weichenandCursor
6219caf690
Add roles CRUD backed by system_roles tables, session list/revoke APIs, capabilities fallback for memory mode, and route all admin checks through AuthorizationService instead of hardcoded role-admin checks. Co-authored-by: Cursor <cursoragent@cursor.com>
103 lines
3.3 KiB
Go
103 lines
3.3 KiB
Go
package server
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
|
|
"chat-agent-system/internal/auth"
|
|
"chat-agent-system/internal/authz"
|
|
"chat-agent-system/internal/ctxmgr"
|
|
)
|
|
|
|
func writeAuthzError(w http.ResponseWriter, err error) {
|
|
switch {
|
|
case errors.Is(err, authz.ErrForbidden):
|
|
writeJSONResponse(w, http.StatusForbidden, map[string]string{
|
|
"error_code": "ERR_FORBIDDEN",
|
|
"message": "无权访问该项目",
|
|
})
|
|
case errors.Is(err, authz.ErrUnauthenticated):
|
|
writeJSONResponse(w, http.StatusUnauthorized, map[string]string{
|
|
"error_code": "ERR_UNAUTHENTICATED",
|
|
"message": "请先登录",
|
|
})
|
|
default:
|
|
http.Error(w, err.Error(), http.StatusInternalServerError)
|
|
}
|
|
}
|
|
|
|
// requireAuthenticatedUser 校验请求已登录，未登录返回 false 并写入 401。
|
|
func (s *Server) requireAuthenticatedUser(w http.ResponseWriter, r *http.Request) (*auth.UserAccount, bool) {
|
|
if user := s.principalFromRequest(r); user != nil {
|
|
return user, true
|
|
}
|
|
user, err := s.authenticateUser(r)
|
|
if err != nil || user == nil {
|
|
http.Error(w, `{"error":"ERR_UNAUTHENTICATED","message":"请先登录"}`, http.StatusUnauthorized)
|
|
return nil, false
|
|
}
|
|
return user, true
|
|
}
|
|
|
|
// assertSessionOwnedByUser 校验会话归属当前用户；会话不存在或归属他人返回 false。
|
|
func (s *Server) assertSessionOwnedByUser(w http.ResponseWriter, r *http.Request, sessionID string, userID int64) bool {
|
|
if s.svc == nil || s.svc.ContextManager() == nil {
|
|
http.Error(w, "context manager not initialized", http.StatusServiceUnavailable)
|
|
return false
|
|
}
|
|
ownerID, err := s.svc.ContextManager().GetSessionOwnerID(r.Context(), sessionID)
|
|
if err != nil || ownerID <= 0 {
|
|
writeJSONResponse(w, http.StatusNotFound, map[string]string{
|
|
"error_code": "SESSION_NOT_FOUND",
|
|
"message": "指定会话不存在或已被删除",
|
|
})
|
|
return false
|
|
}
|
|
if ownerID != userID {
|
|
writeJSONResponse(w, http.StatusForbidden, map[string]string{
|
|
"error_code": "SESSION_FORBIDDEN",
|
|
"message": "无权访问该会话",
|
|
})
|
|
return false
|
|
}
|
|
return true
|
|
}
|
|
|
|
// assertMessageOwnedByUser 校验消息所属会话归属当前用户。
|
|
func (s *Server) assertMessageOwnedByUser(w http.ResponseWriter, r *http.Request, msg *ctxmgr.ChatMessageRecord, userID int64) bool {
|
|
if msg == nil {
|
|
writeJSONResponse(w, http.StatusNotFound, map[string]string{
|
|
"error_code": "MESSAGE_NOT_FOUND",
|
|
"message": "指定消息不存在或已被删除",
|
|
})
|
|
return false
|
|
}
|
|
return s.assertSessionOwnedByUser(w, r, msg.SessionID, userID)
|
|
}
|
|
|
|
// requireProjectAccess 校验当前用户可访问指定项目。
|
|
func (s *Server) requireProjectAccess(w http.ResponseWriter, r *http.Request, projectID int64) (*auth.UserAccount, bool) {
|
|
user, ok := s.requirePrincipal(w, r)
|
|
if !ok {
|
|
return nil, false
|
|
}
|
|
if s.isSystemAdminUser(r.Context(), user) {
|
|
return user, true
|
|
}
|
|
if err := s.authorizer.RequireProjectAccess(r.Context(), projectID, user.ID); err != nil {
|
|
if err == authz.ErrForbidden {
|
|
writeJSONResponse(w, http.StatusForbidden, map[string]string{
|
|
"error_code": "ERR_FORBIDDEN",
|
|
"message": "无权访问该项目",
|
|
})
|
|
return nil, false
|
|
}
|
|
writeJSONResponse(w, http.StatusNotFound, map[string]string{
|
|
"error_code": "ERR_PROJECT_NOT_FOUND",
|
|
"message": "项目不存在或无权限访问",
|
|
})
|
|
return nil, false
|
|
}
|
|
return user, true
|
|
}
|