eb931bf1c6
Add Session model, SessionService, and SessionRepository to track user login sessions and enable token revocation on auth-critical events. - Introduce explicit TokenType (access/refresh) in JWT claims to prevent refresh token misuse via access token endpoints - Add SessionID field to JWT claims, enabling stateless JWT validation against revoked sessions - Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline that validates token type, account status, and session validity - Implement session revocation on password change, reset, user ban/inactive, and explicit logout - Add Principal cache with active invalidation for banned/role-changed users - Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID is conversation participant via GetParticipantStrict - Add group member visibility checks: announcements, group info, member list now require group membership - Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher with globMatch; user_roles table is single source of truth for roles - Add migration logic to clean legacy casbin g rules and migrate old p rules from path-style to admin/<domain> resource naming
35 lines
926 B
Go
35 lines
926 B
Go
package middleware
|
||
|
||
import (
|
||
"net/http"
|
||
|
||
"github.com/gin-gonic/gin"
|
||
|
||
"with_you/internal/pkg/auth"
|
||
"with_you/internal/pkg/response"
|
||
)
|
||
|
||
// RequireActive 要求账户状态为 active。
|
||
//
|
||
// 业务策略：
|
||
// - active：放行。
|
||
// - pending_deletion：在 /users/me/* 路由允许（用户可取消注销），但在 /admin/* 与敏感操作拒绝。
|
||
// - banned/inactive：已由 RequireAuth 在认证管道拦截，不会到达此处。
|
||
//
|
||
// 应挂在需要严格 active 状态的路由组上（如 /admin）。
|
||
func RequireActive() gin.HandlerFunc {
|
||
return func(c *gin.Context) {
|
||
p, ok := auth.GetPrincipal(c)
|
||
if !ok || p == nil {
|
||
response.ErrorWithStringCode(c, http.StatusUnauthorized, "UNAUTHORIZED", "未授权")
|
||
c.Abort()
|
||
return
|
||
}
|
||
if !p.IsActive() {
|
||
response.ErrorWithStringCode(c, http.StatusForbidden, "ACCOUNT_INACTIVE", "账号未激活")
|
||
c.Abort()
|
||
return
|
||
}
|
||
c.Next()
|
||
}
|
||
} |