131 lines
3.1 KiB
Go
131 lines
3.1 KiB
Go
package middleware
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"net/http"
|
|
"server/internal/config"
|
|
"server/internal/db"
|
|
"server/internal/db/sqlc"
|
|
"server/internal/model/auth"
|
|
"server/internal/pkg/cache"
|
|
"server/internal/pkg/cache/cachekey"
|
|
"server/internal/pkg/errs"
|
|
"server/internal/pkg/httputil"
|
|
|
|
"github.com/go-chi/chi/v5"
|
|
"github.com/jackc/pgx/v5"
|
|
)
|
|
|
|
type AuthMiddleware struct {
|
|
store *db.Store
|
|
cache *cache.Caches
|
|
cfg *config.Config
|
|
}
|
|
|
|
func NewAuthMiddleware(store *db.Store, cache *cache.Caches, cfg *config.Config) *AuthMiddleware {
|
|
return &AuthMiddleware{
|
|
cache: cache,
|
|
store: store,
|
|
cfg: cfg,
|
|
}
|
|
}
|
|
|
|
func (m *AuthMiddleware) hasApiPermission(ctx context.Context, uid int32, requestMethod string, requestPath string) (bool, error) {
|
|
var (
|
|
apis []sqlc.ListUserApisRow
|
|
err error
|
|
)
|
|
|
|
// 先从缓存中获取api数据
|
|
k := cachekey.UserApiPermissions(uid)
|
|
apis, err = cache.GetOrSetJSON[[]sqlc.ListUserApisRow](ctx, m.cache, k, 0, func() ([]sqlc.ListUserApisRow, error) {
|
|
return m.store.ListUserApis(ctx, uid)
|
|
})
|
|
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
for _, api := range apis {
|
|
if api.Method != requestMethod {
|
|
continue
|
|
}
|
|
|
|
if api.Path == requestPath {
|
|
return true, nil
|
|
}
|
|
}
|
|
|
|
return false, nil
|
|
}
|
|
|
|
func (m *AuthMiddleware) getAuthState(ctx context.Context, id int32) (*sqlc.GetUserAuthStateRow, error) {
|
|
return cache.GetOrSetJSON[*sqlc.GetUserAuthStateRow](ctx, m.cache, cachekey.UserAuthState(id), m.cfg.JWTConfig.Expire, func() (*sqlc.GetUserAuthStateRow, error) {
|
|
state, err := m.store.GetUserAuthState(ctx, id)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return &state, nil
|
|
})
|
|
}
|
|
|
|
func (m *AuthMiddleware) Middleware(router chi.Router) func(handler http.Handler) http.Handler {
|
|
return func(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
ctx := r.Context()
|
|
|
|
userCtx := GetUserContext(ctx)
|
|
|
|
if userCtx == nil || userCtx.UserID == 0 {
|
|
httputil.Fail(w, errs.ErrUnauthorized)
|
|
return
|
|
}
|
|
|
|
// 判断token version
|
|
state, err := m.getAuthState(ctx, userCtx.UserID)
|
|
if err != nil {
|
|
if errors.Is(err, pgx.ErrNoRows) {
|
|
httputil.Fail(w, errs.ErrInvalidToken) // 用户被删
|
|
return
|
|
}
|
|
httputil.Fail(w, errs.ErrInternalServer) // 基础设施故障，不杀会话
|
|
return
|
|
}
|
|
|
|
if state.TokenVersion != userCtx.TokenVersion {
|
|
httputil.Fail(w, errs.ErrInvalidToken) // 被踢 → 401
|
|
return
|
|
}
|
|
|
|
// 判断是否有管理员权限
|
|
isAdmin := auth.IsAdmin(userCtx.UserID)
|
|
userCtx.IsAdmin = isAdmin
|
|
|
|
if isAdmin {
|
|
next.ServeHTTP(w, r.WithContext(ctx))
|
|
return
|
|
}
|
|
|
|
// 如果不是管理员 需要判断api权限
|
|
rctx := chi.NewRouteContext()
|
|
requestMethod := r.Method
|
|
// https://github.com/go-chi/chi/pull/872
|
|
api := router.Find(rctx, requestMethod, r.URL.Path)
|
|
|
|
hasPermission, err := m.hasApiPermission(ctx, userCtx.UserID, requestMethod, api)
|
|
if err != nil {
|
|
httputil.Fail(w, err)
|
|
return
|
|
}
|
|
|
|
if !hasPermission {
|
|
httputil.Fail(w, errs.ErrPermissionDenied)
|
|
return
|
|
}
|
|
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
}
|