eb931bf1c6
Add Session model, SessionService, and SessionRepository to track user login sessions and enable token revocation on auth-critical events. - Introduce explicit TokenType (access/refresh) in JWT claims to prevent refresh token misuse via access token endpoints - Add SessionID field to JWT claims, enabling stateless JWT validation against revoked sessions - Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline that validates token type, account status, and session validity - Implement session revocation on password change, reset, user ban/inactive, and explicit logout - Add Principal cache with active invalidation for banned/role-changed users - Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID is conversation participant via GetParticipantStrict - Add group member visibility checks: announcements, group info, member list now require group membership - Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher with globMatch; user_roles table is single source of truth for roles - Add migration logic to clean legacy casbin g rules and migrate old p rules from path-style to admin/<domain> resource naming
50 lines
1.7 KiB
Go
50 lines
1.7 KiB
Go
package middleware
|
||
|
||
import (
|
||
"net/http"
|
||
|
||
"github.com/gin-gonic/gin"
|
||
|
||
apperrors "with_you/internal/errors"
|
||
"with_you/internal/pkg/auth"
|
||
"with_you/internal/pkg/response"
|
||
"with_you/internal/service"
|
||
)
|
||
|
||
// Authorize 基于 Casbin 资源/动作策略的路由级授权中间件。
|
||
//
|
||
// 用法：挂在 RequireAuth 之后，按路由标注 (resource, action)。
|
||
// admin.POST("/users/:id/roles", middleware.Authorize(casbin, "admin/users/roles", "write"), h.AssignRole)
|
||
//
|
||
// 校验流程：
|
||
// 1. 从 context 取出 Principal（由 RequireAuth 写入）。
|
||
// 2. 调 CasbinService.EnforceForUser(userID, resource, action)。
|
||
// - 内部先查 user_roles 表得到角色集合，再对每个角色调 Enforce(role, resource, action)。
|
||
// - super_admin 通过 admin/** 通配策略获得所有 admin 能力。
|
||
// 3. 不匹配 → 403 PERMISSION_DENIED。
|
||
//
|
||
// 纵深防御：service 层对最敏感操作（如分配 super_admin）应再次校验 operator 角色，
|
||
// 即使路由 Authorize 漏配，Service 仍能拦截。
|
||
func Authorize(casbinService service.CasbinService, resource, action string) gin.HandlerFunc {
|
||
return func(c *gin.Context) {
|
||
p, ok := auth.GetPrincipal(c)
|
||
if !ok || p == nil {
|
||
response.ErrorWithStringCode(c, http.StatusUnauthorized, "UNAUTHORIZED", "未授权")
|
||
c.Abort()
|
||
return
|
||
}
|
||
|
||
allowed, err := casbinService.EnforceForUser(c.Request.Context(), p.UserID, resource, action)
|
||
if err != nil {
|
||
response.ErrorWithStringCode(c, http.StatusInternalServerError, "CASBIN_INTERNAL_ERROR", "权限系统内部错误")
|
||
c.Abort()
|
||
return
|
||
}
|
||
if !allowed {
|
||
response.ErrorWithStringCode(c, http.StatusForbidden, apperrors.ErrPermissionDenied.Code, apperrors.ErrPermissionDenied.Message)
|
||
c.Abort()
|
||
return
|
||
}
|
||
c.Next()
|
||
}
|
||
} |