refactor: 移除全局单例、修复分层违规、统一错误与响应

internal/middleware/casbin.go

@@ -3,6 +3,7 @@ package middleware
 import (
 	"net/http"
 
+	"carrotskin/internal/model"
 	"carrotskin/pkg/auth"
 
 	"github.com/gin-gonic/gin"
@@ -15,10 +16,11 @@ func CasbinMiddleware(casbinService *auth.CasbinService, resource, action string
 		// 从上下文获取用户角色（由AuthMiddleware设置）
 		role, exists := c.Get("user_role")
 		if !exists {
-			c.JSON(http.StatusUnauthorized, gin.H{
-				"success": false,
-				"message": "未授权访问",
-			})
+			c.JSON(http.StatusUnauthorized, model.NewErrorResponse(
+				model.CodeUnauthorized,
+				model.MsgUnauthorized,
+				nil,
+			))
 			c.Abort()
 			return
 		}
@@ -30,10 +32,11 @@ func CasbinMiddleware(casbinService *auth.CasbinService, resource, action string
 
 		// 检查权限
 		if !casbinService.CheckPermission(roleStr, resource, action) {
-			c.JSON(http.StatusForbidden, gin.H{
-				"success": false,
-				"message": "权限不足",
-			})
+			c.JSON(http.StatusForbidden, model.NewErrorResponse(
+				model.CodeForbidden,
+				model.MsgForbidden,
+				nil,
+			))
 			c.Abort()
 			return
 		}
@@ -47,20 +50,22 @@ func RequireAdmin() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		role, exists := c.Get("user_role")
 		if !exists {
-			c.JSON(http.StatusUnauthorized, gin.H{
-				"success": false,
-				"message": "未授权访问",
-			})
+			c.JSON(http.StatusUnauthorized, model.NewErrorResponse(
+				model.CodeUnauthorized,
+				model.MsgUnauthorized,
+				nil,
+			))
 			c.Abort()
 			return
 		}
 
 		roleStr, ok := role.(string)
 		if !ok || roleStr != "admin" {
-			c.JSON(http.StatusForbidden, gin.H{
-				"success": false,
-				"message": "需要管理员权限",
-			})
+			c.JSON(http.StatusForbidden, model.NewErrorResponse(
+				model.CodeForbidden,
+				"需要管理员权限",
+				nil,
+			))
 			c.Abort()
 			return
 		}
@@ -74,20 +79,22 @@ func RequireRole(allowedRoles ...string) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		role, exists := c.Get("user_role")
 		if !exists {
-			c.JSON(http.StatusUnauthorized, gin.H{
-				"success": false,
-				"message": "未授权访问",
-			})
+			c.JSON(http.StatusUnauthorized, model.NewErrorResponse(
+				model.CodeUnauthorized,
+				model.MsgUnauthorized,
+				nil,
+			))
 			c.Abort()
 			return
 		}
 
 		roleStr, ok := role.(string)
 		if !ok {
-			c.JSON(http.StatusForbidden, gin.H{
-				"success": false,
-				"message": "权限不足",
-			})
+			c.JSON(http.StatusForbidden, model.NewErrorResponse(
+				model.CodeForbidden,
+				model.MsgForbidden,
+				nil,
+			))
 			c.Abort()
 			return
 		}
@@ -100,10 +107,11 @@ func RequireRole(allowedRoles ...string) gin.HandlerFunc {
 			}
 		}
 
-		c.JSON(http.StatusForbidden, gin.H{
-			"success": false,
-			"message": "权限不足",
-		})
+		c.JSON(http.StatusForbidden, model.NewErrorResponse(
+			model.CodeForbidden,
+			model.MsgForbidden,
+			nil,
+		))
 		c.Abort()
 	}
 }