yvan/kra-oa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

优化结构

Browse Source
This commit is contained in:
Yvan
2026-08-22 12:13:16 +08:00
parent d987244d0e
commit b27a66e9d3
200 changed files with 1794 additions and 1715 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/data/data_scope.go
+10 -11
View File
@@ -3,12 +3,11 @@ package data
import (
"database/sql"
"errors"
"kra/internal/biz/system"
"log/slog"
"reflect"
"strings"
"kra/internal/biz"
"gorm.io/gorm"
"gorm.io/gorm/clause"
"gorm.io/gorm/schema"
@@ -64,7 +63,7 @@ func skipDataScope(db *gorm.DB) bool {
return ok && value
}
func validDataScope(scope biz.DataScope) bool {
func validDataScope(scope system.DataScope) bool {
return scope.UserID != 0 && scope.AuthorityID != 0 && scope.Scope >= 1 && scope.Scope <= 5 && scope.All == (scope.Scope == 1)
}
@@ -79,10 +78,10 @@ func applyDataScope(operation string, enqueue dataScopeAuditEnqueue) func(*gorm.
if skipDataScope(db) {
return
}
scope, ok := biz.DataScopeFromContext(db.Statement.Context)
scope, ok := system.DataScopeFromContext(db.Statement.Context)
if !ok {
slog.WarnContext(db.Statement.Context, "数据权限: 业务表访问无身份上下文, 已拒绝", "mod", "data-scope", "table", db.Statement.Table)
recordDataScopeEvent(db, enqueue, "no_identity", operation, "无身份上下文访问受控表, 已拒绝", biz.DataScope{})
recordDataScopeEvent(db, enqueue, "no_identity", operation, "无身份上下文访问受控表, 已拒绝", system.DataScope{})
_ = db.AddError(errDataScopeRequired)
return
}
@@ -116,7 +115,7 @@ func applyDataScope(operation string, enqueue dataScopeAuditEnqueue) func(*gorm.
}
}
func recordDataScopeEvent(db *gorm.DB, enqueue dataScopeAuditEnqueue, eventType, operation, detail string, scope biz.DataScope) {
func recordDataScopeEvent(db *gorm.DB, enqueue dataScopeAuditEnqueue, eventType, operation, detail string, scope system.DataScope) {
if enqueue == nil {
return
}
@@ -128,7 +127,7 @@ func auditBlockedWrite(operation string, enqueue dataScopeAuditEnqueue) func(*go
if _, applied := db.Statement.Clauses["data_scope:applied"]; !applied || db.Error != nil || db.RowsAffected != 0 {
return
}
if scope, ok := biz.DataScopeFromContext(db.Statement.Context); ok && !scope.All {
if scope, ok := system.DataScopeFromContext(db.Statement.Context); ok && !scope.All {
recordDataScopeEvent(db, enqueue, "blocked_write", operation, "数据范围过滤后写操作影响 0 行(疑似越权尝试)", scope)
}
}
@@ -139,9 +138,9 @@ func stampOwnership(enqueue dataScopeAuditEnqueue) func(*gorm.DB) {
if !isControlledTable(db) || skipDataScope(db) {
return
}
scope, ok := biz.DataScopeFromContext(db.Statement.Context)
scope, ok := system.DataScopeFromContext(db.Statement.Context)
if !ok {
recordDataScopeEvent(db, enqueue, "no_identity", "create", "无身份上下文访问受控表, 已拒绝", biz.DataScope{})
recordDataScopeEvent(db, enqueue, "no_identity", "create", "无身份上下文访问受控表, 已拒绝", system.DataScope{})
_ = db.AddError(errDataScopeRequired)
return
}
@@ -164,7 +163,7 @@ func stampUpdatedBy(db *gorm.DB) {
if !isControlledTable(db) || stmt.SkipHooks || !hasScopeField(db, "updated_by") {
return
}
scope, ok := biz.DataScopeFromContext(db.Statement.Context)
scope, ok := system.DataScopeFromContext(db.Statement.Context)
if !ok || scope.UserID == 0 {
return
}
@@ -212,7 +211,7 @@ func stampDeletedBy(db *gorm.DB) {
if _, customZero := deletedAt.TagSettings["ZEROVALUE"]; customZero {
return
}
scope, ok := biz.DataScopeFromContext(stmt.Context)
scope, ok := system.DataScopeFromContext(stmt.Context)
if !ok || scope.UserID == 0 {
return
}