weichenandCursor
90f77eac93
Close P0 auth gaps for lineage/runs, stage ABAC fail-closed, and project:create; add IAM migrations 00021-23, me settings APIs, schema v2 manifests, orchestrator skeleton, and gate A regression coverage. Co-authored-by: Cursor <cursoragent@cursor.com>
67 lines
1.7 KiB
Go
67 lines
1.7 KiB
Go
package server
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
|
|
"chat-agent-system/internal/auth"
|
|
)
|
|
|
|
type taskRunAction string
|
|
|
|
const (
|
|
taskRunView taskRunAction = "view"
|
|
taskRunCancel taskRunAction = "cancel"
|
|
taskRunResume taskRunAction = "resume"
|
|
)
|
|
|
|
func (s *Server) assertTaskRunAccess(w http.ResponseWriter, ctx context.Context, runID string, user *auth.UserAccount, action taskRunAction) bool {
|
|
if user == nil {
|
|
writeJSONResponse(w, http.StatusUnauthorized, map[string]string{
|
|
"error_code": "ERR_UNAUTHENTICATED",
|
|
"message": "请先登录",
|
|
})
|
|
return false
|
|
}
|
|
rec, err := s.taskRuns.GetRun(runID)
|
|
if err != nil {
|
|
http.Error(w, "run not found", http.StatusNotFound)
|
|
return false
|
|
}
|
|
if s.isSystemAdminUser(ctx, user) {
|
|
return true
|
|
}
|
|
isOwner := rec.UserID > 0 && rec.UserID == user.ID
|
|
isProjectOwner := false
|
|
if rec.ProjectID > 0 && s.authorizer != nil {
|
|
isProjectOwner, _ = s.authorizer.IsProjectOwner(ctx, rec.ProjectID, user.ID)
|
|
}
|
|
switch action {
|
|
case taskRunView:
|
|
if isOwner || isProjectOwner {
|
|
return true
|
|
}
|
|
case taskRunCancel, taskRunResume:
|
|
if isOwner || isProjectOwner {
|
|
return true
|
|
}
|
|
}
|
|
writeJSONResponse(w, http.StatusForbidden, map[string]string{
|
|
"error_code": "ERR_FORBIDDEN",
|
|
"message": "无权访问该任务",
|
|
})
|
|
return false
|
|
}
|
|
|
|
func (s *Server) assertTaskRunOwnedByUser(w http.ResponseWriter, ctx context.Context, runID string, user *auth.UserAccount) bool {
|
|
return s.assertTaskRunAccess(w, ctx, runID, user, taskRunView)
|
|
}
|
|
|
|
func (s *Server) isSystemAdminUser(ctx context.Context, user *auth.UserAccount) bool {
|
|
if user == nil {
|
|
return false
|
|
}
|
|
admin, err := s.authzSvc.IsSystemAdmin(ctx, user.ID, user.RoleID)
|
|
return err == nil && admin
|
|
}
|