release version 2.1

auth with ldap
UI: batch update relation
2025-09-19 19:39:17 +08:00 · 2020-04-01 21:20:47 +08:00 · 2020-04-01 20:30:44 +08:00 · 2020-04-01 11:09:41 +08:00 · 2020-03-26 17:35:26 +08:00 · 2020-03-26 17:29:53 +08:00
364 changed files with 16979 additions and 3399 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -38,6 +38,7 @@ pip-log.txt
 .tox
 nosetests.xml
 .pytest_cache
+cmdb-api/test-output

 # Translations
 *.mo
@@ -65,12 +66,11 @@ settings.py
 *.db

 # UI
-ui/node_modules
-ui/dist
+cmdb-ui/node_modules
+cmdb-ui/dist

 # Log files
-ui/npm-debug.log*
-ui/yarn-debug.log*
-ui/yarn-error.log*
-ui/yarn.lock
-ui/package-lock.json
+cmdb-ui/npm-debug.log*
+cmdb-ui/yarn-debug.log*
+cmdb-ui/yarn-error.log*
+cmdb-ui/package-lock.json
--- a/19
+++ b/19
@@ -3,7 +3,7 @@ FROM node:alpine AS builder

 LABEL description="cmdb-ui"

-COPY ui /data/apps/cmdb-ui
+COPY cmdb-ui /data/apps/cmdb-ui

 WORKDIR /data/apps/cmdb-ui

@@ -22,19 +22,22 @@ FROM python:3.7-alpine AS cmdb-api

 LABEL description="Python3.7,cmdb"

-COPY . /data/apps/cmdb
+COPY cmdb-api /data/apps/cmdb

 WORKDIR /data/apps/cmdb

-RUN apk add --no-cache tzdata gcc musl-dev libffi-dev
+RUN apk add --no-cache tzdata gcc musl-dev libffi-dev openldap-dev

 ENV TZ=Asia/Shanghai

-RUN pip install  --no-cache-dir -r docs/requirements.txt \
-    && cp ./api/settings.py.example ./api/settings.py \
-    && sed -i "s#{user}:{password}@127.0.0.1:3306/{db}#cmdb:123456@mysql:3306/cmdb#g" api/settings.py \
-    && sed -i "s#redis://127.0.0.1#redis://redis#g" api/settings.py \
-    && sed -i 's#CACHE_REDIS_HOST = "127.0.0.1"#CACHE_REDIS_HOST = "redis"#g' api/settings.py
+RUN pip install  --no-cache-dir -r requirements.txt \
+    && cp ./settings.py.example settings.py \
+    && sed -i "s#{user}:{password}@127.0.0.1:3306/{db}#cmdb:123456@mysql:3306/cmdb#g" settings.py \
+    && sed -i "s#redis://127.0.0.1#redis://redis#g" settings.py \
+    && sed -i 's#CACHE_REDIS_HOST = "127.0.0.1"#CACHE_REDIS_HOST = "redis"#g' settings.py
+
+ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.7.3/wait /wait
+RUN chmod +x /wait

 CMD ["bash", "-c", "flask run"]

--- a/8
+++ b/8
@@ -19,16 +19,16 @@ deps:
 	pipenv install --dev && \
 	pipenv run flask db-setup && \
 	pipenv run flask init-cache && \
-    cd ui && yarn install && cd ..
+    cd cmdb-ui && yarn install && cd ..

 api:
-	pipenv run flask run -h 0.0.0.0
+	cd cmdb-api && pipenv run flask run -h 0.0.0.0

 worker:
-	pipenv run celery worker -A celery_worker.celery -E -Q cmdb_async --concurrency=1
+	cd cmdb-api && pipenv run celery worker -A celery_worker.celery -E -Q cmdb_async --concurrency=1

 ui:
-	cd ui && yarn run serve
+	cd cmdb-ui && yarn run serve

 clean:
 	pipenv run flask clean
--- a/README.md
+++ b/README.md
@@ -1,6 +1,7 @@
 <h1 align="center">CMDB</h1>
 <div align="center">
-尽可能实现比较通用的运维资产数据的配置和管理
+
+As far as possible to achieve more universal configuration and management of IT resources
 </div>

 <div align="center">
@@ -12,86 +13,121 @@
 </div>


+[English](README.md) / [中文](README_cn.md)

- 在线预览: [CMDB](http://121.42.12.46:8000)
-    - username: admin
-    - password: admin
+## DEMO ONLINE
+- Preview online: [CMDB](http://121.42.12.46:8000)
+    - username: demo
+    - password: 123456
    
-> **重要提示**: `master` 分支在开发过程中可能处于 *不稳定的状态* 。
-请通过[releases](https://github.com/pycook/cmdb/releases)获取
+> **ATTENTION**: branch `master` may be unstable as the result of continued development, please pull code from  [releases](https://github.com/pycook/cmdb/releases)
+
+----
+## Overview
+
+The CMDB is a universal project that can define and manage almost all IT resources, even every resource as long as you want to, which treat all IT resources as resource objects. Objects has both attributes  and relationship.
+
+CMDB's main distinguishing features as compared to other resource systems are:
+- Define attributes of resource objects dynamically，you don't need to define all the attributes at the beginning.
+- Define relationship of resource objects dynamically and simply, even you can draw the relationship through the web.
+- Three view:
+    - Resource view: model instance data that users can subscribe
+    - Tree view: the model is hierarchical by field, shown in a tree diagram, and users can subscribe
+    - Relational view: relationships between models, shown in a tree diagram, **are configurable by the administrator**
+
+- Authority management
+
+
+## Install
+
+There are various ways of installing CMDB.
+
+### Install by Docker
+- Prepare: install docker and docker-compose
+- In directory cmdb
+    ```
+        docker-compose up -d
+    ```
+- View: [http://127.0.0.1:8000](http://127.0.0.1:8000)
+
+### Environment and dependency
+- database: mysql
+- cache: redis
+- python: python2.7, >=python3.6
+
+### Install
+- Start mysql, redis
+- Create mysql database: cmdb
+- Pull code
+    ```bash
+    git clone https://github.com/pycook/cmdb.git
+    cd cmdb
+    cp cmdb-api/settings.py.example cmdb-api/settings.py
+    ```
+    **set database in config file cmdb-api/settings.py**
+
+- Install library
+  - backend: ```cd cmdb-api && pipenv run pipenv install && cd ..```
+  - frontend: ```cd cmdb-ui && yarn install && cd ..```
+  
+- Create tables of cmdb database:
    
-Overview
----
-![基础资源视图](https://raw.githubusercontent.com/pycook/cmdb/master/ui/public/cmdb01.jpeg)
+  in **cmdb-api** directory: ```pipenv run flask db-setup && pipenv run flask init-cache```
+- Suggest step: (default:  user:demo,password:123456)

-![模型配置](https://raw.githubusercontent.com/pycook/cmdb/master/ui/public/cmdb02.jpeg)
+    ``` source docs/cmdb.sql```

-
-Docker一键快速构建
----
- 进入主目录（先安装docker环境）
-```
-    docker-compose up -d
-```
-
- 浏览器打开: [http://127.0.0.1:8000](http://127.0.0.1:8000)
-
-
-本地搭建: 环境和依赖
----
- 存储: mysql, redis
- python版本: python2.7, >=python3.6
-
-Install
----
- 启动mysql服务, redis服务
-
- 创建数据库cmdb
- 拉取代码
-```bash
-git clone https://github.com/pycook/cmdb.git
-cd cmdb
-cp api/settings.py.example api/settings.py
-```
-**设置api/settings.py里的database**
-
- 安装库
-  - 后端: ```pipenv run pipenv install```
-  - 前端: ```cd ui && yarn install && cd ..```
+- Start service
+  - backend: in **cmdb-api** directory: ```pipenv run flask run -h 0.0.0.0```
+  - frontend: in **cmdb-ui** directory: ```yarn run serve```
+  - worker: in **cmdb-api** directory: ```pipenv run celery worker -A celery_worker.celery -E -Q cmdb_async --concurrency=1```
  
- 创建数据库表 ```pipenv run flask db-setup && pipenv run flask init-cache```
- 可以将docs/cmdb.sql导入到数据库里，登录用户和密码都是:admin
-  
- 启动服务
-  - 后端: ```pipenv run flask run -h 0.0.0.0```
-  - 前端: ```cd ui && yarn run serve```
-  - worker: ```celery worker -A celery_worker.celery -E -Q cmdb_async --concurrency=1```
-  
-  - 浏览器打开:  [http://127.0.0.1:8000](http://127.0.0.1:8000)
-    - 如果是非本机访问, 要修改**ui/.env**里**VUE_APP_API_BASE_URL**里的IP地址为后端服务的ip地址
+  - homepage:  [http://127.0.0.1:8000](http://127.0.0.1:8000)
+    - if not run localhost: please change ip address(**VUE_APP_API_BASE_URL**) in config file **cmdb-ui/.env** into your backend ip address
+
+### Install by Makefile
+- Start mysql,redis
+- Create mysql database: cmdb
+- Pull code
+    ```bash
+    git clone https://github.com/pycook/cmdb.git
+    cd cmdb
+    cp cmdb-api/settings.py.example cmdb-api/settings.py
+    ```
+    **set database in config file cmdb-api/settings.py**
+
+- In cmdb directory,start in order as follows:
+    - enviroment: ```make env```
+    - start API: ```make api```
+    - start UI: ```make ui```
+    - start worker: ```make worker```
+    
+## Contributing
+
+1. Fork it
+1. Create your feature branch (`git checkout -b my-feature`)
+1. Commit your changes (`git commit -am 'Add some feature'`)
+1. Push to the branch (`git push origin my-feature`)
+1. Create new Pull Request


-Install by Makefile
----
- 启动mysql服务, redis服务
+## DEMO
+##### resource view
+![resource view](https://raw.githubusercontent.com/pycook/cmdb/master/cmdb-ui/public/cmdb-ci.jpeg) 

- 创建数据库cmdb
- 拉取代码
-```bash
-git clone https://github.com/pycook/cmdb.git
-cd cmdb
-cp api/settings.py.example api/settings.py
-```
-**设置api/settings.py里的database**
+##### tree view
+![tree view](https://raw.githubusercontent.com/pycook/cmdb/master/cmdb-ui/public/cmdb-tree.jpeg) 

- 顺序在cmdb目录下执行
-    - 环境: ```make env```
-    - 启动API: ```make api```
-    - 启动UI: ```make ui```
-    - 启动worker: ```make worker```
+##### relationship view
+![relationship view](https://raw.githubusercontent.com/pycook/cmdb/master/cmdb-ui/public/cmdb-relation.jpeg) 

+##### user subscription
+![user subscription](https://raw.githubusercontent.com/pycook/cmdb/master/cmdb-ui/public/cmdb-preference.jpeg)

----
-_**欢迎加入CMDB运维开发QQ群（336164978）**_
+##### define relationship view
+![define relationship view](https://raw.githubusercontent.com/pycook/cmdb/master/cmdb-ui/public/cmdb-relation-define.jpeg)

-![QQ群](ui/public/qr_code.jpg)
+-----
+_**Welcome to join us through QQ group（336164978）**_
+
+![QQgroup](cmdb-ui/public/qr_code.jpg)
--- a/README_cn.md
+++ b/README_cn.md
@@ -0,0 +1,112 @@
+<h1 align="center">CMDB</h1>
+<div align="center">
+尽可能实现比较通用的运维资源的配置和管理
+</div>
+
+<div align="center">
+
+[![License](https://img.shields.io/badge/License-GPLv2-brightgreen)](https://github.com/pycook/cmdb/blob/master/LICENSE)
+[![UI](https://img.shields.io/badge/UI-Ant%20Design%20Pro%20Vue-brightgreen)](https://github.com/sendya/ant-design-pro-vue) 
+[![API](https://img.shields.io/badge/API-Flask-brightgreen)](https://github.com/pallets/flask) 
+
+</div>
+
+[English](README.md) / [中文](README_cn.md)
+
+- 在线预览: [CMDB](http://121.42.12.46:8000)
+    - username: demo
+    - password: 123456
+    
+> **重要提示**: `master` 分支在开发过程中可能处于 *不稳定的状态* 。
+请通过[releases](https://github.com/pycook/cmdb/releases)获取
+    
+Overview
+----
+### 3种类型视图
+1. 资源视图 - 模型的实例数据, 用户可订阅
+2. 树形视图 - 模型按字段分级, 用树形图方式展示, 用户可订阅
+3. 关系视图 - 模型之间的关系, 用树形图方式展示, **管理员可配置**
+
+##### 资源视图
+![基础资源视图](https://raw.githubusercontent.com/pycook/cmdb/master/cmdb-ui/public/cmdb-ci.jpeg) 
+
+##### 树形视图
+![树形视图](https://raw.githubusercontent.com/pycook/cmdb/master/cmdb-ui/public/cmdb-tree.jpeg) 
+
+##### 关系视图
+![关系视图](https://raw.githubusercontent.com/pycook/cmdb/master/cmdb-ui/public/cmdb-relation.jpeg) 
+
+##### 用户订阅
+![用户订阅](https://raw.githubusercontent.com/pycook/cmdb/master/cmdb-ui/public/cmdb-preference.jpeg)
+
+##### 关系视图配置
+![关系视图配置](https://raw.githubusercontent.com/pycook/cmdb/master/cmdb-ui/public/cmdb-relation-define.jpeg)
+
+Docker一键快速构建
+----
+- 进入主目录（先安装docker环境）
+```
+    docker-compose up -d
+```
+
+- 浏览器打开: [http://127.0.0.1:8000](http://127.0.0.1:8000)
+
+
+本地搭建: 环境和依赖
+----
+- 存储: mysql, redis
+- python版本: python2.7, >=python3.6
+
+Install
+----
+- 启动mysql服务, redis服务
+
+- 创建数据库cmdb
+- 拉取代码
+```bash
+git clone https://github.com/pycook/cmdb.git
+cd cmdb
+cp cmdb-api/settings.py.example cmdb-api/settings.py
+```
+**设置cmdb-api/settings.py里的database**
+
+- 安装库
+  - 后端: ```cd cmdb-api && pipenv run pipenv install && cd ..```
+  - 前端: ```cd cmdb-ui && yarn install && cd ..```
+  
+- 创建数据库表: 进入**cmdb-api**目录执行 ```pipenv run flask db-setup && pipenv run flask init-cache```
+- 可以将docs/cmdb.sql导入到数据库里，登录用户和密码分别是:demo/123456
+  
+- 启动服务
+  - 后端: 进入**cmdb-api**目录执行 ```pipenv run flask run -h 0.0.0.0```
+  - 前端: 进入**cmdb-ui**目录执行```yarn run serve```
+  - worker: 进入**cmdb-api**目录执行 ```pipenv run celery worker -A celery_worker.celery -E -Q cmdb_async --concurrency=1```
+  
+  - 浏览器打开:  [http://127.0.0.1:8000](http://127.0.0.1:8000)
+    - 如果是非本机访问, 要修改**cmdb-ui/.env**里**VUE_APP_API_BASE_URL**里的IP地址为后端服务的ip地址
+
+
+Install by Makefile
+----
+- 启动mysql服务, redis服务
+
+- 创建数据库cmdb
+- 拉取代码
+```bash
+git clone https://github.com/pycook/cmdb.git
+cd cmdb
+cp cmdb-api/settings.py.example cmdb-api/settings.py
+```
+**设置cmdb-api/settings.py里的database**
+
+- 顺序在cmdb目录下执行
+    - 环境: ```make env```
+    - 启动API: ```make api```
+    - 启动UI: ```make ui```
+    - 启动worker: ```make worker```
+
+
+----
+_**欢迎加入CMDB运维开发QQ群（336164978）**_
+
+![QQ群](cmdb-ui/public/qr_code.jpg)
--- a/api/lib/cmdb/search/ci_relation/search.py
+++ b/api/lib/cmdb/search/ci_relation/search.py
@@ -1,77 +0,0 @@
-# -*- coding:utf-8 -*-
-
-
-import json
-
-from flask import abort
-from flask import current_app
-
-from api.extensions import rd
-from api.lib.cmdb.ci_type import CITypeRelationManager
-from api.lib.cmdb.const import REDIS_PREFIX_CI_RELATION
-from api.lib.cmdb.search.ci.db.search import Search as SearchFromDB
-from api.lib.cmdb.search.ci.es.search import Search as SearchFromES
-from api.models.cmdb import CI
-
-
-class Search(object):
-    def __init__(self, root_id, level=1, query=None, fl=None, facet_field=None, page=1, count=None, sort=None):
-        self.orig_query = query
-        self.fl = fl
-        self.facet_field = facet_field
-        self.page = page
-        self.count = count or current_app.config.get("DEFAULT_PAGE_COUNT")
-        self.sort = sort or ("ci_id" if current_app.config.get("USE_ES") else None)
-
-        self.root_id = root_id
-        self.level = int(level)
-
-    def search(self):
-        ci = CI.get_by_id(self.root_id) or abort(404, "CI <{0}> does not exist".format(self.root_id))
-        ids = [self.root_id] if not isinstance(self.root_id, list) else self.root_id
-        for _ in range(0, self.level):
-            print(rd.get(ids, REDIS_PREFIX_CI_RELATION))
-            _tmp = list(map(json.loads, filter(lambda x: x is not None, rd.get(ids, REDIS_PREFIX_CI_RELATION) or [])))
-            ids = [j for i in _tmp for j in i]
-        if not self.orig_query or ("_type:" not in self.orig_query
-                                   and "type_id:" not in self.orig_query
-                                   and "ci_type:" not in self.orig_query):
-            type_ids = CITypeRelationManager.get_child_type_ids(ci.type_id, self.level)
-            self.orig_query = "_type:({0}),{1}".format(";".join(list(map(str, type_ids))), self.orig_query)
-
-        if not ids:
-            # cis, counter, total, self.page, numfound, facet_
-            return [], {}, 0, self.page, 0, {}
-
-        if current_app.config.get("USE_ES"):
-            return SearchFromES(self.orig_query,
-                                fl=self.fl,
-                                facet_field=self.facet_field,
-                                page=self.page,
-                                count=self.count,
-                                sort=self.sort,
-                                ci_ids=ids).search()
-        else:
-            return SearchFromDB(self.orig_query,
-                                fl=self.fl,
-                                facet_field=self.facet_field,
-                                page=self.page,
-                                count=self.count,
-                                sort=self.sort,
-                                ci_ids=ids).search()
-
-    def statistics(self):
-        ids = [self.root_id] if not isinstance(self.root_id, list) else self.root_id
-        for l in range(0, self.level):
-            if l == 0:
-                _tmp = list(map(json.loads, [i or '[]' for i in rd.get(ids, REDIS_PREFIX_CI_RELATION) or []]))
-            else:
-                for idx, i in enumerate(_tmp):
-                    if i:
-                        __tmp = list(map(json.loads, filter(lambda x: x is not None,
-                                                            rd.get(i, REDIS_PREFIX_CI_RELATION) or [])))
-                        _tmp[idx] = [j for i in __tmp for j in i]
-                    else:
-                        _tmp[idx] = []
-
-        return {_id: len(_tmp[idx]) for idx, _id in enumerate(ids)}
--- a/api/lib/exception.py
+++ b/api/lib/exception.py
@@ -1,5 +0,0 @@
-# -*- coding:utf-8 -*-
-
-
-class CommitException(Exception):
-    pass
--- a/api/lib/perm/acl/acl.py
+++ b/api/lib/perm/acl/acl.py
@@ -1,139 +0,0 @@
-# -*- coding:utf-8 -*-
-
-import functools
-
-import six
-
-from flask import current_app, g, request
-from flask import session, abort
-
-from api.extensions import cache
-
-
-def get_access_token():
-    return
-
-
-class AccessTokenCache(object):
-    @classmethod
-    def get(cls):
-        if cache.get("AccessToken") is not None:
-            return cache.get("AccessToken")
-
-        res = get_access_token() or ""
-
-        cache.set("AccessToken", res, timeout=60 * 60)
-        return res
-
-    @classmethod
-    def clean(cls):
-        cache.clear("AccessToken")
-
-
-class ACLManager(object):
-    def __init__(self):
-        self.access_token = AccessTokenCache.get()
-        self.acl_session = dict(uid=session.get("uid"),
-                                token=self.access_token)
-
-        self.user_info = session["acl"] if "acl" in session else {}
-
-    def add_resource(self, name, resource_type_name=None):
-        pass
-
-    def grant_resource_to_role(self, name, role, resource_type_name=None):
-        pass
-
-    def del_resource(self, name, resource_type_name=None):
-        pass
-
-    def get_user_info(self, username):
-        return dict()
-
-    def get_resources(self, resource_type_name=None):
-        if "acl" not in session:
-            abort(405)
-        return []
-
-    def has_permission(self, resource_name, resource_type, perm):
-        if "acl" not in session:
-            abort(405)
-        return True
-
-
-def validate_permission(resources, resource_type, perm):
-    if not resources:
-        return
-
-    if current_app.config.get("USE_ACL"):
-        if g.user.username == "worker":
-            return
-
-        resources = [resources] if isinstance(resources, six.string_types) else resources
-        for resource in resources:
-            if not ACLManager().has_permission(resource, resource_type, perm):
-                return abort(403, "has no permission")
-
-
-def can_access_resources(resource_type):
-    def decorator_can_access_resources(func):
-        @functools.wraps(func)
-        def wrapper_can_access_resources(*args, **kwargs):
-            if current_app.config.get("USE_ACL"):
-                res = ACLManager().get_resources(resource_type)
-                result = {i.get("name"): i.get("permissions") for i in res}
-                if hasattr(g, "resources"):
-                    g.resources.update({resource_type: result})
-                else:
-                    g.resources = {resource_type: result}
-            return func(*args, **kwargs)
-        return wrapper_can_access_resources
-    return decorator_can_access_resources
-
-
-def has_perm(resources, resource_type, perm):
-    def decorator_has_perm(func):
-        @functools.wraps(func)
-        def wrapper_has_perm(*args, **kwargs):
-            if not resources:
-                return
-
-            if current_app.config.get("USE_ACL"):
-                validate_permission(resources, resource_type, perm)
-
-            return func(*args, **kwargs)
-        return wrapper_has_perm
-    return decorator_has_perm
-
-
-def has_perm_from_args(arg_name, resource_type, perm, callback=None):
-    def decorator_has_perm(func):
-        @functools.wraps(func)
-        def wrapper_has_perm(*args, **kwargs):
-            if not arg_name:
-                return
-            resource = request.view_args.get(arg_name) or request.values.get(arg_name)
-            if callback is not None and resource:
-                resource = callback(resource)
-
-            if current_app.config.get("USE_ACL") and resource:
-                validate_permission(resource, resource_type, perm)
-
-            return func(*args, **kwargs)
-        return wrapper_has_perm
-    return decorator_has_perm
-
-
-def role_required(role_name):
-    def decorator_role_required(func):
-        @functools.wraps(func)
-        def wrapper_role_required(*args, **kwargs):
-            if not role_name:
-                return
-
-            if current_app.config.get("USE_ACL"):
-                if role_name not in session.get("acl", {}).get("parentRoles", []):
-                    return abort(403, "Role {0} is required".format(role_name))
-            return func(*args, **kwargs)
-        return wrapper_role_required
-    return decorator_role_required
--- a/api/lib/perm/acl/const.py
+++ b/api/lib/perm/acl/const.py
@@ -1,4 +0,0 @@
-# -*- coding:utf-8 -*-
-
-
-ACL_QUEUE = "acl_async"
--- a/cmdb-api/.env
+++ b/cmdb-api/.env
@@ -4,4 +4,4 @@ FLASK_DEBUG=1
 FLASK_ENV=development
 GUNICORN_WORKERS=2
 LOG_LEVEL=debug
-SECRET_KEY='YourSecretKey'
+SECRET_KEY='<YourSecretKey>'
--- a/cmdb-api/Makefile
+++ b/cmdb-api/Makefile
@@ -0,0 +1,16 @@
+default: help
+
+test: ## test in local environment
+	pytest -s  --html=test-output/test/index.html --cov-report html:test-output/coverage --cov=api tests
+
+clean_test: ## clean test output
+	rm -f .coverage
+	rm -rf .pytest_cache
+	rm -rf test-output
+
+
+docker_test: ## test all case in docker container
+	@echo "TODO"
+
+help:
+	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' ./Makefile | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
--- a/cmdb-api/Pipfile
+++ b/cmdb-api/Pipfile
@@ -6,7 +6,7 @@ name = "pypi"
 [packages]
 # Flask
 Flask = "==1.0.3"
-Werkzeug = "==0.15.4"
+Werkzeug = ">=0.15.5"
 click = ">=5.0"
 # Api
 Flask-RESTful = "==0.3.7"
@@ -25,6 +25,7 @@ supervisor = "==4.0.3"
 Flask-Login = "==0.4.1"
 Flask-Bcrypt = "==0.7.1"
 Flask-Cors = ">=3.0.8"
+python-ldap = "==3.2.0"
 # Caching
 Flask-Caching = ">=1.0.0"
 # Environment variable parsing
@@ -41,6 +42,7 @@ toposort = ">=1.5"
 requests = ">=2.22.0"
 PyJWT = ">=1.7.1"
 elasticsearch = "==7.0.4"
+future = "==0.18.2"

 [dev-packages]
 # Testing
--- a/cmdb-api/api/init.py
+++ b/cmdb-api/api/init.py
--- a/cmdb-api/api/app.py
+++ b/cmdb-api/api/app.py
@@ -6,6 +6,7 @@ import sys
 from inspect import getmembers
 from logging.handlers import RotatingFileHandler

+from api.flask_cas import CAS
 from flask import Flask
 from flask import make_response, jsonify
 from flask.blueprints import Blueprint
@@ -23,8 +24,7 @@ from api.extensions import (
    rd,
    es
 )
-from api.flask_cas import CAS
-from api.models.acl import User
+from .models.acl import User

 HERE = os.path.abspath(os.path.dirname(__file__))
 PROJECT_ROOT = os.path.join(HERE, os.pardir)
@@ -72,7 +72,7 @@ class ReverseProxy(object):
        return self.app(environ, start_response)


-def create_app(config_object="{0}.settings".format(API_PACKAGE)):
+def create_app(config_object="settings"):
    """Create application factory, as explained here: http://flask.pocoo.org/docs/patterns/appfactories/.

    :param config_object: The configuration object to use.
--- a/cmdb-api/api/commands/init.py
+++ b/cmdb-api/api/commands/init.py
--- a/cmdb-api/api/commands/click_cmdb.py
+++ b/cmdb-api/api/commands/click_cmdb.py
@@ -10,11 +10,23 @@ from flask.cli import with_appcontext
 import api.lib.cmdb.ci
 from api.extensions import db
 from api.extensions import rd
+from api.lib.cmdb.const import PermEnum
 from api.lib.cmdb.const import REDIS_PREFIX_CI
 from api.lib.cmdb.const import REDIS_PREFIX_CI_RELATION
+from api.lib.cmdb.const import ResourceTypeEnum
+from api.lib.cmdb.const import RoleEnum
 from api.lib.cmdb.const import ValueTypeEnum
+from api.lib.exception import AbortException
+from api.lib.perm.acl.acl import ACLManager
+from api.lib.perm.acl.cache import AppCache
+from api.lib.perm.acl.resource import ResourceCRUD
+from api.lib.perm.acl.resource import ResourceTypeCRUD
+from api.lib.perm.acl.role import RoleCRUD
+from api.models.acl import ResourceType
 from api.models.cmdb import CI
 from api.models.cmdb import CIRelation
+from api.models.cmdb import CIType
+from api.models.cmdb import PreferenceRelationView


@click.command()
@@ -67,10 +79,59 @@ def init_cache():
    ci_relations = CIRelation.get_by(to_dict=False)
    relations = dict()
    for cr in ci_relations:
-        relations.setdefault(cr.first_ci_id, []).append(cr.second_ci_id)
+        relations.setdefault(cr.first_ci_id, {}).update({cr.second_ci_id: cr.second_ci.type_id})
    for i in relations:
        relations[i] = json.dumps(relations[i])
    if relations:
        rd.create_or_update(relations, REDIS_PREFIX_CI_RELATION)

    db.session.remove()
+
+
+@click.command()
+@with_appcontext
+def init_acl():
+    app_id = AppCache.get('cmdb').id
+    # 1. add resource type
+    for resource_type in ResourceTypeEnum.all():
+        try:
+            ResourceTypeCRUD.add(app_id, resource_type, '', PermEnum.all())
+        except AbortException:
+            pass
+
+    # 2. add role
+    try:
+        RoleCRUD.add_role(RoleEnum.CONFIG, app_id, True)
+    except AbortException:
+        pass
+    try:
+        RoleCRUD.add_role(RoleEnum.CMDB_READ_ALL, app_id, False)
+    except AbortException:
+        pass
+
+    # 3. add resource and grant
+    ci_types = CIType.get_by(to_dict=False)
+    type_id = ResourceType.get_by(name=ResourceTypeEnum.CI, first=True, to_dict=False).id
+    for ci_type in ci_types:
+        try:
+            ResourceCRUD.add(ci_type.name, type_id, app_id)
+        except AbortException:
+            pass
+
+        ACLManager().grant_resource_to_role(ci_type.name,
+                                            RoleEnum.CMDB_READ_ALL,
+                                            ResourceTypeEnum.CI,
+                                            [PermEnum.READ])
+
+    relation_views = PreferenceRelationView.get_by(to_dict=False)
+    type_id = ResourceType.get_by(name=ResourceTypeEnum.RELATION_VIEW, first=True, to_dict=False).id
+    for view in relation_views:
+        try:
+            ResourceCRUD.add(view.name, type_id, app_id)
+        except AbortException:
+            pass
+
+        ACLManager().grant_resource_to_role(view.name,
+                                            RoleEnum.CMDB_READ_ALL,
+                                            ResourceTypeEnum.RELATION_VIEW,
+                                            [PermEnum.READ])
--- a/cmdb-api/api/commands/common.py
+++ b/cmdb-api/api/commands/common.py
--- a/cmdb-api/api/extensions.py
+++ b/cmdb-api/api/extensions.py
--- a/cmdb-api/api/flask_cas/init.py
+++ b/cmdb-api/api/flask_cas/init.py
--- a/cmdb-api/api/flask_cas/cas_urls.py
+++ b/cmdb-api/api/flask_cas/cas_urls.py
--- a/cmdb-api/api/flask_cas/routing.py
+++ b/cmdb-api/api/flask_cas/routing.py
--- a/cmdb-api/api/lib/init.py
+++ b/cmdb-api/api/lib/init.py
--- a/cmdb-api/api/lib/cmdb/init.py
+++ b/cmdb-api/api/lib/cmdb/init.py
--- a/cmdb-api/api/lib/cmdb/attribute.py
+++ b/cmdb-api/api/lib/cmdb/attribute.py
@@ -10,6 +10,7 @@ from api.lib.cmdb.utils import ValueTypeMap
 from api.lib.decorator import kwargs_required
 from api.models.cmdb import Attribute
 from api.models.cmdb import CITypeAttribute
+from api.models.cmdb import CITypeAttributeGroupItem
 from api.models.cmdb import PreferenceShowAttributes


@@ -39,6 +40,13 @@ class AttributeManager(object):
            db.session.add(table)
        db.session.flush()

+    @staticmethod
+    def _del_choice_values(_id, value_type):
+        choice_table = ValueTypeMap.choice.get(value_type)
+
+        db.session.query(choice_table).filter(choice_table.attr_id == _id).delete()
+        db.session.flush()
+
    @classmethod
    def search_attributes(cls, name=None, alias=None, page=1, page_size=None):
        """
@@ -150,11 +158,14 @@ class AttributeManager(object):

        choice_value = kwargs.pop("choice_value", False)
        is_choice = True if choice_value else False
+        kwargs['is_choice'] = is_choice

        attr.update(flush=True, **kwargs)

        if is_choice:
            self._add_choice_values(attr.id, attr.value_type, choice_value)
+        else:
+            self._del_choice_values(attr.id, attr.value_type)

        try:
            db.session.commit()
@@ -187,4 +198,7 @@ class AttributeManager(object):
        for i in PreferenceShowAttributes.get_by(attr_id=_id, to_dict=False):
            i.soft_delete()

+        for i in CITypeAttributeGroupItem.get_by(attr_id=_id, to_dict=False):
+            i.soft_delete()
+
        return name
--- a/cmdb-api/api/lib/cmdb/cache.py
+++ b/cmdb-api/api/lib/cmdb/cache.py
@@ -107,13 +107,13 @@ class RelationTypeCache(object):
            cache.delete(cls.PREFIX_ID.format(ct.id))


-class CITypeAttributeCache(object):
+class CITypeAttributesCache(object):
    """
    key is type_id or type_name
    """

-    PREFIX_ID = "CITypeAttribute::ID::{0}"
-    PREFIX_NAME = "CITypeAttribute::Name::{0}"
+    PREFIX_ID = "CITypeAttributes::TypeID::{0}"
+    PREFIX_NAME = "CITypeAttributes::TypeName::{0}"

    @classmethod
    def get(cls, key):
@@ -146,3 +146,30 @@ class CITypeAttributeCache(object):
        if attrs is not None and ci_type:
            cache.delete(cls.PREFIX_ID.format(ci_type.id))
            cache.delete(cls.PREFIX_NAME.format(ci_type.name))
+
+
+class CITypeAttributeCache(object):
+    """
+    key is type_id  & attr_id
+    """
+
+    PREFIX_ID = "CITypeAttribute::TypeID::{0}::AttrID::{1}"
+
+    @classmethod
+    def get(cls, type_id, attr_id):
+
+        attr = cache.get(cls.PREFIX_ID.format(type_id, attr_id))
+        attr = attr or cache.get(cls.PREFIX_ID.format(type_id, attr_id))
+        if not attr:
+            attr = CITypeAttribute.get_by(type_id=type_id, attr_id=attr_id, first=True, to_dict=False)
+            if attr is not None:
+                cls.set(type_id, attr_id, attr)
+        return attr
+
+    @classmethod
+    def set(cls, type_id, attr_id, attr):
+        cache.set(cls.PREFIX_ID.format(type_id, attr_id), attr)
+
+    @classmethod
+    def clean(cls, type_id, attr_id):
+        cache.delete(cls.PREFIX_ID.format(type_id, attr_id))
--- a/cmdb-api/api/lib/cmdb/ci.py
+++ b/cmdb-api/api/lib/cmdb/ci.py
@@ -12,7 +12,6 @@ from api.extensions import db
 from api.extensions import rd
 from api.lib.cmdb.cache import AttributeCache
 from api.lib.cmdb.cache import CITypeCache
-from api.lib.cmdb.cache import RelationTypeCache
 from api.lib.cmdb.ci_type import CITypeAttributeManager
 from api.lib.cmdb.ci_type import CITypeManager
 from api.lib.cmdb.const import CMDB_QUEUE
@@ -32,6 +31,7 @@ from api.lib.utils import handle_arg_list
 from api.models.cmdb import CI
 from api.models.cmdb import CIRelation
 from api.models.cmdb import CITypeAttribute
+from api.models.cmdb import CITypeRelation
 from api.tasks.cmdb import ci_cache
 from api.tasks.cmdb import ci_delete
 from api.tasks.cmdb import ci_relation_cache
@@ -52,7 +52,7 @@ class CIManager(object):

    @staticmethod
    def confirm_ci_existed(ci_id):
-        CI.get_by_id(ci_id) or abort(404, "CI <{0}> is not existed".format(ci_id))
+        return CI.get_by_id(ci_id) or abort(404, "CI <{0}> is not existed".format(ci_id))

    @classmethod
    def get_ci_by_id(cls, ci_id, ret_key=RetKey.NAME, fields=None, need_children=True):
@@ -190,7 +190,7 @@ class CIManager(object):
        value_manager = AttributeValueManager()
        for p, v in ci_dict.items():
            try:
-                value_manager.create_or_update_attr_value(p, v, ci.id, _no_attribute_policy)
+                value_manager.create_or_update_attr_value(p, v, ci, _no_attribute_policy)
            except BadRequest as e:
                if existed is None:
                    cls.delete(ci.id)
@@ -201,11 +201,12 @@ class CIManager(object):
        return ci.id

    def update(self, ci_id, **ci_dict):
-        self.confirm_ci_existed(ci_id)
+        ci = self.confirm_ci_existed(ci_id)
+
        value_manager = AttributeValueManager()
        for p, v in ci_dict.items():
            try:
-                value_manager.create_or_update_attr_value(p, v, ci_id)
+                value_manager.create_or_update_attr_value(p, v, ci)
            except BadRequest as e:
                raise e

@@ -213,9 +214,9 @@ class CIManager(object):

    @staticmethod
    def update_unique_value(ci_id, unique_name, unique_value):
-        CI.get_by_id(ci_id) or abort(404, "CI <{0}> is not found".format(ci_id))
+        ci = CI.get_by_id(ci_id) or abort(404, "CI <{0}> is not found".format(ci_id))

-        AttributeValueManager().create_or_update_attr_value(unique_name, unique_value, ci_id)
+        AttributeValueManager().create_or_update_attr_value(unique_name, unique_value, ci)

        ci_cache.apply_async([ci_id], queue=CMDB_QUEUE)

@@ -408,10 +409,6 @@ class CIRelationManager(object):
    def __init__(self):
        pass

-    @staticmethod
-    def _get_default_relation_type():
-        return RelationTypeCache.get("contain").id  # FIXME
-
    @classmethod
    def get_children(cls, ci_id, ret_key=RetKey.NAME):
        second_cis = CIRelation.get_by(first_ci_id=ci_id, to_dict=False)
@@ -428,17 +425,15 @@ class CIRelationManager(object):
            res[ci_type.name] = children
        return res

-    def get_second_cis(self, first_ci_id, relation_type_id=None, page=1, per_page=None, **kwargs):
+    @staticmethod
+    def get_second_cis(first_ci_id, relation_type_id=None, page=1, per_page=None):
        second_cis = db.session.query(CI.id).filter(CI.deleted.is_(False)).join(
            CIRelation, CIRelation.second_ci_id == CI.id).filter(
-            CIRelation.first_ci_id == first_ci_id)
+            CIRelation.first_ci_id == first_ci_id).filter(CIRelation.deleted.is_(False))

        if relation_type_id is not None:
            second_cis = second_cis.filter(CIRelation.relation_type_id == relation_type_id)

-        if kwargs:  # TODO: special for devices
-            second_cis = self._query_wrap_for_device(second_cis, **kwargs)
-
        numfound = second_cis.count()
        if per_page != "all":
            second_cis = second_cis.offset((page - 1) * per_page).limit(per_page).all()
@@ -473,33 +468,6 @@ class CIRelationManager(object):

        return query_sql

-    def _query_wrap_for_device(self, query_sql, **kwargs):
-        _type = kwargs.pop("_type", False) or kwargs.pop("type", False) or kwargs.pop("ci_type", False)
-        if _type:
-            ci_type = CITypeCache.get(_type)
-            if ci_type is None:
-                return
-            query_sql = query_sql.filter(CI.type_id == ci_type.id)
-
-        for k, v in kwargs.items():
-            attr = AttributeCache.get(k)
-            if attr is None:
-                continue
-
-            value_table = TableMap(attr_name=k).table
-            ci_table = query_sql.subquery()
-            query_sql = db.session.query(ci_table.c.id).join(
-                value_table, value_table.ci_id == ci_table.c.id).filter(
-                value_table.attr_id == attr.id).filter(ci_table.deleted.is_(False)).filter(
-                value_table.value.ilike(v.replace("*", "%")))
-
-        # current_app.logger.debug(query_sql)
-        sort_by = kwargs.pop("sort", "")
-        if sort_by:
-            query_sql = self._sort_handler(sort_by, query_sql)
-
-        return query_sql
-
    @classmethod
    def get_first_cis(cls, second_ci, relation_type_id=None, page=1, per_page=None):
        first_cis = db.session.query(CIRelation.first_ci_id).filter(
@@ -517,25 +485,44 @@ class CIRelationManager(object):
        return numfound, len(first_ci_ids), result

    @classmethod
-    def add(cls, first_ci_id, second_ci_id, more=None, relation_type_id=None):
+    def add(cls, first_ci_id, second_ci_id, more=None, relation_type_id=None, many_to_one=False):

-        relation_type_id = relation_type_id or cls._get_default_relation_type()
-
-        CIManager.confirm_ci_existed(first_ci_id)
-        CIManager.confirm_ci_existed(second_ci_id)
+        first_ci = CIManager.confirm_ci_existed(first_ci_id)
+        second_ci = CIManager.confirm_ci_existed(second_ci_id)

        existed = CIRelation.get_by(first_ci_id=first_ci_id,
                                    second_ci_id=second_ci_id,
                                    to_dict=False,
                                    first=True)
        if existed is not None:
-            if existed.relation_type_id != relation_type_id:
+            if existed.relation_type_id != relation_type_id and relation_type_id is not None:
                existed.update(relation_type_id=relation_type_id)
+
                CIRelationHistoryManager().add(existed, OperateType.UPDATE)
        else:
+            if relation_type_id is None:
+                type_relation = CITypeRelation.get_by(parent_id=first_ci.type_id,
+                                                      child_id=second_ci.type_id,
+                                                      first=True,
+                                                      to_dict=False)
+                relation_type_id = type_relation and type_relation.relation_type_id
+                relation_type_id or abort(404, "Relation {0} <-> {1} is not found".format(
+                    first_ci.ci_type.name, second_ci.ci_type.name))
+
+            if many_to_one:
+                for item in CIRelation.get_by(second_ci_id=second_ci_id,
+                                              relation_type_id=relation_type_id,
+                                              to_dict=False):
+                    item.soft_delete()
+                    his_manager = CIRelationHistoryManager()
+                    his_manager.add(item, operate_type=OperateType.DELETE)
+
+                    ci_relation_delete.apply_async(args=(item.first_ci_id, item.second_ci_id), queue=CMDB_QUEUE)
+
            existed = CIRelation.create(first_ci_id=first_ci_id,
                                        second_ci_id=second_ci_id,
                                        relation_type_id=relation_type_id)
+
            CIRelationHistoryManager().add(existed, OperateType.ADD)

            ci_relation_cache.apply_async(args=(first_ci_id, second_ci_id), queue=CMDB_QUEUE)
@@ -548,7 +535,7 @@ class CIRelationManager(object):
    @staticmethod
    def delete(cr_id):
        cr = CIRelation.get_by_id(cr_id) or abort(404, "CIRelation <{0}> is not existed".format(cr_id))
-        cr.soft_delete()
+        cr.delete()

        his_manager = CIRelationHistoryManager()
        his_manager.add(cr, operate_type=OperateType.DELETE)
@@ -566,4 +553,26 @@ class CIRelationManager(object):

        ci_relation_delete.apply_async(args=(first_ci_id, second_ci_id), queue=CMDB_QUEUE)

-        return cls.delete(cr.cr_id)
+        return cls.delete(cr.id)
+
+    @classmethod
+    def batch_update(cls, ci_ids, parents):
+        """
+        only for many to one
+        :param ci_ids: 
+        :param parents: 
+        :return: 
+        """
+        from api.lib.cmdb.utils import TableMap
+
+        if parents is not None and isinstance(parents, dict):
+            for attr_name in parents:
+                if parents[attr_name]:
+                    attr = AttributeCache.get(attr_name)
+                    value_table = TableMap(attr_name=attr.name).table
+                    parent = value_table.get_by(attr_id=attr.id, value=parents[attr_name], first=True, to_dict=False)
+                    if not parent:
+                        return abort(404, "{0}: {1} is not found".format(attr_name, parents[attr_name]))
+                    parent_id = parent.ci_id
+                    for ci_id in ci_ids:
+                        cls.add(parent_id, ci_id, many_to_one=True)
--- a/cmdb-api/api/lib/cmdb/ci_type.py
+++ b/cmdb-api/api/lib/cmdb/ci_type.py
@@ -8,7 +8,10 @@ from api.extensions import db
 from api.lib.cmdb.attribute import AttributeManager
 from api.lib.cmdb.cache import AttributeCache
 from api.lib.cmdb.cache import CITypeAttributeCache
+from api.lib.cmdb.cache import CITypeAttributesCache
 from api.lib.cmdb.cache import CITypeCache
+from api.lib.cmdb.const import CMDB_QUEUE
+from api.lib.cmdb.value import AttributeValueManager
 from api.lib.decorator import kwargs_required
 from api.models.cmdb import CI
 from api.models.cmdb import CIType
@@ -18,8 +21,8 @@ from api.models.cmdb import CITypeAttributeGroupItem
 from api.models.cmdb import CITypeGroup
 from api.models.cmdb import CITypeGroupItem
 from api.models.cmdb import CITypeRelation
-from api.models.cmdb import PreferenceTreeView
 from api.models.cmdb import PreferenceShowAttributes
+from api.models.cmdb import PreferenceTreeView


 class CITypeManager(object):
@@ -36,7 +39,9 @@ class CITypeManager(object):

    @staticmethod
    def check_is_existed(key):
-        return CITypeCache.get(key) or abort(404, "CIType <{0}> is not existed".format(key))
+        ci_type = CITypeCache.get(key) or abort(404, "CIType <{0}> is not existed".format(key))
+
+        return CIType.get_by_id(ci_type.id)

    @staticmethod
    def get_ci_types(type_name=None):
@@ -52,16 +57,35 @@ class CITypeManager(object):
        ci_type = CITypeCache.get(_type) or abort(404, "CIType <{0}> is not found".format(_type))
        return ci_type.to_dict()

+    @staticmethod
+    def _validate_unique(type_id=None, name=None, alias=None):
+        if name is not None:
+            ci_type = CIType.get_by(name=name, first=True, to_dict=False)
+        elif alias is not None:
+            ci_type = CIType.get_by(alias=alias, first=True, to_dict=False)
+        else:
+            return
+
+        if not ci_type:
+            return
+
+        if type_id is not None and ci_type.id != type_id:
+            return abort(400, "CIType <{0}> is already existed".format(name or alias))
+
+        if type_id is None and ci_type is not None:
+            return abort(400, "CIType <{0}> is already existed".format(name or alias))
+
    @classmethod
    @kwargs_required("name")
    def add(cls, **kwargs):
        unique_key = kwargs.pop("unique_key", None)
        unique_key = AttributeCache.get(unique_key) or abort(404, "Unique key is not defined")

-        CIType.get_by(name=kwargs['name']) and abort(404, "CIType <{0}> is already existed".format(kwargs.get("name")))
-
        kwargs["alias"] = kwargs["name"] if not kwargs.get("alias") else kwargs["alias"]

+        cls._validate_unique(name=kwargs['name'])
+        cls._validate_unique(alias=kwargs['alias'])
+
        kwargs["unique_id"] = unique_key.id
        ci_type = CIType.create(**kwargs)

@@ -69,6 +93,15 @@ class CITypeManager(object):

        CITypeCache.clean(ci_type.name)

+        if current_app.config.get("USE_ACL"):
+            from api.lib.perm.acl.acl import ACLManager
+            from api.lib.cmdb.const import ResourceTypeEnum, RoleEnum, PermEnum
+            ACLManager().add_resource(ci_type.name, ResourceTypeEnum.CI)
+            ACLManager().grant_resource_to_role(ci_type.name,
+                                                RoleEnum.CMDB_READ_ALL,
+                                                ResourceTypeEnum.CI,
+                                                permissions=[PermEnum.READ])
+
        return ci_type.id

    @classmethod
@@ -76,6 +109,9 @@ class CITypeManager(object):

        ci_type = cls.check_is_existed(type_id)

+        cls._validate_unique(type_id=type_id, name=kwargs.get('name'))
+        cls._validate_unique(type_id=type_id, alias=kwargs.get('alias'))
+
        unique_key = kwargs.pop("unique_key", None)
        unique_key = AttributeCache.get(unique_key)
        if unique_key is not None:
@@ -103,7 +139,7 @@ class CITypeManager(object):
    def delete(cls, type_id):
        ci_type = cls.check_is_existed(type_id)

-        if CI.get_by(type_id=type_id, first=True, to_dict=False) is not False:
+        if CI.get_by(type_id=type_id, first=True, to_dict=False) is not None:
            return abort(400, "cannot delete, because CI instance exists")

        for item in CITypeRelation.get_by(parent_id=type_id, to_dict=False):
@@ -122,6 +158,11 @@ class CITypeManager(object):

        CITypeCache.clean(type_id)

+        if current_app.config.get("USE_ACL"):
+            from api.lib.perm.acl.acl import ACLManager
+            from api.lib.cmdb.const import ResourceTypeEnum, RoleEnum, PermEnum
+            ACLManager().del_resource(ci_type.name, ResourceTypeEnum.CI)
+

 class CITypeGroupManager(object):
    @staticmethod
@@ -187,11 +228,11 @@ class CITypeAttributeManager(object):

    @staticmethod
    def get_attr_names_by_type_id(type_id):
-        return [AttributeCache.get(attr.attr_id).name for attr in CITypeAttributeCache.get(type_id)]
+        return [AttributeCache.get(attr.attr_id).name for attr in CITypeAttributesCache.get(type_id)]

    @staticmethod
    def get_attributes_by_type_id(type_id):
-        attrs = CITypeAttributeCache.get(type_id)
+        attrs = CITypeAttributesCache.get(type_id)
        result = list()
        for attr in sorted(attrs, key=lambda x: (x.order, x.id)):
            attr_dict = AttributeManager().get_attribute(attr.attr_id)
@@ -233,7 +274,7 @@ class CITypeAttributeManager(object):
            current_app.logger.debug(attr_id)
            CITypeAttribute.create(type_id=type_id, attr_id=attr_id, **kwargs)

-        CITypeAttributeCache.clean(type_id)
+        CITypeAttributesCache.clean(type_id)

    @classmethod
    def update(cls, type_id, attributes):
@@ -255,7 +296,9 @@ class CITypeAttributeManager(object):

            existed.update(**attr)

-        CITypeAttributeCache.clean(type_id)
+            CITypeAttributeCache.clean(type_id, existed.attr_id)
+
+        CITypeAttributesCache.clean(type_id)

    @classmethod
    def delete(cls, type_id, attr_ids=None):
@@ -265,6 +308,8 @@ class CITypeAttributeManager(object):
        :param attr_ids: list
        :return: 
        """
+        from api.tasks.cmdb import ci_cache
+
        cls._check(type_id, attr_ids)

        for attr_id in attr_ids:
@@ -275,7 +320,40 @@ class CITypeAttributeManager(object):
            if existed is not None:
                existed.soft_delete()

-        CITypeAttributeCache.clean(type_id)
+                for ci in CI.get_by(type_id=type_id, to_dict=False):
+                    AttributeValueManager.delete_attr_value(attr_id, ci.id)
+
+                    ci_cache.apply_async([ci.id], queue=CMDB_QUEUE)
+
+                CITypeAttributeCache.clean(type_id, attr_id)
+
+        CITypeAttributesCache.clean(type_id)
+
+    @classmethod
+    def transfer(cls, type_id, _from, _to):
+        current_app.logger.info("[{0}] {1} -> {2}".format(type_id, _from, _to))
+        attr_id = _from.get('attr_id')
+        from_group_id = _from.get('group_id')
+        to_group_id = _to.get('group_id')
+        order = _to.get('order')
+
+        if from_group_id != to_group_id:
+            if from_group_id is not None:
+                CITypeAttributeGroupManager.delete_item(from_group_id, attr_id)
+
+            if to_group_id is not None:
+                CITypeAttributeGroupManager.add_item(to_group_id, attr_id, order)
+
+        elif from_group_id:
+            CITypeAttributeGroupManager.update_item(from_group_id, attr_id, order)
+
+        else:  # other attribute transfer
+            return abort(400, "invalid operation!!!")
+
+        CITypeAttributesCache.clean(type_id)
+
+        from api.tasks.cmdb import ci_type_attribute_order_rebuild
+        ci_type_attribute_order_rebuild.apply_async(args=(type_id,), queue=CMDB_QUEUE)


 class CITypeRelationManager(object):
@@ -413,6 +491,8 @@ class CITypeAttributeGroupManager(object):
            return abort(400, "Group <{0}> duplicate".format(name))
        if name is not None:
            group.update(name=name)
+        else:
+            name = group.name

        cls.create_or_update(group.type_id, name, attr_order, group_order)

@@ -427,3 +507,87 @@ class CITypeAttributeGroupManager(object):
            item.soft_delete()

        return group_id
+
+    @classmethod
+    def add_item(cls, group_id, attr_id, order):
+        db.session.remove()
+
+        existed = CITypeAttributeGroupItem.get_by(group_id=group_id,
+                                                  attr_id=attr_id,
+                                                  first=True,
+                                                  to_dict=False)
+        if existed is not None:
+            existed.update(order=order)
+        else:
+            CITypeAttributeGroupItem.create(group_id=group_id, attr_id=attr_id, order=order)
+
+        gt_items = db.session.query(CITypeAttributeGroupItem).filter(
+            CITypeAttributeGroupItem.deleted.is_(False)).filter(CITypeAttributeGroupItem.order > order)
+        for _item in gt_items:
+            _order = _item.order
+            _item.update(order=_order + 1)
+
+    @classmethod
+    def update_item(cls, group_id, attr_id, order):
+        db.session.remove()
+
+        existed = CITypeAttributeGroupItem.get_by(group_id=group_id,
+                                                  attr_id=attr_id,
+                                                  first=True,
+                                                  to_dict=False)
+        existed or abort(404, "Group<{0}> - Attribute<{1}> is not found".format(group_id, attr_id))
+
+        if existed.order > order:  # forward, +1
+            items = db.session.query(CITypeAttributeGroupItem).filter(
+                CITypeAttributeGroupItem.deleted.is_(False)).filter(
+                CITypeAttributeGroupItem.order >= order).filter(
+                CITypeAttributeGroupItem.order < existed.order)
+            for item in items:
+                item.update(order=item.order + 1)
+
+        elif existed.order < order:  # backward, -1
+            items = db.session.query(CITypeAttributeGroupItem).filter(
+                CITypeAttributeGroupItem.deleted.is_(False)).filter(
+                CITypeAttributeGroupItem.order > existed.order).filter(
+                CITypeAttributeGroupItem.order <= order)
+            for item in items:
+                item.update(order=item.order - 1)
+
+        existed.update(order=order)
+
+    @classmethod
+    def delete_item(cls, group_id, attr_id):
+        db.session.remove()
+
+        item = CITypeAttributeGroupItem.get_by(group_id=group_id,
+                                               attr_id=attr_id,
+                                               first=True,
+                                               to_dict=False)
+
+        if item is not None:
+            item.soft_delete()
+            order = item.order
+            gt_items = db.session.query(CITypeAttributeGroupItem).filter(
+                CITypeAttributeGroupItem.deleted.is_(False)).filter(CITypeAttributeGroupItem.order > order)
+            for _item in gt_items:
+                _order = _item.order
+                _item.update(order=_order - 1)
+
+    @classmethod
+    def transfer(cls, type_id, _from, _to):
+        current_app.logger.info("CIType[{0}] {1} -> {2}".format(type_id, _from, _to))
+        from_group = CITypeAttributeGroup.get_by_id(_from)
+        from_group or abort(404, "Group <{0}> is not found".format(_from))
+
+        to_group = CITypeAttributeGroup.get_by_id(_to)
+        to_group or abort(404, "Group <{0}> is not found".format(_to))
+
+        from_order, to_order = from_group.order, to_group.order
+
+        from_group.update(order=to_order)
+        to_group.update(order=from_order)
+
+        CITypeAttributesCache.clean(type_id)
+
+        from api.tasks.cmdb import ci_type_attribute_order_rebuild
+        ci_type_attribute_order_rebuild.apply_async(args=(type_id,), queue=CMDB_QUEUE)
--- a/cmdb-api/api/lib/cmdb/const.py
+++ b/cmdb-api/api/lib/cmdb/const.py
@@ -11,6 +11,7 @@ class ValueTypeEnum(BaseEnum):
    DATETIME = "3"
    DATE = "4"
    TIME = "5"
+    JSON = "6"


 class CIStatusEnum(BaseEnum):
@@ -37,8 +38,9 @@ class RetKey(BaseEnum):
    ALIAS = "alias"


-class ResourceType(BaseEnum):
+class ResourceTypeEnum(BaseEnum):
    CI = "CIType"
+    RELATION_VIEW = "RelationView"


 class PermEnum(BaseEnum):
@@ -50,6 +52,7 @@ class PermEnum(BaseEnum):

 class RoleEnum(BaseEnum):
    CONFIG = "admin"
+    CMDB_READ_ALL = "CMDB_READ_ALL"


 CMDB_QUEUE = "cmdb_async"
--- a/cmdb-api/api/lib/cmdb/history.py
+++ b/cmdb-api/api/lib/cmdb/history.py
@@ -1,6 +1,8 @@
 # -*- coding:utf-8 -*- 


+import json
+
 from flask import abort
 from flask import g

@@ -105,8 +107,8 @@ class AttributeHistoryManger(object):
        for attr_id, operate_type, old, new in history_list or []:
            AttributeHistory.create(attr_id=attr_id,
                                    operate_type=operate_type,
-                                    old=old,
-                                    new=new,
+                                    old=json.dumps(old) if isinstance(old, (dict, list)) else old,
+                                    new=json.dumps(new) if isinstance(new, (dict, list)) else new,
                                    ci_id=ci_id,
                                    record_id=record.id)

--- a/cmdb-api/api/lib/cmdb/preference.py
+++ b/cmdb-api/api/lib/cmdb/preference.py
@@ -1,18 +1,25 @@
 # -*- coding:utf-8 -*-

+
+import copy
 import json

 import six
 import toposort
 from flask import abort
+from flask import current_app
 from flask import g

 from api.extensions import db
 from api.lib.cmdb.attribute import AttributeManager
 from api.lib.cmdb.cache import AttributeCache
-from api.lib.cmdb.cache import CITypeAttributeCache
+from api.lib.cmdb.cache import CITypeAttributesCache
 from api.lib.cmdb.cache import CITypeCache
+from api.lib.cmdb.const import ResourceTypeEnum, RoleEnum, PermEnum
+from api.lib.exception import AbortException
+from api.lib.perm.acl.acl import ACLManager
 from api.models.cmdb import CITypeAttribute
+from api.models.cmdb import CITypeRelation
 from api.models.cmdb import PreferenceRelationView
 from api.models.cmdb import PreferenceShowAttributes
 from api.models.cmdb import PreferenceTreeView
@@ -93,7 +100,7 @@ class PreferenceManager(object):

    @staticmethod
    def create_or_update_tree_view(type_id, levels):
-        attrs = CITypeAttributeCache.get(type_id)
+        attrs = CITypeAttributesCache.get(type_id)
        for idx, i in enumerate(levels):
            for attr in attrs:
                attr = AttributeCache.get(attr.attr_id)
@@ -112,21 +119,59 @@ class PreferenceManager(object):

    @staticmethod
    def get_relation_view():
-        views = PreferenceRelationView.get_by(to_dict=True)
+        _views = PreferenceRelationView.get_by(to_dict=True)
+        views = []
+        if current_app.config.get("USE_ACL"):
+            for i in _views:
+                try:
+                    if ACLManager().has_permission(i.get('name'),
+                                                   ResourceTypeEnum.RELATION_VIEW,
+                                                   PermEnum.READ):
+                        views.append(i)
+                except AbortException:
+                    pass
+        else:
+            views = _views
+
+        view2cr_ids = dict()
        result = dict()
        name2id = list()
        for view in views:
-            result.setdefault(view['name'], []).extend(json.loads(view['cr_ids']))
+            view2cr_ids.setdefault(view['name'], []).extend(json.loads(view['cr_ids']))
            name2id.append([view['name'], view['id']])

        id2type = dict()
-        for view_name in result:
-            for i in result[view_name]:
+        for view_name in view2cr_ids:
+            for i in view2cr_ids[view_name]:
                id2type[i['parent_id']] = None
                id2type[i['child_id']] = None
+            topo = {i['child_id']: {i['parent_id']} for i in view2cr_ids[view_name]}
+            leaf = list(set(toposort.toposort_flatten(topo)) - set([j for i in topo.values() for j in i]))

-            result[view_name] = toposort.toposort_flatten(
-                {i['child_id']: {i['parent_id']} for i in result[view_name]})
+            leaf2show_types = {i: [t['child_id'] for t in CITypeRelation.get_by(parent_id=i)] for i in leaf}
+            node2show_types = copy.deepcopy(leaf2show_types)
+
+            def _find_parent(_node_id):
+                parents = topo.get(_node_id, {})
+                for parent in parents:
+                    node2show_types.setdefault(parent, []).extend(node2show_types.get(_node_id, []))
+                    _find_parent(parent)
+                if not parents:
+                    return
+
+            for l in leaf:
+                _find_parent(l)
+
+            for node_id in node2show_types:
+                node2show_types[node_id] = [CITypeCache.get(i).to_dict() for i in set(node2show_types[node_id])]
+
+            result[view_name] = dict(topo=list(map(list, toposort.toposort(topo))),
+                                     topo_flatten=list(toposort.toposort_flatten(topo)),
+                                     leaf=leaf,
+                                     leaf2show_types=leaf2show_types,
+                                     node2show_types=node2show_types,
+                                     show_types=[CITypeCache.get(j).to_dict()
+                                                 for i in leaf2show_types.values() for j in i])

        for type_id in id2type:
            id2type[type_id] = CITypeCache.get(type_id).to_dict()
@@ -135,14 +180,29 @@ class PreferenceManager(object):

    @classmethod
    def create_or_update_relation_view(cls, name, cr_ids):
+        if not cr_ids:
+            return abort(400, "Node must be selected")
+
        existed = PreferenceRelationView.get_by(name=name, to_dict=False, first=True)
+        current_app.logger.debug(existed)
        if existed is None:
            PreferenceRelationView.create(name=name, cr_ids=json.dumps(cr_ids))

+            if current_app.config.get("USE_ACL"):
+                ACLManager().add_resource(name, ResourceTypeEnum.RELATION_VIEW)
+                ACLManager().grant_resource_to_role(name,
+                                                    RoleEnum.CMDB_READ_ALL,
+                                                    ResourceTypeEnum.RELATION_VIEW,
+                                                    permissions=[PermEnum.READ])
+
        return cls.get_relation_view()

    @staticmethod
    def delete_relation_view(name):
        for existed in PreferenceRelationView.get_by(name=name, to_dict=False):
            existed.soft_delete()
+
+        if current_app.config.get("USE_ACL"):
+            ACLManager().del_resource(name, ResourceTypeEnum.RELATION_VIEW)
+
        return name
--- a/cmdb-api/api/lib/cmdb/relation_type.py
+++ b/cmdb-api/api/lib/cmdb/relation_type.py
--- a/cmdb-api/api/lib/cmdb/search/init.py
+++ b/cmdb-api/api/lib/cmdb/search/init.py
--- a/cmdb-api/api/lib/cmdb/search/ci/init.py
+++ b/cmdb-api/api/lib/cmdb/search/ci/init.py
--- a/cmdb-api/api/lib/cmdb/search/ci/db/init.py
+++ b/cmdb-api/api/lib/cmdb/search/ci/db/init.py
--- a/cmdb-api/api/lib/cmdb/search/ci/db/query_sql.py
+++ b/cmdb-api/api/lib/cmdb/search/ci/db/query_sql.py
--- a/cmdb-api/api/lib/cmdb/search/ci/db/search.py
+++ b/cmdb-api/api/lib/cmdb/search/ci/db/search.py
--- a/cmdb-api/api/lib/cmdb/search/ci/es/init.py
+++ b/cmdb-api/api/lib/cmdb/search/ci/es/init.py
--- a/cmdb-api/api/lib/cmdb/search/ci/es/search.py
+++ b/cmdb-api/api/lib/cmdb/search/ci/es/search.py
@@ -3,6 +3,7 @@

 from __future__ import unicode_literals

+import six
 from flask import current_app

 from api.extensions import es
@@ -73,6 +74,10 @@ class Search(object):
    def _in_query_handle(self, attr, v):
        terms = v[1:-1].split(";")
        operator = "|"
+        if attr in ('_type', 'ci_type', 'type_id') and terms and terms[0].isdigit():
+            attr = "type_id"
+            terms = map(int, terms)
+        current_app.logger.warning(terms)
        for term in terms:
            self._operator2query(operator).append({
                "term": {
@@ -125,7 +130,7 @@ class Search(object):
        if "*" in v:
            self._operator2query(operator).append({
                "wildcard": {
-                    attr: v
+                    attr: v.lower() if isinstance(v, six.string_types) else v
                }
            })
        else:
@@ -133,7 +138,7 @@ class Search(object):
                attr = "type_id"
            self._operator2query(operator).append({
                "term": {
-                    attr: v
+                    attr: v.lower() if isinstance(v, six.string_types) else v
                }
            })

@@ -164,6 +169,7 @@ class Search(object):
    def _query_build_raw(self):

        queries = handle_arg_list(self.orig_query)
+
        current_app.logger.debug(queries)

        self.__query_build_by_field(queries)
--- a/cmdb-api/api/lib/cmdb/search/ci_relation/init.py
+++ b/cmdb-api/api/lib/cmdb/search/ci_relation/init.py
--- a/cmdb-api/api/lib/cmdb/search/ci_relation/search.py
+++ b/cmdb-api/api/lib/cmdb/search/ci_relation/search.py
@@ -0,0 +1,109 @@
+# -*- coding:utf-8 -*-
+
+
+import json
+
+from flask import abort
+from flask import current_app
+
+from api.extensions import rd
+from api.lib.cmdb.ci_type import CITypeRelationManager
+from api.lib.cmdb.const import REDIS_PREFIX_CI_RELATION
+from api.lib.cmdb.search.ci.db.search import Search as SearchFromDB
+from api.lib.cmdb.search.ci.es.search import Search as SearchFromES
+from api.models.cmdb import CI
+
+
+class Search(object):
+    def __init__(self, root_id,
+                 level=None,
+                 query=None,
+                 fl=None,
+                 facet_field=None,
+                 page=1,
+                 count=None,
+                 sort=None):
+        self.orig_query = query
+        self.fl = fl
+        self.facet_field = facet_field
+        self.page = page
+        self.count = count or current_app.config.get("DEFAULT_PAGE_COUNT")
+        self.sort = sort or ("ci_id" if current_app.config.get("USE_ES") else None)
+
+        self.root_id = root_id
+        self.level = level
+
+    def search(self):
+        ids = [self.root_id] if not isinstance(self.root_id, list) else self.root_id
+        cis = [CI.get_by_id(_id) or abort(404, "CI <{0}> does not exist".format(_id)) for _id in ids]
+
+        merge_ids = []
+        for level in self.level:
+            ids = [self.root_id] if not isinstance(self.root_id, list) else self.root_id
+            for _ in range(0, level):
+                _tmp = list(map(lambda x: list(json.loads(x).keys()),
+                                filter(lambda x: x is not None, rd.get(ids, REDIS_PREFIX_CI_RELATION) or [])))
+                ids = [j for i in _tmp for j in i]
+
+            merge_ids.extend(ids)
+
+        if not self.orig_query or ("_type:" not in self.orig_query
+                                   and "type_id:" not in self.orig_query
+                                   and "ci_type:" not in self.orig_query):
+            type_ids = []
+            for level in self.level:
+                for ci in cis:
+                    type_ids.extend(CITypeRelationManager.get_child_type_ids(ci.type_id, level))
+            type_ids = list(set(type_ids))
+            if self.orig_query:
+                self.orig_query = "_type:({0}),{1}".format(";".join(list(map(str, type_ids))), self.orig_query)
+            else:
+                self.orig_query = "_type:({0})".format(";".join(list(map(str, type_ids))))
+
+        if not merge_ids:
+            # cis, counter, total, self.page, numfound, facet_
+            return [], {}, 0, self.page, 0, {}
+
+        if current_app.config.get("USE_ES"):
+            return SearchFromES(self.orig_query,
+                                fl=self.fl,
+                                facet_field=self.facet_field,
+                                page=self.page,
+                                count=self.count,
+                                sort=self.sort,
+                                ci_ids=merge_ids).search()
+        else:
+            return SearchFromDB(self.orig_query,
+                                fl=self.fl,
+                                facet_field=self.facet_field,
+                                page=self.page,
+                                count=self.count,
+                                sort=self.sort,
+                                ci_ids=merge_ids).search()
+
+    def statistics(self, type_ids):
+        _tmp = []
+        ids = [self.root_id] if not isinstance(self.root_id, list) else self.root_id
+        for l in range(0, int(self.level)):
+            if not l:
+                _tmp = list(map(lambda x: list(json.loads(x).keys()),
+                                [i or '{}' for i in rd.get(ids, REDIS_PREFIX_CI_RELATION) or []]))
+            else:
+                for idx, i in enumerate(_tmp):
+                    if i:
+                        if type_ids and l == self.level - 1:
+                            __tmp = list(
+                                map(lambda x: list({_id: 1 for _id, type_id in json.loads(x).items()
+                                                    if type_id in type_ids}.keys()),
+                                    filter(lambda x: x is not None,
+                                           rd.get(i, REDIS_PREFIX_CI_RELATION) or [])))
+                        else:
+
+                            __tmp = list(map(lambda x: list(json.loads(x).keys()),
+                                             filter(lambda x: x is not None,
+                                                    rd.get(i, REDIS_PREFIX_CI_RELATION) or [])))
+                        _tmp[idx] = [j for i in __tmp for j in i]
+                    else:
+                        _tmp[idx] = []
+
+        return {_id: len(_tmp[idx]) for idx, _id in enumerate(ids)}
--- a/cmdb-api/api/lib/cmdb/utils.py
+++ b/cmdb-api/api/lib/cmdb/utils.py
@@ -3,6 +3,7 @@
 from __future__ import unicode_literals

 import datetime
+import json

 import six
 from markupsafe import escape
@@ -33,15 +34,17 @@ class ValueTypeMap(object):
        ValueTypeEnum.TIME: lambda x: escape(x).encode('utf-8').decode('utf-8'),
        ValueTypeEnum.DATETIME: str2datetime,
        ValueTypeEnum.DATE: str2datetime,
+        ValueTypeEnum.JSON: lambda x: json.loads(x) if isinstance(x, six.string_types) and x else x,
    }

    serialize = {
        ValueTypeEnum.INT: int,
        ValueTypeEnum.FLOAT: float,
-        ValueTypeEnum.TEXT: lambda x: x if isinstance(x, six.text_type) else str(x),
-        ValueTypeEnum.TIME: lambda x: x if isinstance(x, six.text_type) else str(x),
+        ValueTypeEnum.TEXT: lambda x: x if isinstance(x, six.string_types) else str(x),
+        ValueTypeEnum.TIME: lambda x: x if isinstance(x, six.string_types) else str(x),
        ValueTypeEnum.DATE: lambda x: x.strftime("%Y-%m-%d"),
        ValueTypeEnum.DATETIME: lambda x: x.strftime("%Y-%m-%d %H:%M:%S"),
+        ValueTypeEnum.JSON: lambda x: json.loads(x) if isinstance(x, six.string_types) and x else x,
    }

    serialize2 = {
@@ -51,6 +54,7 @@ class ValueTypeMap(object):
        ValueTypeEnum.TIME: lambda x: x.decode() if not isinstance(x, six.string_types) else x,
        ValueTypeEnum.DATE: lambda x: x.decode() if not isinstance(x, six.string_types) else x,
        ValueTypeEnum.DATETIME: lambda x: x.decode() if not isinstance(x, six.string_types) else x,
+        ValueTypeEnum.JSON: lambda x: json.loads(x) if isinstance(x, six.string_types) and x else x,
    }

    choice = {
@@ -66,12 +70,14 @@ class ValueTypeMap(object):
        ValueTypeEnum.DATE: model.CIValueDateTime,
        ValueTypeEnum.TIME: model.CIValueText,
        ValueTypeEnum.FLOAT: model.CIValueFloat,
+        ValueTypeEnum.JSON: model.CIValueJson,
        'index_{0}'.format(ValueTypeEnum.INT): model.CIIndexValueInteger,
        'index_{0}'.format(ValueTypeEnum.TEXT): model.CIIndexValueText,
        'index_{0}'.format(ValueTypeEnum.DATETIME): model.CIIndexValueDateTime,
        'index_{0}'.format(ValueTypeEnum.DATE): model.CIIndexValueDateTime,
        'index_{0}'.format(ValueTypeEnum.TIME): model.CIIndexValueText,
        'index_{0}'.format(ValueTypeEnum.FLOAT): model.CIIndexValueFloat,
+        'index_{0}'.format(ValueTypeEnum.JSON): model.CIValueJson,
    }

    table_name = {
@@ -81,12 +87,14 @@ class ValueTypeMap(object):
        ValueTypeEnum.DATE: 'c_value_datetime',
        ValueTypeEnum.TIME: 'c_value_texts',
        ValueTypeEnum.FLOAT: 'c_value_floats',
+        ValueTypeEnum.JSON: 'c_value_json',
        'index_{0}'.format(ValueTypeEnum.INT): 'c_value_index_integers',
        'index_{0}'.format(ValueTypeEnum.TEXT): 'c_value_index_texts',
        'index_{0}'.format(ValueTypeEnum.DATETIME): 'c_value_index_datetime',
        'index_{0}'.format(ValueTypeEnum.DATE): 'c_value_index_datetime',
        'index_{0}'.format(ValueTypeEnum.TIME): 'c_value_index_texts',
        'index_{0}'.format(ValueTypeEnum.FLOAT): 'c_value_index_floats',
+        'index_{0}'.format(ValueTypeEnum.JSON): 'c_value_json',
    }

    es_type = {
@@ -95,7 +103,8 @@ class ValueTypeMap(object):
        ValueTypeEnum.DATETIME: 'text',
        ValueTypeEnum.DATE: 'text',
        ValueTypeEnum.TIME: 'text',
-        ValueTypeEnum.FLOAT: 'float'
+        ValueTypeEnum.FLOAT: 'float',
+        ValueTypeEnum.JSON: 'object'
    }


--- a/cmdb-api/api/lib/cmdb/value.py
+++ b/cmdb-api/api/lib/cmdb/value.py
@@ -8,6 +8,7 @@ from flask import abort
 from api.extensions import db
 from api.lib.cmdb.attribute import AttributeManager
 from api.lib.cmdb.cache import AttributeCache
+from api.lib.cmdb.cache import CITypeAttributeCache
 from api.lib.cmdb.const import ExistPolicy
 from api.lib.cmdb.const import OperateType
 from api.lib.cmdb.const import ValueTypeEnum
@@ -78,23 +79,31 @@ class AttributeValueManager(object):
            return abort(400, "attribute value <{0}> is invalid".format(value))

    @staticmethod
-    def __check_is_choice(attr_id, value_type, value):
-        choice_values = AttributeManager.get_choice_values(attr_id, value_type)
+    def __check_is_choice(attr, value_type, value):
+        choice_values = AttributeManager.get_choice_values(attr.id, value_type)
        if value not in choice_values:
            return abort(400, "{0} does not existed in choice values".format(value))

    @staticmethod
-    def __check_is_unique(value_table, attr_id, ci_id, value):
+    def __check_is_unique(value_table, attr, ci_id, value):
        existed = db.session.query(value_table.attr_id).filter(
-            value_table.attr_id == attr_id).filter(value_table.deleted.is_(False)).filter(
+            value_table.attr_id == attr.id).filter(value_table.deleted.is_(False)).filter(
            value_table.value == value).filter(value_table.ci_id != ci_id).first()
-        existed and abort(400, "attribute <{0}> value {1} must be unique".format(attr_id, value))
+        existed and abort(400, "attribute <{0}> value {1} must be unique".format(attr.alias, value))

-    def _validate(self, attr, value, value_table, ci_id):
+    @staticmethod
+    def __check_is_required(type_id, attr, value):
+        type_attr = CITypeAttributeCache.get(type_id, attr.id)
+        if type_attr and type_attr.is_required and not value and value != 0:
+            return abort(400, "attribute <{0}> value is required".format(attr.alias))
+
+    def _validate(self, attr, value, value_table, ci):
        v = self.__deserialize_value(attr.value_type, value)

-        attr.is_choice and value and self.__check_is_choice(attr.id, attr.value_type, v)
-        attr.is_unique and self.__check_is_unique(value_table, attr.id, ci_id, v)
+        attr.is_choice and value and self.__check_is_choice(attr, attr.value_type, v)
+        attr.is_unique and self.__check_is_unique(value_table, attr, ci.id, v)
+
+        self.__check_is_required(ci.type_id, attr, v)

        return v

@@ -102,12 +111,12 @@ class AttributeValueManager(object):
    def _write_change(ci_id, attr_id, operate_type, old, new):
        AttributeHistoryManger.add(ci_id, [(attr_id, operate_type, old, new)])

-    def create_or_update_attr_value(self, key, value, ci_id, _no_attribute_policy=ExistPolicy.IGNORE):
+    def create_or_update_attr_value(self, key, value, ci, _no_attribute_policy=ExistPolicy.IGNORE):
        """
        add or update attribute value, then write history
        :param key: id, name or alias
        :param value:
-        :param ci_id:
+        :param ci: instance object
        :param _no_attribute_policy: ignore or reject
        :return:
        """
@@ -119,29 +128,49 @@ class AttributeValueManager(object):
                return abort(400, 'attribute {0} does not exist'.format(key))

        value_table = TableMap(attr_name=attr.name).table
-        existed_attr = value_table.get_by(attr_id=attr.id,
-                                          ci_id=ci_id,
-                                          first=True,
-                                          to_dict=False)
-        existed_value = existed_attr and existed_attr.value
-        operate_type = OperateType.ADD if existed_attr is None else OperateType.UPDATE

-        value_list = handle_arg_list(value) if attr.is_list else [value]
-        if not isinstance(value, list):
-            value_list = [value]
+        if attr.is_list:
+            value_list = [self._validate(attr, i, value_table, ci) for i in handle_arg_list(value)]
+            if not value_list:
+                self.__check_is_required(ci.type_id, attr, '')

-        for v in value_list:
-            v = self._validate(attr, v, value_table, ci_id)
-            if not v and attr.value_type != ValueTypeEnum.TEXT:
-                v = None
+            existed_attrs = value_table.get_by(attr_id=attr.id,
+                                               ci_id=ci.id,
+                                               to_dict=False)
+            existed_values = [i.value for i in existed_attrs]
+            added = set(value_list) - set(existed_values)
+            deleted = set(existed_values) - set(value_list)
+            for v in added:
+                value_table.create(ci_id=ci.id, attr_id=attr.id, value=v)
+                self._write_change(ci.id, attr.id, OperateType.ADD, None, v)

-            if operate_type == OperateType.ADD:
-                if v is not None:
-                    value_table.create(ci_id=ci_id, attr_id=attr.id, value=v)
-                    self._write_change(ci_id, attr.id, operate_type, None, v)
-            elif existed_attr.value != v:
-                if v is not None:
-                    existed_attr.update(value=v)
-                else:
+            for v in deleted:
+                existed_attr = existed_attrs[existed_values.index(v)]
+                existed_attr.delete()
+                self._write_change(ci.id, attr.id, OperateType.DELETE, v, None)
+        else:
+            value = self._validate(attr, value, value_table, ci)
+            existed_attr = value_table.get_by(attr_id=attr.id,
+                                              ci_id=ci.id,
+                                              first=True,
+                                              to_dict=False)
+            existed_value = existed_attr and existed_attr.value
+            if existed_value is None:
+                value_table.create(ci_id=ci.id, attr_id=attr.id, value=value)
+
+                self._write_change(ci.id, attr.id, OperateType.ADD, None, value)
+            else:
+                if not value and attr.value_type != ValueTypeEnum.TEXT:
                    existed_attr.delete()
-                self._write_change(ci_id, attr.id, operate_type, existed_value, v)
+                else:
+                    existed_attr.update(value=value)
+
+                self._write_change(ci.id, attr.id, OperateType.UPDATE, existed_value, value)
+
+    @staticmethod
+    def delete_attr_value(attr_id, ci_id):
+        attr = AttributeCache.get(attr_id)
+        if attr is not None:
+            value_table = TableMap(attr_name=attr.name).table
+            for item in value_table.get_by(attr_id=attr.id, ci_id=ci_id, to_dict=False):
+                item.delete()
--- a/cmdb-api/api/lib/database.py
+++ b/cmdb-api/api/lib/database.py
@@ -25,6 +25,9 @@ class FormatMixin(object):


 class CRUDMixin(FormatMixin):
+    def __init__(self, **kwargs):
+        super(CRUDMixin, self).__init__(**kwargs)
+
    @classmethod
    def create(cls, flush=False, **kwargs):
        return cls(**kwargs).save(flush=flush)
--- a/cmdb-api/api/lib/decorator.py
+++ b/cmdb-api/api/lib/decorator.py
--- a/cmdb-api/api/lib/exception.py
+++ b/cmdb-api/api/lib/exception.py
@@ -0,0 +1,11 @@
+# -*- coding:utf-8 -*-
+
+
+from werkzeug.exceptions import NotFound, Forbidden, BadRequest
+
+
+class CommitException(Exception):
+    pass
+
+
+AbortException = (NotFound, Forbidden, BadRequest)
--- a/cmdb-api/api/lib/http_cli.py
+++ b/cmdb-api/api/lib/http_cli.py
@@ -12,7 +12,7 @@ from future.moves.urllib.parse import urlparse


 def build_api_key(path, params):
-    g.user is not None or abort(403, "您得登陆才能进行该操作")
+    g.user is not None or abort(403, "You have to login to do this")
    key = g.user.key
    secret = g.user.secret
    values = "".join([str(params[k]) for k in sorted(params.keys())
--- a/cmdb-api/api/lib/mail.py
+++ b/cmdb-api/api/lib/mail.py
--- a/cmdb-api/api/lib/perm/init.py
+++ b/cmdb-api/api/lib/perm/init.py
--- a/cmdb-api/api/lib/perm/acl/init.py
+++ b/cmdb-api/api/lib/perm/acl/init.py
--- a/cmdb-api/api/lib/perm/acl/acl.py
+++ b/cmdb-api/api/lib/perm/acl/acl.py
@@ -0,0 +1,174 @@
+# -*- coding:utf-8 -*-
+
+import functools
+
+import six
+from flask import current_app, g, request
+from flask import session, abort
+
+from api.lib.cmdb.const import ResourceTypeEnum as CmdbResourceType
+from api.lib.cmdb.const import RoleEnum
+from api.lib.perm.acl.cache import AppCache
+from api.lib.perm.acl.cache import RoleCache
+from api.lib.perm.acl.cache import UserCache
+from api.lib.perm.acl.permission import PermissionCRUD
+from api.lib.perm.acl.resource import ResourceCRUD
+from api.lib.perm.acl.role import RoleCRUD
+from api.models.acl import Resource
+from api.models.acl import ResourceGroup
+from api.models.acl import ResourceType
+from api.models.acl import Role
+
+CMDB_RESOURCE_TYPES = CmdbResourceType.all()
+
+
+class ACLManager(object):
+    def __init__(self):
+        self.app_id = AppCache.get('cmdb')
+        if not self.app_id:
+            raise Exception("cmdb not in acl apps")
+        self.app_id = self.app_id.id
+
+    def _get_resource(self, name, resource_type_name):
+        resource_type = ResourceType.get_by(name=resource_type_name, first=True, to_dict=False)
+        resource_type or abort(404, "ResourceType <{0}> cannot be found".format(resource_type_name))
+
+        return Resource.get_by(resource_type_id=resource_type.id,
+                               app_id=self.app_id,
+                               name=name,
+                               first=True,
+                               to_dict=False)
+
+    def _get_resource_group(self, name):
+        return ResourceGroup.get_by(
+            app_id=self.app_id,
+            name=name,
+            first=True,
+            to_dict=False
+        )
+
+    def _get_role(self, name):
+        user = UserCache.get(name)
+        if user:
+            return Role.get_by(name=name, uid=user.uid, first=True, to_dict=False)
+
+        return Role.get_by(name=name, app_id=self.app_id, first=True, to_dict=False)
+
+    def add_resource(self, name, resource_type_name=None):
+        resource_type = ResourceType.get_by(name=resource_type_name, first=True, to_dict=False)
+        resource_type or abort(404, "ResourceType <{0}> cannot be found".format(resource_type_name))
+
+        ResourceCRUD.add(name, resource_type.id, self.app_id)
+
+    def grant_resource_to_role(self, name, role, resource_type_name=None, permissions=None):
+        resource = self._get_resource(name, resource_type_name)
+
+        role = self._get_role(role)
+
+        if resource:
+            PermissionCRUD.grant(role.id, permissions, resource_id=resource.id)
+        else:
+            group = self._get_resource_group(name)
+            if group:
+                PermissionCRUD.grant(role.id, permissions, group_id=group.id)
+
+    def del_resource(self, name, resource_type_name=None):
+        resource = self._get_resource(name, resource_type_name)
+        if resource:
+            ResourceCRUD.delete(resource.id)
+
+    def has_permission(self, resource_name, resource_type, perm):
+
+        role = self._get_role(g.user.username)
+
+        role or abort(404, "Role <{0}> is not found".format(g.user.username))
+
+        return RoleCRUD.has_permission(role.id, resource_name, resource_type, self.app_id, perm)
+
+
+def validate_permission(resources, resource_type, perm):
+    if not resources:
+        return
+
+    if current_app.config.get("USE_ACL"):
+        if g.user.username == "worker":
+            return
+
+        resources = [resources] if isinstance(resources, six.string_types) else resources
+        for resource in resources:
+            if not ACLManager().has_permission(resource, resource_type, perm):
+                return abort(403, "has no permission")
+
+
+def has_perm(resources, resource_type, perm):
+    def decorator_has_perm(func):
+        @functools.wraps(func)
+        def wrapper_has_perm(*args, **kwargs):
+            if not resources:
+                return
+
+            if current_app.config.get("USE_ACL"):
+                if is_app_admin():
+                    return func(*args, **kwargs)
+
+                validate_permission(resources, resource_type, perm)
+
+            return func(*args, **kwargs)
+
+        return wrapper_has_perm
+
+    return decorator_has_perm
+
+
+def is_app_admin(app=None):
+    if RoleEnum.CONFIG in session.get("acl", {}).get("parentRoles", []):
+        return True
+
+    app = app or 'cmdb'
+    app_id = AppCache.get(app).id
+
+    for role in session.get("acl", {}).get("parentRoles", []):
+        if RoleCache.get_by_name(app_id, role).is_app_admin:
+            return True
+
+    return False
+
+
+def has_perm_from_args(arg_name, resource_type, perm, callback=None):
+    def decorator_has_perm(func):
+        @functools.wraps(func)
+        def wrapper_has_perm(*args, **kwargs):
+            if not arg_name:
+                return
+            resource = request.view_args.get(arg_name) or request.values.get(arg_name)
+            if callback is not None and resource:
+                resource = callback(resource)
+
+            if current_app.config.get("USE_ACL") and resource:
+                if is_app_admin():
+                    return func(*args, **kwargs)
+
+                validate_permission(resource, resource_type, perm)
+
+            return func(*args, **kwargs)
+
+        return wrapper_has_perm
+
+    return decorator_has_perm
+
+
+def role_required(role_name):
+    def decorator_role_required(func):
+        @functools.wraps(func)
+        def wrapper_role_required(*args, **kwargs):
+            if not role_name:
+                return
+
+            if current_app.config.get("USE_ACL"):
+                if role_name not in session.get("acl", {}).get("parentRoles", []) and not is_app_admin():
+                    return abort(403, "Role {0} is required".format(role_name))
+            return func(*args, **kwargs)
+
+        return wrapper_role_required
+
+    return decorator_role_required
--- a/cmdb-api/api/lib/perm/acl/cache.py
+++ b/cmdb-api/api/lib/perm/acl/cache.py
@@ -1,6 +1,7 @@
 # -*- coding:utf-8 -*-

 from api.extensions import cache
+from api.extensions import db
 from api.models.acl import App
 from api.models.acl import Permission
 from api.models.acl import Role
@@ -139,7 +140,7 @@ class RoleRelationCache(object):
    @classmethod
    def rebuild(cls, rid):
        cls.clean(rid)
-
+        db.session.close()
        cls.get_parent_ids(rid)
        cls.get_child_ids(rid)
        cls.get_resources(rid)
--- a/cmdb-api/api/lib/perm/acl/const.py
+++ b/cmdb-api/api/lib/perm/acl/const.py
@@ -0,0 +1,5 @@
+# -*- coding:utf-8 -*-
+
+from api.lib.cmdb.const import CMDB_QUEUE
+
+ACL_QUEUE = CMDB_QUEUE
--- a/cmdb-api/api/lib/perm/acl/permission.py
+++ b/cmdb-api/api/lib/perm/acl/permission.py
@@ -3,7 +3,9 @@

 from api.lib.perm.acl.cache import PermissionCache
 from api.lib.perm.acl.cache import RoleCache
+from api.lib.perm.acl.const import ACL_QUEUE
 from api.models.acl import RolePermission
+from api.tasks.acl import role_rebuild


 class PermissionCRUD(object):
@@ -29,6 +31,8 @@ class PermissionCRUD(object):
            existed = RolePermission.get_by(rid=rid, perm_id=perm.id, group_id=group_id, resource_id=resource_id)
            existed or RolePermission.create(rid=rid, perm_id=perm.id, group_id=group_id, resource_id=resource_id)

+        role_rebuild.apply_async(args=(rid,), queue=ACL_QUEUE)
+
    @staticmethod
    def revoke(rid, perms, resource_id=None, group_id=None):
        for perm in perms:
@@ -40,3 +44,5 @@ class PermissionCRUD(object):
                                            first=True,
                                            to_dict=False)
            existed and existed.soft_delete()
+
+        role_rebuild.apply_async(args=(rid,), queue=ACL_QUEUE)
--- a/cmdb-api/api/lib/perm/acl/resource.py
+++ b/cmdb-api/api/lib/perm/acl/resource.py
@@ -4,11 +4,14 @@
 from flask import abort

 from api.extensions import db
+from api.lib.perm.acl.const import ACL_QUEUE
 from api.models.acl import Permission
 from api.models.acl import Resource
 from api.models.acl import ResourceGroup
 from api.models.acl import ResourceGroupItems
 from api.models.acl import ResourceType
+from api.models.acl import RolePermission
+from api.tasks.acl import role_rebuild


 class ResourceTypeCRUD(object):
@@ -36,11 +39,11 @@ class ResourceTypeCRUD(object):
        return [i.to_dict() for i in perms]

    @classmethod
-    def add(cls, app_id, name, perms):
+    def add(cls, app_id, name, description, perms):
        ResourceType.get_by(name=name, app_id=app_id) and abort(
            400, "ResourceType <{0}> is already existed".format(name))

-        rt = ResourceType.create(name=name, app_id=app_id)
+        rt = ResourceType.create(name=name, description=description, app_id=app_id)

        cls.update_perms(rt.id, perms, app_id)

@@ -65,6 +68,9 @@ class ResourceTypeCRUD(object):
    def delete(cls, rt_id):
        rt = ResourceType.get_by_id(rt_id) or abort(404, "ResourceType <{0}> is not found".format(rt_id))

+        if Resource.get_by(resource_type_id=rt_id):
+            return abort(400, "At least one instance of this type exists and cannot be deleted")
+
        cls.update_perms(rt_id, [], rt.app_id)

        rt.soft_delete()
@@ -134,6 +140,10 @@ class ResourceGroupCRUD(object):
        for item in items:
            item.soft_delete()

+        for i in RolePermission.get_by(group_id=rg_id, to_dict=False):
+            i.soft_delete()
+            role_rebuild.apply_async(args=(i.rid,), queue=ACL_QUEUE)
+

 class ResourceCRUD(object):
    @staticmethod
@@ -173,3 +183,7 @@ class ResourceCRUD(object):
        resource = Resource.get_by_id(_id) or abort(404, "Resource <{0}> is not found".format(_id))

        resource.soft_delete()
+
+        for i in RolePermission.get_by(resource_id=_id, to_dict=False):
+            i.soft_delete()
+            role_rebuild.apply_async(args=(i.rid,), queue=ACL_QUEUE)
--- a/cmdb-api/api/lib/perm/acl/role.py
+++ b/cmdb-api/api/lib/perm/acl/role.py
@@ -10,6 +10,7 @@ from api.lib.perm.acl.cache import RoleRelationCache
 from api.lib.perm.acl.const import ACL_QUEUE
 from api.models.acl import Resource
 from api.models.acl import ResourceGroupItems
+from api.models.acl import ResourceType
 from api.models.acl import Role
 from api.models.acl import RolePermission
 from api.models.acl import RoleRelation
@@ -23,8 +24,8 @@ class RoleRelationCRUD(object):
        if uids is not None:
            uids = [uids] if isinstance(uids, six.integer_types) else uids
            rids = db.session.query(Role).filter(Role.deleted.is_(False)).filter(Role.uid.in_(uids))
-            rid2uid = {i.rid: i.uid for i in rids}
-            rids = [i.rid for i in rids]
+            rid2uid = {i.id: i.uid for i in rids}
+            rids = [i.id for i in rids]
        else:
            rids = [rids] if isinstance(rids, six.integer_types) else rids

@@ -44,9 +45,9 @@ class RoleRelationCRUD(object):

    @staticmethod
    def get_child_ids(rid):
-        res = RoleRelation.get_by(child_id=rid, to_dict=False)
+        res = RoleRelation.get_by(parent_id=rid, to_dict=False)

-        return [i.parent_id for i in res]
+        return [i.child_id for i in res]

    @classmethod
    def recursive_parent_ids(cls, rid):
@@ -76,31 +77,56 @@ class RoleRelationCRUD(object):

        return all_child_ids

-    @staticmethod
-    def add(parent_id, child_id):
+    @classmethod
+    def add(cls, parent_id, child_id):
        RoleRelation.get_by(parent_id=parent_id, child_id=child_id) and abort(400, "It's already existed")

+        if parent_id in cls.recursive_child_ids(child_id):
+            return abort(400, "Circulation inheritance!!!")
+
+        RoleRelationCache.clean(parent_id)
+        RoleRelationCache.clean(child_id)
+
        return RoleRelation.create(parent_id=parent_id, child_id=child_id)

-    @staticmethod
-    def delete(_id):
+    @classmethod
+    def delete(cls, _id):
        existed = RoleRelation.get_by_id(_id) or abort(400, "RoleRelation <{0}> does not exist".format(_id))

+        child_ids = cls.recursive_child_ids(existed.child_id)
+        for child_id in child_ids:
+            role_rebuild.apply_async(args=(child_id,), queue=ACL_QUEUE)
+
+        RoleRelationCache.clean(existed.parent_id)
+        RoleRelationCache.clean(existed.child_id)
+
        existed.soft_delete()

-    @staticmethod
-    def delete2(parent_id, child_id):
-        existed = RoleRelation.get_by(parent_id=parent_id, child_id=child_id)
+    @classmethod
+    def delete2(cls, parent_id, child_id):
+        existed = RoleRelation.get_by(parent_id=parent_id, child_id=child_id, first=True, to_dict=False)
        existed or abort(400, "RoleRelation < {0} -> {1} > does not exist".format(parent_id, child_id))

+        child_ids = cls.recursive_child_ids(existed.child_id)
+        for child_id in child_ids:
+            role_rebuild.apply_async(args=(child_id,), queue=ACL_QUEUE)
+
+        RoleRelationCache.clean(existed.parent_id)
+        RoleRelationCache.clean(existed.child_id)
+
        existed.soft_delete()


 class RoleCRUD(object):
    @staticmethod
-    def search(q, app_id, page=1, page_size=None):
-        query = db.session.query(Role).filter(Role.deleted.is_(False)).filter(
-            Role.app_id == app_id).filter(Role.uid.is_(None))
+    def search(q, app_id, page=1, page_size=None, user_role=True):
+        query = db.session.query(Role).filter(Role.deleted.is_(False))
+        query = query.filter(Role.app_id == app_id).filter(Role.uid.is_(None))
+
+        if user_role:
+            query1 = db.session.query(Role).filter(Role.deleted.is_(False)).filter(Role.uid.isnot(None))
+            query = query.union(query1)
+
        if q:
            query = query.filter(Role.name.ilike('%{0}%'.format(q)))

@@ -109,7 +135,7 @@ class RoleCRUD(object):
        return numfound, query.offset((page - 1) * page_size).limit(page_size)

    @staticmethod
-    def add_role(name, app_id, is_app_admin=False, uid=None):
+    def add_role(name, app_id=None, is_app_admin=False, uid=None):
        Role.get_by(name=name, app_id=app_id) and abort(400, "Role <{0}> is already existed".format(name))

        return Role.create(name=name,
@@ -131,9 +157,6 @@ class RoleCRUD(object):
    def delete_role(cls, rid):
        role = Role.get_by_id(rid) or abort(404, "Role <{0}> does not exist".format(rid))

-        parent_ids = RoleRelationCRUD.get_parent_ids(rid)
-        child_ids = RoleRelationCRUD.get_child_ids(rid)
-
        for i in RoleRelation.get_by(parent_id=rid, to_dict=False):
            i.soft_delete()
        for i in RoleRelation.get_by(child_id=rid, to_dict=False):
@@ -142,7 +165,7 @@ class RoleCRUD(object):
        for i in RolePermission.get_by(rid=rid, to_dict=False):
            i.soft_delete()

-        role_rebuild.apply_async(args=(parent_ids + child_ids,), queue=ACL_QUEUE)
+        role_rebuild.apply_async(args=(list(RoleRelationCRUD.recursive_child_ids(rid)), ), queue=ACL_QUEUE)

        RoleCache.clean(rid)
        RoleRelationCache.clean(rid)
@@ -163,20 +186,21 @@ class RoleCRUD(object):

    @staticmethod
    def get_group_ids(resource_id):
-        return [i.group_id for i in ResourceGroupItems.get_by(resource_id, to_dict=False)]
+        return [i.group_id for i in ResourceGroupItems.get_by(resource_id=resource_id, to_dict=False)]

    @classmethod
-    def has_permission(cls, rid, resource_name, perm):
-        resource = Resource.get_by(name=resource_name, first=True, to_dict=False)
+    def has_permission(cls, rid, resource_name, resource_type, app_id, perm):
+        resource_type = ResourceType.get_by(app_id=app_id, name=resource_type, first=True, to_dict=False)
+        resource_type or abort(404, "ResourceType <{0}> is not found".format(resource_type))
+        type_id = resource_type.id
+        resource = Resource.get_by(name=resource_name, resource_type_id=type_id, first=True, to_dict=False)
        resource = resource or abort(403, "Resource <{0}> is not in ACL".format(resource_name))

        parent_ids = RoleRelationCRUD.recursive_parent_ids(rid)

        group_ids = cls.get_group_ids(resource.id)
-
        for parent_id in parent_ids:
            id2perms = RoleRelationCache.get_resources(parent_id)
-
            perms = id2perms['id2perms'].get(resource.id, [])
            if perms and {perm}.issubset(set(perms)):
                return True
--- a/cmdb-api/api/lib/perm/acl/user.py
+++ b/cmdb-api/api/lib/perm/acl/user.py
@@ -1,15 +1,17 @@
 # -*- coding:utf-8 -*-


-import uuid
-import string
 import random
+import string
+import uuid

 from flask import abort
 from flask import g

 from api.extensions import db
 from api.lib.perm.acl.cache import UserCache
+from api.lib.perm.acl.role import RoleCRUD
+from api.models.acl import Role
 from api.models.acl import User


@@ -40,14 +42,28 @@ class UserCRUD(object):
        kwargs['block'] = 0
        kwargs['key'], kwargs['secret'] = cls._gen_key_secret()

-        return User.create(**kwargs)
+        user = User.create(**kwargs)
+
+        RoleCRUD.add_role(user.username, uid=user.uid)
+
+        return user

    @staticmethod
    def update(uid, **kwargs):
        user = User.get_by(uid=uid, to_dict=False, first=True) or abort(404, "User <{0}> does not exist".format(uid))

+        if kwargs.get("username"):
+            other = User.get_by(username=kwargs['username'], first=True, to_dict=False)
+            if other is not None and other.uid != user.uid:
+                return abort(400, "User <{0}> cannot be duplicated".format(kwargs['username']))
+
        UserCache.clean(user)

+        if kwargs.get("username") and kwargs['username'] != user.username:
+            role = Role.get_by(name=user.username, first=True, to_dict=False)
+            if role is not None:
+                RoleCRUD.update_role(role.id, **dict(name=kwargs['name']))
+
        return user.update(**kwargs)

    @classmethod
@@ -59,6 +75,9 @@ class UserCRUD(object):

    @classmethod
    def delete(cls, uid):
+        if uid == g.user.uid:
+            return abort(400, "You cannot delete yourself")
+
        user = User.get_by(uid=uid, to_dict=False, first=True) or abort(404, "User <{0}> does not exist".format(uid))

        UserCache.clean(user)
--- a/cmdb-api/api/lib/perm/auth.py
+++ b/cmdb-api/api/lib/perm/auth.py
@@ -13,8 +13,8 @@ from flask import request
 from flask import session
 from flask_login import login_user

-from api.models.acl import User
 from api.lib.perm.acl.cache import UserCache
+from api.models.acl import User


 def _auth_with_key():
@@ -47,12 +47,13 @@ def _auth_with_token():

    try:
        token = auth_headers
-        data = jwt.decode(token, current_app.config['SECRET_KEY'])
+        data = jwt.decode(token, current_app.config['SECRET_KEY'], algorithms=['HS256'])
        user = User.query.filter_by(email=data['sub']).first()
        if not user:
            return False

        login_user(user)
+        g.user = user
        return True
    except jwt.ExpiredSignatureError:
        return False
--- a/cmdb-api/api/lib/utils.py
+++ b/cmdb-api/api/lib/utils.py
@@ -1,5 +1,7 @@
 # -*- coding:utf-8 -*- 

+import json
+
 import redis
 import six
 from elasticsearch import Elasticsearch
@@ -26,6 +28,9 @@ def get_page_size(page_size):


 def handle_arg_list(arg):
+    if isinstance(arg, six.string_types) and arg.startswith('['):
+        return json.loads(arg)
+
    return list(filter(lambda x: x != "", arg.strip().split(","))) if isinstance(arg, six.string_types) else arg


--- a/cmdb-api/api/models/init.py
+++ b/cmdb-api/api/models/init.py
--- a/cmdb-api/api/models/acl.py
+++ b/cmdb-api/api/models/acl.py
@@ -5,6 +5,7 @@ import copy
 import hashlib
 from datetime import datetime

+import ldap
 from flask import current_app
 from flask_sqlalchemy import BaseQuery

@@ -29,7 +30,7 @@ class UserQuery(BaseQuery):

    def authenticate(self, login, password):
        user = self.filter(db.or_(User.username == login,
-                                  User.email == login)).first()
+                                  User.email == login)).filter(User.deleted.is_(False)).first()
        if user:
            current_app.logger.info(user)
            authenticated = user.check_password(password)
@@ -39,7 +40,7 @@ class UserQuery(BaseQuery):
        return user, authenticated

    def authenticate_with_key(self, key, secret, args, path):
-        user = self.filter(User.key == key).filter(User.block == 0).first()
+        user = self.filter(User.key == key).filter(User.deleted.is_(False)).filter(User.block == 0).first()
        if not user:
            return None, False
        if user and hashlib.sha1('{0}{1}{2}'.format(
@@ -50,24 +51,50 @@ class UserQuery(BaseQuery):

        return user, authenticated

+    def authenticate_with_ldap(self, username, password):
+        ldap_conn = ldap.initialize(current_app.config.get('LDAP_SERVER'))
+        ldap_conn.protocol_version = 3
+        ldap_conn.set_option(ldap.OPT_REFERRALS, 0)
+        if '@' in username:
+            who = '{0}@{1}'.format(username.split('@')[0], current_app.config.get('LDAP_DOMAIN'))
+        else:
+            who = '{0}@{1}'.format(username, current_app.config.get('LDAP_DOMAIN'))
+
+        username = username.split('@')[0]
+        user = self.get_by_username(username)
+        try:
+
+            if not password:
+                raise ldap.INVALID_CREDENTIALS
+
+            ldap_conn.simple_bind_s(who, password)
+
+            if not user:
+                from api.lib.perm.acl.user import UserCRUD
+                user = UserCRUD.add(username=username, email=who)
+
+            return user, True
+        except ldap.INVALID_CREDENTIALS:
+            return user, False
+
    def search(self, key):
        query = self.filter(db.or_(User.email == key,
                                   User.nickname.ilike('%' + key + '%'),
-                                   User.username.ilike('%' + key + '%')))
+                                   User.username.ilike('%' + key + '%'))).filter(User.deleted.is_(False))
        return query

    def get_by_username(self, username):
-        user = self.filter(User.username == username).first()
+        user = self.filter(User.username == username).filter(User.deleted.is_(False)).first()

        return user

    def get_by_nickname(self, nickname):
-        user = self.filter(User.nickname == nickname).first()
+        user = self.filter(User.nickname == nickname).filter(User.deleted.is_(False)).first()

        return user

    def get(self, uid):
-        user = self.filter(User.uid == uid).first()
+        user = self.filter(User.uid == uid).filter(User.deleted.is_(False)).first()

        return copy.deepcopy(user)

@@ -136,9 +163,6 @@ class RoleRelation(Model):
    parent_id = db.Column(db.Integer, db.ForeignKey('acl_roles.id'))
    child_id = db.Column(db.Integer, db.ForeignKey('acl_roles.id'))

-    __table_args__ = (
-        db.UniqueConstraint("parent_id", "child_id", name="role_relation_unique"),)
-

 class ResourceType(Model):
    __tablename__ = "acl_resource_types"
@@ -156,8 +180,6 @@ class ResourceGroup(Model):

    app_id = db.Column(db.Integer, db.ForeignKey('acl_apps.id'))

-    __table_args__ = (db.UniqueConstraint("name", "resource_type_id", "app_id", name="resource_group_app_unique"),)
-

 class Resource(Model):
    __tablename__ = "acl_resources"
@@ -167,8 +189,6 @@ class Resource(Model):

    app_id = db.Column(db.Integer, db.ForeignKey("acl_apps.id"))

-    __table_args__ = (db.UniqueConstraint("name", "resource_type_id", "app_id", name="resource_name_app_unique"),)
-

 class ResourceGroupItems(Model):
    __tablename__ = "acl_resource_group_items"
@@ -185,8 +205,6 @@ class Permission(Model):

    app_id = db.Column(db.Integer, db.ForeignKey("acl_apps.id"))

-    __table_args__ = (db.UniqueConstraint("name", "resource_type_id", "app_id", name="perm_name_app_unique"),)
-

 class RolePermission(Model):
    __tablename__ = "acl_role_permissions"
--- a/cmdb-api/api/models/cmdb.py
+++ b/cmdb-api/api/models/cmdb.py
@@ -15,13 +15,13 @@ from api.lib.database import Model
 class RelationType(Model):
    __tablename__ = "c_relation_types"

-    name = db.Column(db.String(16), index=True)
+    name = db.Column(db.String(16), index=True, nullable=False)


 class CITypeGroup(Model):
    __tablename__ = "c_ci_type_groups"

-    name = db.Column(db.String(32))
+    name = db.Column(db.String(32), nullable=False)


 class CITypeGroupItem(Model):
@@ -35,12 +35,12 @@ class CITypeGroupItem(Model):
 class CIType(Model):
    __tablename__ = "c_ci_types"

-    name = db.Column(db.String(32))
-    alias = db.Column(db.String(32))
+    name = db.Column(db.String(32), nullable=False)
+    alias = db.Column(db.String(32), nullable=False)
    unique_id = db.Column(db.Integer, db.ForeignKey("c_attributes.id"), nullable=False)
    enabled = db.Column(db.Boolean, default=True, nullable=False)
    is_attached = db.Column(db.Boolean, default=False, nullable=False)
-    icon_url = db.Column(db.String(256))
+    icon_url = db.Column(db.String(256), default='', nullable=False)
    order = db.Column(db.SmallInteger, default=0, nullable=False)

    unique_key = db.relationship("Attribute", backref="c_ci_types.unique_id")
@@ -89,7 +89,7 @@ class CITypeAttribute(Model):
 class CITypeAttributeGroup(Model):
    __tablename__ = "c_ci_type_attribute_groups"

-    name = db.Column(db.String(64))
+    name = db.Column(db.String(64), nullable=False)
    type_id = db.Column(db.Integer, db.ForeignKey("c_ci_types.id"), nullable=False)
    order = db.Column(db.SmallInteger, default=0)

@@ -250,13 +250,24 @@ class CIValueDateTime(Model):
    attr = db.relationship("Attribute", backref="c_value_datetime.attr_id")


+class CIValueJson(Model):
+    __tablename__ = "c_value_json"
+
+    ci_id = db.Column(db.Integer, db.ForeignKey('c_cis.id'), nullable=False)
+    attr_id = db.Column(db.Integer, db.ForeignKey('c_attributes.id'), nullable=False)
+    value = db.Column(db.JSON, nullable=False)
+
+    ci = db.relationship("CI", backref="c_value_json.ci_id")
+    attr = db.relationship("Attribute", backref="c_value_json.attr_id")
+
+
 # history
 class OperationRecord(Model):
    __tablename__ = "c_records"

    uid = db.Column(db.Integer, index=True, nullable=False)
-    origin = db.Column(db.String(32))
-    ticket_id = db.Column(db.String(32))
+    origin = db.Column(db.String(32), nullable=True)
+    ticket_id = db.Column(db.String(32), nullable=True)
    reason = db.Column(db.Text)


@@ -306,5 +317,5 @@ class PreferenceTreeView(Model):
 class PreferenceRelationView(Model):
    __tablename__ = "c_preference_relation_views"

-    name = db.Column(db.String(8), index=True, nullable=False)
+    name = db.Column(db.String(64), index=True, nullable=False)
    cr_ids = db.Column(db.TEXT)  # [{parent_id: x, child_id: y}] TODO: JSON
--- a/cmdb-api/api/resource.py
+++ b/cmdb-api/api/resource.py
--- a/cmdb-api/api/tasks/init.py
+++ b/cmdb-api/api/tasks/init.py
--- a/cmdb-api/api/tasks/acl.py
+++ b/cmdb-api/api/tasks/acl.py
@@ -13,4 +13,4 @@ def role_rebuild(rids):
    for rid in rids:
        RoleRelationCache.rebuild(rid)

-    current_app.logger.info("%d rebuild.........." % rids)
+    current_app.logger.info("Role {0} rebuild..........".format(rids))
--- a/cmdb-api/api/tasks/cmdb.py
+++ b/cmdb-api/api/tasks/cmdb.py
@@ -11,9 +11,11 @@ from api.extensions import celery
 from api.extensions import db
 from api.extensions import es
 from api.extensions import rd
+from api.lib.cmdb.cache import CITypeAttributesCache
 from api.lib.cmdb.const import CMDB_QUEUE
 from api.lib.cmdb.const import REDIS_PREFIX_CI
 from api.lib.cmdb.const import REDIS_PREFIX_CI_RELATION
+from api.models.cmdb import CIRelation


@celery.task(name="cmdb.ci_cache", queue=CMDB_QUEUE)
@@ -45,11 +47,16 @@ def ci_delete(ci_id):

@celery.task(name="cmdb.ci_relation_cache", queue=CMDB_QUEUE)
 def ci_relation_cache(parent_id, child_id):
-    children = rd.get([parent_id], REDIS_PREFIX_CI_RELATION)[0]
-    children = json.loads(children) if children is not None else []
-    children.append(child_id)
+    db.session.close()

-    rd.create_or_update({parent_id: json.dumps(list(set(children)))}, REDIS_PREFIX_CI_RELATION)
+    children = rd.get([parent_id], REDIS_PREFIX_CI_RELATION)[0]
+    children = json.loads(children) if children is not None else {}
+
+    cr = CIRelation.get_by(first_ci_id=parent_id, second_ci_id=child_id, first=True, to_dict=False)
+    if str(child_id) not in children:
+        children[str(child_id)] = cr.second_ci.type_id
+
+    rd.create_or_update({parent_id: json.dumps(children)}, REDIS_PREFIX_CI_RELATION)

    current_app.logger.info("ADD ci relation cache: {0} -> {1}".format(parent_id, child_id))

@@ -57,10 +64,31 @@ def ci_relation_cache(parent_id, child_id):
@celery.task(name="cmdb.ci_relation_delete", queue=CMDB_QUEUE)
 def ci_relation_delete(parent_id, child_id):
    children = rd.get([parent_id], REDIS_PREFIX_CI_RELATION)[0]
-    children = json.loads(children) if children is not None else []
-    if child_id in children:
-        children.remove(child_id)
+    children = json.loads(children) if children is not None else {}

-    rd.create_or_update({parent_id: json.dumps(list(set(children)))}, REDIS_PREFIX_CI_RELATION)
+    if str(child_id) in children:
+        children.pop(str(child_id))
+
+    rd.create_or_update({parent_id: json.dumps(children)}, REDIS_PREFIX_CI_RELATION)

    current_app.logger.info("DELETE ci relation cache: {0} -> {1}".format(parent_id, child_id))
+
+
+@celery.task(name="cmdb.ci_type_attribute_order_rebuild", queue=CMDB_QUEUE)
+def ci_type_attribute_order_rebuild(type_id):
+    current_app.logger.info('rebuild attribute order')
+    db.session.remove()
+
+    from api.lib.cmdb.ci_type import CITypeAttributeGroupManager
+
+    attrs = CITypeAttributesCache.get(type_id)
+    id2attr = {attr.attr_id: attr for attr in attrs}
+
+    res = CITypeAttributeGroupManager.get_by_type_id(type_id, True)
+    order = 0
+    for group in res:
+        for _attr in group.get('attributes'):
+            if order != id2attr.get(_attr['id']) and id2attr.get(_attr['id']):
+                id2attr.get(_attr['id']).update(order=order)
+
+            order += 1
--- a/cmdb-api/api/tasks/test.py
+++ b/cmdb-api/api/tasks/test.py
--- a/cmdb-api/api/views/init.py
+++ b/cmdb-api/api/views/init.py
@@ -6,7 +6,7 @@ from flask import Blueprint
 from flask_restful import Api

 from api.resource import register_resources
-from .account import LoginView, LogoutView
+from api.views.account import LoginView, LogoutView

 HERE = os.path.abspath(os.path.dirname(__file__))

--- a/cmdb-api/api/views/account.py
+++ b/cmdb-api/api/views/account.py
@@ -6,12 +6,15 @@ import jwt
 from flask import abort
 from flask import current_app
 from flask import request
+from flask import session
 from flask_login import login_user, logout_user

 from api.lib.decorator import args_required
 from api.lib.perm.auth import auth_abandoned
-from api.models.acl import User
+from api.models.acl import User, Role
 from api.resource import APIView
+from api.lib.perm.acl.role import RoleRelationCRUD
+from api.lib.perm.acl.cache import RoleCache


 class LoginView(APIView):
@@ -23,7 +26,10 @@ class LoginView(APIView):
    def post(self):
        username = request.values.get("username") or request.values.get("email")
        password = request.values.get("password")
-        user, authenticated = User.query.authenticate(username, password)
+        if current_app.config.get('AUTH_WITH_LDAP'):
+            user, authenticated = User.query.authenticate_with_ldap(username, password)
+        else:
+            user, authenticated = User.query.authenticate(username, password)
        if not user:
            return abort(403, "User <{0}> does not exist".format(username))
        if not authenticated:
@@ -37,6 +43,18 @@ class LoginView(APIView):
            'exp': datetime.datetime.now() + datetime.timedelta(minutes=24 * 60 * 7)},
            current_app.config['SECRET_KEY'])

+        role = Role.get_by(uid=user.uid, first=True, to_dict=False)
+        if role:
+            parent_ids = RoleRelationCRUD.recursive_parent_ids(role.id)
+            parent_roles = [RoleCache.get(i).name for i in parent_ids]
+        else:
+            parent_roles = []
+        session["acl"] = dict(uid=user.uid,
+                              avatar=user.avatar,
+                              userName=user.username,
+                              nickName=user.nickname,
+                              parentRoles=parent_roles)
+
        return self.jsonify(token=token.decode())


--- a/cmdb-api/api/views/acl/init.py
+++ b/cmdb-api/api/views/acl/init.py
--- a/cmdb-api/api/views/acl/permission.py
+++ b/cmdb-api/api/views/acl/permission.py
--- a/cmdb-api/api/views/acl/resources.py
+++ b/cmdb-api/api/views/acl/resources.py
@@ -39,9 +39,10 @@ class ResourceTypeView(APIView):
    def post(self):
        name = request.values.get('name')
        app_id = request.values.get('app_id')
+        description = request.values.get('description', '')
        perms = request.values.get('perms')

-        rt = ResourceTypeCRUD.add(app_id, name, perms)
+        rt = ResourceTypeCRUD.add(app_id, name, description, perms)

        return self.jsonify(rt.to_dict())

--- a/cmdb-api/api/views/acl/role.py
+++ b/cmdb-api/api/views/acl/role.py
@@ -1,5 +1,6 @@
 # -*- coding:utf-8 -*-

+from flask import current_app
 from flask import request

 from api.lib.decorator import args_required
@@ -21,8 +22,10 @@ class RoleView(APIView):
        page_size = get_page_size(request.values.get("page_size"))
        q = request.values.get('q')
        app_id = request.values.get('app_id')
+        user_role = request.values.get('user_role', True)
+        user_role = True if user_role in current_app.config.get("BOOL_TRUE") else False

-        numfound, roles = RoleCRUD.search(q, app_id, page, page_size)
+        numfound, roles = RoleCRUD.search(q, app_id, page, page_size, user_role)

        id2parents = RoleRelationCRUD.get_parents([i.id for i in roles])

--- a/cmdb-api/api/views/acl/user.py
+++ b/cmdb-api/api/views/acl/user.py
@@ -17,9 +17,10 @@ class GetUserInfoView(APIView):
    url_prefix = "/users/info"

    def get(self):
-        name = session.get("acl", {}).get("nickName") or session.get("CAS_USERNAME") or current_user.nickname
-        role = dict(permissions=session.get("acl", {}).get("parentRoles", []) or ["admin"])
-        avatar = session.get("acl", {}).get("avatar") or current_user.avatar
+        name = session.get("CAS_USERNAME") or current_user.nickname
+        role = dict(permissions=session.get("acl", {}).get("parentRoles", []))
+        avatar = current_user.avatar
+
        return self.jsonify(result=dict(name=name,
                                        role=role,
                                        avatar=avatar))
--- a/cmdb-api/api/views/cmdb/init.py
+++ b/cmdb-api/api/views/cmdb/init.py
--- a/cmdb-api/api/views/cmdb/attribute.py
+++ b/cmdb-api/api/views/cmdb/attribute.py
--- a/cmdb-api/api/views/cmdb/ci.py
+++ b/cmdb-api/api/views/cmdb/ci.py
@@ -10,7 +10,7 @@ from flask import request
 from api.lib.cmdb.cache import CITypeCache
 from api.lib.cmdb.ci import CIManager
 from api.lib.cmdb.const import ExistPolicy
-from api.lib.cmdb.const import ResourceType, PermEnum
+from api.lib.cmdb.const import ResourceTypeEnum, PermEnum
 from api.lib.cmdb.const import RetKey
 from api.lib.cmdb.search import SearchError
 from api.lib.cmdb.search.ci.db.search import Search as SearchFromDB
@@ -73,7 +73,7 @@ class CIView(APIView):
                ci_dict[k] = v.strip() if isinstance(v, six.string_types) else v
        return ci_dict

-    @has_perm_from_args("ci_type", ResourceType.CI, PermEnum.ADD)
+    @has_perm_from_args("ci_type", ResourceTypeEnum.CI, PermEnum.ADD, lambda x: CITypeCache.get(x).name)
    def post(self):
        ci_type = request.values.get("ci_type")
        _no_attribute_policy = request.values.get("_no_attribute_policy", ExistPolicy.IGNORE)
@@ -87,7 +87,7 @@ class CIView(APIView):
                            _no_attribute_policy=_no_attribute_policy, **ci_dict)
        return self.jsonify(ci_id=ci_id)

-    @has_perm_from_args("ci_id", ResourceType.CI, PermEnum.UPDATE, CIManager.get_type_name)
+    @has_perm_from_args("ci_id", ResourceTypeEnum.CI, PermEnum.UPDATE, CIManager.get_type_name)
    def put(self, ci_id=None):
        args = request.values
        ci_type = args.get("ci_type")
@@ -104,7 +104,7 @@ class CIView(APIView):
                                **ci_dict)
        return self.jsonify(ci_id=ci_id)

-    @has_perm_from_args("ci_id", ResourceType.CI, PermEnum.DELETE, CIManager.get_type_name)
+    @has_perm_from_args("ci_id", ResourceTypeEnum.CI, PermEnum.DELETE, CIManager.get_type_name)
    def delete(self, ci_id):
        manager = CIManager()
        manager.delete(ci_id)
@@ -163,7 +163,7 @@ class CISearchView(APIView):
 class CIUnique(APIView):
    url_prefix = "/ci/<int:ci_id>/unique"

-    @has_perm_from_args("ci_id", ResourceType.CI, PermEnum.UPDATE, CIManager.get_type_name)
+    @has_perm_from_args("ci_id", ResourceTypeEnum.CI, PermEnum.UPDATE, CIManager.get_type_name)
    def put(self, ci_id):
        params = request.values
        unique_name = params.keys()[0]
--- a/cmdb-api/api/views/cmdb/ci_relation.py
+++ b/cmdb-api/api/views/cmdb/ci_relation.py
@@ -7,9 +7,11 @@ from flask import abort
 from flask import current_app
 from flask import request

+from api.lib.cmdb.cache import RelationTypeCache
 from api.lib.cmdb.ci import CIRelationManager
 from api.lib.cmdb.search import SearchError
 from api.lib.cmdb.search.ci_relation.search import Search
+from api.lib.decorator import args_required
 from api.lib.perm.auth import auth_abandoned
 from api.lib.utils import get_page
 from api.lib.utils import get_page_size
@@ -34,7 +36,7 @@ class CIRelationSearchView(APIView):
        count = get_page_size(request.values.get("count") or request.values.get("page_size"))

        root_id = request.values.get('root_id')
-        level = request.values.get('level', 1)
+        level = list(map(int, handle_arg_list(request.values.get('level', '1'))))

        query = request.values.get('q', "")
        fl = handle_arg_list(request.values.get('fl', ""))
@@ -64,11 +66,12 @@ class CIRelationStatisticsView(APIView):
    def get(self):
        root_ids = list(map(int, handle_arg_list(request.values.get('root_ids'))))
        level = request.values.get('level', 1)
+        type_ids = set(map(int, handle_arg_list(request.values.get('type_ids', []))))

        start = time.time()
        s = Search(root_ids, level)
        try:
-            result = s.statistics()
+            result = s.statistics(type_ids)
        except SearchError as e:
            return abort(400, str(e))
        current_app.logger.debug("search time is :{0}".format(time.time() - start))
@@ -82,11 +85,15 @@ class GetSecondCIsView(APIView):
    def get(self, first_ci_id):
        page = get_page(request.values.get("page", 1))
        count = get_page_size(request.values.get("count"))
-        relation_type = request.values.get("relation_type", "contain")
+        relation_type = request.values.get("relation_type")
+        try:
+            relation_type_id = RelationTypeCache.get(relation_type).id if relation_type else None
+        except AttributeError:
+            return abort(400, "invalid relation type <{0}>".format(relation_type))

        manager = CIRelationManager()
        numfound, total, second_cis = manager.get_second_cis(
-            first_ci_id, page=page, per_page=count, relation_type=relation_type)
+            first_ci_id, page=page, per_page=count, relation_type_id=relation_type_id)

        return self.jsonify(numfound=numfound,
                            total=total,
@@ -116,11 +123,13 @@ class CIRelationView(APIView):
    def post(self, first_ci_id, second_ci_id):
        manager = CIRelationManager()
        res = manager.add(first_ci_id, second_ci_id)
+
        return self.jsonify(cr_id=res)

    def delete(self, first_ci_id, second_ci_id):
        manager = CIRelationManager()
        manager.delete_2(first_ci_id, second_ci_id)
+
        return self.jsonify(message="CIType Relation is deleted")


@@ -130,4 +139,24 @@ class DeleteCIRelationView(APIView):
    def delete(self, cr_id):
        manager = CIRelationManager()
        manager.delete(cr_id)
+
        return self.jsonify(message="CIType Relation is deleted")
+
+
+class BatchCreateOrUpdateCIRelationView(APIView):
+    url_prefix = "/ci_relations/batch"
+
+    @args_required('ci_ids')
+    @args_required('parents')
+    def post(self):
+        ci_ids = request.values.get('ci_ids')
+        parents = request.values.get('parents')
+
+        CIRelationManager.batch_update(ci_ids, parents)
+
+        return self.jsonify(code=200)
+
+    @args_required('ci_ids')
+    @args_required('parents')
+    def put(self):
+        return self.post()
--- a/cmdb-api/api/views/cmdb/ci_type.py
+++ b/cmdb-api/api/views/cmdb/ci_type.py
@@ -164,6 +164,34 @@ class CITypeAttributeView(APIView):
        return self.jsonify(attributes=attr_id_list)


+class CITypeAttributeTransferView(APIView):
+    url_prefix = "/ci_types/<int:type_id>/attributes/transfer"
+
+    @args_required('from')
+    @args_required('to')
+    def post(self, type_id):
+        _from = request.values.get('from')  # {'attr_id': xx, 'group_id': xx}
+        _to = request.values.get('to')  # {'group_id': xx, 'order': xxx}
+
+        CITypeAttributeManager.transfer(type_id, _from, _to)
+
+        return self.jsonify(code=200)
+
+
+class CITypeAttributeGroupTransferView(APIView):
+    url_prefix = "/ci_types/<int:type_id>/attribute_groups/transfer"
+
+    @args_required('from')
+    @args_required('to')
+    def post(self, type_id):
+        _from = request.values.get('from')  # group_id
+        _to = request.values.get('to')  # group_id
+
+        CITypeAttributeGroupManager.transfer(type_id, _from, _to)
+
+        return self.jsonify(code=200)
+
+
 class CITypeAttributeGroupView(APIView):
    url_prefix = ("/ci_types/<int:type_id>/attribute_groups",
                  "/ci_types/attribute_groups/<int:group_id>")
--- a/cmdb-api/api/views/cmdb/ci_type_relation.py
+++ b/cmdb-api/api/views/cmdb/ci_type_relation.py
--- a/cmdb-api/api/views/cmdb/history.py
+++ b/cmdb-api/api/views/cmdb/history.py
--- a/cmdb-api/api/views/cmdb/preference.py
+++ b/cmdb-api/api/views/cmdb/preference.py
@@ -4,7 +4,7 @@
 from flask import request

 from api.lib.cmdb.ci_type import CITypeManager
-from api.lib.cmdb.const import ResourceType, PermEnum, RoleEnum
+from api.lib.cmdb.const import ResourceTypeEnum, PermEnum, RoleEnum
 from api.lib.cmdb.preference import PreferenceManager
 from api.lib.decorator import args_required
 from api.lib.perm.acl.acl import has_perm_from_args
@@ -31,7 +31,7 @@ class PreferenceShowAttributesView(APIView):

        return self.jsonify(attributes=attributes, is_subscribed=is_subscribed)

-    @has_perm_from_args("id_or_name", ResourceType.CI, PermEnum.READ, CITypeManager.get_name_by_id)
+    @has_perm_from_args("id_or_name", ResourceTypeEnum.CI, PermEnum.READ, CITypeManager.get_name_by_id)
    @args_required("attr")
    def post(self, id_or_name):
        id_or_name = int(id_or_name)
@@ -42,7 +42,7 @@ class PreferenceShowAttributesView(APIView):
        return self.jsonify(type_id=id_or_name,
                            attr_order=list(zip(attr_list, orders)))

-    @has_perm_from_args("id_or_name", ResourceType.CI, PermEnum.READ, CITypeManager.get_name_by_id)
+    @has_perm_from_args("id_or_name", ResourceTypeEnum.CI, PermEnum.READ, CITypeManager.get_name_by_id)
    def put(self, id_or_name):
        return self.post(id_or_name)

@@ -53,7 +53,7 @@ class PreferenceTreeApiView(APIView):
    def get(self):
        return self.jsonify(PreferenceManager.get_tree_view())

-    @has_perm_from_args("type_id", ResourceType.CI, PermEnum.READ, CITypeManager.get_name_by_id)
+    @has_perm_from_args("type_id", ResourceTypeEnum.CI, PermEnum.READ, CITypeManager.get_name_by_id)
    @args_required("type_id")
    @args_required("levels")
    def post(self):
@@ -77,6 +77,7 @@ class PreferenceRelationApiView(APIView):

    @role_required(RoleEnum.CONFIG)
    @args_required("name")
+    @args_required("cr_ids")
    def post(self):
        name = request.values.get("name")
        cr_ids = request.values.get("cr_ids")
@@ -84,9 +85,11 @@ class PreferenceRelationApiView(APIView):

        return self.jsonify(views=views, id2type=id2type, name2id=name2id)

+    @role_required(RoleEnum.CONFIG)
    def put(self):
        return self.post()

+    @role_required(RoleEnum.CONFIG)
    @args_required("name")
    def delete(self):
        name = request.values.get("name")
--- a/cmdb-api/api/views/cmdb/relation_type.py
+++ b/cmdb-api/api/views/cmdb/relation_type.py
--- a/cmdb-api/autoapp.py
+++ b/cmdb-api/autoapp.py
@@ -1,6 +1,5 @@
 # -*- coding: utf-8 -*-

-"""Create an application instance."""

 from flask import g
 from flask_login import current_user
--- a/cmdb-api/celery_worker.py
+++ b/cmdb-api/celery_worker.py
@@ -3,7 +3,7 @@
 from api.app import create_app
 from api.extensions import celery

-# celery worker -A celery_worker.celery -l DEBUG -E -Q <queue_name>
+# celery worker -A celery_worker.celery -l DEBUG -E -Q <queue_name> --concurrency=1
 print(celery)

 app = create_app()
--- a/cmdb-api/local_test.py
+++ b/cmdb-api/local_test.py
@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+"""For debugging in ide"""
+
+from tests.conftest import *
+from pytest_mock import mocker
+from _pytest.config import _prepareconfig
+
+from tests.test_cmdb_attribute import test_create_attribute
+
+
+for a in app():
+    for d in database(a):
+        for s in session(d, a):
+            for c in client(a):
+                for m in mocker(_prepareconfig()):
+                    clean_db()
+                    test_create_attribute(s, c)
--- a/cmdb-api/logs/.gitkeep
+++ b/cmdb-api/logs/.gitkeep
--- a/cmdb-api/requirements-test.txt
+++ b/cmdb-api/requirements-test.txt
@@ -0,0 +1,7 @@
+-i https://mirrors.aliyun.com/pypi/simple
+pytest==4.0.2
+attrs==19.1.0
+coverage==4.4.2
+pytest-cov==2.5.1
+pytest-html==1.16.1
+pytest-mock==1.10.0
--- a/cmdb-api/requirements.txt
+++ b/cmdb-api/requirements.txt
@@ -0,0 +1,40 @@
+-i https://mirrors.aliyun.com/pypi/simple
+# Flask
+Flask == 1.0.3
+Werkzeug >= 0.15.5
+click >= 5.0
+# Api
+Flask-RESTful == 0.3.7
+# Database
+Flask-SQLAlchemy == 2.4.0
+SQLAlchemy == 1.3.5
+PyMySQL == 0.9.3
+redis == 3.2.1
+# Migrations
+Flask-Migrate == 2.5.2
+# Deployment
+gevent == 1.4.0
+gunicorn == 19.5.0
+supervisor == 4.0.3
+# Auth
+Flask-Login == 0.4.1
+Flask-Bcrypt == 0.7.1
+Flask-Cors >= 3.0.8
+python-ldap == 3.2.0
+# Caching
+Flask-Caching >= 1.0.0
+# Environment variable parsing
+environs == 4.2.0
+marshmallow == 2.20.2
+# async tasks
+celery == 4.3.0
+more-itertools == 5.0.0
+kombu == 4.4.0
+# other
+six == 1.12.0
+bs4 >= 0.0.1
+toposort >= 1.5
+requests >= 2.22.0
+PyJWT >= 1.7.1
+elasticsearch == 7.0.4
+future == 0.18.2
--- a/cmdb-api/settings.py.example
+++ b/cmdb-api/settings.py.example
@@ -69,6 +69,11 @@ CAS_VALIDATE_ROUTE = "/cas/serviceValidate"
 CAS_AFTER_LOGIN = "/"
 DEFAULT_SERVICE = "http://127.0.0.1:8000"

+# # ldap
+AUTH_WITH_LDAP = False
+LDAP_SERVER = ''
+LDAP_DOMAIN = ''
+
 # # pagination
 DEFAULT_PAGE_COUNT = 50

@@ -79,3 +84,6 @@ USE_ACL = False
 # # elastic search
 ES_HOST = '127.0.0.1'
 USE_ES = False
+
+
+BOOL_TRUE = ['true', 'TRUE', 'True', True, '1', 1, "Yes", "YES", "yes", 'Y', 'y']
--- a/cmdb-api/setup.cfg
+++ b/cmdb-api/setup.cfg
@@ -4,6 +4,7 @@ max-line-length = 120
 exclude = migrations/*
 max-complexity = 10

+
 [isort]
 line_length = 88
 multi_line_output = 3
--- a/tests/test_cmdb_attribute.py
+++ b/tests/test_cmdb_attribute.py
--- a/cmdb-api/tests/conftest.py
+++ b/cmdb-api/tests/conftest.py
@@ -0,0 +1,123 @@
+# -*- coding: utf-8 -*-
+"""Defines fixtures available to all tests."""
+
+import jwt
+import pytest
+from webtest import TestApp
+from flask import Response, json
+from flask.testing import FlaskClient
+from werkzeug.datastructures import Headers
+
+from api.app import create_app
+from api.extensions import db, cache
+from api.models.acl import User
+
+
+class CMDBTestClient(FlaskClient):
+    TEST_APP_SECRET = "test"
+
+    def open(self, *args, **kwargs):
+        headers = kwargs.pop("headers", Headers())
+        headers.setdefault("User-Agent", "py.test")
+        kwargs["headers"] = headers
+
+        json_data = kwargs.pop("json", None)
+        if json_data is not None:
+            kwargs["data"] = json.dumps(json_data)
+            if not kwargs.get("content_type"):
+                kwargs["content_type"] = "application/json"
+
+        auth = kwargs.pop("auth", (
+            "Access-Token",
+            jwt.encode({"sub": "test@xx.com"}, key=self.TEST_APP_SECRET)
+        ))
+        kwargs["headers"][auth[0]] = auth[1]
+
+        return super(CMDBTestClient, self).open(*args, **kwargs)
+
+
+class CMDBTestResponse(Response):
+    @property
+    def json(self):
+        return json.loads(self.data)
+
+
+@pytest.fixture(scope="session")
+def app():
+    """Create application for the tests."""
+    _app = create_app("tests.settings")
+    _app.config['SECRET_KEY'] = CMDBTestClient.TEST_APP_SECRET
+    _app.test_client_class = CMDBTestClient
+    _app.response_class = CMDBTestResponse
+
+    ctx = _app.test_request_context()
+    ctx.push()
+    yield _app
+
+    ctx.pop()
+
+
+@pytest.fixture(scope="session")
+def client(app):
+    with app.test_client(use_cookies=False) as c:
+        yield c
+
+
+@pytest.fixture(scope="session")
+def database(app):
+    """Clean database after each case finished"""
+    setup_db()
+    yield db
+    teardown_db()
+
+
+@pytest.fixture(scope="function")
+def session(database, app):
+    with app.app_context():
+        clean_db()
+        clean_cache()
+        yield database.session
+        database.session.rollback()
+
+
+def setup_db():
+    teardown_db()
+    db.create_all()
+    # create test user
+
+
+def teardown_db():
+    db.session.remove()
+    db.drop_all()
+    db.session.bind.dispose()
+
+
+def clean_cache():
+    cache.clear()
+
+
+def clean_db():
+    """clean all data but not drop table"""
+    for table in reversed(db.metadata.sorted_tables):
+        if table.fullname in ["users"]:
+            continue
+        db.session.execute(table.delete())
+        db.session.commit()
+
+    if not User.get_by(email="test@xx.com"):
+        u = User.create(
+            flush=True,
+            username="test",
+            nickname="测试",
+            email="test@xx.com",
+            key="",
+            secret=""
+        )
+        u._set_password("123456")
+        u.save()
+
+
+@pytest.fixture
+def testapp(app):
+    """Create Webtest app."""
+    return TestApp(app)
--- a/cmdb-api/tests/sample.py
+++ b/cmdb-api/tests/sample.py
@@ -0,0 +1,135 @@
+# -*- coding: utf-8 -*-
+"""provide some sample data in database"""
+import uuid
+import random
+
+from api.models.cmdb import (
+    Attribute,
+    CIType,
+    CITypeAttributeGroup,
+    CITypeAttribute,
+    CITypeRelation,
+    RelationType
+)
+from api.models.acl import User
+
+from api.lib.cmdb.ci_type import CITypeAttributeManager
+from api.lib.cmdb.ci import CIManager, CIRelationManager
+
+
+def force_add_user():
+    from flask import g
+    if not getattr(g, "user", None):
+        g.user = User.query.first()
+
+
+def init_attributes(num=1):
+    attrs = []
+    for i in range(num):
+        attrs.append(Attribute.create(
+            name=uuid.uuid4().hex[:8],
+            alias=uuid.uuid4().hex[:8],
+            value_type=str(random.randint(0, 100) % 3)
+        ))
+    return attrs
+
+
+def init_ci_types(num=1):
+    attrs = init_attributes(num)
+
+    ci_types = []
+    for i in range(num):
+        ci_type = CIType.create(
+            name=uuid.uuid4().hex[:8],
+            alias=uuid.uuid4().hex[:8],
+            unique_id=attrs[i].id
+        )
+        CITypeAttribute.create(
+            type_id=ci_type.id,
+            attr_id=attrs[i].id,
+        )
+        ci_types.append(ci_type)
+
+    return ci_types
+
+
+def init_attribute_groups(num=1):
+    ci_types = init_ci_types(num)
+
+    ags = []
+    for i in range(num):
+        ags.append(CITypeAttributeGroup.create(
+            name=uuid.uuid4().hex[:8],
+            type_id=ci_types[i].id,
+            order=i
+        ))
+    return ags
+
+
+def init_relation_type(num=1):
+    result = []
+    for i in range(num):
+        result.append(RelationType.create(
+            name=uuid.uuid4().hex[:8],
+        ))
+    return result
+
+
+def init_ci_type_relation(num=1):
+    result = []
+    ci_types = init_ci_types(num+1)
+    relation_types = init_relation_type(num)
+    for i in range(num):
+        result.append(CITypeRelation.create(
+            parent_id=ci_types[i].id,
+            child_id=ci_types[i+1].id,
+            relation_type_id=relation_types[i].id
+        ))
+    return result
+
+
+def fake_attr_value(attr_dict):
+    attr_type = attr_dict["value_type"]
+    attr_name = attr_dict["name"]
+
+    if attr_type == "0":
+        return {attr_name: random.randint(0, 1000)}
+    elif attr_type == "1":
+        return {attr_name: random.randint(0, 1000) / 3.0}
+    elif attr_type == "2":
+        return {attr_name: uuid.uuid4().hex[:8]}
+
+
+def init_ci(num=1):
+    # store ci need has user
+    force_add_user()
+    ci_type = init_ci_types(1)[0]
+    attrs = CITypeAttributeManager.get_attributes_by_type_id(ci_type.id)
+    manager = CIManager()
+    result = []
+
+    for i in range(num):
+        ci_id = manager.add(ci_type.name, **fake_attr_value(attrs[0]))
+        result.append(manager.get_ci_by_id_from_db(ci_id))
+
+    return result
+
+
+def init_ci_with_type(ci_types):
+    force_add_user()
+    cis = []
+    manager = CIManager()
+    for ci_type in ci_types:
+        attrs = CITypeAttributeManager.get_attributes_by_type_id(ci_type.id)
+        ci_id = manager.add(ci_type.name, **fake_attr_value(attrs[0]))
+        cis.append(manager.get_ci_by_id_from_db(ci_id))
+    return cis
+
+
+def init_ci_relation():
+    init_ci_type_relation(1)
+    ci_types = CIType.query.all()
+    cis = init_ci_with_type(ci_types)
+    manager = CIRelationManager()
+    cir_id = manager.add(cis[0]['ci_id'], cis[1]['ci_id'])
+    return cir_id
--- a/cmdb-api/tests/test_cmdb_attribute.py
+++ b/cmdb-api/tests/test_cmdb_attribute.py
@@ -0,0 +1,59 @@
+# -*- coding: utf-8 -*-
+from api.models.cmdb import Attribute
+
+from tests.sample import init_attributes
+
+
+def test_create_attribute(session, client):
+    url = "/api/v0.1/attributes"
+    payload = {
+        "name": "region",
+        "alias": "区域",
+        "value_type": "2"
+    }
+
+    resp = client.post(url, json=payload)
+
+    # check resp status code and content
+    assert resp.status_code == 200
+    assert resp.json["attr_id"]
+
+    # check there is a attribute in database
+    attr_id = resp.json["attr_id"]
+    attr_ins = Attribute.get_by_id(attr_id)
+    assert attr_ins.id == attr_id
+    assert attr_ins.name == "region"
+    assert attr_ins.alias == "区域"
+
+
+def test_update_attribute(session, client):
+    attr_ins = init_attributes(1)[0]
+
+    url = "/api/v0.1/attributes/" + str(attr_ins.id)
+    payload = {
+        "name": "update",
+    }
+
+    resp = client.put(url, json=payload)
+
+    # check resp status code and content
+    assert resp.status_code == 200
+    assert resp.json["attr_id"] == attr_ins.id
+
+    # check attribute updated in database
+    attr_ins = Attribute.get_by_id(attr_ins.id)
+    assert attr_ins.name == "update"
+
+
+def test_delete_attribute(session, client):
+    attr_ins = init_attributes(1)[0]
+    url = "/api/v0.1/attributes/" + str(attr_ins.id)
+
+    resp = client.delete(url)
+
+    assert resp.status_code == 200
+    # attr should be soft delete
+    attr_ins = Attribute.get_by_id(attr_ins.id)
+    assert attr_ins.deleted is True
+    assert attr_ins.deleted_at
+
--- a/cmdb-api/tests/test_cmdb_ci.py
+++ b/cmdb-api/tests/test_cmdb_ci.py
@@ -0,0 +1,89 @@
+# -*- coding: utf-8 -*-
+from .sample import init_ci_types, fake_attr_value, init_ci
+from api.lib.cmdb.ci_type import CITypeAttributeManager, CITypeManager
+from api.lib.cmdb.ci import CIManager
+from api.models.cmdb import CI
+
+
+def test_create_ci(session, client):
+    ci_type = init_ci_types(1)[0]
+    attrs = CITypeAttributeManager.get_attributes_by_type_id(ci_type.id)
+    url = "/api/v0.1/ci"
+
+    fake_value = fake_attr_value(attrs[0])
+
+    payload = {
+        "ci_type": ci_type.id,
+        **fake_value
+    }
+
+    resp = client.post(url, json=payload)
+    assert resp.status_code == 200
+    assert resp.json["ci_id"]
+
+    ci_id = resp.json["ci_id"]
+    ci = CIManager().get_ci_by_id_from_db(ci_id)
+    assert ci[attrs[0]["name"]] == fake_value[attrs[0]['name']]
+
+
+def test_update_ci(session, client):
+    ci = init_ci(1)[0]
+    ci_id = ci.get("ci_id")
+    ci_type = CITypeManager.get_ci_types(ci.get("ci_type"))[0]
+    attrs = CITypeAttributeManager.get_attributes_by_type_id(ci_type["id"])
+    url = "/api/v0.1/ci/{}".format(ci_id)
+
+    fake_value = fake_attr_value(attrs[0])
+
+    payload = {**fake_value}
+
+    resp = client.put(url, json=payload)
+
+    assert resp.status_code == 200
+    assert resp.json["ci_id"] == ci_id
+    ci = CIManager().get_ci_by_id_from_db(ci_id)
+    assert ci[attrs[0]['name']] == fake_value[attrs[0]['name']]
+
+
+def test_delete_ci(session, client):
+    ci = init_ci(1)[0]
+    ci_id = ci.get("ci_id")
+    url = "/api/v0.1/ci/{}".format(ci_id)
+
+    resp = client.delete(url)
+
+    assert resp.status_code == 200
+
+    ci_from_db = CI.query.filter_by(id=ci_id).first()
+    assert ci_from_db is None
+
+
+def test_get_ci_by_types(session, client):
+    ci = init_ci(1)[0]
+    ci_type = CITypeManager.get_ci_types(ci.get("ci_type"))[0]
+    url = "/api/v0.1/ci/type/{}".format(ci_type["id"])
+
+    resp = client.get(url)
+    assert resp.status_code == 200
+
+    assert resp.json['cis'][0]['ci_id'] == ci['ci_id']
+
+
+def test_get_ci_by_id(session, client):
+    ci = init_ci(1)[0]
+    url = "/api/v0.1/ci/{}".format(ci["ci_id"])
+
+    resp = client.get(url)
+    assert resp.status_code == 200
+    assert resp.json['ci_id'] == ci['ci_id']
+
+
+def test_get_ci_detail_by_id(session, client):
+    ci = init_ci(1)[0]
+    url = "/api/v0.1/ci/{}/detail".format(ci["ci_id"])
+
+    resp = client.get(url)
+    assert resp.status_code == 200
+    assert resp.json['id'] == ci['ci_id']
+
+
--- a/cmdb-api/tests/test_cmdb_ci_realtion.py
+++ b/cmdb-api/tests/test_cmdb_ci_realtion.py
@@ -0,0 +1,39 @@
+# -*- coding: utf-8 -*-
+from .sample import init_ci_with_type, init_ci_type_relation, init_ci_relation
+from api.lib.cmdb.ci import CIRelationManager
+from api.models.cmdb import CIRelation, CIType, CI
+
+
+def test_create_ci_relation(session, client):
+    init_ci_type_relation(1)
+    ci_types = CIType.query.all()
+    cis = init_ci_with_type(ci_types)
+
+    url = "/api/v0.1/ci_relations/{}/{}".format(cis[0]['ci_id'], cis[1]['ci_id'])
+
+    resp = client.post(url)
+    assert resp.status_code == 200
+    cr_id = resp.json['cr_id']
+    cr = CIRelation.get_by_id(cr_id)
+    assert cr is not None
+
+
+def test_delte_ci_relation_by_ci_id(session, client):
+    cr_id = init_ci_relation()
+    cis = CI.query.all()
+
+    url = "/api/v0.1/ci_relations/{}/{}".format(cis[0].id, cis[1].id)
+    resp = client.delete(url)
+    assert resp.status_code == 200
+    cr = CIRelation.get_by_id(cr_id)
+    assert cr is None
+
+
+def test_delete_ci_relation_by_id(session, client):
+    cr_id = init_ci_relation()
+    url = "/api/v0.1/ci_relations/{cr_id}".format(cr_id=cr_id)
+    resp = client.delete(url)
+    assert resp.status_code == 200
+    cr = CIRelation.get_by_id(cr_id)
+    assert cr is None
+
--- a/cmdb-api/tests/test_cmdb_ci_type.py
+++ b/cmdb-api/tests/test_cmdb_ci_type.py
@@ -0,0 +1,167 @@
+# -*- coding: utf-8 -*-
+from api.models.cmdb import (
+    CIType, CITypeAttribute,
+    Attribute, CITypeAttributeGroup,
+    CITypeAttributeGroupItem)
+
+from tests.sample import (
+    init_attributes, init_ci_types,
+    init_attribute_groups)
+
+
+def test_create_ci_type(session, client):
+    attr = init_attributes(1)[0]
+
+    url = "/api/v0.1/ci_types"
+    payload = {
+        "name": "test",
+        "alias": "测试",
+        "unique_key": attr.id
+    }
+
+    resp = client.post(url, json=payload)
+
+    # check resp status code and content
+    assert resp.status_code == 200
+    assert resp.json["type_id"]
+
+    # check there is a attribute in database
+    type_id = resp.json["type_id"]
+    ci_type_ins = CIType.get_by_id(type_id)
+    assert ci_type_ins.id == type_id
+    assert ci_type_ins.name == "test"
+    assert ci_type_ins.alias == "测试"
+    assert ci_type_ins.unique_id == attr.id
+
+
+def test_update_ci_type(session, client):
+    ci_type_ins = init_ci_types(1)[0]
+
+    url = "/api/v0.1/ci_types/" + str(ci_type_ins.id)
+    payload = {
+        "name": "update",
+    }
+
+    resp = client.put(url, json=payload)
+
+    # check resp status code and content
+    assert resp.status_code == 200
+    assert resp.json["type_id"] == ci_type_ins.id
+
+    # check ci_type updated in database
+    ci_type_ins = CIType.get_by_id(ci_type_ins.id)
+    assert ci_type_ins.name == "update"
+
+
+def test_delete_ci_type(session, client):
+    ci_type_ins = init_ci_types(1)[0]
+    url = "/api/v0.1/ci_types/" + str(ci_type_ins.id)
+
+    resp = client.delete(url)
+
+    assert resp.status_code == 200
+    # attr should be soft delete
+    ci_type_ins = CIType.get_by_id(ci_type_ins.id)
+    assert ci_type_ins.deleted is True
+    assert ci_type_ins.deleted_at
+
+
+def test_bind_attributes_ci_type(session, client):
+    attrs = init_attributes(3)
+    ci_type = init_ci_types(1)[0]
+
+    url = "/api/v0.1/ci_types/{}/attributes".format(ci_type.id)
+    payload = {
+        "attr_id": [str(x.id) for x in attrs]
+    }
+
+    resp = client.post(url, json=payload)
+
+    # check resp status code and content
+    assert resp.status_code == 200
+    assert len(resp.json["attributes"]) == len(attrs)
+
+    # check ci_type has 4 attributes
+    ci_type_attribute_ids = [x.attr_id for x in CITypeAttribute.query.filter_by(type_id=ci_type.id).all()]
+    for attr in attrs:
+        assert attr.id in ci_type_attribute_ids
+
+
+def test_get_attributes_ci_type(session, client):
+    ci_type = init_ci_types(1)[0]
+    url = "/api/v0.1/ci_types/{}/attributes".format(ci_type.name)
+
+    resp = client.get(url)
+
+    assert resp.status_code == 200
+    assert len(resp.json["attributes"]) == 1
+
+
+def test_update_attributes_ci_type(session, client):
+    ci_type = init_ci_types(1)[0]
+    attr = Attribute.query.first()
+    url = "/api/v0.1/ci_types/{}/attributes".format(ci_type.id)
+
+    payload = {
+        "attributes": [
+            {"attr_id": attr.id, "default_show": False, "is_required": True}
+        ]
+    }
+    resp = client.put(url, json=payload)
+    assert resp.status_code == 200
+
+    ci_type_attr_ins = CITypeAttribute.query.filter_by(type_id=ci_type.id).first()
+    assert ci_type_attr_ins
+    assert ci_type_attr_ins.is_required is True
+    assert ci_type_attr_ins.default_show is False
+
+
+def test_create_attribute_group_ci_type(session, client):
+    ci_type = init_ci_types(1)[0]
+
+    url = "/api/v0.1/ci_types/{}/attribute_groups".format(ci_type.id)
+    payload = {
+        "name": "A",
+        "order": 100,
+    }
+
+    resp = client.post(url, json=payload)
+
+    # check resp status code and content
+    assert resp.status_code == 200
+    assert resp.json["group_id"]
+
+    ins = CITypeAttributeGroup.query.filter_by(type_id=ci_type.id).first()
+    assert ins
+    assert ins.id == resp.json["group_id"]
+    assert ins.name == "A"
+    assert ins.order == 100
+
+
+def test_update_attribute_group_ci_type(session, client):
+    attribute_groups = init_attribute_groups(1)[0]
+
+    url = "/api/v0.1/ci_types/attribute_groups/{}".format(attribute_groups.id)
+    payload = {
+        "attributes": [x.id for x in Attribute.query.all()]
+    }
+
+    resp = client.put(url, json=payload)
+    assert resp.status_code == 200
+    assert resp.json["group_id"]
+
+    ag_items = CITypeAttributeGroupItem.query.filter_by(group_id=attribute_groups.id).all()
+    for a in Attribute.query.all():
+        assert a.id in [x.attr_id for x in ag_items]
+
+
+def test_delete_attribute_group_ci_type(session, client):
+    attribute_groups = init_attribute_groups(1)[0]
+
+    url = "/api/v0.1/ci_types/attribute_groups/{}".format(attribute_groups.id)
+    resp = client.delete(url)
+
+    assert resp.status_code == 200
+    attribute_group_ins = CITypeAttributeGroup.query.filter_by(id=attribute_groups.id).first()
+    assert attribute_group_ins.deleted is True
+    assert attribute_group_ins.deleted_at
--- a/cmdb-api/tests/test_cmdb_ci_type_relation.py
+++ b/cmdb-api/tests/test_cmdb_ci_type_relation.py
@@ -0,0 +1,86 @@
+# -*- coding: utf-8 -*-
+from api.models.cmdb import (
+   CITypeRelation
+)
+
+from .sample import init_relation_type, init_ci_types, init_ci_type_relation
+
+
+def test_create_ci_type_relation(session, client):
+    ci_types = init_ci_types(2)
+    relation_type = init_relation_type(1)[0]
+
+    url = "/api/v0.1/ci_type_relations/{}/{}".format(*[x.id for x in ci_types])
+    payload = {
+        "relation_type_id": relation_type.id,
+    }
+
+    resp = client.post(url, json=payload)
+
+    assert resp.status_code == 200
+    assert resp.json["ctr_id"]
+
+    ci_type_relations_id = resp.json["ctr_id"]
+    ci_type_relation = CITypeRelation.get_by_id(ci_type_relations_id)
+    assert ci_type_relation.parent_id == ci_types[0].id
+    assert ci_type_relation.child_id == ci_types[1].id
+    assert ci_type_relation.relation_type_id == relation_type.id
+
+
+def test_delete_ci_type_relation_by_ci_type_id(session, client):
+    ci_type_relation_ins = init_ci_type_relation(1)[0]
+    url = "/api/v0.1/ci_type_relations/{}/{}".format(
+        ci_type_relation_ins.parent_id, ci_type_relation_ins.child_id)
+    resp = client.delete(url)
+
+    assert resp.status_code == 200
+    # fake deleted
+    ci_type_relation_ins = CITypeRelation.query.filter_by(id=ci_type_relation_ins.id).first()
+    assert ci_type_relation_ins is not None
+
+
+def test_delete_ci_type_relation_by_id(session, client):
+    ci_type_relation_ins = init_ci_type_relation(1)[0]
+    url = "/api/v0.1/ci_type_relations/" + str(ci_type_relation_ins.id)
+    resp = client.delete(url)
+
+    assert resp.status_code == 200
+    # fake deleted
+    ci_type_relation_ins = CITypeRelation.query.filter_by(id=ci_type_relation_ins.id).first()
+    assert ci_type_relation_ins is not None
+
+
+def test_get_ci_type_relations(session, client):
+    ci_type_relations = init_ci_type_relation(2)
+    url = "/api/v0.1/ci_type_relations"
+    resp = client.get(url)
+
+    assert resp.status_code == 200
+    assert len(resp.json) == 2
+    assert resp.json[0]["id"] == ci_type_relations[0].id
+    assert resp.json[1]["id"] == ci_type_relations[1].id
+
+
+def test_get_children(session, client):
+    ci_type_relation_ins = init_ci_type_relation(1)[0]
+    url = "/api/v0.1/ci_type_relations/{parent_id}/children".format(
+        parent_id=ci_type_relation_ins.parent_id)
+    resp = client.get(url)
+
+    assert resp.status_code == 200
+    assert len(resp.json["children"]) == 1
+    assert resp.json["children"][0]["id"] == ci_type_relation_ins.child_id
+
+
+def test_get_parents(session, client):
+    ci_type_relation_ins = init_ci_type_relation(1)[0]
+    url = "/api/v0.1/ci_type_relations/{child_id}/parents".format(
+        child_id=ci_type_relation_ins.child_id)
+    resp = client.get(url)
+
+    assert resp.status_code == 200
+    assert len(resp.json["parents"]) == 1
+    assert resp.json["parents"][0]["id"] == ci_type_relation_ins.parent_id
+
+
+
--- a/cmdb-api/tests/test_cmdb_history.py
+++ b/cmdb-api/tests/test_cmdb_history.py
--- a/cmdb-api/tests/test_cmdb_preference.py
+++ b/cmdb-api/tests/test_cmdb_preference.py
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
pycook	5b38385f7e	release version 2.1	2020-04-01 21:20:47 +08:00
pycook	036e1d236b	auth with ldap	2020-04-01 20:30:44 +08:00
pycook	c31be0f753	UI: batch update relation	2020-04-01 11:09:41 +08:00
pycook	764d2fac3f	add .eslintrc.js	2020-03-26 17:35:26 +08:00
pycook	f4079e9c3e	Merge pull request #42 from pycook/dependabot/npm_and_yarn/cmdb-ui/yarn-1.22.0 Bump yarn from 1.21.1 to 1.22.0 in /cmdb-ui	2020-03-26 17:29:53 +08:00
pycook	2a0ed72235	fix: delete attribute	2020-03-23 15:49:33 +08:00
dependabot[bot]	9e803ae4c7	Bump yarn from 1.21.1 to 1.22.0 in /cmdb-ui Bumps [yarn](https://github.com/yarnpkg/yarn) from 1.21.1 to 1.22.0. - [Release notes](https://github.com/yarnpkg/yarn/releases) - [Changelog](https://github.com/yarnpkg/yarn/blob/master/CHANGELOG.md) - [Commits](https://github.com/yarnpkg/yarn/compare/v1.21.1...v1.22.0) Signed-off-by: dependabot[bot] <support@github.com>	2020-03-22 03:14:30 +00:00
pycook	bebdb61adf	update deps	2020-03-22 11:14:09 +08:00
pycook	f49cad771b	Merge pull request #41 from pycook/dependabot/npm_and_yarn/cmdb-ui/acorn-5.7.4 Bump acorn from 5.7.3 to 5.7.4 in /cmdb-ui	2020-03-15 13:06:51 +08:00
dependabot[bot]	a5b4fbda40	Bump acorn from 5.7.3 to 5.7.4 in /cmdb-ui Bumps [acorn](https://github.com/acornjs/acorn) from 5.7.3 to 5.7.4. - [Release notes](https://github.com/acornjs/acorn/releases) - [Commits](https://github.com/acornjs/acorn/compare/5.7.3...5.7.4) Signed-off-by: dependabot[bot] <support@github.com>	2020-03-14 18:55:18 +00:00
pycook	2cce2d5cf2	Fix: permission management	2020-03-13 10:30:21 +08:00
pycook	e720b7af66	Merge branch 'develop' of https://github.com/pycook/cmdb into develop	2020-03-10 17:03:23 +08:00
pycook	09e4a5111b	Merge pull request #40 from OhBonsai/develop chore: use wait script to hang api before cache/db/es started	2020-03-10 17:01:58 +08:00
penzai	3539b12503	chore: use wait script to hang api before cache/db/es started	2020-03-10 16:49:40 +08:00
pycook	21d8673b5d	Merge pull request #38 from AngrygrayWolf/dev Change the requirements to support python3.8	2020-03-07 22:06:25 +08:00
what	7154426dc7	Change Pipfile	2020-03-07 21:51:37 +08:00
what	ca75c7dcd0	Change the requirements to support python3.8	2020-03-07 21:20:46 +08:00
pycook	194a2254a6	fix case sensitive of ES search	2020-02-28 14:32:51 +08:00
pycook	26abad14d0	Merge branch 'develop' of https://github.com/pycook/cmdb into develop	2020-02-23 23:13:59 +08:00
pycook	1521a71f9c	alter table c_preference_relation_views column name varchar(64)	2020-02-23 23:13:22 +08:00
pycook	d425b455f1	Merge pull request #36 from OhBonsai/develop test: add ci and ci relation crud test cases	2020-02-23 23:12:36 +08:00
pycook	230307474b	version 2.1 and update readme	2020-02-23 20:21:13 +08:00
pycook	69d6b40e39	/ redirect to /relation_views	2020-02-23 18:53:28 +08:00
pycook	5dc2f89e7f	fix i18n	2020-02-23 18:41:23 +08:00
pycook	9eaca4d6a0	add library future	2020-02-21 23:29:20 +08:00
pycook	3680a462f5	Remove Chinese comments	2020-02-21 23:14:26 +08:00
pycook	3ac50e7cd8	lint	2020-02-21 22:46:12 +08:00
pycook	21b2cc1d5d	The resource view is made into a two-level menu	2020-02-21 22:44:10 +08:00
penzai	cd5448cc7d	test: add ci and ci relation crud test cases	2020-02-18 22:05:13 +08:00
pycook	10610bdb4b	logo left justify	2020-02-16 19:18:51 +08:00
pycook	b5c2156387	Merge pull request #35 from shaohaojiecoder/i18n I18n	2020-02-16 19:06:58 +08:00
pycook	b05ae0d1a7	Merge pull request #34 from OhBonsai/develop add test cases	2020-02-16 19:06:24 +08:00
shaohaojiecoder	bbf6138d43	Merge branch 'develop' into i18n	2020-02-16 18:19:09 +08:00
shaohaojiecoder	1ba3e6a680	add a log pic	2020-02-16 18:18:15 +08:00
penzai	64045c1f93	test: add some test cases	2020-02-16 18:03:33 +08:00
penzai	5a3e55813c	model: allow origin and ticket_id nullable in OperationRecord	2020-02-16 18:03:08 +08:00
penzai	bc72e58886	auth: add user in flask.g when auth by jwt	2020-02-16 18:02:24 +08:00
pycook	9e78955ba1	ACL i18n	2020-02-16 17:36:03 +08:00
pycook	136853d9a4	Merge pull request #33 from shaohaojiecoder/i18n fix local storage for defalut lang	2020-02-16 14:51:59 +08:00
pycook	036e3ad00d	modeling i18n	2020-02-16 14:50:17 +08:00
shaohaojiecoder	5ce6c93237	fix local storage for defalut lang	2020-02-16 13:47:30 +08:00
pycook	43dba7f7ed	Merge pull request #32 from OhBonsai/develop fix: recycle import by celery task	2020-02-16 10:38:27 +08:00
penzai	f4879d20d6	fix: recycle import by celery task	2020-02-16 09:39:33 +08:00
pycook	740e4c6034	i18n	2020-02-15 20:57:47 +08:00
pycook	0f2baa1d94	Merge pull request #31 from shaohaojiecoder/i18n I18n	2020-02-11 09:50:50 +08:00
pycook	405b0af72c	Merge branch 'develop' into i18n	2020-02-11 09:50:11 +08:00
shaohaojiecoder	a4e5178979	fix meta title	2020-02-09 19:50:23 +08:00
shaohaojiecoder	c14fe23283	add i18n basic structure	2020-02-09 17:54:57 +08:00
shaohaojiecoder	b3a058f908	add something	2020-02-09 17:22:17 +08:00
shaohaojiecoder	bd82a0e27c	add some	2020-02-08 22:27:56 +08:00
pycook	f22a5c3543	Define display fields	2020-02-08 17:39:42 +08:00
pycook	ed81c3f091	Define display fields	2020-02-08 17:36:54 +08:00
shaohaojiecoder	07814b85f9	add basic	2020-02-07 22:05:52 +08:00
pycook	db52b28d6b	fix jwt decode	2020-02-06 09:59:24 +08:00
pycook	fc85ba21c8	Merge pull request #29 from OhBonsai/master fix ci_type_attr_group update bug and add ci_type test case	2020-02-04 12:47:15 +08:00
Bonsai	6c5ee3fcd9	Merge pull request #2 from pycook/master merge from main repo	2020-02-04 10:56:03 +08:00
penzai	40f1ef88a9	test: add ci_type test cases	2020-02-04 10:54:16 +08:00
penzai	bce422ffc8	fix: update attribute group without name params will fail. #tests/test_cmdb_ci_type.py::test_update_attribute_group_ci_type	2020-02-04 10:53:07 +08:00
pycook	7c79066532	Merge branch 'master' of https://github.com/pycook/cmdb	2020-01-19 18:18:43 +08:00
pycook	1129ac93fb	Merge pull request #28 from shaohaojiecoder/master fix drag group and attrs	2020-01-19 18:18:23 +08:00
haojie.shao	5ab0e7e737	fix drag group and attrs	2020-01-19 18:14:53 +08:00
pycook	23319c7417	/ci_types/<int:type_id>/attributes/transfer and /ci_types/<int:type_id>/attribute_groups/transfer	2020-01-19 17:59:32 +08:00
pycook	c74f85cabb	Merge pull request #26 from OhBonsai/master test: add basic test code and attribute create api test case	2020-01-17 15:34:02 +08:00
penzai	fce2b689fb	Merge remote-tracking branch 'origin/master'	2020-01-17 15:10:16 +08:00
penzai	105327bb0c	test: add basic test code and attribute create api test case	2020-01-17 15:08:46 +08:00
Bonsai	745c43d0a4	Merge pull request #1 from pycook/master merge master	2020-01-17 10:05:05 +08:00
pycook	3130d94568	[fix] cycle import	2020-01-15 11:52:33 +08:00
pycook	04a66eb239	flush cache when delete attribute	2020-01-15 09:06:31 +08:00
pycook	68390ec6f1	[fix] delete CIType's attribute	2020-01-14 20:52:36 +08:00
pycook	17392be138	api docs update	2020-01-06 21:58:06 +08:00
pycook	f2fdb29221	api docs update	2020-01-06 21:54:33 +08:00
pycook	4a18698423	update README	2019-12-31 22:53:21 +08:00
pycook	95ccee04f9	update README	2019-12-31 22:50:01 +08:00
pycook	b60628247b	Update README.md update	2019-12-31 22:37:36 +08:00
pycook	a6d7699ab4	Merge pull request #24 from fxiang21/master add Readme of English	2019-12-31 22:32:48 +08:00
fxiang21	4b21bcc438	add Readme of English	2019-12-31 22:25:42 +08:00
pycook	33dce2f0f3	Update README.md [fix] flask db-setup	2019-12-31 11:06:59 +08:00
pycook	d43b827fe5	[fix] fuzzy search	2019-12-25 13:36:43 +08:00
pycook	aec8bade41	[fix] security alerts	2019-12-25 10:19:03 +08:00
pycook	89ae89a449	[fix] validate attribute is required	2019-12-24 20:37:32 +08:00
pycook	945f90e386	disable eslint warning	2019-12-24 15:15:03 +08:00
pycook	2ba6a16613	support JSON type	2019-12-23 18:51:33 +08:00
pycook	6089039366	fix sidebar menu in mobile	2019-12-23 11:58:41 +08:00
pycook	e1e5307084	add yarn.lock	2019-12-23 11:27:47 +08:00
pycook	2ff7fce9dd	flask init-acl	2019-12-20 12:57:39 +09:00
pycook	fc4d3e0c1a	update makefile	2019-12-18 23:36:58 +09:00
pycook	f66a94712e	Modify code organization	2019-12-18 23:33:22 +09:00
pycook	24664c7686	catch abort exception when getting relation views	2019-12-13 09:59:38 +08:00
pycook	1d668bab6e	update	2019-12-12 21:45:19 +08:00
pycook	3d4b84909e	fix delete relation view	2019-12-12 21:36:33 +08:00
pycook	8341e742eb	[fix] update attribute which is list	2019-12-11 18:12:10 +08:00
pycook	a71ba83de0	release 2.0	2019-12-11 12:43:55 +08:00
pycook	9668131c18	V2.0	2019-12-11 12:14:23 +08:00
pycook	4a744dcad9	fix relation tree	2019-12-10 15:35:59 +08:00
pycook	2a420225e2	Merge pull request #22 from lovvvve/FixDelCi_type fix(ci_type api): fix the judgment condition of deleting ci_type	2019-12-10 14:41:27 +08:00
Lovvvve	ff67785618	fix(ci_type api): fix the judgment condition of deleting ci_type	2019-12-10 14:31:27 +08:00
pycook	dfe1ba55d5	sidebar scroll	2019-12-09 17:16:38 +08:00
pycook	90b1b6b7af	fix relation view	2019-12-09 12:03:58 +08:00
pycook	d5fbe42ed7	relation view bugfix	2019-12-08 00:20:55 +08:00
pycook	f424ad6864	acl done and bugfix	2019-12-06 22:33:31 +08:00
pycook	16b724bd40	ACL: permission management [doing]	2019-12-04 18:14:09 +08:00
pycook	f70ed54cad	update readme	2019-12-04 09:26:01 +08:00
pycook	dd64564160	remove print	2019-12-03 22:13:14 +08:00
pycook	cc2cdbcc9f	fix delete ci relation	2019-12-03 21:57:44 +08:00
pycook	81fe850627	fix get second cis api	2019-12-03 20:10:27 +08:00
pycook	487d9f76f6	关系视图定义支持两只方式	2019-12-03 19:54:01 +08:00
pycook	92dd4c5dfe	relation view has been optimised	2019-12-03 19:10:54 +08:00