97 lines
3.5 KiB
Go
97 lines
3.5 KiB
Go
|
package handler
|
||
|
|
|
||
|
|
import (
|
||
|
|
"context"
|
||
|
|
"net/http"
|
||
|
|
"strings"
|
||
|
|
|
||
|
|
"bj_power_mes/common/httpx"
|
||
|
|
"bj_power_mes/internal/svc"
|
||
|
|
)
|
||
|
|
|
||
|
|
// pathPermMap 请求方法+路径 → 所需按钮级权限码（块2：后端接口兜底校验）。
|
||
|
|
// 路径中的 :id 统一以 * 结尾匹配。
|
||
|
|
var pathPermMap = map[string]string{
|
||
|
|
"POST:/api/v1/product-types": "produce.product:add",
|
||
|
|
"PUT:/api/v1/product-types": "produce.product:edit",
|
||
|
|
"DELETE:/api/v1/product-types/*": "produce.product:delete",
|
||
|
|
"POST:/api/v1/work-orders": "produce.workorder:add",
|
||
|
|
"PUT:/api/v1/work-orders": "produce.workorder:edit",
|
||
|
|
"DELETE:/api/v1/work-orders/*": "produce.workorder:delete",
|
||
|
|
"POST:/api/v1/daily-plans": "produce.workorder:dailyplan",
|
||
|
|
"PUT:/api/v1/bom": "produce.bom:edit",
|
||
|
|
"POST:/api/v1/material-requests/generate": "produce.material:generate",
|
||
|
|
"POST:/api/v1/plc/send-process": "produce.plc:send",
|
||
|
|
"POST:/api/v1/process-flows": "produce.processflow:add",
|
||
|
|
"DELETE:/api/v1/process-flows/*": "produce.processflow:delete",
|
||
|
|
"POST:/api/v1/process-flows/upload": "produce.processflow:upload",
|
||
|
|
"POST:/api/v1/process-steps": "produce.processflow:edit",
|
||
|
|
"POST:/api/v1/stations": "produce.station:edit",
|
||
|
|
"POST:/api/v1/users": "sys.rbac:user",
|
||
|
|
"PUT:/api/v1/users": "sys.rbac:user",
|
||
|
|
"DELETE:/api/v1/users/*": "sys.rbac:user",
|
||
|
|
"POST:/api/v1/roles": "sys.rbac:role",
|
||
|
|
"PUT:/api/v1/roles": "sys.rbac:role",
|
||
|
|
"DELETE:/api/v1/roles/*": "sys.rbac:role",
|
||
|
|
"POST:/api/v1/permissions": "sys.rbac:perm",
|
||
|
|
"PUT:/api/v1/permissions": "sys.rbac:perm",
|
||
|
|
"DELETE:/api/v1/permissions/*": "sys.rbac:perm",
|
||
|
|
}
|
||
|
|
|
||
|
|
// userHasPerm 校验当前登录用户是否拥有某权限码（SUPER_ADMIN 或 * 放行）。
|
||
|
|
// 用户ID 使用 uidFromRequest：优先取 context，缺失时回退解析 Authorization token。
|
||
|
|
func userHasPerm(r *http.Request, svcCtx *svc.ServiceContext, code string) bool {
|
||
|
|
if code == "" {
|
||
|
|
return true
|
||
|
|
}
|
||
|
|
userId := uidFromRequest(r, svcCtx)
|
||
|
|
if userId <= 0 {
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
usr, err := svcCtx.EntClient.User.Get(r.Context(), userId)
|
||
|
|
if err != nil {
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
role, err := svcCtx.EntClient.Role.Get(r.Context(), usr.RoleId)
|
||
|
|
if err != nil {
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
if role.Code == "SUPER_ADMIN" {
|
||
|
|
return true
|
||
|
|
}
|
||
|
|
for _, c := range role.PermissionCodes {
|
||
|
|
if c == "*" || c == code {
|
||
|
|
return true
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
|
||
|
|
// permissionGuard 按钮级权限后端兜底中间件（仅对写操作映射表内的路径生效）
|
||
|
|
func permissionGuard(svcCtx *svc.ServiceContext) func(http.HandlerFunc) http.HandlerFunc {
|
||
|
|
return func(next http.HandlerFunc) http.HandlerFunc {
|
||
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
||
|
|
code, ok := pathPerm(r.Method, r.URL.Path)
|
||
|
|
if ok && !userHasPerm(r, svcCtx, code) {
|
||
|
|
httpx.FailHTTP(w, http.StatusForbidden, "无操作权限："+code)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
next(w, r)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// pathPerm 先按完整路径精确匹配；未命中时把末段替换为 * 再匹配（用于 :id 结尾的路径）。
|
||
|
|
func pathPerm(method, path string) (string, bool) {
|
||
|
|
key := method + ":" + strings.TrimSuffix(path, "/")
|
||
|
|
if code, ok := pathPermMap[key]; ok {
|
||
|
|
return code, true
|
||
|
|
}
|
||
|
|
segs := strings.Split(key, "/")
|
||
|
|
if len(segs) > 0 {
|
||
|
|
segs[len(segs)-1] = "*"
|
||
|
|
}
|
||
|
|
code, ok := pathPermMap[strings.Join(segs, "/")]
|
||
|
|
return code, ok
|
||
|
|
}
|