MiFaZhan
365 lines
11 KiB
Go
365 lines
11 KiB
Go
package middleware
|
|
|
|
import (
|
|
"context"
|
|
"database/sql"
|
|
"errors"
|
|
"net/http"
|
|
"slices"
|
|
"strconv"
|
|
"strings"
|
|
|
|
"github.com/gogf/gf/v2/errors/gcode"
|
|
"github.com/gogf/gf/v2/errors/gerror"
|
|
"github.com/gogf/gf/v2/frame/g"
|
|
"github.com/gogf/gf/v2/net/ghttp"
|
|
"github.com/gogf/gf/v2/os/gtime"
|
|
"github.com/gogf/gf/v2/util/gmeta"
|
|
|
|
"git.5iot.com/iotlcm-public/iotlcm-openapi/internal/consts"
|
|
"git.5iot.com/iotlcm-public/iotlcm-openapi/internal/dao"
|
|
"git.5iot.com/iotlcm-public/iotlcm-openapi/internal/library/contexts"
|
|
"git.5iot.com/iotlcm-public/iotlcm-openapi/internal/model"
|
|
"git.5iot.com/iotlcm-public/iotlcm-openapi/internal/model/entity"
|
|
"git.5iot.com/iotlcm-public/iotlcm-openapi/internal/packed/response"
|
|
"git.5iot.com/iotlcm-public/iotlcm-openapi/internal/service"
|
|
)
|
|
|
|
type sMiddleware struct{}
|
|
|
|
const apiDataScopeRoleId int64 = 17
|
|
|
|
func New() *sMiddleware {
|
|
return &sMiddleware{}
|
|
}
|
|
|
|
func init() {
|
|
service.RegisterMiddleware(New())
|
|
}
|
|
|
|
func getContentType(r *ghttp.Request) (contentType string) {
|
|
contentType = r.Response.Header().Get("Content-Type")
|
|
if contentType != "" {
|
|
return
|
|
}
|
|
|
|
mime := gmeta.Get(r.GetHandlerResponse(), "mime").String()
|
|
if mime == "" {
|
|
contentType = consts.HTTPContentTypeJson
|
|
} else {
|
|
contentType = mime
|
|
}
|
|
return
|
|
}
|
|
|
|
func (m *sMiddleware) ResponseHandler(r *ghttp.Request) {
|
|
r.Middleware.Next()
|
|
if r.Response.BufferLength() > 0 || contexts.IsWebSocket(r.GetCtx()) {
|
|
return
|
|
}
|
|
if getContentType(r) == consts.HTTPContentTypeExcel {
|
|
r.Response.Status = http.StatusOK
|
|
return
|
|
}
|
|
|
|
err := r.GetError()
|
|
res := r.GetHandlerResponse()
|
|
var code gcode.Code = gcode.CodeOK
|
|
if err != nil {
|
|
code = gerror.Code(err)
|
|
if code == gcode.CodeNil {
|
|
code = gcode.CodeInternalError
|
|
}
|
|
response.JsonExit(r, code.Code(), err.Error())
|
|
return
|
|
}
|
|
response.Json(r, code.Code(), "", res)
|
|
}
|
|
|
|
func (s *sMiddleware) ApiCtx(r *ghttp.Request) {
|
|
ctx := r.GetCtx()
|
|
r.SetCtx(r.GetNeverDoneCtx())
|
|
if r.URL != nil && s.IsExceptLogin(ctx, r.URL.Path) {
|
|
r.Middleware.Next()
|
|
return
|
|
}
|
|
|
|
data, err := service.QueryToken().GetCurrentCustomer(ctx)
|
|
if err != nil {
|
|
g.Log().Errorf(ctx, "sMiddleware.ApiCtx current customer error: %v", err)
|
|
r.Middleware.Next()
|
|
return
|
|
}
|
|
if data != nil {
|
|
contextModel := new(model.Context)
|
|
contextModel.User = &model.Identity{
|
|
BaseClaims: model.BaseClaims{
|
|
ID: 0,
|
|
TenantId: data.BaseClaimsApi.TenantId,
|
|
DeptId: data.BaseClaimsApi.DeptId,
|
|
Roles: []model.Role{
|
|
{RoleId: apiDataScopeRoleId, DataScope: consts.SysRoleDataScopeDeptAndBelow},
|
|
},
|
|
LoginAt: data.BaseClaimsApi.LoginAt,
|
|
},
|
|
}
|
|
contextModel.AgentUser = &data.BaseClaimsApi
|
|
contexts.Init(r, contextModel)
|
|
}
|
|
r.Middleware.Next()
|
|
}
|
|
|
|
func (s *sMiddleware) ApiAuth(r *ghttp.Request) {
|
|
ctx := r.Context()
|
|
path := r.URL.Path
|
|
if s.IsExceptLogin(ctx, path) {
|
|
r.Middleware.Next()
|
|
return
|
|
}
|
|
|
|
deptKey := contexts.GetDeptKey(ctx)
|
|
if deptKey == "" {
|
|
g.Log().Error(ctx, "sMiddleware.ApiAuth deptKey is empty", "path", path)
|
|
response.JsonExit(r, gcode.CodeNotAuthorized.Code(), consts.CodeLoginExpired.Message())
|
|
return
|
|
}
|
|
|
|
appId := r.Get("appId").String()
|
|
if appId == "" {
|
|
g.Log().Error(ctx, "sMiddleware.ApiAuth appId is empty", "path", path)
|
|
response.JsonExit(r, gcode.CodeNotAuthorized.Code(), consts.CodeLoginExpired.Message())
|
|
return
|
|
}
|
|
if deptKey != appId {
|
|
g.Log().Error(ctx, "sMiddleware.ApiAuth deptKey not match appId", "path", path)
|
|
response.JsonExit(r, gcode.CodeNotAuthorized.Code(), consts.CodeLoginExpired.Message())
|
|
return
|
|
}
|
|
if contexts.GetAgentDeptId(ctx) == 0 {
|
|
g.Log().Error(ctx, "sMiddleware.ApiAuth deptId is 0", "path", path)
|
|
response.JsonExit(r, gcode.CodeNotAuthorized.Code(), consts.CodeLoginExpired.Message())
|
|
return
|
|
}
|
|
allowed, err := s.hasOpenApiPermission(ctx, r.Method, path)
|
|
if err != nil {
|
|
g.Log().Errorf(ctx, "sMiddleware.ApiAuth permission check failed, method: %s, path: %s, err: %v", r.Method, path, err)
|
|
response.JsonExit(r, consts.CodePermissionCheckFailed.Code(), consts.CodePermissionCheckFailed.Message())
|
|
return
|
|
}
|
|
if !allowed {
|
|
response.JsonExit(r, consts.CodeNoPermission.Code(), consts.CodeNoPermission.Message())
|
|
return
|
|
}
|
|
|
|
r.Middleware.Next()
|
|
}
|
|
|
|
func openApiMethodValues(method string) []string {
|
|
method = strings.ToUpper(strings.TrimSpace(method))
|
|
values := []string{method}
|
|
switch method {
|
|
case "GET":
|
|
values = append(values, "4")
|
|
case "POST":
|
|
values = append(values, "1")
|
|
case "PUT":
|
|
values = append(values, "2")
|
|
case "DELETE":
|
|
values = append(values, "3")
|
|
}
|
|
return values
|
|
}
|
|
|
|
// hasOpenApiPermission 判定当前 API 账号对指定路由是否已授权。
|
|
// 返回值 error 仅代表权限数据查询本身的系统故障，与「无权限」(false, nil) 严格区分：
|
|
// 调用方对 error 返回系统异常码，对 false 返回无权限码，避免把数据库故障误报成授权问题。
|
|
// 未登记资源、资源停用、账号不可用、未绑定权限组均按无权限处理。
|
|
func (s *sMiddleware) hasOpenApiPermission(ctx context.Context, method, path string) (bool, error) {
|
|
agentUser := contexts.GetAgentUser(ctx)
|
|
if agentUser == nil {
|
|
return false, nil
|
|
}
|
|
|
|
path = strings.TrimSpace(path)
|
|
if path != "/" {
|
|
path = strings.TrimRight(path, "/")
|
|
}
|
|
// 每条受保护路由（含 /common 兼容前缀的别名路由）都必须显式登记资源并完成授权，
|
|
// 资源查询失败不得降级为放行。
|
|
var apiResource entity.TApiResource
|
|
err := dao.TApiResource.Ctx(ctx).
|
|
WhereIn(dao.TApiResource.Columns().Method, openApiMethodValues(method)).
|
|
Where(dao.TApiResource.Columns().Path, path).
|
|
Scan(&apiResource)
|
|
if err != nil && !errors.Is(err, sql.ErrNoRows) {
|
|
return false, gerror.Wrapf(err, "query t_api_resource failed, method: %s, path: %s", method, path)
|
|
}
|
|
if err != nil || apiResource.Id == 0 {
|
|
g.Log().Warningf(ctx, "sMiddleware.hasOpenApiPermission resource not configured, method: %s, path: %s", method, path)
|
|
return false, nil
|
|
}
|
|
if apiResource.Status == 1 {
|
|
return false, nil
|
|
}
|
|
|
|
var tApi entity.TApi
|
|
apiMod := dao.TApi.Ctx(ctx)
|
|
if agentUser.ApiId > 0 {
|
|
apiMod = apiMod.Where(dao.TApi.Columns().Id, agentUser.ApiId)
|
|
} else if agentUser.AppKey != "" {
|
|
apiMod = apiMod.Where(dao.TApi.Columns().AppKey, agentUser.AppKey)
|
|
} else {
|
|
g.Log().Warningf(ctx, "sMiddleware.hasOpenApiPermission api identity is empty, resourceApiId: %d, path: %s", apiResource.Id, path)
|
|
return false, nil
|
|
}
|
|
if err := apiMod.Scan(&tApi); err != nil {
|
|
if errors.Is(err, sql.ErrNoRows) {
|
|
g.Log().Warningf(ctx, "sMiddleware.hasOpenApiPermission t_api not found, resourceApiId: %d, path: %s", apiResource.Id, path)
|
|
return false, nil
|
|
}
|
|
return false, gerror.Wrapf(err, "query t_api failed, resourceApiId: %d, path: %s", apiResource.Id, path)
|
|
}
|
|
if tApi.Id == 0 || tApi.Status == 1 {
|
|
g.Log().Warningf(ctx, "sMiddleware.hasOpenApiPermission t_api unavailable, tApiId: %d, status: %d, resourceApiId: %d, path: %s", tApi.Id, tApi.Status, apiResource.Id, path)
|
|
return false, nil
|
|
}
|
|
if tApi.GroupId <= 0 {
|
|
g.Log().Warningf(ctx, "sMiddleware.hasOpenApiPermission groupId is empty, tApiId: %d, appKey: %s, resourceApiId: %d, path: %s", tApi.Id, tApi.AppKey, apiResource.Id, path)
|
|
return false, nil
|
|
}
|
|
|
|
count, err := dao.TApiGroupResource.Ctx(ctx).
|
|
Where(dao.TApiGroupResource.Columns().GroupId, tApi.GroupId).
|
|
Where(dao.TApiGroupResource.Columns().ApiId, apiResource.Id).
|
|
Count()
|
|
if err != nil {
|
|
return false, gerror.Wrapf(err, "query t_api_group_resource failed, groupId: %d, resourceApiId: %d, path: %s", tApi.GroupId, apiResource.Id, path)
|
|
}
|
|
return count > 0, nil
|
|
}
|
|
|
|
func (m *sMiddleware) OldResponseHandler(r *ghttp.Request) {
|
|
r.Middleware.Next()
|
|
if r.Response.BufferLength() > 0 || contexts.IsWebSocket(r.GetCtx()) {
|
|
return
|
|
}
|
|
if getContentType(r) == consts.HTTPContentTypeExcel {
|
|
r.Response.Status = http.StatusOK
|
|
return
|
|
}
|
|
|
|
err := r.GetError()
|
|
res := r.GetHandlerResponse()
|
|
var code gcode.Code = gcode.CodeOK
|
|
if err != nil {
|
|
code = gerror.Code(err)
|
|
if code == gcode.CodeNil {
|
|
code = gcode.CodeInternalError
|
|
}
|
|
response.OldJson(r, code.Code(), err.Error())
|
|
return
|
|
}
|
|
response.OldJson(r, code.Code(), "", res)
|
|
}
|
|
|
|
func (s *sMiddleware) OldCtx(r *ghttp.Request) {
|
|
ctx := r.GetCtx()
|
|
r.SetCtx(r.GetNeverDoneCtx())
|
|
|
|
verifyVar := r.Get("verify")
|
|
var verify model.VerifyItem
|
|
if err := verifyVar.Scan(&verify); err != nil {
|
|
g.Log().Errorf(ctx, "sMiddleware.OldCtx verify scan error: %v", err)
|
|
response.JsonExit(r, gcode.CodeNotAuthorized.Code(), "request param invalid")
|
|
return
|
|
}
|
|
|
|
var tApi entity.TApi
|
|
err := dao.TApi.Ctx(ctx).Where(g.Map{
|
|
dao.TApi.Columns().AppKey: verify.AppId,
|
|
}).Scan(&tApi)
|
|
if err != nil {
|
|
r.Middleware.Next()
|
|
return
|
|
}
|
|
if tApi.Id != 0 {
|
|
contextModel := new(model.Context)
|
|
contextModel.User = &model.Identity{
|
|
BaseClaims: model.BaseClaims{
|
|
ID: 0,
|
|
TenantId: tApi.TenantId,
|
|
DeptId: tApi.DeptId,
|
|
Roles: []model.Role{
|
|
{RoleId: apiDataScopeRoleId, DataScope: consts.SysRoleDataScopeDeptAndBelow},
|
|
},
|
|
LoginAt: gtime.Now().TimestampMilli(),
|
|
},
|
|
}
|
|
contextModel.AgentUser = &model.BaseClaimsApi{
|
|
ApiId: tApi.Id,
|
|
AppKey: tApi.AppKey,
|
|
GroupId: tApi.GroupId,
|
|
DeptId: tApi.DeptId,
|
|
TenantId: tApi.TenantId,
|
|
LoginAt: gtime.Now().TimestampMilli(),
|
|
}
|
|
contexts.Init(r, contextModel)
|
|
}
|
|
r.Middleware.Next()
|
|
}
|
|
|
|
func (s *sMiddleware) OldAuth(r *ghttp.Request) {
|
|
ctx := r.Context()
|
|
path := r.URL.Path
|
|
if s.IsExceptLogin(ctx, path) {
|
|
r.Middleware.Next()
|
|
return
|
|
}
|
|
|
|
verifyVar := r.Get("verify")
|
|
var verify model.VerifyItem
|
|
if err := verifyVar.Scan(&verify); err != nil {
|
|
g.Log().Errorf(ctx, "sMiddleware.OldAuth verify scan error: %v", err)
|
|
response.JsonExit(r, gcode.CodeNotAuthorized.Code(), "request param invalid")
|
|
return
|
|
}
|
|
if verify.TimeStamp == "" {
|
|
g.Log().Error(ctx, "sMiddleware.OldAuth timestamp is empty", "path", path)
|
|
response.JsonExit(r, gcode.CodeNotAuthorized.Code(), "request param invalid")
|
|
return
|
|
}
|
|
|
|
givenTime, err := strconv.ParseInt(verify.TimeStamp, 10, 64)
|
|
if err != nil {
|
|
g.Log().Errorf(ctx, "sMiddleware.OldAuth timestamp parse error: %v", err)
|
|
response.JsonExit(r, gcode.CodeNotAuthorized.Code(), "request param invalid")
|
|
return
|
|
}
|
|
if givenTime > gtime.Now().TimestampMilli()+3*60*1000 {
|
|
g.Log().Error(ctx, "sMiddleware.OldAuth timestamp expired", "path", path)
|
|
response.JsonExit(r, gcode.CodeNotAuthorized.Code(), "request timeout")
|
|
return
|
|
}
|
|
if verify.AppId == "" {
|
|
g.Log().Error(ctx, "sMiddleware.OldAuth appId is empty", "path", path)
|
|
response.JsonExit(r, gcode.CodeNotAuthorized.Code(), "request param invalid")
|
|
return
|
|
}
|
|
|
|
var tApi entity.TApi
|
|
err = dao.TApi.Ctx(ctx).Where(g.Map{
|
|
dao.TApi.Columns().AppKey: verify.AppId,
|
|
}).Scan(&tApi)
|
|
if err != nil || tApi.Id == 0 || verify.Password != tApi.AppSecret {
|
|
g.Log().Errorf(ctx, "sMiddleware.OldAuth auth failed: %v", err)
|
|
response.JsonExit(r, gcode.CodeNotAuthorized.Code(), consts.CodeUserNotFound.Message())
|
|
return
|
|
}
|
|
r.Middleware.Next()
|
|
}
|
|
|
|
func (s *sMiddleware) IsExceptLogin(ctx context.Context, path string) bool {
|
|
pathList := g.Cfg().MustGet(ctx, "router.exceptLogin").Strings()
|
|
return slices.Contains(pathList, path)
|
|
}
|