go-admin

mirror of https://github.com/go-admin-team/go-admin.git synced 2026-09-21 02:04:09 +00:00

Files

T

zhangwenjian 4156387eb9 fix🐛: enforce Casbin when editing another user

PUT /api/v1/sys-user sits in CasbinExclude so the profile page can reach it,
which means AuthCheckRole never runs for this route. The handler took the
target user id from the request body, so any authenticated caller could edit
another user's record - including their roleId.

The route has to stay excluded: the profile page and the admin user list share
this one endpoint, so removing the exclusion would break self-service editing
for every non-admin role. The check therefore moves into the handler: when the
target is not the caller, the request is put through Casbin explicitly.

EnforceRoleFor carries the same admin short-circuit and enforcement AuthCheckRole
uses, so a route that opts out of the middleware can still ask the same question.

Claude-Session: https://claude.ai/code/session_01HPTAw8b8tAdFNFn8rKdPYx

2026-09-04 17:23:01 +08:00

handler

docs📝: describe the rules rather than who follows them

2026-09-01 19:56:27 +08:00

auth.go

chore🔧: move to go-admin-core v2

2026-08-23 13:26:46 +08:00

customerror.go

捕获runtime.Error异常，否则接口报错不返回任何信息

2022-08-18 10:02:00 +08:00

db.go

chore🔧: move to go-admin-core v2