1、action中各动作添加数据权限

2、修改jwt中key为常量

apis/actions/create.go

@@ -35,10 +35,10 @@ func CreateAction(control dto.Control) gin.HandlerFunc {
 			err = db.WithContext(c).Create(object).Error
 			tools.HasError(err, "创建失败", 500)
 			app.OK(c, object.GetId(), "创建成功")
+			c.Next()
 		default:
 			err = errors.New("db connect not exist")
 			tools.HasError(err, "", 500)
 		}
-		c.Next()
 	}
 }

apis/actions/delete.go

@@ -31,14 +31,27 @@ func DeleteAction(control dto.Control) gin.HandlerFunc {
 			var object model.ActiveRecord
 			object, err = req.GenerateM()
 			tools.HasError(err, "模型生成失败", 500)
+
+			//数据权限检查
 			object.SetUpdateBy(tools.GetUserIdStr(c))
-			err = db.WithContext(c).Delete(object).Error
-			tools.HasError(err, "更新失败", 500)
-			app.OK(c, object.GetId(), "更新成功")
+			var p = new(dataPermission)
+			if userId := tools.GetUserIdStr(c); userId != "" {
+				p, err = newDataPermission(db, userId)
+				tools.HasError(err, "权限范围鉴定错误", 500)
+			}
+			db = db.WithContext(c).Scopes(
+				Permission(object.TableName(), p),
+			).Delete(object)
+			tools.HasError(db.Error, "删除失败", 500)
+			if db.RowsAffected == 0 {
+				err = errors.New("无权删除该数据")
+				tools.HasError(err, "", 403)
+			}
+			app.OK(c, object.GetId(), "删除成功")
+			c.Next()
 		default:
 			err = errors.New("db connect not exist")
 			tools.HasError(err, "", 500)
 		}
-		c.Next()
 	}
 }

apis/actions/index.go

@@ -49,11 +49,11 @@ func IndexAction(m model.ActiveRecord, d dto.Index, f func() interface{}) gin.Ha
 			if !errors.Is(err, gorm.ErrRecordNotFound) {
 				tools.HasError(err, "查询失败", 500)
 			}
+			app.PageOK(c, list, int(count), req.GetPageIndex(), req.GetPageSize(), "查询成功")
+			c.Next()
 		default:
 			err = errors.New("db connect not exist")
 			tools.HasError(err, "", 500)
 		}
-		app.PageOK(c, list, int(count), req.GetPageIndex(), req.GetPageSize(), "查询成功")
-		c.Next()
 	}
 }

apis/actions/update.go

@@ -32,13 +32,26 @@ func UpdateAction(control dto.Control) gin.HandlerFunc {
 			object, err = req.GenerateM()
 			tools.HasError(err, "参数验证失败", 422)
 			object.SetUpdateBy(tools.GetUserIdStr(c))
-			err = db.WithContext(c).Updates(object).Error
-			tools.HasError(err, "更新失败", 500)
+
+			//数据权限检查
+			var p = new(dataPermission)
+			if userId := tools.GetUserIdStr(c); userId != "" {
+				p, err = newDataPermission(db, userId)
+				tools.HasError(err, "权限范围鉴定错误", 500)
+			}
+			db = db.WithContext(c).Scopes(
+				Permission(object.TableName(), p),
+			).Updates(object)
+			tools.HasError(db.Error, "更新失败", 500)
+			if db.RowsAffected == 0 {
+				err = errors.New("无权更新该数据")
+				tools.HasError(err, "", 403)
+			}
 			app.OK(c, object.GetId(), "更新成功")
+			c.Next()
 		default:
 			err = errors.New("db connect not exist")
 			tools.HasError(err, "", 500)
 		}
-		c.Next()
 	}
 }

apis/actions/view.go

@@ -31,13 +31,23 @@ func ViewAction(control dto.Control) gin.HandlerFunc {
 			var object model.ActiveRecord
 			object, err = req.GenerateM()
 			tools.HasError(err, "模型生成失败", 500)
-			err = db.WithContext(c).First(object).Error
+			var p = new(dataPermission)
+			if userId := tools.GetUserIdStr(c); userId != "" {
+				p, err = newDataPermission(db, userId)
+				tools.HasError(err, "权限范围鉴定错误", 500)
+			}
+			err = db.WithContext(c).Scopes(
+				Permission(object.TableName(), p),
+			).First(object).Error
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				tools.HasError(err, "查看失败", 404)
+			}
 			tools.HasError(err, "查看失败", 500)
 			app.OK(c, object, "查看成功")
+			c.Next()
 		default:
 			err = errors.New("db connect not exist")
 			tools.HasError(err, "", 500)
 		}
-		c.Next()
 	}
 }

middleware/permission.go

@@ -14,7 +14,7 @@ import (
 //权限检查中间件
 func AuthCheckRole() gin.HandlerFunc {
 	return func(c *gin.Context) {
-		data, _ := c.Get("JWT_PAYLOAD")
+		data, _ := c.Get(jwtauth.JwtPayloadKey)
 		v := data.(jwtauth.MapClaims)
 		e, err := mycasbin.Casbin()
 		tools.HasError(err, "", 500)

pkg/jwtauth/jwtauth.go

@@ -12,6 +12,8 @@ import (
 	"time"
 )
 
+const JwtPayloadKey = "JWT_PAYLOAD"
+
 type MapClaims map[string]interface{}
 
 // GinJWTMiddleware provides a Json-Web-Token authentication implementation. On failure, a 401 HTTP response
@@ -400,7 +402,7 @@ func (mw *GinJWTMiddleware) middlewareImpl(c *gin.Context) {
 		return
 	}
 
-	c.Set("JWT_PAYLOAD", claims)
+	c.Set(JwtPayloadKey, claims)
 	identity := mw.IdentityHandler(c)
 
 	if identity != nil {
@@ -716,7 +718,7 @@ func (mw *GinJWTMiddleware) unauthorized(c *gin.Context, code int, message strin
 
 // ExtractClaims help to extract the JWT claims
 func ExtractClaims(c *gin.Context) MapClaims {
-	claims, exists := c.Get("JWT_PAYLOAD")
+	claims, exists := c.Get(JwtPayloadKey)
 	if !exists {
 		return make(MapClaims)
 	}

tools/user.go

@@ -9,7 +9,7 @@ import (
 )
 
 func ExtractClaims(c *gin.Context) jwt.MapClaims {
-	claims, exists := c.Get("JWT_PAYLOAD")
+	claims, exists := c.Get(jwt.JwtPayloadKey)
 	if !exists {
 		return make(jwt.MapClaims)
 	}