363 lines
12 KiB
Go
363 lines
12 KiB
Go
package data
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"strconv"
|
|
"time"
|
|
|
|
"kra/internal/biz"
|
|
|
|
"github.com/casbin/casbin/v3"
|
|
casbinmodel "github.com/casbin/casbin/v3/model"
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
type apiRepo struct{ data *Data }
|
|
|
|
func NewAPIRepo(data *Data) biz.APIRepo { return &apiRepo{data: data} }
|
|
|
|
type apiPO struct {
|
|
ID uint `gorm:"primaryKey"`
|
|
CreatedAt time.Time
|
|
UpdatedAt time.Time
|
|
DeletedAt gorm.DeletedAt `gorm:"index"`
|
|
Path string
|
|
Description string
|
|
APIGroup string `gorm:"column:api_group"`
|
|
Method string
|
|
}
|
|
|
|
func (apiPO) TableName() string { return "sys_apis" }
|
|
|
|
type ignoredAPIPO struct {
|
|
ID uint `gorm:"primaryKey"`
|
|
CreatedAt time.Time
|
|
UpdatedAt time.Time
|
|
DeletedAt gorm.DeletedAt `gorm:"index"`
|
|
Path string
|
|
Method string `gorm:"default:POST"`
|
|
}
|
|
|
|
func (ignoredAPIPO) TableName() string { return "sys_ignore_apis" }
|
|
|
|
type authorityAPIPO struct {
|
|
AuthorityID uint `gorm:"primaryKey;column:authority_id"`
|
|
APIID uint `gorm:"primaryKey;column:api_id"`
|
|
}
|
|
|
|
func (authorityAPIPO) TableName() string { return "sys_authority_apis" }
|
|
|
|
func apiFromPO(po apiPO) *biz.API {
|
|
return &biz.API{ID: po.ID, CreatedAt: po.CreatedAt, UpdatedAt: po.UpdatedAt, Path: po.Path, Description: po.Description, APIGroup: po.APIGroup, Method: po.Method}
|
|
}
|
|
func (r *apiRepo) CreateAPI(ctx context.Context, v *biz.API) error {
|
|
po := apiPO{Path: v.Path, Description: v.Description, APIGroup: v.APIGroup, Method: v.Method}
|
|
var count int64
|
|
if err := r.data.gormDB.WithContext(ctx).Model(&apiPO{}).Where("path = ? AND method = ?", po.Path, po.Method).Count(&count).Error; err != nil {
|
|
return err
|
|
}
|
|
if count > 0 {
|
|
return errors.New("存在相同api")
|
|
}
|
|
if err := r.data.gormDB.WithContext(ctx).Create(&po).Error; err != nil {
|
|
return err
|
|
}
|
|
v.ID, v.CreatedAt, v.UpdatedAt, v.Method = po.ID, po.CreatedAt, po.UpdatedAt, po.Method
|
|
return nil
|
|
}
|
|
func (r *apiRepo) UpdateAPI(ctx context.Context, v *biz.API) error {
|
|
db := r.data.gormDB.WithContext(ctx)
|
|
var old apiPO
|
|
if err := db.First(&old, v.ID).Error; err != nil {
|
|
return err
|
|
}
|
|
method := v.Method
|
|
if old.Path != v.Path || old.Method != method {
|
|
var count int64
|
|
if err := db.Model(&apiPO{}).Where("id <> ? AND path = ? AND method = ?", v.ID, v.Path, method).Count(&count).Error; err != nil {
|
|
return err
|
|
}
|
|
if count > 0 {
|
|
return errors.New("存在相同api路径")
|
|
}
|
|
}
|
|
// Authorization is stored independently in casbin_rule and updates every
|
|
// matching policy when an API path or method changes.
|
|
if err := db.Model(&casbinRulePO{}).
|
|
Where("ptype = ? AND v1 = ? AND v2 = ?", "p", old.Path, old.Method).
|
|
Updates(map[string]any{"v1": v.Path, "v2": method}).Error; err != nil {
|
|
return err
|
|
}
|
|
return db.Model(&old).Updates(map[string]any{"path": v.Path, "description": v.Description, "api_group": v.APIGroup, "method": method}).Error
|
|
}
|
|
func (r *apiRepo) DeleteAPIs(ctx context.Context, ids []uint) error {
|
|
return r.data.gormDB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
|
|
var apis []apiPO
|
|
if err := tx.Where("id IN ?", ids).Find(&apis).Error; err != nil {
|
|
return err
|
|
}
|
|
for _, api := range apis {
|
|
if err := deletePoliciesForPath(tx, api.Path, api.Method); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
// Keep the legacy relation table clean for upgraded installations. It is
|
|
// no longer the authorization source.
|
|
if err := tx.Where("api_id IN ?", ids).Delete(&authorityAPIPO{}).Error; err != nil {
|
|
return err
|
|
}
|
|
return tx.Delete(&apiPO{}, ids).Error
|
|
})
|
|
}
|
|
func (r *apiRepo) FindAPI(ctx context.Context, id uint) (*biz.API, error) {
|
|
var po apiPO
|
|
if err := r.data.gormDB.WithContext(ctx).First(&po, id).Error; err != nil {
|
|
return nil, err
|
|
}
|
|
return apiFromPO(po), nil
|
|
}
|
|
func (r *apiRepo) ListAPIs(ctx context.Context, page, size int, q *biz.API) ([]*biz.API, int64, error) {
|
|
db := r.data.gormDB.WithContext(ctx).Model(&apiPO{})
|
|
if q != nil && q.StrictAll {
|
|
config := r.data.runtime.Admin()
|
|
if actor, ok := biz.ActorFromContext(ctx); ok && config != nil && config.System != nil && config.System.UseStrictAuth {
|
|
var authority authorityPO
|
|
if err := r.data.gormDB.WithContext(ctx).Where("authority_id = ?", actor.AuthorityID).First(&authority).Error; err != nil {
|
|
return nil, 0, err
|
|
}
|
|
if authority.ParentID != nil && *authority.ParentID != 0 {
|
|
// Strict mode filters API metadata by the actor's persisted
|
|
// Casbin policies, matching on path/method rather than an API FK.
|
|
db = db.Where(`EXISTS (
|
|
SELECT 1 FROM casbin_rule cr
|
|
WHERE cr.ptype = 'p' AND cr.v0 = ?
|
|
AND cr.v1 = sys_apis.path AND cr.v2 = sys_apis.method
|
|
)`, strconv.FormatUint(uint64(actor.AuthorityID), 10))
|
|
}
|
|
}
|
|
}
|
|
if q != nil {
|
|
if q.Path != "" {
|
|
db = db.Where("path LIKE ?", "%"+q.Path+"%")
|
|
}
|
|
if q.Description != "" {
|
|
db = db.Where("description LIKE ?", "%"+q.Description+"%")
|
|
}
|
|
if q.APIGroup != "" {
|
|
db = db.Where("api_group = ?", q.APIGroup)
|
|
}
|
|
if q.Method != "" {
|
|
db = db.Where("method = ?", q.Method)
|
|
}
|
|
}
|
|
var total int64
|
|
if err := db.Count(&total).Error; err != nil {
|
|
return nil, 0, err
|
|
}
|
|
order := "id desc"
|
|
if q != nil && q.OrderKey != "" {
|
|
allowed := map[string]bool{"id": true, "path": true, "api_group": true, "description": true, "method": true}
|
|
if !allowed[q.OrderKey] {
|
|
return nil, 0, errors.New("非法的排序字段: " + q.OrderKey)
|
|
}
|
|
order = q.OrderKey
|
|
if q.Desc {
|
|
order += " desc"
|
|
}
|
|
}
|
|
var pos []apiPO
|
|
maxSize := 100
|
|
if q != nil && q.StrictAll {
|
|
maxSize = 0
|
|
}
|
|
if err := applyPagination(db.Order(order), page, size, maxSize).Find(&pos).Error; err != nil {
|
|
return nil, 0, err
|
|
}
|
|
out := make([]*biz.API, 0, len(pos))
|
|
for _, po := range pos {
|
|
out = append(out, apiFromPO(po))
|
|
}
|
|
return out, total, nil
|
|
}
|
|
func (r *apiRepo) APIRoleIDs(ctx context.Context, path, method string) ([]uint, error) {
|
|
rows := make([]casbinRulePO, 0)
|
|
err := policyScope(r.data.gormDB.WithContext(ctx)).
|
|
Where("v1 = ? AND v2 = ?", path, method).
|
|
Find(&rows).Error
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
ids := make([]uint, 0, len(rows))
|
|
for _, row := range rows {
|
|
id, err := strconv.ParseUint(row.V0, 10, 64)
|
|
if err != nil {
|
|
continue
|
|
}
|
|
ids = append(ids, uint(id))
|
|
}
|
|
return ids, nil
|
|
}
|
|
func (r *apiRepo) SetAPIRoles(ctx context.Context, path, method string, ids []uint) error {
|
|
return r.data.gormDB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
|
|
// A path/method need not be present in sys_apis when replacing
|
|
// all matching policy rows. Do not validate or deduplicate authority IDs.
|
|
if err := deletePoliciesForPath(tx, path, method); err != nil {
|
|
return err
|
|
}
|
|
if len(ids) == 0 {
|
|
return nil
|
|
}
|
|
rules := make([]casbinRulePO, 0, len(ids))
|
|
for _, aid := range ids {
|
|
rules = append(rules, newPolicyRule(aid, path, method))
|
|
}
|
|
return tx.Create(&rules).Error
|
|
})
|
|
}
|
|
func (r *apiRepo) Authorize(ctx context.Context, aid uint, path, method string) (bool, error) {
|
|
rows, err := policyRowsForAuthority(r.data.gormDB.WithContext(ctx), aid)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
model, err := casbinmodel.NewModelFromString(`[request_definition]
|
|
r = sub, obj, act
|
|
[policy_definition]
|
|
p = sub, obj, act
|
|
[policy_effect]
|
|
e = some(where (p.eft == allow))
|
|
[matchers]
|
|
m = r.sub == p.sub && keyMatch2(r.obj, p.obj) && r.act == p.act`)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
enforcer, err := casbin.NewEnforcer(model)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
subject := strconv.FormatUint(uint64(aid), 10)
|
|
for _, policy := range rows {
|
|
if _, err := enforcer.AddPolicy(subject, policy.V1, policy.V2); err != nil {
|
|
return false, err
|
|
}
|
|
}
|
|
return enforcer.Enforce(subject, path, method)
|
|
}
|
|
func (r *apiRepo) PolicyPaths(ctx context.Context, aid uint) ([]*biz.API, error) {
|
|
rows, err := policyRowsForAuthority(r.data.gormDB.WithContext(ctx), aid)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
out := make([]*biz.API, 0, len(rows))
|
|
for _, row := range rows {
|
|
out = append(out, &biz.API{Path: row.V1, Method: row.V2})
|
|
}
|
|
return out, nil
|
|
}
|
|
func (r *apiRepo) SetPolicyPaths(ctx context.Context, aid uint, paths []*biz.API) error {
|
|
if err := (&authorityAccessRepo{data: r.data}).checkAuthorityIDAuth(ctx, aid); err != nil {
|
|
return err
|
|
}
|
|
config := r.data.runtime.Admin()
|
|
if actor, ok := biz.ActorFromContext(ctx); ok && config != nil && config.System != nil && config.System.UseStrictAuth {
|
|
var authority authorityPO
|
|
if err := r.data.gormDB.WithContext(ctx).Where("authority_id = ?", actor.AuthorityID).First(&authority).Error; err != nil {
|
|
return err
|
|
}
|
|
if authority.ParentID != nil && *authority.ParentID != 0 {
|
|
allowed, err := r.PolicyPaths(ctx, actor.AuthorityID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
allowedSet := make(map[string]bool, len(allowed))
|
|
for _, item := range allowed {
|
|
allowedSet[item.Path+"\x00"+item.Method] = true
|
|
}
|
|
for _, item := range paths {
|
|
if !allowedSet[item.Path+"\x00"+item.Method] {
|
|
return errors.New("存在api不在权限列表中")
|
|
}
|
|
}
|
|
}
|
|
}
|
|
return r.data.gormDB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
|
|
if err := deletePoliciesForAuthority(tx, aid); err != nil {
|
|
return err
|
|
}
|
|
// Keep the legacy relation table clean for upgraded installations. It
|
|
// is not consulted for authorization anymore.
|
|
if err := tx.Where("authority_id = ?", aid).Delete(&authorityAPIPO{}).Error; err != nil {
|
|
return err
|
|
}
|
|
rules := make([]casbinRulePO, 0, len(paths))
|
|
seen := make(map[string]struct{}, len(paths))
|
|
for _, path := range paths {
|
|
key := path.Path + "\x00" + path.Method
|
|
if _, ok := seen[key]; ok {
|
|
continue
|
|
}
|
|
seen[key] = struct{}{}
|
|
rules = append(rules, newPolicyRule(aid, path.Path, path.Method))
|
|
}
|
|
if len(rules) > 0 {
|
|
return tx.Create(&rules).Error
|
|
}
|
|
return nil
|
|
})
|
|
}
|
|
|
|
func (r *apiRepo) IgnoredAPIs(ctx context.Context) ([]*biz.API, error) {
|
|
var pos []ignoredAPIPO
|
|
if err := r.data.gormDB.WithContext(ctx).Find(&pos).Error; err != nil {
|
|
return nil, err
|
|
}
|
|
out := make([]*biz.API, 0, len(pos))
|
|
for _, po := range pos {
|
|
out = append(out, &biz.API{Path: po.Path, Method: po.Method})
|
|
}
|
|
return out, nil
|
|
}
|
|
func (r *apiRepo) SetAPIIgnored(ctx context.Context, path, method string, ignored bool) error {
|
|
po := ignoredAPIPO{Path: path, Method: method}
|
|
if ignored {
|
|
// The compatible endpoint creates an ignore row on every request (the table has no
|
|
// path/method uniqueness constraint); retain that observable behavior.
|
|
return r.data.gormDB.WithContext(ctx).Create(&po).Error
|
|
}
|
|
return r.data.gormDB.WithContext(ctx).Unscoped().Where("path = ? AND method = ?", po.Path, po.Method).Delete(&ignoredAPIPO{}).Error
|
|
}
|
|
func (r *apiRepo) ApplyAPISync(ctx context.Context, added, deleted []*biz.API) error {
|
|
return r.data.gormDB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
|
|
if len(added) > 0 {
|
|
pos := make([]apiPO, 0, len(added))
|
|
for _, item := range added {
|
|
pos = append(pos, apiPO{Path: item.Path, Method: item.Method, Description: item.Description, APIGroup: item.APIGroup})
|
|
}
|
|
// Insert the submitted newApis slice as-is. Do not silently
|
|
// collapse repeated/existing path+method pairs here; sys_apis itself
|
|
// intentionally has no uniqueness constraint.
|
|
if err := tx.Create(&pos).Error; err != nil {
|
|
return err
|
|
}
|
|
}
|
|
for _, item := range deleted {
|
|
var ids []uint
|
|
if err := tx.Model(&apiPO{}).Where("path = ? AND method = ?", item.Path, item.Method).Pluck("id", &ids).Error; err != nil {
|
|
return err
|
|
}
|
|
if len(ids) > 0 {
|
|
if err := deletePoliciesForPath(tx, item.Path, item.Method); err != nil {
|
|
return err
|
|
}
|
|
if err := tx.Where("api_id IN ?", ids).Delete(&authorityAPIPO{}).Error; err != nil {
|
|
return err
|
|
}
|
|
if err := tx.Where("id IN ?", ids).Delete(&apiPO{}).Error; err != nil {
|
|
return err
|
|
}
|
|
}
|
|
}
|
|
return nil
|
|
})
|
|
}
|