", "manage_customers", "view_users", "manage_users", "manage_roles"]},
+    {"code": "user", "name": "普通用户", "description": "普通用户，可使用模具分析和查看库存", "is_system": False, "permissions": ["view_dashboard", "view_moldinsight", "upload_file", "view_history", "view_inventory", "view_products", "view_suppliers", "view_customers"]},
+    {"code": "viewer", "name": "只读用户", "description": "只读用户，只能查看数据", "is_system": False, "permissions": ["view_dashboard", "view_moldinsight", "view_history", "view_inventory", "view_products", "view_suppliers", "view_customers"]},
+]
+
+
+async def init_permissions(session):
+    """初始化权限"""
+    result = await session.execute(select(Permission))
+    existing_perms = result.scalars().all()
+    
+    if existing_perms:
+        logger.info("权限已初始化")
+        return
+    
+    perm_map = {}
+    for perm_data in DEFAULT_PERMISSIONS:
+        perm = Permission(**perm_data)
+        session.add(perm)
+        await session.flush()
+        perm_map[perm.code] = perm.id
+    
+    logger.info(f"创建了 {len(DEFAULT_PERMISSIONS)} 个权限")
+    return perm_map
+
+
+async def init_roles(session, perm_map):
+    """初始化角色"""
+    result = await session.execute(select(Role))
+    existing_roles = result.scalars().all()
+    
+    if existing_roles:
+        logger.info("角色已初始化")
+        return
+    
+    for role_data in DEFAULT_ROLES:
+        perm_ids = [perm_map[code] for code in role_data.pop("permissions")]
+        role = Role(**role_data)
+        session.add(role)
+        await session.flush()
+        
+        for perm_id in perm_ids:
+            rp = RolePermission(role_id=role.id, permission_id=perm_id)
+            session.add(rp)
+    
+    logger.info(f"创建了 {len(DEFAULT_ROLES)} 个角色")
+
+
+async def create_admin_user(session):
+    """创建默认管理员"""
+    result = await session.execute(select(User).where(User.username == settings.ADMIN_USERNAME))
+    existing_admin = result.scalar_one_or_none()
+    
+    if existing_admin:
+        logger.info("管理员账户已存在")
+        return
+    
+    admin = User(
+        username=settings.ADMIN_USERNAME,
+        email=settings.ADMIN_EMAIL,
+        hashed_password=get_password_hash(settings.ADMIN_PASSWORD),
+        full_name=settings.ADMIN_FULL_NAME,
+        is_active=True
+    )
+    session.add(admin)
+    await session.flush()
+    
+    result = await session.execute(select(Role).where(Role.code == "admin"))
+    admin_role = result.scalar_one_or_none()
+    
+    if admin_role:
+        user_role = UserRole(user_id=admin.id, role_id=admin_role.id)
+        session.add(user_role)
+    
+    await session.commit()
+    logger.info(f"创建了管理员账户: {settings.ADMIN_USERNAME}")
 
 
 async def init_database():
@@ -44,13 +110,36 @@ async def init_database():
     try:
         await db_manager.connect()
         await db_manager.create_tables()
-        await create_default_admin()
+        
+        async with db_manager.session() as session:
+            perm_map = await init_permissions(session)
+            await init_roles(session, perm_map)
+            await create_admin_user(session)
+        
         logger.info("数据库初始化完成")
+        print("=" * 60)
+        print("数据库初始化成功！")
+        print("=" * 60)
+        print(f"管理员用户名: {settings.ADMIN_USERNAME}")
+        print(f"管理员密码: {settings.ADMIN_PASSWORD}")
+        print(f"管理员邮箱: {settings.ADMIN_EMAIL}")
+        print("=" * 60)
+        print("可以在 .env 文件中修改管理员配置:")
+        print("  ADMIN_USERNAME")
+        print("  ADMIN_PASSWORD")
+        print("  ADMIN_EMAIL")
+        print("  ADMIN_FULL_NAME")
+        print("=" * 60)
+        
         return True
         
     except Exception as e:
         logger.error(f"数据库初始化失败: {e}")
+        print(f"数据库初始化失败: {e}")
         return False
+    finally:
+        await db_manager.disconnect()
+
 
 if __name__ == "__main__":
-    asyncio.run(init_database())
+    asyncio.run(init_database())

src/models/database.py

@@ -17,15 +17,102 @@ class User(Base):
     hashed_password = Column(String(255), nullable=False)
     full_name = Column(String(100))
     is_active = Column(Boolean, default=True)
-    is_superuser = Column(Boolean, default=False)
     created_at = Column(DateTime, default=func.now())
     last_login = Column(DateTime, nullable=True)
     
-    # 关联关系
     stp_files = relationship("STPFile", back_populates="user")
+    user_roles = relationship("UserRole", back_populates="user", cascade="all, delete-orphan")
+    
+    @property
+    def roles(self):
+        return [ur.role for ur in self.user_roles]
+    
+    @property
+    def is_superuser(self):
+        return any(r.code == 'admin' for r in self.roles)
+    
+    def has_permission(self, permission_code: str) -> bool:
+        if self.is_superuser:
+            return True
+        for role in self.roles:
+            for perm in role.permissions:
+                if perm.code == permission_code:
+                    return True
+        return False
     
     def __repr__(self):
-        return f"<User(id={self.id}, username='{self.username}', email='{self.email}')>"
+        return f"<User(id={self.id}, username='{self.username}')>"
+
+
+class Role(Base):
+    """角色表"""
+    __tablename__ = "roles"
+    
+    id = Column(Integer, primary_key=True, index=True)
+    code = Column(String(50), unique=True, index=True, nullable=False)
+    name = Column(String(100), nullable=False)
+    description = Column(Text, nullable=True)
+    is_system = Column(Boolean, default=False)
+    created_at = Column(DateTime, default=func.now())
+    
+    user_roles = relationship("UserRole", back_populates="role", cascade="all, delete-orphan")
+    role_permissions = relationship("RolePermission", back_populates="role", cascade="all, delete-orphan")
+    
+    @property
+    def permissions(self):
+        return [rp.permission for rp in self.role_permissions]
+    
+    def __repr__(self):
+        return f"<Role(code='{self.code}', name='{self.name}')>"
+
+
+class Permission(Base):
+    """权限表"""
+    __tablename__ = "permissions"
+    
+    id = Column(Integer, primary_key=True, index=True)
+    code = Column(String(100), unique=True, index=True, nullable=False)
+    name = Column(String(100), nullable=False)
+    module = Column(String(50), nullable=True)
+    description = Column(Text, nullable=True)
+    created_at = Column(DateTime, default=func.now())
+    
+    role_permissions = relationship("RolePermission", back_populates="permission", cascade="all, delete-orphan")
+    
+    def __repr__(self):
+        return f"<Permission(code='{self.code}', name='{self.name}')>"
+
+
+class UserRole(Base):
+    """用户角色关联表"""
+    __tablename__ = "user_roles"
+    
+    id = Column(Integer, primary_key=True, index=True)
+    user_id = Column(Integer, ForeignKey("users.id"), nullable=False, index=True)
+    role_id = Column(Integer, ForeignKey("roles.id"), nullable=False, index=True)
+    created_at = Column(DateTime, default=func.now())
+    
+    user = relationship("User", back_populates="user_roles")
+    role = relationship("Role", back_populates="user_roles")
+    
+    def __repr__(self):
+        return f"<UserRole(user_id={self.user_id}, role_id={self.role_id})>"
+
+
+class RolePermission(Base):
+    """角色权限关联表"""
+    __tablename__ = "role_permissions"
+    
+    id = Column(Integer, primary_key=True, index=True)
+    role_id = Column(Integer, ForeignKey("roles.id"), nullable=False, index=True)
+    permission_id = Column(Integer, ForeignKey("permissions.id"), nullable=False, index=True)
+    created_at = Column(DateTime, default=func.now())
+    
+    role = relationship("Role", back_populates="role_permissions")
+    permission = relationship("Permission", back_populates="role_permissions")
+    
+    def __repr__(self):
+        return f"<RolePermission(role_id={self.role_id}, permission_id={self.permission_id})>"
 
 class STPFile(Base):
     """STP源文件元数据表"""