backend/internal/middleware/casbin.go

package middleware

import (
	"slices"
	"strings"

	"with_you/internal/service"

	"github.com/gin-gonic/gin"
)

// RequireRole 要求特定角色的中间件
func RequireRole(casbinService service.CasbinService, requiredRoles ...string) gin.HandlerFunc {
	return func(c *gin.Context) {
		userID, exists := c.Get("user_id")
		if !exists {
			c.AbortWithStatusJSON(401, gin.H{
				"code":    "UNAUTHORIZED",
				"message": "请先登录",
			})
			return
		}

		userRoles, err := casbinService.GetRolesForUser(c.Request.Context(), userID.(string))
		if err != nil {
			c.AbortWithStatusJSON(500, gin.H{
				"code":    "INTERNAL_ERROR",
				"message": "获取用户角色失败",
			})
			return
		}

		// 检查用户是否拥有任一所需角色
		hasRole := slices.ContainsFunc(requiredRoles, func(required string) bool {
			return slices.Contains(userRoles, required)
		})

		if !hasRole {
			c.AbortWithStatusJSON(403, gin.H{
				"code":    "FORBIDDEN",
				"message": "需要以下角色之一: " + strings.Join(requiredRoles, ", "),
			})
			return
		}

		c.Next()
	}
}