odboy/kenaito-conf
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(auth): 移除 RO/RW 权限机制并完善配置历史

Browse Source 
- 删除 GrantPermissons 与 buildPermissionCode，权限只判断超管、组管理员和应用负责人
- GetHistory 增加权限校验，避免越权读取配置历史
- 配置历史改为分页查询，前端历史弹窗增加分页并处理删除后的页码回退
This commit is contained in:
odboy
2026-09-16 21:11:09 +08:00
parent af3cf2f6e6
commit 1f8cae5a8b
8 changed files with 217 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/internal/handler/config.go
+47 -15
View File
@@ -149,7 +149,7 @@ func (h *ConfigHandler) GetById(c *gin.Context) {
}
userInfo := middleware.GetUserInfo(c)
if err := h.permService.RequirePermission(userInfo, config.GroupId, config.AppId, "RO"); err != nil {
if err := h.permService.RequirePermission(userInfo, config.GroupId, config.AppId); err != nil {
c.JSON(http.StatusForbidden, model.WrapperResponse{Code: 403, Msg: err.Error()})
return
}
@@ -183,7 +183,7 @@ func (h *ConfigHandler) Add(c *gin.Context) {
c.JSON(http.StatusOK, model.WrapperResponse{Code: 400, Msg: "全局配置需要指定所属业务组"})
return
}
if err := h.permService.RequirePermission(userInfo, req.GroupId, nil, "RW"); err != nil {
if err := h.permService.RequirePermission(userInfo, req.GroupId, nil); err != nil {
c.JSON(http.StatusForbidden, model.WrapperResponse{Code: 403, Msg: err.Error()})
return
}
@@ -264,7 +264,7 @@ func (h *ConfigHandler) Update(c *gin.Context) {
}
userInfo := middleware.GetUserInfo(c)
if err := h.permService.RequirePermission(userInfo, config.GroupId, config.AppId, "RW"); err != nil {
if err := h.permService.RequirePermission(userInfo, config.GroupId, config.AppId); err != nil {
c.JSON(http.StatusForbidden, model.WrapperResponse{Code: 403, Msg: err.Error()})
return
}
@@ -311,7 +311,7 @@ func (h *ConfigHandler) Delete(c *gin.Context) {
}
userInfo := middleware.GetUserInfo(c)
if err := h.permService.RequirePermission(userInfo, config.GroupId, config.AppId, "RW"); err != nil {
if err := h.permService.RequirePermission(userInfo, config.GroupId, config.AppId); err != nil {
c.JSON(http.StatusForbidden, model.WrapperResponse{Code: 403, Msg: err.Error()})
return
}
@@ -335,19 +335,51 @@ func (h *ConfigHandler) Delete(c *gin.Context) {
func (h *ConfigHandler) GetHistory(c *gin.Context) {
id, _ := strconv.Atoi(c.Param("id"))
var histories []model.AppConfigHistory
dao.Engine.Where("origin_id = ?", id).OrderBy("id desc").Find(&histories)
if len(histories) > 0 {
var currentConfig model.AppConfig
if has, _ := dao.Engine.ID(histories[0].OriginId).Get(&currentConfig); has {
for i := range histories {
histories[i].ActiveContents = currentConfig.Contents
}
var config model.AppConfig
has, _ := dao.Engine.ID(id).Get(&config)
userInfo := middleware.GetUserInfo(c)
if has {
if err := h.permService.RequirePermission(userInfo, config.GroupId, config.AppId); err != nil {
c.JSON(http.StatusForbidden, model.WrapperResponse{Code: 403, Msg: err.Error()})
return
}
} else if !userInfo.IsSuperAdmin() {
// 配置已被物理删除时，只有超级管理员可以查看残留历史
c.JSON(http.StatusForbidden, model.WrapperResponse{Code: 403, Msg: "只有超级管理员才能查看该配置历史"})
return
}
pageNo, _ := strconv.Atoi(c.DefaultQuery("pageNo", "1"))
pageSize, _ := strconv.Atoi(c.DefaultQuery("pageSize", "10"))
if pageNo < 1 {
pageNo = 1
}
if pageSize < 1 {
pageSize = 10
}
if pageSize > 200 {
pageSize = 200
}
histories := make([]model.AppConfigHistory, 0)
total, _ := dao.Engine.Where("origin_id = ?", id).Count(&model.AppConfigHistory{})
dao.Engine.Where("origin_id = ?", id).OrderBy("id desc").
Limit(pageSize, (pageNo-1)*pageSize).Find(&histories)
if has {
for i := range histories {
histories[i].ActiveContents = config.Contents
}
}
c.JSON(http.StatusOK, model.WrapperResponse{Code: 0, Data: histories})
c.JSON(http.StatusOK, model.PageResult{
PageNo: pageNo,
PageSize: pageSize,
Total: total,
Data: histories,
})
}
// DeleteHistory 手动删除单条配置历史
@@ -363,7 +395,7 @@ func (h *ConfigHandler) DeleteHistory(c *gin.Context) {
userInfo := middleware.GetUserInfo(c)
var config model.AppConfig
if has, _ := dao.Engine.ID(history.OriginId).Get(&config); has {
if err := h.permService.RequirePermission(userInfo, config.GroupId, config.AppId, "RW"); err != nil {
if err := h.permService.RequirePermission(userInfo, config.GroupId, config.AppId); err != nil {
c.JSON(http.StatusForbidden, model.WrapperResponse{Code: 403, Msg: err.Error()})
return
}
@@ -394,7 +426,7 @@ func (h *ConfigHandler) Rollback(c *gin.Context) {
var config model.AppConfig
if has, _ := dao.Engine.ID(history.OriginId).Get(&config); has {
userInfo := middleware.GetUserInfo(c)
if err := h.permService.RequirePermission(userInfo, config.GroupId, config.AppId, "RW"); err != nil {
if err := h.permService.RequirePermission(userInfo, config.GroupId, config.AppId); err != nil {
c.JSON(http.StatusForbidden, model.WrapperResponse{Code: 403, Msg: err.Error()})
return
}
server/internal/model/user.go
+6 -7
View File
@@ -23,13 +23,12 @@ func (User) TableName() string {
}
type LoginUserInfo struct {
Id string `json:"id"`
Name string `json:"name"`
Type string `json:"type"`
GroupId *int `json:"groupId"`
GrantAppIds []int `json:"grantAppIds"`
GrantPermissons []string `json:"grantPermissons"`
GroupMaster bool `json:"groupMaster"`
Id string `json:"id"`
Name string `json:"name"`
Type string `json:"type"`
GroupId *int `json:"groupId"`
GrantAppIds []int `json:"grantAppIds"`
GroupMaster bool `json:"groupMaster"`
}
func (u *LoginUserInfo) IsSuperAdmin() bool {
server/internal/service/auth.go
+10 -17
View File
@@ -45,12 +45,11 @@ func (s *AuthService) Login(userName, password string) (string, *model.LoginUser
}
userInfo := &model.LoginUserInfo{
Id: strconv.Itoa(user.Id),
Name: user.Name,
Type: user.Type,
GroupId: user.GroupId,
GrantAppIds: make([]int, 0),
GrantPermissons: make([]string, 0),
Id: strconv.Itoa(user.Id),
Name: user.Name,
Type: user.Type,
GroupId: user.GroupId,
GrantAppIds: make([]int, 0),
}
// load permissions
@@ -120,12 +119,11 @@ func (s *AuthService) ValidateToken(tokenString string) (*model.LoginUserInfo, e
}
userInfo := &model.LoginUserInfo{
Id: strconv.Itoa(user.Id),
Name: user.Name,
Type: user.Type,
GroupId: user.GroupId,
GrantAppIds: make([]int, 0),
GrantPermissons: make([]string, 0),
Id: strconv.Itoa(user.Id),
Name: user.Name,
Type: user.Type,
GroupId: user.GroupId,
GrantAppIds: make([]int, 0),
}
s.loadPermissions(userInfo, user.Id)
return userInfo, nil
@@ -146,10 +144,5 @@ func (s *AuthService) loadPermissions(userInfo *model.LoginUserInfo, userId int)
}
for _, app := range apps {
userInfo.GrantAppIds = append(userInfo.GrantAppIds, app.Id)
userInfo.GrantPermissons = append(userInfo.GrantPermissons, buildPermissionCode(app.Id, "RW"))
}
}
func buildPermissionCode(appId int, operate string) string {
return strconv.Itoa(appId) + ":" + operate
}
server/internal/service/permission.go
+4 -5
View File
@@ -18,19 +18,18 @@ func (s *PermissionService) RequireSuperAdmin(userInfo *model.LoginUserInfo) err
return nil
}
func (s *PermissionService) RequirePermission(userInfo *model.LoginUserInfo, groupId *int, appId *int, operate string) error {
func (s *PermissionService) RequirePermission(userInfo *model.LoginUserInfo, groupId *int, appId *int) error {
if userInfo.IsSuperAdmin() {
return nil
}
if groupId != nil && userInfo.GroupId != nil && *groupId == *userInfo.GroupId {
if userInfo.IsGroupAdmin() && groupId != nil && userInfo.GroupId != nil && *groupId == *userInfo.GroupId {
return nil
}
if appId == nil || *appId == 0 {
return errors.New("你没有全局配置权限")
}
permCode := buildPermissionCode(*appId, operate)
for _, p := range userInfo.GrantPermissons {
if p == permCode {
for _, id := range userInfo.GrantAppIds {
if id == *appId {
return nil
}
}
server/internal/service/permission_test.go
+93
View File
@@ -0,0 +1,93 @@
package service
import (
"testing"
"kenaito-conf/server/internal/model"
)
func TestRequirePermission(t *testing.T) {
svc := NewPermissionService()
groupID := 1
otherGroupID := 2
appID := 10
tests := []struct {
name string
user *model.LoginUserInfo
groupId *int
appId *int
wantErr bool
}{
{
name: "super admin can access anything",
user: &model.LoginUserInfo{Type: "superAdmin"},
groupId: &groupID,
appId: &appID,
},
{
name: "group admin can access own group",
user: &model.LoginUserInfo{Type: "groupAdmin", GroupId: &groupID},
groupId: &groupID,
appId: &appID,
},
{
name: "group admin cannot access other group",
user: &model.LoginUserInfo{Type: "groupAdmin", GroupId: &groupID},
groupId: &otherGroupID,
appId: &appID,
wantErr: true,
},
{
name: "owner can access app",
user: &model.LoginUserInfo{Type: "user", GroupId: &groupID, GrantAppIds: []int{appID}},
groupId: &groupID,
appId: &appID,
},
{
name: "owner can access app across group",
user: &model.LoginUserInfo{Type: "user", GroupId: &otherGroupID, GrantAppIds: []int{appID}},
groupId: &groupID,
appId: &appID,
},
{
name: "normal group member cannot access app without ownership",
user: &model.LoginUserInfo{Type: "user", GroupId: &groupID},
groupId: &groupID,
appId: &appID,
wantErr: true,
},
{
name: "normal user cannot access global config",
user: &model.LoginUserInfo{Type: "user", GroupId: &groupID},
groupId: &groupID,
appId: nil,
wantErr: true,
},
{
name: "group admin can access own global config",
user: &model.LoginUserInfo{Type: "groupAdmin", GroupId: &groupID},
groupId: &groupID,
appId: nil,
},
{
name: "group admin cannot access other global config",
user: &model.LoginUserInfo{Type: "groupAdmin", GroupId: &groupID},
groupId: &otherGroupID,
appId: nil,
wantErr: true,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
err := svc.RequirePermission(tt.user, tt.groupId, tt.appId)
if tt.wantErr && err == nil {
t.Fatalf("expected an error, got nil")
}
if !tt.wantErr && err != nil {
t.Fatalf("unexpected error: %v", err)
}
})
}
}