weichen
3145550a59
Unify auth middleware and remove X-User-ID trust, add project_members authorization, sandbox workspaces via resolver, and admin-only reconcile by run_id. Introduce goose migrations with startup schema gate, fail closed when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in app Dockerfile, and remove frontend pseudo-login fallback.
85 lines
2.7 KiB
Go
85 lines
2.7 KiB
Go
package server
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"chat-agent-system/internal/auth"
|
|
"chat-agent-system/internal/authz"
|
|
"chat-agent-system/internal/ctxmgr"
|
|
)
|
|
|
|
// requireAuthenticatedUser 校验请求已登录，未登录返回 false 并写入 401。
|
|
func (s *Server) requireAuthenticatedUser(w http.ResponseWriter, r *http.Request) (*auth.UserAccount, bool) {
|
|
if user := s.principalFromRequest(r); user != nil {
|
|
return user, true
|
|
}
|
|
user, err := s.authenticateUser(r)
|
|
if err != nil || user == nil {
|
|
http.Error(w, `{"error":"ERR_UNAUTHENTICATED","message":"请先登录"}`, http.StatusUnauthorized)
|
|
return nil, false
|
|
}
|
|
return user, true
|
|
}
|
|
|
|
// assertSessionOwnedByUser 校验会话归属当前用户；会话不存在或归属他人返回 false。
|
|
func (s *Server) assertSessionOwnedByUser(w http.ResponseWriter, r *http.Request, sessionID string, userID int64) bool {
|
|
if s.svc == nil || s.svc.ContextManager() == nil {
|
|
http.Error(w, "context manager not initialized", http.StatusServiceUnavailable)
|
|
return false
|
|
}
|
|
ownerID, err := s.svc.ContextManager().GetSessionOwnerID(r.Context(), sessionID)
|
|
if err != nil || ownerID <= 0 {
|
|
writeJSONResponse(w, http.StatusNotFound, map[string]string{
|
|
"error_code": "SESSION_NOT_FOUND",
|
|
"message": "指定会话不存在或已被删除",
|
|
})
|
|
return false
|
|
}
|
|
if ownerID != userID {
|
|
writeJSONResponse(w, http.StatusForbidden, map[string]string{
|
|
"error_code": "SESSION_FORBIDDEN",
|
|
"message": "无权访问该会话",
|
|
})
|
|
return false
|
|
}
|
|
return true
|
|
}
|
|
|
|
// assertMessageOwnedByUser 校验消息所属会话归属当前用户。
|
|
func (s *Server) assertMessageOwnedByUser(w http.ResponseWriter, r *http.Request, msg *ctxmgr.ChatMessageRecord, userID int64) bool {
|
|
if msg == nil {
|
|
writeJSONResponse(w, http.StatusNotFound, map[string]string{
|
|
"error_code": "MESSAGE_NOT_FOUND",
|
|
"message": "指定消息不存在或已被删除",
|
|
})
|
|
return false
|
|
}
|
|
return s.assertSessionOwnedByUser(w, r, msg.SessionID, userID)
|
|
}
|
|
|
|
// requireProjectAccess 校验当前用户可访问指定项目。
|
|
func (s *Server) requireProjectAccess(w http.ResponseWriter, r *http.Request, projectID int64) (*auth.UserAccount, bool) {
|
|
user, ok := s.requirePrincipal(w, r)
|
|
if !ok {
|
|
return nil, false
|
|
}
|
|
if isAdminUser(user) {
|
|
return user, true
|
|
}
|
|
if err := s.authorizer.RequireProjectAccess(r.Context(), projectID, user.ID); err != nil {
|
|
if err == authz.ErrForbidden {
|
|
writeJSONResponse(w, http.StatusForbidden, map[string]string{
|
|
"error_code": "ERR_FORBIDDEN",
|
|
"message": "无权访问该项目",
|
|
})
|
|
return nil, false
|
|
}
|
|
writeJSONResponse(w, http.StatusNotFound, map[string]string{
|
|
"error_code": "ERR_PROJECT_NOT_FOUND",
|
|
"message": "项目不存在或无权限访问",
|
|
})
|
|
return nil, false
|
|
}
|
|
return user, true
|
|
}
|