初始化
This commit is contained in:
李琦
209
server/middleware/auth.go
Normal file
209
server/middleware/auth.go
Normal file
@@ -0,0 +1,209 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"net/http"
|
||||
"os"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
"github.com/niangaodev/art-code/repositories"
|
||||
)
|
||||
|
||||
// JWT密钥
|
||||
var jwtSecret = []byte(getJWTSecret())
|
||||
|
||||
// getJWTSecret 获取JWT密钥，优先从环境变量获取，否则使用默认值
|
||||
func getJWTSecret() string {
|
||||
secret := os.Getenv("JWT_SECRET")
|
||||
if secret == "" {
|
||||
return "your-secret-key" // 开发环境默认值，生产环境必须通过环境变量设置
|
||||
}
|
||||
return secret
|
||||
}
|
||||
|
||||
// Claims JWT声明结构
|
||||
type Claims struct {
|
||||
UserID uint `json:"userId"`
|
||||
Username string `json:"username"`
|
||||
Role string `json:"role"`
|
||||
RoleID uint `json:"roleId"`
|
||||
jwt.RegisteredClaims
|
||||
}
|
||||
|
||||
// GenerateToken 生成JWT令牌
|
||||
func GenerateToken(userID uint, username, role string) (string, int64, error) {
|
||||
// 设置令牌过期时间为7天
|
||||
expireTime := time.Now().Add(7 * 24 * time.Hour)
|
||||
expireUnix := expireTime.Unix()
|
||||
|
||||
// 获取用户的RoleID
|
||||
var roleID uint
|
||||
userRole, err := repositories.GetRoleByName(role)
|
||||
if err == nil && userRole != nil {
|
||||
roleID = userRole.ID
|
||||
}
|
||||
|
||||
// 创建声明
|
||||
claims := Claims{
|
||||
UserID: userID,
|
||||
Username: username,
|
||||
Role: role,
|
||||
RoleID: roleID,
|
||||
RegisteredClaims: jwt.RegisteredClaims{
|
||||
ExpiresAt: jwt.NewNumericDate(expireTime),
|
||||
IssuedAt: jwt.NewNumericDate(time.Now()),
|
||||
Subject: "admin-token",
|
||||
},
|
||||
}
|
||||
|
||||
// 创建令牌
|
||||
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
|
||||
|
||||
// 签名令牌
|
||||
tokenString, err := token.SignedString(jwtSecret)
|
||||
if err != nil {
|
||||
return "", 0, err
|
||||
}
|
||||
|
||||
return tokenString, expireUnix, nil
|
||||
}
|
||||
|
||||
// ParseToken 解析JWT令牌
|
||||
func ParseToken(tokenString string) (*Claims, error) {
|
||||
// 解析令牌
|
||||
token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
|
||||
return jwtSecret, nil
|
||||
})
|
||||
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// 验证令牌
|
||||
if claims, ok := token.Claims.(*Claims); ok && token.Valid {
|
||||
return claims, nil
|
||||
}
|
||||
|
||||
return nil, errors.New("invalid token")
|
||||
}
|
||||
|
||||
// AuthMiddleware JWT认证中间件
|
||||
func AuthMiddleware() gin.HandlerFunc {
|
||||
return func(c *gin.Context) {
|
||||
// 从请求头中获取令牌
|
||||
authHeader := c.GetHeader("Authorization")
|
||||
if authHeader == "" {
|
||||
c.JSON(http.StatusUnauthorized, gin.H{"error": "Authorization header is required"})
|
||||
c.Abort()
|
||||
return
|
||||
}
|
||||
|
||||
// 检查令牌格式
|
||||
parts := strings.SplitN(authHeader, " ", 2)
|
||||
if !(len(parts) == 2 && parts[0] == "Bearer") {
|
||||
c.JSON(http.StatusUnauthorized, gin.H{"error": "Authorization header format must be Bearer {token}"})
|
||||
c.Abort()
|
||||
return
|
||||
}
|
||||
|
||||
// 解析令牌
|
||||
claims, err := ParseToken(parts[1])
|
||||
if err != nil {
|
||||
c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid or expired token"})
|
||||
c.Abort()
|
||||
return
|
||||
}
|
||||
|
||||
// 将用户信息存储到上下文
|
||||
c.Set("userID", claims.UserID)
|
||||
c.Set("username", claims.Username)
|
||||
c.Set("role", claims.Role)
|
||||
c.Set("roleID", claims.RoleID)
|
||||
|
||||
c.Next()
|
||||
}
|
||||
}
|
||||
|
||||
// RoleMiddleware 角色验证中间件 (Legacy support)
|
||||
func RoleMiddleware(roles ...string) gin.HandlerFunc {
|
||||
return func(c *gin.Context) {
|
||||
// 从上下文中获取用户角色
|
||||
role, exists := c.Get("role")
|
||||
if !exists {
|
||||
c.JSON(http.StatusUnauthorized, gin.H{"error": "Unauthorized"})
|
||||
c.Abort()
|
||||
return
|
||||
}
|
||||
|
||||
// 检查用户角色是否在允许列表中
|
||||
allowed := false
|
||||
for _, r := range roles {
|
||||
if role == r {
|
||||
allowed = true
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
if !allowed {
|
||||
c.JSON(http.StatusForbidden, gin.H{"error": "Insufficient permissions"})
|
||||
c.Abort()
|
||||
return
|
||||
}
|
||||
|
||||
c.Next()
|
||||
}
|
||||
}
|
||||
|
||||
// PermissionMiddleware 权限验证中间件
|
||||
func PermissionMiddleware(resource, action string) gin.HandlerFunc {
|
||||
return func(c *gin.Context) {
|
||||
// 获取用户RoleID
|
||||
roleIDInterface, exists := c.Get("roleID")
|
||||
if !exists {
|
||||
// 尝试从role name获取
|
||||
roleName, exists := c.Get("role")
|
||||
if !exists {
|
||||
c.JSON(http.StatusUnauthorized, gin.H{"error": "Unauthorized"})
|
||||
c.Abort()
|
||||
return
|
||||
}
|
||||
role, err := repositories.GetRoleByName(roleName.(string))
|
||||
if err != nil || role == nil {
|
||||
c.JSON(http.StatusForbidden, gin.H{"error": "Role not found"})
|
||||
c.Abort()
|
||||
return
|
||||
}
|
||||
roleIDInterface = role.ID
|
||||
}
|
||||
|
||||
roleID := roleIDInterface.(uint)
|
||||
|
||||
// 获取该角色的所有权限
|
||||
permissions, err := repositories.GetPermissionsByRoleID(roleID)
|
||||
if err != nil {
|
||||
c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to check permissions"})
|
||||
c.Abort()
|
||||
return
|
||||
}
|
||||
|
||||
// 检查是否有匹配的权限
|
||||
allowed := false
|
||||
for _, p := range permissions {
|
||||
if p.Resource == resource && p.Action == action {
|
||||
allowed = true
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
if !allowed {
|
||||
c.JSON(http.StatusForbidden, gin.H{"error": "Insufficient permissions"})
|
||||
c.Abort()
|
||||
return
|
||||
}
|
||||
|
||||
c.Next()
|
||||
}
|
||||
}
|
||||
68
server/middleware/log.go
Normal file
68
server/middleware/log.go
Normal file
@@ -0,0 +1,68 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"io/ioutil"
|
||||
"log"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/niangaodev/art-code/models"
|
||||
"github.com/niangaodev/art-code/repositories"
|
||||
)
|
||||
|
||||
// OperationLogMiddleware 操作日志中间件
|
||||
func OperationLogMiddleware() gin.HandlerFunc {
|
||||
return func(c *gin.Context) {
|
||||
// 开始时间
|
||||
startTime := time.Now()
|
||||
|
||||
// 读取请求参数
|
||||
var requestBody []byte
|
||||
if c.Request.Method != "GET" {
|
||||
body, err := ioutil.ReadAll(c.Request.Body)
|
||||
if err != nil {
|
||||
log.Printf("Error reading request body: %v", err)
|
||||
} else {
|
||||
requestBody = body
|
||||
// 重置请求体，以便后续处理
|
||||
c.Request.Body = ioutil.NopCloser(bytes.NewBuffer(requestBody))
|
||||
}
|
||||
}
|
||||
|
||||
// 执行请求
|
||||
c.Next()
|
||||
|
||||
// 结束时间
|
||||
endTime := time.Now()
|
||||
// 计算请求持续时间（毫秒）
|
||||
duration := int(endTime.Sub(startTime).Milliseconds())
|
||||
|
||||
// 获取用户信息
|
||||
userID, exists := c.Get("userID")
|
||||
if !exists {
|
||||
return
|
||||
}
|
||||
|
||||
username, _ := c.Get("username")
|
||||
|
||||
// 构建操作日志
|
||||
operationLog := &models.OperationLog{
|
||||
UserID: userID.(uint),
|
||||
Username: username.(string),
|
||||
IP: c.ClientIP(),
|
||||
Path: c.Request.URL.Path,
|
||||
Method: c.Request.Method,
|
||||
Params: string(requestBody),
|
||||
Status: c.Writer.Status(),
|
||||
Duration: duration,
|
||||
}
|
||||
|
||||
// 异步记录日志，避免影响响应
|
||||
go func() {
|
||||
if err := repositories.CreateOperationLog(operationLog); err != nil {
|
||||
log.Printf("Error creating operation log: %v", err)
|
||||
}
|
||||
}()
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user