WeiCHEN
d49c8f8cfc
Expose fine-grained system:* checks (admin grants all) and list system_setting_policy_audits for settings change visibility.
107 lines
3.1 KiB
Go
107 lines
3.1 KiB
Go
package server
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
|
|
"chat-agent-system/internal/auth"
|
|
)
|
|
|
|
type principalContextKey struct{}
|
|
|
|
// withPrincipal 将已认证用户写入请求 context。
|
|
func withPrincipal(ctx context.Context, user *auth.UserAccount) context.Context {
|
|
return context.WithValue(ctx, principalContextKey{}, user)
|
|
}
|
|
|
|
// principalFromContext 从 context 读取当前用户；未认证返回 nil。
|
|
func principalFromContext(ctx context.Context) *auth.UserAccount {
|
|
if ctx == nil {
|
|
return nil
|
|
}
|
|
user, _ := ctx.Value(principalContextKey{}).(*auth.UserAccount)
|
|
return user
|
|
}
|
|
|
|
// principalFromRequest 从 HTTP 请求 context 读取当前用户。
|
|
func (s *Server) principalFromRequest(r *http.Request) *auth.UserAccount {
|
|
return principalFromContext(r.Context())
|
|
}
|
|
|
|
// requirePrincipal 要求已认证用户，否则写入 401。
|
|
func (s *Server) requirePrincipal(w http.ResponseWriter, r *http.Request) (*auth.UserAccount, bool) {
|
|
user := s.principalFromRequest(r)
|
|
if user == nil {
|
|
writeJSONResponse(w, http.StatusUnauthorized, map[string]string{
|
|
"error_code": "ERR_UNAUTHENTICATED",
|
|
"message": "请先登录",
|
|
})
|
|
return nil, false
|
|
}
|
|
return user, true
|
|
}
|
|
|
|
// requireAdmin 要求系统管理员角色。
|
|
func (s *Server) requireAdmin(w http.ResponseWriter, r *http.Request) (*auth.UserAccount, bool) {
|
|
return s.requireSystemAdmin(w, r)
|
|
}
|
|
|
|
// requireSystemAdmin 通过 AuthorizationService 判定系统管理员。
|
|
func (s *Server) requireSystemAdmin(w http.ResponseWriter, r *http.Request) (*auth.UserAccount, bool) {
|
|
user, ok := s.requirePrincipal(w, r)
|
|
if !ok {
|
|
return nil, false
|
|
}
|
|
admin, err := s.authzSvc.IsSystemAdmin(r.Context(), user.ID, user.RoleID)
|
|
if err != nil {
|
|
writeJSONResponse(w, http.StatusInternalServerError, map[string]string{
|
|
"error_code": "ERR_AUTHZ",
|
|
"message": "权限判定失败",
|
|
})
|
|
return nil, false
|
|
}
|
|
if !admin {
|
|
writeJSONResponse(w, http.StatusForbidden, map[string]string{
|
|
"error_code": "ERR_FORBIDDEN",
|
|
"message": "需要管理员权限",
|
|
})
|
|
return nil, false
|
|
}
|
|
return user, true
|
|
}
|
|
|
|
// requireSystemPermission 校验细粒度 system:*（或其它系统权限）。
|
|
// Phase-2：系统管理员授予全部；非管理员 fail-closed。
|
|
func (s *Server) requireSystemPermission(w http.ResponseWriter, r *http.Request, perm string) (*auth.UserAccount, bool) {
|
|
user, ok := s.requirePrincipal(w, r)
|
|
if !ok {
|
|
return nil, false
|
|
}
|
|
if s.authzSvc == nil {
|
|
if s.failClosedAuthz() {
|
|
writeJSONResponse(w, http.StatusForbidden, map[string]string{
|
|
"error_code": "ERR_FORBIDDEN",
|
|
"message": "需要系统权限",
|
|
})
|
|
return nil, false
|
|
}
|
|
return user, true
|
|
}
|
|
allowed, err := s.authzSvc.HasSystemPermission(r.Context(), user.ID, user.RoleID, perm)
|
|
if err != nil {
|
|
writeJSONResponse(w, http.StatusInternalServerError, map[string]string{
|
|
"error_code": "ERR_AUTHZ",
|
|
"message": "权限判定失败",
|
|
})
|
|
return nil, false
|
|
}
|
|
if !allowed {
|
|
writeJSONResponse(w, http.StatusForbidden, map[string]string{
|
|
"error_code": "ERR_FORBIDDEN",
|
|
"message": "需要系统权限",
|
|
})
|
|
return nil, false
|
|
}
|
|
return user, true
|
|
}
|