weichen
3145550a59
Unify auth middleware and remove X-User-ID trust, add project_members authorization, sandbox workspaces via resolver, and admin-only reconcile by run_id. Introduce goose migrations with startup schema gate, fail closed when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in app Dockerfile, and remove frontend pseudo-login fallback.
54 lines
1.3 KiB
Go
54 lines
1.3 KiB
Go
package server
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
)
|
|
|
|
func (s *Server) allowLegacyTestPrincipal() bool {
|
|
return s.cfg != nil && s.cfg.AllowInMemory && s.cfg.ContextDbHost == ""
|
|
}
|
|
|
|
func isPublicRoute(method, path string) bool {
|
|
if path == "/" || path == "/health" || path == "/api/v1/health" {
|
|
return true
|
|
}
|
|
if method == http.MethodPost && path == "/api/v1/auth/login" {
|
|
return true
|
|
}
|
|
if method == http.MethodPost && path == "/api/v1/auth/register" {
|
|
return true
|
|
}
|
|
if !strings.HasPrefix(path, "/api/") {
|
|
return true
|
|
}
|
|
return false
|
|
}
|
|
|
|
func (s *Server) authMiddleware(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
path := r.URL.Path
|
|
if isPublicRoute(r.Method, path) {
|
|
next.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
|
|
user, err := s.authenticateUser(r)
|
|
if (err != nil || user == nil) && s.allowLegacyTestPrincipal() {
|
|
if fallback, fbErr := s.authSvc.GetUserByID(r.Context(), 1); fbErr == nil && fallback != nil {
|
|
user = fallback
|
|
}
|
|
}
|
|
if user == nil {
|
|
writeJSONResponse(w, http.StatusUnauthorized, map[string]string{
|
|
"error_code": "ERR_UNAUTHENTICATED",
|
|
"message": "请先登录",
|
|
})
|
|
return
|
|
}
|
|
|
|
ctx := withPrincipal(r.Context(), user)
|
|
next.ServeHTTP(w, r.WithContext(ctx))
|
|
})
|
|
}
|