migrate

Wavelet/internal/apps/openflare/compat/auth.go

@@ -0,0 +1,78 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package compat
+
+import (
+	"github.com/Rain-kl/Wavelet/internal/apps/oauth"
+	"github.com/Rain-kl/Wavelet/internal/model"
+	"github.com/gin-gonic/gin"
+)
+
+const openFlareTokenHeader = "OpenFlare-Token"
+
+// Role constants mirror legacy OpenFlare role values.
+const (
+	RoleCommonUser = 1
+	RoleAdminUser  = 10
+	RoleRootUser   = 100
+)
+
+// RequireRole ensures the caller is authenticated with at least minRole.
+// Phase 1: supports Wavelet session/access-token via oauth.GetUserFromRequest.
+func RequireRole(minRole int) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		user, err := oauth.GetUserFromRequest(c)
+		if err != nil || user == nil {
+			Unauthorized(c, "无权进行此操作，未登录或 token 无效")
+			c.Abort()
+			return
+		}
+		role := resolveRole(user)
+		if role < minRole {
+			Fail(c, "无权进行此操作，权限不足")
+			c.Abort()
+			return
+		}
+		c.Set("of_user_id", user.ID)
+		c.Set("of_role", role)
+		c.Set("of_is_admin", user.IsAdmin)
+		c.Next()
+	}
+}
+
+// UserAuth requires role >= CommonUser.
+func UserAuth() gin.HandlerFunc { return RequireRole(RoleCommonUser) }
+
+// AdminAuth requires role >= AdminUser.
+func AdminAuth() gin.HandlerFunc { return RequireRole(RoleAdminUser) }
+
+// RootAuth requires role >= RootUser.
+func RootAuth() gin.HandlerFunc { return RequireRole(RoleRootUser) }
+
+func resolveRole(user *model.User) int {
+	if user == nil {
+		return 0
+	}
+	if user.IsAdmin {
+		return RoleRootUser
+	}
+	return RoleCommonUser
+}
+
+// OpenFlareTokenHeader returns the legacy auth header name.
+func OpenFlareTokenHeader() string {
+	return openFlareTokenHeader
+}
+
+// BridgeOpenFlareToken maps OpenFlare-Token to X-Access-Token for legacy clients.
+func BridgeOpenFlareToken() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if c.GetHeader("X-Access-Token") == "" {
+			if token := c.GetHeader(openFlareTokenHeader); token != "" {
+				c.Request.Header.Set("X-Access-Token", token)
+			}
+		}
+		c.Next()
+	}
+}

Wavelet/internal/apps/openflare/compat/bind.go

@@ -0,0 +1,34 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package compat
+
+import (
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+)
+
+// IDParam parses :id from the URL path.
+func IDParam(c *gin.Context) (uint, bool) {
+	raw := c.Param("id")
+	if raw == "" {
+		Fail(c, "无效的 ID")
+		return 0, false
+	}
+	id64, err := strconv.ParseUint(raw, 10, 64)
+	if err != nil || id64 == 0 {
+		Fail(c, "无效的 ID")
+		return 0, false
+	}
+	return uint(id64), true
+}
+
+// BindJSON binds JSON body; returns false after writing a failure response.
+func BindJSON(c *gin.Context, dst any) bool {
+	if err := c.ShouldBindJSON(dst); err != nil {
+		Fail(c, "参数错误")
+		return false
+	}
+	return true
+}

Wavelet/internal/apps/openflare/compat/response.go

@@ -0,0 +1,43 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+// Package compat provides OpenFlare legacy API compatibility helpers.
+package compat
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+// Envelope is the legacy OpenFlare frontend response format.
+type Envelope struct {
+	Success bool   `json:"success"`
+	Message string `json:"message"`
+	Data    any    `json:"data"`
+}
+
+// OK sends a successful legacy response.
+func OK(c *gin.Context, data any) {
+	c.JSON(http.StatusOK, Envelope{Success: true, Message: "", Data: data})
+}
+
+// OKMessage sends a successful legacy response with a message.
+func OKMessage(c *gin.Context, message string) {
+	c.JSON(http.StatusOK, Envelope{Success: true, Message: message, Data: nil})
+}
+
+// Fail sends a failed legacy response with HTTP 200 (OpenFlare convention).
+func Fail(c *gin.Context, message string) {
+	c.JSON(http.StatusOK, Envelope{Success: false, Message: message, Data: nil})
+}
+
+// Unauthorized sends a 401 legacy response.
+func Unauthorized(c *gin.Context, message string) {
+	c.JSON(http.StatusUnauthorized, Envelope{Success: false, Message: message, Data: nil})
+}
+
+// Forbidden sends a 403 legacy response.
+func Forbidden(c *gin.Context, message string) {
+	c.JSON(http.StatusForbidden, Envelope{Success: false, Message: message, Data: nil})
+}