eb931bf1c6
Add Session model, SessionService, and SessionRepository to track user login sessions and enable token revocation on auth-critical events. - Introduce explicit TokenType (access/refresh) in JWT claims to prevent refresh token misuse via access token endpoints - Add SessionID field to JWT claims, enabling stateless JWT validation against revoked sessions - Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline that validates token type, account status, and session validity - Implement session revocation on password change, reset, user ban/inactive, and explicit logout - Add Principal cache with active invalidation for banned/role-changed users - Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID is conversation participant via GetParticipantStrict - Add group member visibility checks: announcements, group info, member list now require group membership - Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher with globMatch; user_roles table is single source of truth for roles - Add migration logic to clean legacy casbin g rules and migrate old p rules from path-style to admin/<domain> resource naming
54 lines
1.5 KiB
Go
54 lines
1.5 KiB
Go
package wire
|
|
|
|
import (
|
|
"context"
|
|
|
|
"with_you/internal/middleware"
|
|
"with_you/internal/model"
|
|
"with_you/internal/repository"
|
|
"with_you/internal/service"
|
|
)
|
|
|
|
// ProvideIdentityProvider 提供认证管道依赖的 IdentityProvider 实现。
|
|
//
|
|
// 把 UserService + CasbinService + SessionRepository 组合为中间件所需的查询接口，
|
|
// 避免中间件直接依赖具体 service 三个包，便于测试以 fake 注入。
|
|
func ProvideIdentityProvider(
|
|
userService service.UserService,
|
|
casbinService service.CasbinService,
|
|
sessionRepo repository.SessionRepository,
|
|
) middleware.IdentityProvider {
|
|
return &identityProviderImpl{
|
|
userService: userService,
|
|
casbinService: casbinService,
|
|
sessionRepo: sessionRepo,
|
|
}
|
|
}
|
|
|
|
type identityProviderImpl struct {
|
|
userService service.UserService
|
|
casbinService service.CasbinService
|
|
sessionRepo repository.SessionRepository
|
|
}
|
|
|
|
func (i *identityProviderImpl) GetUserByID(ctx context.Context, userID string) (*model.User, error) {
|
|
return i.userService.GetUserByID(ctx, userID)
|
|
}
|
|
|
|
func (i *identityProviderImpl) GetRolesForUser(ctx context.Context, userID string) ([]string, error) {
|
|
roles, err := i.casbinService.GetRolesForUser(ctx, userID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if roles == nil {
|
|
roles = []string{}
|
|
}
|
|
return roles, nil
|
|
}
|
|
|
|
func (i *identityProviderImpl) GetSessionByID(ctx context.Context, sessionID string) (*model.Session, error) {
|
|
if sessionID == "" {
|
|
return nil, nil
|
|
}
|
|
return i.sessionRepo.GetByID(ctx, sessionID)
|
|
} |