refactor: split backend transport and domain modules

internal/server/middleware/access.go

@@ -0,0 +1,37 @@
+package middleware
+
+import (
+	"net/http"
+
+	"kra/internal/biz"
+	"kra/internal/server/httpx"
+	"kra/internal/service"
+
+	"github.com/gin-gonic/gin"
+)
+
+func AccessControl(access *service.AccessService, audit *service.AuditService) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		claims := Claims(c)
+		if claims == nil {
+			httpx.NoAuth(c, "未登录或非法访问")
+			return
+		}
+		path := c.Request.URL.Path
+		allowed, err := access.Authorize(c.Request.Context(), claims.AuthorityID, path, c.Request.Method)
+		if err != nil || !allowed {
+			requestID, _ := c.Get("request_id")
+			requestIDText, _ := requestID.(string)
+			_ = audit.RecordDataAccess(c.Request.Context(), &biz.DataAccessLog{EventType: "blocked_access", Operation: c.Request.Method, UserID: claims.ID, AuthorityID: claims.AuthorityID, RequestID: requestIDText, Method: c.Request.Method, Path: path, Detail: "Casbin policy denied the request"})
+			c.AbortWithStatusJSON(http.StatusForbidden, httpx.Response{Code: httpx.CodeError, Data: nil, Msg: "权限不足"})
+			return
+		}
+		scope, err := access.ResolveDataScope(c.Request.Context(), claims.AuthorityID, claims.ID)
+		if err != nil {
+			httpx.Fail(c, "数据权限加载失败")
+			return
+		}
+		c.Request = c.Request.WithContext(biz.NewDataScopeContext(c.Request.Context(), scope))
+		c.Next()
+	}
+}

internal/server/middleware/auth.go

@@ -0,0 +1,84 @@
+package middleware
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"kra/internal/conf"
+	"kra/internal/server/httpx"
+	"kra/internal/service"
+	"kra/pkg/adminauth"
+
+	"github.com/gin-gonic/gin"
+)
+
+const claimsKey = "admin_claims"
+
+func Auth(config *conf.AdminBackend, settings *service.SettingsService) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		token := c.GetHeader("x-token")
+		if token == "" {
+			token, _ = c.Cookie("x-token")
+		}
+		secret := ""
+		if config != nil && config.Jwt != nil {
+			secret = config.Jwt.SigningKey
+		}
+		claims, err := adminauth.Parse(token, secret)
+		if err != nil {
+			httpx.NoAuth(c, "未登录或非法访问")
+			return
+		}
+		if disabled, checkErr := settings.IsTokenDisabled(c.Request.Context(), token); checkErr != nil || disabled {
+			httpx.NoAuth(c, "登录状态已失效")
+			return
+		}
+		if claims.ExpiresAt != nil && claims.BufferTime > 0 && time.Until(claims.ExpiresAt.Time) < time.Duration(claims.BufferTime)*time.Second {
+			expires, buffer := 7*24*time.Hour, time.Duration(claims.BufferTime)*time.Second
+			issuer := claims.Issuer
+			if config != nil && config.Jwt != nil {
+				if config.Jwt.ExpiresTime != nil {
+					expires = config.Jwt.ExpiresTime.AsDuration()
+				}
+				if config.Jwt.BufferTime != nil {
+					buffer = config.Jwt.BufferTime.AsDuration()
+				}
+				if config.Jwt.Issuer != "" {
+					issuer = config.Jwt.Issuer
+				}
+			}
+			newToken, newClaims, refreshErr := adminauth.Generate(secret, issuer, expires, buffer, claims.ID, claims.AuthorityID, claims.UUID, claims.Username, claims.NickName, claims.MustChangePwd)
+			if refreshErr == nil {
+				c.Header("new-token", newToken)
+				c.Header("new-expires-at", strconv.FormatInt(newClaims.ExpiresAt.Unix(), 10))
+				http.SetCookie(c.Writer, &http.Cookie{Name: "x-token", Value: newToken, Path: "/", MaxAge: int(expires.Seconds()), HttpOnly: true, SameSite: http.SameSiteStrictMode})
+			}
+		}
+		c.Set(claimsKey, claims)
+		c.Next()
+	}
+}
+
+func Claims(c *gin.Context) *adminauth.Claims {
+	value, _ := c.Get(claimsKey)
+	claims, _ := value.(*adminauth.Claims)
+	return claims
+}
+
+func MustChangePassword() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		claims := Claims(c)
+		if claims == nil || !claims.MustChangePwd {
+			c.Next()
+			return
+		}
+		path := strings.TrimSuffix(c.Request.URL.Path, "/")
+		if strings.HasSuffix(path, "/user/changePassword") || strings.HasSuffix(path, "/user/getUserInfo") || strings.HasSuffix(path, "/jwt/jsonInBlacklist") {
+			c.Next()
+			return
+		}
+		c.AbortWithStatusJSON(http.StatusConflict, httpx.Response{Code: httpx.CodePasswordChangeRequired, Data: gin.H{"needChangePassword": true}, Msg: "请先修改初始密码"})
+	}
+}

internal/server/middleware/request.go

@@ -0,0 +1,18 @@
+package middleware
+
+import (
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+func RequestMeta() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		requestID := c.GetHeader("X-Request-Id")
+		if requestID == "" {
+			requestID = uuid.NewString()
+		}
+		c.Header("X-Request-Id", requestID)
+		c.Set("request_id", requestID)
+		c.Next()
+	}
+}