kra-oa/internal/server/gin.go

package server

import (
	"log/slog"
	"mime"
	"net/http"
	"os"
	"path"
	"strings"
	"time"

	"kra/internal/conf"
	"kra/internal/server/handler"
	"kra/internal/server/httpx"
	servermiddleware "kra/internal/server/middleware"
	serverrouter "kra/internal/server/router"
	"kra/internal/service"

	"github.com/gin-gonic/gin"
	kratoshttp "github.com/go-kratos/kratos/v3/transport/http"
)

func NewGinEngine(runtime *conf.Runtime, access *service.AccessControlService, handlers *handler.Set, auth *service.AuthService, security *service.SecurityService, audit *service.AuditRecorder, logger *slog.Logger) *gin.Engine {
	gin.SetMode(gin.ReleaseMode)
	engine := gin.New()
	engine.Use(servermiddleware.RequestMeta(), servermiddleware.Recovery(audit, logger), servermiddleware.AccessLog(runtime, logger), servermiddleware.ErrorAudit(audit), servermiddleware.SecurityRateLimit(security), servermiddleware.OperationAudit(runtime, audit))

	prefix := ""
	config := runtime.Admin()
	if config != nil {
		prefix = strings.TrimSuffix(config.RouterPrefix, "/")
	}
	public := engine.Group(prefix)
	public.GET("/health", func(c *gin.Context) { c.JSON(http.StatusOK, "ok") })
	serverrouter.RegisterPublic(public, engine, handlers.Public)

	private := engine.Group(prefix)
	private.Use(servermiddleware.Auth(auth), servermiddleware.MustChangePassword(), servermiddleware.AccessControl(runtime, access, audit))
	serverrouter.RegisterUser(private, handlers.User)
	serverrouter.RegisterNavigation(private, handlers.Navigation)
	serverrouter.RegisterSession(private, handlers.Session)
	serverrouter.RegisterAuthority(private, handlers.Authority)
	serverrouter.RegisterMenu(private, handlers.Menu)
	serverrouter.RegisterAPI(private, public, engine, handlers.API)
	serverrouter.RegisterPermission(private, handlers.Permission)
	serverrouter.RegisterOrganization(private, handlers.Organization)
	serverrouter.RegisterDictionary(private, handlers.Dictionary)
	serverrouter.RegisterParameter(private, handlers.Parameter)
	serverrouter.RegisterAPIToken(private, handlers.APIToken)
	serverrouter.RegisterSystemConfig(private, handlers.SystemConfig)
	serverrouter.RegisterVersion(private, handlers.Version)
	serverrouter.RegisterExport(private, public, handlers.Export)
	serverrouter.RegisterAudit(private, public, handlers.Audit)
	serverrouter.RegisterTask(private, handlers.Task)
	serverrouter.RegisterMedia(private, handlers.Media)
	serverrouter.RegisterAnnouncement(private, public, handlers.Announcement)
	serverrouter.RegisterEmail(private, handlers.Email)

	engine.NoRoute(func(c *gin.Context) {
		if serveLocalStorage(c, runtime) {
			return
		}
		httpx.Fail(c, "请求的接口不存在")
	})
	return engine
}

func NewGinServer(c *conf.Server, engine *gin.Engine) *kratoshttp.Server {
	network, address := "tcp", ":8000"
	if c != nil && c.Http != nil {
		if c.Http.Network != "" {
			network = c.Http.Network
		}
		if c.Http.Addr != "" {
			address = c.Http.Addr
		}
	}
	timeout := 10 * time.Minute
	if c != nil && c.Http != nil && c.Http.Timeout != nil && c.Http.Timeout.AsDuration() > 0 {
		timeout = c.Http.Timeout.AsDuration()
	}
	server := kratoshttp.NewServer(kratoshttp.Network(network), kratoshttp.Address(address), kratoshttp.Timeout(timeout))
	server.HandlePrefix("/", engine)
	server.Server.ReadHeaderTimeout = 10 * time.Second
	server.Server.ReadTimeout = timeout
	server.Server.WriteTimeout = timeout
	server.Server.IdleTimeout = 2 * time.Minute
	server.Server.MaxHeaderBytes = 1 << 20
	return server
}

// serveLocalStorage resolves the local path for every request so a config
// reload takes effect without rebuilding the Gin engine.
func serveLocalStorage(c *gin.Context, runtime *conf.Runtime) bool {
	config := runtime.Admin()
	if config == nil || config.Local == nil || config.Local.StorePath == "" {
		return false
	}
	if config.Storage != nil && config.Storage.Type != "" && config.Storage.Type != "local" {
		return false
	}
	prefix := "/" + strings.Trim(config.Local.PathPrefix, "/")
	if prefix == "/" || (c.Request.URL.Path != prefix && !strings.HasPrefix(c.Request.URL.Path, prefix+"/")) {
		return false
	}
	c.Header("X-Content-Type-Options", "nosniff")
	filename := path.Base(c.Request.URL.Path)
	if !canServeUploadInline(filename) {
		c.Header("Content-Disposition", mime.FormatMediaType("attachment", map[string]string{"filename": filename}))
	}
	http.StripPrefix(prefix, http.FileServer(filesOnly{FileSystem: http.Dir(config.Local.StorePath)})).ServeHTTP(c.Writer, c.Request)
	return true
}

func canServeUploadInline(filename string) bool {
	switch strings.ToLower(path.Ext(filename)) {
	case ".jpg", ".jpeg", ".png", ".gif", ".webp", ".bmp", ".ico", ".avif",
		".mp3", ".wav", ".ogg", ".m4a", ".flac", ".aac",
		".mp4", ".webm", ".mov", ".avi", ".mkv":
		return true
	default:
		return false
	}
}

type filesOnly struct{ http.FileSystem }

func (f filesOnly) Open(name string) (http.File, error) {
	file, err := f.FileSystem.Open(name)
	if err != nil {
		return nil, err
	}
	info, statErr := file.Stat()
	if statErr != nil {
		_ = file.Close()
		return nil, statErr
	}
	if info.IsDir() {
		_ = file.Close()
		return nil, os.ErrPermission
	}
	return file, nil
}