WeiCHENandCursor
28faa4932d
封堵鉴权旁路与导出 IDOR，DocGov 改服务端身份；对话层 PendingAction 接真实 docgov/taskrun；修复流式租约假死与会话级任务流；加固配置/doc_id/NULL；补齐 slog 与测试；前端 ErrorBoundary 与受控文档重试。 Co-authored-by: Cursor <cursoragent@cursor.com>
55 lines
1.8 KiB
Go
55 lines
1.8 KiB
Go
package server
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"chat-agent-system/internal/auth"
|
|
"chat-agent-system/internal/ctxmgr"
|
|
)
|
|
|
|
// requireAuthenticatedUser 校验请求已登录，未登录返回 false 并写入 401。
|
|
func (s *Server) requireAuthenticatedUser(w http.ResponseWriter, r *http.Request) (*auth.UserAccount, bool) {
|
|
user, err := s.authenticateUser(r)
|
|
if err != nil || user == nil {
|
|
http.Error(w, `{"error":"ERR_UNAUTHENTICATED","message":"请先登录"}`, http.StatusUnauthorized)
|
|
return nil, false
|
|
}
|
|
return user, true
|
|
}
|
|
|
|
// assertSessionOwnedByUser 校验会话归属当前用户；会话不存在或归属他人返回 false。
|
|
func (s *Server) assertSessionOwnedByUser(w http.ResponseWriter, r *http.Request, sessionID string, userID int64) bool {
|
|
if s.svc == nil || s.svc.ContextManager() == nil {
|
|
http.Error(w, "context manager not initialized", http.StatusServiceUnavailable)
|
|
return false
|
|
}
|
|
ownerID, err := s.svc.ContextManager().GetSessionOwnerID(r.Context(), sessionID)
|
|
if err != nil || ownerID <= 0 {
|
|
writeJSONResponse(w, http.StatusNotFound, map[string]string{
|
|
"error_code": "SESSION_NOT_FOUND",
|
|
"message": "指定会话不存在或已被删除",
|
|
})
|
|
return false
|
|
}
|
|
if ownerID != userID {
|
|
writeJSONResponse(w, http.StatusForbidden, map[string]string{
|
|
"error_code": "SESSION_FORBIDDEN",
|
|
"message": "无权访问该会话",
|
|
})
|
|
return false
|
|
}
|
|
return true
|
|
}
|
|
|
|
// assertMessageOwnedByUser 校验消息所属会话归属当前用户。
|
|
func (s *Server) assertMessageOwnedByUser(w http.ResponseWriter, r *http.Request, msg *ctxmgr.ChatMessageRecord, userID int64) bool {
|
|
if msg == nil {
|
|
writeJSONResponse(w, http.StatusNotFound, map[string]string{
|
|
"error_code": "MESSAGE_NOT_FOUND",
|
|
"message": "指定消息不存在或已被删除",
|
|
})
|
|
return false
|
|
}
|
|
return s.assertSessionOwnedByUser(w, r, msg.SessionID, userID)
|
|
}
|