81 lines
2.3 KiB
Go
81 lines
2.3 KiB
Go
// Package middleware 提供 Gin 中间件：跨域、JWT 鉴权、超管校验
|
||
package middleware
|
||
|
||
import (
|
||
"strings"
|
||
|
||
"github.com/gin-gonic/gin"
|
||
|
||
"nl-game-api-gin/internal/database"
|
||
"nl-game-api-gin/internal/model"
|
||
"nl-game-api-gin/pkg/jwtutil"
|
||
"nl-game-api-gin/pkg/resp"
|
||
)
|
||
|
||
// CORS 跨域中间件：开发时前端(5173)与后端(8080)端口不同，需要放行跨域请求
|
||
func CORS() gin.HandlerFunc {
|
||
return func(c *gin.Context) {
|
||
origin := c.GetHeader("Origin")
|
||
if origin != "" {
|
||
c.Header("Access-Control-Allow-Origin", origin)
|
||
c.Header("Access-Control-Allow-Credentials", "true")
|
||
c.Header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
|
||
c.Header("Access-Control-Allow-Headers", "Content-Type, Authorization")
|
||
}
|
||
// 预检请求直接返回 204
|
||
if c.Request.Method == "OPTIONS" {
|
||
c.AbortWithStatus(204)
|
||
return
|
||
}
|
||
c.Next()
|
||
}
|
||
}
|
||
|
||
// Auth JWT 鉴权中间件：从 Authorization: Bearer xxx 中解析用户身份
|
||
// 校验通过后将 user_id 与 role 写入上下文供后续处理函数使用
|
||
func Auth() gin.HandlerFunc {
|
||
return func(c *gin.Context) {
|
||
authHeader := c.GetHeader("Authorization")
|
||
token := strings.TrimPrefix(authHeader, "Bearer ")
|
||
if token == "" || token == authHeader {
|
||
resp.Unauthorized(c, "请先登录")
|
||
return
|
||
}
|
||
claims, err := jwtutil.Parse(token)
|
||
if err != nil {
|
||
resp.Unauthorized(c, "登录已过期，请重新登录")
|
||
return
|
||
}
|
||
// 查库校验账号仍然有效：否则封禁/删除的用户在 Token 过期前仍可操作全部接口
|
||
var user model.User
|
||
if err := database.DB.Select("status").First(&user, claims.UserID).Error; err != nil {
|
||
resp.Unauthorized(c, "账号不存在，请重新登录")
|
||
return
|
||
}
|
||
if user.Status == model.UserStatusBanned {
|
||
resp.Forbidden(c, "账号已被禁用")
|
||
return
|
||
}
|
||
// 身份信息写入请求上下文
|
||
c.Set("user_id", claims.UserID)
|
||
c.Set("role", claims.Role)
|
||
c.Next()
|
||
}
|
||
}
|
||
|
||
// AdminOnly 超管校验中间件：需在 Auth 之后使用，非超管直接拒绝
|
||
func AdminOnly() gin.HandlerFunc {
|
||
return func(c *gin.Context) {
|
||
if c.GetInt("role") != model.RoleAdmin {
|
||
resp.Forbidden(c, "仅超级管理员可操作")
|
||
return
|
||
}
|
||
c.Next()
|
||
}
|
||
}
|
||
|
||
// UID 从上下文取当前登录用户ID的快捷方法
|
||
func UID(c *gin.Context) int {
|
||
return c.GetInt("user_id")
|
||
}
|