sync: 同步 v1.0.4 开源代码并脱敏

internal/logic/middleware/middleware.go

@@ -2,6 +2,8 @@ package middleware
 
 import (
 	"context"
+	"database/sql"
+	"errors"
 	"net/http"
 	"slices"
 	"strconv"
@@ -138,7 +140,13 @@ func (s *sMiddleware) ApiAuth(r *ghttp.Request) {
 		response.JsonExit(r, gcode.CodeNotAuthorized.Code(), consts.CodeLoginExpired.Message())
 		return
 	}
-	if !s.hasOpenApiPermission(ctx, r.Method, path) {
+	allowed, err := s.hasOpenApiPermission(ctx, r.Method, path)
+	if err != nil {
+		g.Log().Errorf(ctx, "sMiddleware.ApiAuth permission check failed, method: %s, path: %s, err: %v", r.Method, path, err)
+		response.JsonExit(r, consts.CodePermissionCheckFailed.Code(), consts.CodePermissionCheckFailed.Message())
+		return
+	}
+	if !allowed {
 		response.JsonExit(r, consts.CodeNoPermission.Code(), consts.CodeNoPermission.Message())
 		return
 	}
@@ -162,33 +170,36 @@ func openApiMethodValues(method string) []string {
 	return values
 }
 
-func (s *sMiddleware) hasOpenApiPermission(ctx context.Context, method, path string) bool {
+// hasOpenApiPermission 判定当前 API 账号对指定路由是否已授权。
+// 返回值 error 仅代表权限数据查询本身的系统故障，与「无权限」(false, nil) 严格区分：
+// 调用方对 error 返回系统异常码，对 false 返回无权限码，避免把数据库故障误报成授权问题。
+// 未登记资源、资源停用、账号不可用、未绑定权限组均按无权限处理。
+func (s *sMiddleware) hasOpenApiPermission(ctx context.Context, method, path string) (bool, error) {
 	agentUser := contexts.GetAgentUser(ctx)
 	if agentUser == nil {
-		return false
-	}
-	if path == "/openapi/v3/query/token" {
-		return true
+		return false, nil
 	}
 
 	path = strings.TrimSpace(path)
 	if path != "/" {
 		path = strings.TrimRight(path, "/")
 	}
+	// 每条受保护路由（含 /common 兼容前缀的别名路由）都必须显式登记资源并完成授权，
+	// 资源查询失败不得降级为放行。
 	var apiResource entity.TApiResource
-	if err := dao.TApiResource.Ctx(ctx).
+	err := dao.TApiResource.Ctx(ctx).
 		WhereIn(dao.TApiResource.Columns().Method, openApiMethodValues(method)).
 		Where(dao.TApiResource.Columns().Path, path).
-		Scan(&apiResource); err != nil {
-		g.Log().Warningf(ctx, "sMiddleware.hasOpenApiPermission resource not configured, method: %s, path: %s, err: %v", method, path, err)
-		return true
+		Scan(&apiResource)
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		return false, gerror.Wrapf(err, "query t_api_resource failed, method: %s, path: %s", method, path)
 	}
-	if apiResource.Id == 0 {
+	if err != nil || apiResource.Id == 0 {
 		g.Log().Warningf(ctx, "sMiddleware.hasOpenApiPermission resource not configured, method: %s, path: %s", method, path)
-		return true
+		return false, nil
 	}
 	if apiResource.Status == 1 {
-		return false
+		return false, nil
 	}
 
 	var tApi entity.TApi
@@ -199,19 +210,22 @@ func (s *sMiddleware) hasOpenApiPermission(ctx context.Context, method, path str
 		apiMod = apiMod.Where(dao.TApi.Columns().AppKey, agentUser.AppKey)
 	} else {
 		g.Log().Warningf(ctx, "sMiddleware.hasOpenApiPermission api identity is empty, resourceApiId: %d, path: %s", apiResource.Id, path)
-		return false
+		return false, nil
 	}
 	if err := apiMod.Scan(&tApi); err != nil {
-		g.Log().Errorf(ctx, "sMiddleware.hasOpenApiPermission scan t_api error: %v", err)
-		return false
+		if errors.Is(err, sql.ErrNoRows) {
+			g.Log().Warningf(ctx, "sMiddleware.hasOpenApiPermission t_api not found, resourceApiId: %d, path: %s", apiResource.Id, path)
+			return false, nil
+		}
+		return false, gerror.Wrapf(err, "query t_api failed, resourceApiId: %d, path: %s", apiResource.Id, path)
 	}
 	if tApi.Id == 0 || tApi.Status == 1 {
 		g.Log().Warningf(ctx, "sMiddleware.hasOpenApiPermission t_api unavailable, tApiId: %d, status: %d, resourceApiId: %d, path: %s", tApi.Id, tApi.Status, apiResource.Id, path)
-		return false
+		return false, nil
 	}
 	if tApi.GroupId <= 0 {
 		g.Log().Warningf(ctx, "sMiddleware.hasOpenApiPermission groupId is empty, tApiId: %d, appKey: %s, resourceApiId: %d, path: %s", tApi.Id, tApi.AppKey, apiResource.Id, path)
-		return false
+		return false, nil
 	}
 
 	count, err := dao.TApiGroupResource.Ctx(ctx).
@@ -219,10 +233,9 @@ func (s *sMiddleware) hasOpenApiPermission(ctx context.Context, method, path str
 		Where(dao.TApiGroupResource.Columns().ApiId, apiResource.Id).
 		Count()
 	if err != nil {
-		g.Log().Errorf(ctx, "sMiddleware.hasOpenApiPermission scan relation error: %v", err)
-		return false
+		return false, gerror.Wrapf(err, "query t_api_group_resource failed, groupId: %d, resourceApiId: %d, path: %s", tApi.GroupId, apiResource.Id, path)
 	}
-	return count > 0
+	return count > 0, nil
 }
 
 func (m *sMiddleware) OldResponseHandler(r *ghttp.Request) {