weichen
3145550a59
Unify auth middleware and remove X-User-ID trust, add project_members authorization, sandbox workspaces via resolver, and admin-only reconcile by run_id. Introduce goose migrations with startup schema gate, fail closed when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in app Dockerfile, and remove frontend pseudo-login fallback.
59 lines
1.6 KiB
Go
59 lines
1.6 KiB
Go
package server
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
|
|
"chat-agent-system/internal/auth"
|
|
)
|
|
|
|
type principalContextKey struct{}
|
|
|
|
// withPrincipal 将已认证用户写入请求 context。
|
|
func withPrincipal(ctx context.Context, user *auth.UserAccount) context.Context {
|
|
return context.WithValue(ctx, principalContextKey{}, user)
|
|
}
|
|
|
|
// principalFromContext 从 context 读取当前用户；未认证返回 nil。
|
|
func principalFromContext(ctx context.Context) *auth.UserAccount {
|
|
if ctx == nil {
|
|
return nil
|
|
}
|
|
user, _ := ctx.Value(principalContextKey{}).(*auth.UserAccount)
|
|
return user
|
|
}
|
|
|
|
// principalFromRequest 从 HTTP 请求 context 读取当前用户。
|
|
func (s *Server) principalFromRequest(r *http.Request) *auth.UserAccount {
|
|
return principalFromContext(r.Context())
|
|
}
|
|
|
|
// requirePrincipal 要求已认证用户，否则写入 401。
|
|
func (s *Server) requirePrincipal(w http.ResponseWriter, r *http.Request) (*auth.UserAccount, bool) {
|
|
user := s.principalFromRequest(r)
|
|
if user == nil {
|
|
writeJSONResponse(w, http.StatusUnauthorized, map[string]string{
|
|
"error_code": "ERR_UNAUTHENTICATED",
|
|
"message": "请先登录",
|
|
})
|
|
return nil, false
|
|
}
|
|
return user, true
|
|
}
|
|
|
|
// requireAdmin 要求系统管理员角色。
|
|
func (s *Server) requireAdmin(w http.ResponseWriter, r *http.Request) (*auth.UserAccount, bool) {
|
|
user, ok := s.requirePrincipal(w, r)
|
|
if !ok {
|
|
return nil, false
|
|
}
|
|
if user.RoleID != "role-admin" {
|
|
writeJSONResponse(w, http.StatusForbidden, map[string]string{
|
|
"error_code": "ERR_FORBIDDEN",
|
|
"message": "需要管理员权限",
|
|
})
|
|
return nil, false
|
|
}
|
|
return user, true
|
|
}
|