102 lines
2.0 KiB
Go
102 lines
2.0 KiB
Go
package middleware
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
db "server/internal/db/sqlc"
|
|
"server/internal/pkg/cache"
|
|
"server/internal/pkg/errs"
|
|
"server/internal/pkg/httputil"
|
|
"strings"
|
|
|
|
"github.com/go-chi/chi/v5"
|
|
)
|
|
|
|
const (
|
|
IsAdminKey contextKey = "is_admin"
|
|
)
|
|
|
|
type AuthMiddleware struct {
|
|
queries *db.Queries
|
|
cache *cache.Caches
|
|
}
|
|
|
|
func NewAuthMiddleware(queries *db.Queries, cache *cache.Caches) *AuthMiddleware {
|
|
return &AuthMiddleware{
|
|
cache: cache,
|
|
queries: queries,
|
|
}
|
|
}
|
|
|
|
func (m *AuthMiddleware) Middleware(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
ctx := r.Context()
|
|
|
|
claims, ok := GetClaims(ctx)
|
|
if !ok || claims.UserID == 0 {
|
|
httputil.Fail(w, errs.ErrUnauthorized)
|
|
return
|
|
}
|
|
|
|
// 判断是否有管理员权限 目前只判断uid是否为1
|
|
isAdmin := userIsAdmin(claims.UserID)
|
|
|
|
if isAdmin {
|
|
ctx = context.WithValue(ctx, IsAdminKey, isAdmin)
|
|
next.ServeHTTP(w, r.WithContext(ctx))
|
|
return
|
|
}
|
|
|
|
hasPermission, err := userHasApiPermission(ctx, r, m.queries, claims.UserID, m.cache)
|
|
if err != nil {
|
|
httputil.Fail(w, err)
|
|
return
|
|
}
|
|
|
|
if !hasPermission {
|
|
httputil.Fail(w, errs.ErrPermissionDenied)
|
|
return
|
|
}
|
|
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
|
|
func userIsAdmin(uid int32) bool {
|
|
if uid == 1 {
|
|
return true
|
|
}
|
|
|
|
return false
|
|
}
|
|
|
|
func userHasApiPermission(ctx context.Context, r *http.Request, queries *db.Queries, uid int32, cache *cache.Caches) (bool, error) {
|
|
var (
|
|
apis []db.GetSysUserApisRow
|
|
err error
|
|
)
|
|
|
|
apis, ok := cache.SysUserApisCache.GetIfPresent(uid)
|
|
|
|
if !ok {
|
|
apis, err = queries.GetSysUserApis(ctx, uid)
|
|
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
cache.SysUserApisCache.Set(uid, apis)
|
|
}
|
|
|
|
requestPath := chi.RouteContext(r.Context()).RoutePattern()
|
|
requestPath = strings.TrimPrefix(requestPath, "/api")
|
|
requestMethod := r.Method
|
|
|
|
for _, api := range apis {
|
|
if api.Path == requestPath && api.Method == requestMethod {
|
|
return true, nil
|
|
}
|
|
}
|
|
|
|
return false, nil
|
|
}
|