lan
9a1851f023
This commit performs a significant cleanup of the codebase by removing unused functions, methods, and entire files across various internal modules. This reduces technical debt and simplifies the project structure. Key changes include: - **cache**: Removed unused cache key generators and metrics snapshots. - **dto**: Removed redundant converter functions and segment creation helpers. - **middleware**: Deleted the unused `logger.go` middleware and simplified `ratelimit.go` and `casbin.go`. - **model**: Removed unused ID helpers, database closing functions, and batch decryption logic. - **pkg**: Cleaned up unused utility functions in `circuitbreaker`, `crypto`, `cursor`, `hook`, and `utils`. - **service**: Deleted `account_cleanup_service.go` and removed unused helper functions in `log_cleanup_service.go` and `sensitive_service.go`. - **repository**: Removed unused private loading methods in `comment_repo.go`.
106 lines
2.4 KiB
Go
106 lines
2.4 KiB
Go
package middleware
|
|
|
|
import (
|
|
"slices"
|
|
"strings"
|
|
|
|
"with_you/internal/service"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
// CasbinAuth Casbin 权限中间件
|
|
// 需要在 Auth 中间件之后使用
|
|
func CasbinAuth(casbinService service.CasbinService) gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
// 获取请求路径和方法
|
|
path := c.Request.URL.Path
|
|
method := c.Request.Method
|
|
|
|
// 从上下文获取用户ID (由 Auth 中间件设置)
|
|
userID, exists := c.Get("user_id")
|
|
|
|
// 如果用户未登录，检查是否是公开路由
|
|
if !exists {
|
|
// 对于未登录用户，使用匿名角色检查权限
|
|
allowed, err := casbinService.Enforce(c.Request.Context(), "anonymous", path, method)
|
|
if err != nil {
|
|
c.AbortWithStatusJSON(500, gin.H{
|
|
"code": "INTERNAL_ERROR",
|
|
"message": "权限检查失败",
|
|
})
|
|
return
|
|
}
|
|
|
|
if !allowed {
|
|
c.AbortWithStatusJSON(401, gin.H{
|
|
"code": "UNAUTHORIZED",
|
|
"message": "请先登录",
|
|
})
|
|
return
|
|
}
|
|
|
|
c.Next()
|
|
return
|
|
}
|
|
|
|
// 检查用户权限
|
|
allowed, err := casbinService.EnforceForUser(c.Request.Context(), userID.(string), path, method)
|
|
if err != nil {
|
|
c.AbortWithStatusJSON(500, gin.H{
|
|
"code": "INTERNAL_ERROR",
|
|
"message": "权限检查失败",
|
|
})
|
|
return
|
|
}
|
|
|
|
if !allowed {
|
|
c.AbortWithStatusJSON(403, gin.H{
|
|
"code": "FORBIDDEN",
|
|
"message": "权限不足",
|
|
})
|
|
return
|
|
}
|
|
|
|
c.Next()
|
|
}
|
|
}
|
|
|
|
// RequireRole 要求特定角色的中间件
|
|
func RequireRole(casbinService service.CasbinService, requiredRoles ...string) gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
userID, exists := c.Get("user_id")
|
|
if !exists {
|
|
c.AbortWithStatusJSON(401, gin.H{
|
|
"code": "UNAUTHORIZED",
|
|
"message": "请先登录",
|
|
})
|
|
return
|
|
}
|
|
|
|
userRoles, err := casbinService.GetRolesForUser(c.Request.Context(), userID.(string))
|
|
if err != nil {
|
|
c.AbortWithStatusJSON(500, gin.H{
|
|
"code": "INTERNAL_ERROR",
|
|
"message": "获取用户角色失败",
|
|
})
|
|
return
|
|
}
|
|
|
|
// 检查用户是否拥有任一所需角色
|
|
hasRole := slices.ContainsFunc(requiredRoles, func(required string) bool {
|
|
return slices.Contains(userRoles, required)
|
|
})
|
|
|
|
if !hasRole {
|
|
c.AbortWithStatusJSON(403, gin.H{
|
|
"code": "FORBIDDEN",
|
|
"message": "需要以下角色之一: " + strings.Join(requiredRoles, ", "),
|
|
})
|
|
return
|
|
}
|
|
|
|
c.Next()
|
|
}
|
|
}
|