文件管理权限控制

internal/apps/oauth/middlewares.go

@@ -5,6 +5,7 @@
 package oauth
 
 import (
+	"errors"
 	"net/http"
 
 	"github.com/Rain-kl/Wavelet/internal/common"
@@ -26,6 +27,57 @@ type loginRequiredAuditLog struct {
 	Referer    string `json:"referer"`
 }
 
+// GetUserFromRequest 校验 Access Token 或 Session 并返回用户对象，如果未登录或用户失效则返回 error
+func GetUserFromRequest(c *gin.Context) (*model.User, error) {
+	ctx := c.Request.Context()
+
+	// check token in headers
+	tokenStr := c.GetHeader("X-Access-Token")
+	if tokenStr == "" {
+		authHeader := c.GetHeader("Authorization")
+		if len(authHeader) > 7 && authHeader[:7] == "Bearer " {
+			tokenStr = authHeader[7:]
+		}
+	}
+
+	var user model.User
+	var authenticated bool
+	var tokenAuth bool
+	var tokenAdmin bool
+
+	if tokenStr != "" {
+		tokenHash := model.HashToken(tokenStr)
+		var tokenRecord model.AccessToken
+		if err := db.DB(ctx).Where("token_hash = ?", tokenHash).First(&tokenRecord).Error; err == nil {
+			if err := db.DB(ctx).Where("id = ? AND is_active = ?", tokenRecord.UserID, true).First(&user).Error; err == nil {
+				authenticated = true
+				tokenAuth = true
+				tokenAdmin = tokenRecord.IsAdmin
+			}
+		}
+	}
+
+	if !authenticated {
+		// load user from session
+		userID := GetUserIDFromContext(c)
+		if userID <= 0 {
+			return nil, errors.New("unauthorized")
+		}
+
+		// load user from db to make sure is active
+		tx := db.DB(ctx).Where("id = ? AND is_active = ?", userID, true).First(&user)
+		if tx.Error != nil {
+			return nil, tx.Error
+		}
+	}
+
+	// set keys in context
+	util.SetToContext(c, TokenAuthKey, tokenAuth)
+	util.SetToContext(c, TokenAdminKey, tokenAdmin)
+
+	return &user, nil
+}
+
 // LoginRequired 返回登录鉴权中间件，校验 Access Token 或 Session
 func LoginRequired() gin.HandlerFunc {
 	return func(c *gin.Context) {
@@ -33,55 +85,17 @@ func LoginRequired() gin.HandlerFunc {
 		ctx, span := otel_trace.Start(c.Request.Context(), "LoginRequired")
 		defer span.End()
 
-		// check token in headers
-		tokenStr := c.GetHeader("X-Access-Token")
-		if tokenStr == "" {
-			authHeader := c.GetHeader("Authorization")
-			if len(authHeader) > 7 && authHeader[:7] == "Bearer " {
-				tokenStr = authHeader[7:]
-			}
-		}
-
-		var user model.User
-		var authenticated bool
-		var tokenAuth bool
-		var tokenAdmin bool
-
-		if tokenStr != "" {
-			tokenHash := model.HashToken(tokenStr)
-			var tokenRecord model.AccessToken
-			if err := db.DB(ctx).Where("token_hash = ?", tokenHash).First(&tokenRecord).Error; err == nil {
-				if err := db.DB(ctx).Where("id = ? AND is_active = ?", tokenRecord.UserID, true).First(&user).Error; err == nil {
-					authenticated = true
-					tokenAuth = true
-					tokenAdmin = tokenRecord.IsAdmin
-				}
-			}
-		}
-
-		if !authenticated {
-			// load user from session
-			userID := GetUserIDFromContext(c)
-			if userID <= 0 {
-				c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error_msg": common.UnAuthorized, "data": nil})
-				return
-			}
-
-			// load user from db to make sure is active
-			tx := db.DB(ctx).Where("id = ? AND is_active = ?", userID, true).First(&user)
-			if tx.Error != nil {
-				c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error_msg": common.UnAuthorized, "data": nil})
-				return
-			}
+		user, err := GetUserFromRequest(c)
+		if err != nil {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error_msg": common.UnAuthorized, "data": nil})
+			return
 		}
 
 		// log
-		LogForAudit(ctx, &user, c)
+		LogForAudit(ctx, user, c)
 
 		// set user info
-		util.SetToContext(c, UserObjKey, &user)
-		util.SetToContext(c, TokenAuthKey, tokenAuth)
-		util.SetToContext(c, TokenAdminKey, tokenAdmin)
+		util.SetToContext(c, UserObjKey, user)
 
 		// next
 		c.Next()