mirror of
https://github.com/go-admin-team/go-admin.git
synced 2026-09-21 02:04:09 +00:00
zhangwenjian
82ea8539eb
The pinned core dated from April, before sdk stopped being a separate module, so the build resolved sdk packages from the old module and core packages from the new one. Dropping the separate requirement is what makes the two agree again. Most of the diff is renames that came with that: the tenant accessors gained a ByTenant suffix, GetDb now returns one database and GetAllDb the map, and casbin moved to v3. The change that matters is four call sites moving from GetMemoryQueue to GetQueuePrefix. GetMemoryQueue returns a queue fixed at construction, so the login log, the operate log and the api check ran in process no matter what the settings file selected — a second instance saw none of it. GetQueuePrefix returns whatever the configuration built, which is the point of being able to configure a queue at all. Verified against core at main: build and vet clean. The two file_store failures are unchanged from before this branch; they need cloud credentials.
62 lines
1.7 KiB
Go
62 lines
1.7 KiB
Go
package middleware
|
|
|
|
import (
|
|
"github.com/casbin/casbin/v3/util"
|
|
"net/http"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/go-admin-team/go-admin-core/sdk"
|
|
"github.com/go-admin-team/go-admin-core/sdk/api"
|
|
"github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
|
|
"github.com/go-admin-team/go-admin-core/sdk/pkg/response"
|
|
)
|
|
|
|
// AuthCheckRole 权限检查中间件
|
|
func AuthCheckRole() gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
log := api.GetRequestLogger(c)
|
|
data, _ := c.Get(jwtauth.JwtPayloadKey)
|
|
v := data.(jwtauth.MapClaims)
|
|
e := sdk.Runtime.GetCasbinByTenant(c.Request.Host)
|
|
var res, casbinExclude bool
|
|
var err error
|
|
//检查权限
|
|
if v["rolekey"] == "admin" {
|
|
res = true
|
|
c.Next()
|
|
return
|
|
}
|
|
for _, i := range CasbinExclude {
|
|
if util.KeyMatch2(c.Request.URL.Path, i.Url) && c.Request.Method == i.Method {
|
|
casbinExclude = true
|
|
break
|
|
}
|
|
}
|
|
if casbinExclude {
|
|
log.Infof("Casbin exclusion, no validation method:%s path:%s", c.Request.Method, c.Request.URL.Path)
|
|
c.Next()
|
|
return
|
|
}
|
|
res, err = e.Enforce(v["rolekey"], c.Request.URL.Path, c.Request.Method)
|
|
if err != nil {
|
|
log.Errorf("AuthCheckRole error:%s method:%s path:%s", err, c.Request.Method, c.Request.URL.Path)
|
|
response.Error(c, 500, err, "")
|
|
return
|
|
}
|
|
|
|
if res {
|
|
log.Infof("isTrue: %v role: %s method: %s path: %s", res, v["rolekey"], c.Request.Method, c.Request.URL.Path)
|
|
c.Next()
|
|
} else {
|
|
log.Warnf("isTrue: %v role: %s method: %s path: %s message: %s", res, v["rolekey"], c.Request.Method, c.Request.URL.Path, "当前request无权限，请管理员确认！")
|
|
c.JSON(http.StatusOK, gin.H{
|
|
"code": 403,
|
|
"msg": "对不起，您没有该接口访问权限，请联系管理员",
|
|
})
|
|
c.Abort()
|
|
return
|
|
}
|
|
|
|
}
|
|
}
|