49 lines
1.7 KiB
Go
49 lines
1.7 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
|
|
"kra/internal/biz"
|
|
"kra/internal/conf"
|
|
"kra/internal/server/httpx"
|
|
"kra/internal/service"
|
|
"kra/internal/service/dto"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func AccessControl(runtime *conf.Runtime, access *service.AccessService, audit *service.AuditService) gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
claims := Claims(c)
|
|
if claims == nil {
|
|
httpx.NoAuth(c, "未登录或非法访问")
|
|
return
|
|
}
|
|
path := c.Request.URL.Path
|
|
policyPath := path
|
|
if config := runtime.Admin(); config != nil && config.RouterPrefix != "" {
|
|
policyPath = strings.TrimPrefix(policyPath, strings.TrimSuffix(config.RouterPrefix, "/"))
|
|
if policyPath == "" {
|
|
policyPath = "/"
|
|
}
|
|
}
|
|
allowed, err := access.Authorize(c.Request.Context(), claims.AuthorityID, policyPath, c.Request.Method)
|
|
if err != nil || !allowed {
|
|
requestID, _ := c.Get("request_id")
|
|
requestIDText, _ := requestID.(string)
|
|
_ = audit.RecordDataAccessRequest(c.Request.Context(), &dto.DataAccessRecordRequest{EventType: "blocked_access", Operation: c.Request.Method, UserID: claims.ID, AuthorityID: claims.AuthorityID, RequestID: requestIDText, Method: c.Request.Method, Path: path, Detail: "Casbin policy denied the request"})
|
|
c.AbortWithStatusJSON(http.StatusForbidden, httpx.Response{Code: httpx.CodeError, Data: nil, Msg: "权限不足"})
|
|
return
|
|
}
|
|
requestContext, err := access.ContextWithDataScope(c.Request.Context(), claims.AuthorityID, claims.ID)
|
|
if err != nil {
|
|
httpx.Fail(c, "数据权限加载失败")
|
|
return
|
|
}
|
|
requestContext = biz.NewActorContext(requestContext, biz.Actor{UserID: claims.ID, AuthorityID: claims.AuthorityID})
|
|
c.Request = c.Request.WithContext(requestContext)
|
|
c.Next()
|
|
}
|
|
}
|