weichenandCursor
39ab0ca1e4
Add roles CRUD backed by system_roles tables, session list/revoke APIs, capabilities fallback for memory mode, and route all admin checks through AuthorizationService instead of hardcoded role-admin checks. Co-authored-by: Cursor <cursoragent@cursor.com>
48 lines
1.2 KiB
Go
48 lines
1.2 KiB
Go
package server
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
|
|
"chat-agent-system/internal/auth"
|
|
)
|
|
|
|
func (s *Server) assertTaskRunOwnedByUser(w http.ResponseWriter, ctx context.Context, runID string, user *auth.UserAccount) bool {
|
|
if user == nil {
|
|
writeJSONResponse(w, http.StatusUnauthorized, map[string]string{
|
|
"error_code": "ERR_UNAUTHENTICATED",
|
|
"message": "请先登录",
|
|
})
|
|
return false
|
|
}
|
|
rec, err := s.taskRuns.GetRun(runID)
|
|
if err != nil {
|
|
http.Error(w, "run not found", http.StatusNotFound)
|
|
return false
|
|
}
|
|
if s.isSystemAdminUser(ctx, user) {
|
|
return true
|
|
}
|
|
if rec.UserID > 0 && rec.UserID == user.ID {
|
|
return true
|
|
}
|
|
if rec.ProjectID > 0 && s.authorizer != nil {
|
|
if err := s.authorizer.RequireProjectAccess(ctx, rec.ProjectID, user.ID); err == nil {
|
|
return true
|
|
}
|
|
}
|
|
writeJSONResponse(w, http.StatusForbidden, map[string]string{
|
|
"error_code": "ERR_FORBIDDEN",
|
|
"message": "无权访问该任务",
|
|
})
|
|
return false
|
|
}
|
|
|
|
func (s *Server) isSystemAdminUser(ctx context.Context, user *auth.UserAccount) bool {
|
|
if user == nil {
|
|
return false
|
|
}
|
|
admin, err := s.authzSvc.IsSystemAdmin(ctx, user.ID, user.RoleID)
|
|
return err == nil && admin
|
|
}
|