271 lines
8.1 KiB
Go
271 lines
8.1 KiB
Go
/*
|
||
* @desc:中间件
|
||
* @company:云南奇讯科技有限公司
|
||
* @Author: yixiaohu<yxh669@qq.com>
|
||
* @Date: 2022/9/23 15:05
|
||
*/
|
||
|
||
package middleware
|
||
|
||
import (
|
||
"fmt"
|
||
"github.com/gogf/gf/v2/frame/g"
|
||
"github.com/gogf/gf/v2/net/ghttp"
|
||
"github.com/gogf/gf/v2/os/gctx"
|
||
"github.com/gogf/gf/v2/text/gstr"
|
||
"github.com/gogf/gf/v2/util/gconv"
|
||
"github.com/tiger1103/gfast-token/gftoken"
|
||
"github.com/tiger1103/gfast/v3/api/wxApplet/wxApplet"
|
||
commonService "github.com/tiger1103/gfast/v3/internal/app/common/service"
|
||
"github.com/tiger1103/gfast/v3/internal/app/system/dao"
|
||
"github.com/tiger1103/gfast/v3/internal/app/system/model"
|
||
"github.com/tiger1103/gfast/v3/internal/app/system/service"
|
||
"github.com/tiger1103/gfast/v3/library/libResponse"
|
||
"strings"
|
||
)
|
||
|
||
func init() {
|
||
service.RegisterMiddleware(New())
|
||
}
|
||
|
||
func New() *sMiddleware {
|
||
return &sMiddleware{}
|
||
}
|
||
|
||
type sMiddleware struct{}
|
||
|
||
// Ctx 自定义上下文对象
|
||
func (s *sMiddleware) Ctx(r *ghttp.Request) {
|
||
ctx := r.GetCtx()
|
||
// 初始化登录用户信息
|
||
data, err := service.GfToken().ParseToken(r)
|
||
if err != nil {
|
||
// 执行下一步请求逻辑
|
||
r.Middleware.Next()
|
||
}
|
||
if data != nil {
|
||
context := new(model.Context)
|
||
err = gconv.Struct(data.Data, &context.User)
|
||
if err != nil {
|
||
g.Log().Error(ctx, err)
|
||
// 执行下一步请求逻辑
|
||
r.Middleware.Next()
|
||
}
|
||
service.Context().Init(r, context)
|
||
}
|
||
// 执行下一步请求逻辑
|
||
r.Middleware.Next()
|
||
}
|
||
|
||
// Auth 权限判断处理中间件
|
||
func (s *sMiddleware) Auth(r *ghttp.Request) {
|
||
ctx := r.GetCtx()
|
||
//获取登陆用户id
|
||
adminId := service.Context().GetUserId(ctx)
|
||
accessParams := r.Get("accessParams").Strings()
|
||
accessParamsStr := ""
|
||
if len(accessParams) > 0 && accessParams[0] != "undefined" {
|
||
accessParamsStr = "?" + gstr.Join(accessParams, "&")
|
||
}
|
||
url := gstr.TrimLeft(r.Request.URL.Path, "/") + accessParamsStr
|
||
/*if r.Method != "GET" && adminId != 1 && url!="api/v1/system/login" {
|
||
libResponse.FailJson(true, r, "对不起！演示系统，不能删改数据！")
|
||
}*/
|
||
//获取无需验证权限的用户id
|
||
tagSuperAdmin := false
|
||
service.SysUser().NotCheckAuthAdminIds(ctx).Iterator(func(v interface{}) bool {
|
||
if gconv.Uint64(v) == adminId {
|
||
tagSuperAdmin = true
|
||
return false
|
||
}
|
||
return true
|
||
})
|
||
if tagSuperAdmin {
|
||
r.Middleware.Next()
|
||
//不要再往后面执行
|
||
return
|
||
}
|
||
//获取地址对应的菜单id
|
||
menuList, err := service.SysAuthRule().GetMenuList(ctx)
|
||
if err != nil {
|
||
g.Log().Error(ctx, err)
|
||
libResponse.FailJson(true, r, "请求数据失败")
|
||
}
|
||
var menu *model.SysAuthRuleInfoRes
|
||
for _, m := range menuList {
|
||
ms := gstr.SubStr(m.Name, 0, gstr.Pos(m.Name, "?"))
|
||
if m.Name == url || ms == url {
|
||
menu = m
|
||
break
|
||
}
|
||
}
|
||
//只验证存在数据库中的规则
|
||
if menu != nil {
|
||
//若是不登录能访问的接口则不判断权限
|
||
excludePaths := g.Cfg().MustGet(ctx, "gfToken.excludePaths").Strings()
|
||
for _, p := range excludePaths {
|
||
if gstr.Equal(menu.Name, gstr.TrimLeft(p, "/")) {
|
||
r.Middleware.Next()
|
||
return
|
||
}
|
||
}
|
||
//若存在不需要验证的条件则跳过
|
||
if gstr.Equal(menu.Condition, "nocheck") {
|
||
r.Middleware.Next()
|
||
return
|
||
}
|
||
menuId := menu.Id
|
||
//菜单没存数据库不验证权限
|
||
if menuId != 0 {
|
||
//判断权限操作
|
||
enforcer, err := commonService.CasbinEnforcer(ctx)
|
||
if err != nil {
|
||
g.Log().Error(ctx, err)
|
||
libResponse.FailJson(true, r, "获取权限失败")
|
||
}
|
||
hasAccess := false
|
||
hasAccess, err = enforcer.Enforce(fmt.Sprintf("%s%d", service.SysUser().GetCasBinUserPrefix(), adminId), gconv.String(menuId), "All")
|
||
if err != nil {
|
||
g.Log().Error(ctx, err)
|
||
libResponse.FailJson(true, r, "判断权限失败")
|
||
}
|
||
if !hasAccess {
|
||
libResponse.FailJson(true, r, "没有访问权限")
|
||
}
|
||
}
|
||
} else if menu == nil && accessParamsStr != "" {
|
||
libResponse.FailJson(true, r, "没有访问权限")
|
||
}
|
||
r.Middleware.Next()
|
||
}
|
||
|
||
// Blacklist 黑名单 阻挡小程序的黑名单用户登录
|
||
func (s *sMiddleware) Blacklist(r *ghttp.Request) {
|
||
ctx := gctx.New()
|
||
//1、判断是否是小程序请求来的数据
|
||
userAgent := strings.ToLower(r.Header.Get("User-Agent"))
|
||
if strings.Contains(userAgent, "micromessenger") {
|
||
//2、解析token 拿到openid
|
||
var user *wxApplet.BusConstructionUserAddReq
|
||
datatoken, err := service.GfToken().ParseToken(r)
|
||
if err != nil {
|
||
libResponse.FailJson(true, r, "解析token错误！")
|
||
}
|
||
if datatoken != nil {
|
||
err = gconv.Struct(datatoken.Data, &user)
|
||
if err != nil {
|
||
libResponse.FailJson(true, r, "获取用户信息错误！")
|
||
}
|
||
}
|
||
//3、查询数据库黑名单
|
||
count, err := dao.BusConstructionBlacklist.Ctx(ctx).Where("openid", user.Openid).Count()
|
||
if err != nil {
|
||
libResponse.FailJson(true, r, "系统错误，请联系管理员！")
|
||
}
|
||
if count > 0 {
|
||
gfToken := gftoken.NewGfToken()
|
||
token := gfToken.GetRequestToken(r)
|
||
service.GfToken().RemoveToken(ctx, token)
|
||
libResponse.FailJson(true, r, "登录异常，请联系管理员！")
|
||
} else {
|
||
//4、匹配黑名单用户 随后放行
|
||
r.Middleware.Next()
|
||
}
|
||
} else {
|
||
r.Middleware.Next()
|
||
}
|
||
}
|
||
|
||
var engineeringData = "/zm/api/v1/system/documentData/newFolder," + //新建文件夹
|
||
"/zm/api/v1/system/documentData/add," + //导入
|
||
"/zm/api/v1/system/documentData/edit" + //重命名
|
||
"/zm/api/v1/system/documentData/compressedDownload" + //下载
|
||
"/zm/api/v1/system/documentData/get" + //查看
|
||
"/zm/api/v1/system/documentData/complaintBoxAdd" + //保存
|
||
"/zm/api/v1/system/documentData/delete" + //删除
|
||
"/zm/api/v1/system/documentData/onlineImport" + //模板批量导入
|
||
"/zm/api/v1/system/documentData/onlineMobile" + //资料在线移动
|
||
"/zm/api/v1/system/documentData/dataFileQuery" + //所有资料查询
|
||
"/zm/api/v1/system/document/templateRecycleBin" + //模板回收站
|
||
"/zm/api/v1/system/documentData/dataRecyclingStation" + //资料回收站
|
||
"/zm/api/v1/system/documentData/uniFileDownload" //下载
|
||
|
||
// EngineeringDataPermission 工程资料权限校验（资料-回收站）
|
||
func (s *sMiddleware) EngineeringDataPermission(r *ghttp.Request) {
|
||
ctx := r.GetCtx()
|
||
userId := service.Context().GetUserId(ctx)
|
||
//0、把admin用户给排除掉
|
||
if userId == 1 {
|
||
r.Middleware.Next()
|
||
return
|
||
}
|
||
projectId := r.Get("projectId").String()
|
||
//1、看看有哪些API需要调用权限
|
||
path := r.Request.URL.Path
|
||
authorityJudgment := strings.Split(engineeringData, ",")
|
||
for _, pathApi := range authorityJudgment {
|
||
//2、根据用户id去数据库查询工程资料的权限是否开启（1有权 2无权）
|
||
if pathApi == path {
|
||
if projectId == "" {
|
||
libResponse.FailJson(true, r, "当前操作暂无项目id！")
|
||
}
|
||
sql := g.DB().Model("document_power").
|
||
Where("sys_user_id", userId).
|
||
Where("project_id", projectId)
|
||
if strings.Contains(path, "/zm/api/v1/system/document/allList") || strings.Contains(path, "/zm/api/v1/system/documentData/allList") {
|
||
sql = sql.Where("type = 3")
|
||
} else if strings.Contains(path, "/zm/api/v1/system/documentData/") {
|
||
sql = sql.Where("type = 2")
|
||
} else {
|
||
libResponse.FailJson(true, r, "系统错误，请联系管理员！")
|
||
}
|
||
//3、判断具体是什么权限
|
||
fetch := fieldFetch(path, authorityJudgment)
|
||
count, err := sql.Where(fetch, "1").Count()
|
||
if err != nil {
|
||
libResponse.FailJson(true, r, "系统错误，请联系管理员！")
|
||
}
|
||
if count > 0 {
|
||
r.Middleware.Next()
|
||
} else {
|
||
libResponse.FailJson(true, r, "当前操作暂无权限！")
|
||
}
|
||
}
|
||
}
|
||
r.Middleware.Next()
|
||
}
|
||
|
||
// fieldFetch 根据数据匹配 返回需要查询的字段
|
||
func fieldFetch(path string, authorityJudgment []string) string {
|
||
switch path {
|
||
case authorityJudgment[0]:
|
||
return "v1"
|
||
case authorityJudgment[1]:
|
||
return "v2"
|
||
case authorityJudgment[2]:
|
||
return "v3"
|
||
case authorityJudgment[3]:
|
||
return "v4"
|
||
case authorityJudgment[4]:
|
||
return "v5"
|
||
case authorityJudgment[5]:
|
||
return "v6"
|
||
case authorityJudgment[6]:
|
||
return "v7"
|
||
case authorityJudgment[7]:
|
||
return "v8"
|
||
case authorityJudgment[8]:
|
||
return "v9"
|
||
case authorityJudgment[9]:
|
||
return "v10"
|
||
case authorityJudgment[10]:
|
||
return "v11"
|
||
case authorityJudgment[11]:
|
||
return "v12"
|
||
case authorityJudgment[12]:
|
||
return "v4"
|
||
default:
|
||
return ""
|
||
}
|
||
}
|