tcjlj/OpenFlare
1
0
Fork 0
mirror of https://github.com/Rain-kl/OpenFlare.git synced 2026-10-06 15:46:37 +08:00
Code Issues Packages Projects Releases Wiki Activity

AccessToken 默认非管理员权限

Browse Source
This commit is contained in:
ryan
2026-06-10 22:36:17 +08:00
parent bff9e8811d
commit 983228227e
15 changed files with 107 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/apps/user/access_tokens.go
+10 -2
View File
@@ -18,7 +18,8 @@ import (
)
type createTokenRequest struct {
Name string `json:"name"`
Name string `json:"name"`
IsAdmin bool `json:"is_admin"`
}
type tokenResponse struct {
@@ -51,7 +52,7 @@ func ListAccessTokens(c *gin.Context) {
// CreateAccessToken 创建一个新的 AccessToken
// @Summary 创建一个新的 AccessToken
// @Description 为当前用户新建一个 API 访问令牌，仅在此接口返回一次明文令牌值，请妥善保存。
// @Description 为当前用户新建一个 API 访问令牌，仅在此接口返回一次明文令牌值，请妥善保存。可通过 is_admin 字段赋予令牌管理员权限（仅管理员用户可设置）。
// @Tags user
// @Accept json
// @Produce json
@@ -76,6 +77,12 @@ func CreateAccessToken(c *gin.Context) {
return
}
// 只有管理员才能创建具有管理员权限的令牌
if req.IsAdmin && !currUser.IsAdmin {
c.JSON(http.StatusOK, util.Err(errAdminTokenRequiresAdmin))
return
}
// 检查最大限制（基于 ConfigKeyMaxAPIKeysPerUser 配置，默认值为 5）
maxLimit := 5
if val, err := model.GetIntByKey(ctx, model.ConfigKeyMaxAPIKeysPerUser); err == nil {
@@ -108,6 +115,7 @@ func CreateAccessToken(c *gin.Context) {
Name: req.Name,
TokenHash: tokenHash,
MaskedToken: maskedToken,
IsAdmin: req.IsAdmin,
}
if err := db.DB(ctx).Create(&tokenRecord).Error; err != nil {
internal/apps/user/errs.go
+6 -5
View File
@@ -31,11 +31,12 @@ const (
errRenderEmailTemplateFailed = "渲染验证邮件模板失败：%w"
errGenerateEmailCodeFailed = "生成验证码失败，请重试"
errDispatchEmailTaskFailed = "投递验证邮件发送任务失败，请重试"
errTokenNameRequired = "令牌名称不能为空" //nolint:gosec // false positive: this is an error message, not hardcoded credentials
errAccessTokenLimitReached = "已达到访问令牌最大创建数量限制" //nolint:gosec // false positive: this is an error message, not hardcoded credentials
errGenerateTokenFailed = "生成令牌失败" //nolint:gosec // false positive: this is an error message, not hardcoded credentials
errInvalidTokenID = "无效的令牌ID" //nolint:gosec // false positive: this is an error message, not hardcoded credentials
errTokenNotFoundOrForbidden = "令牌不存在或无权操作" //nolint:gosec // false positive: this is an error message, not hardcoded credentials
errTokenNameRequired = "令牌名称不能为空" //nolint:gosec // false positive: this is an error message, not hardcoded credentials
errAccessTokenLimitReached = "已达到访问令牌最大创建数量限制" //nolint:gosec // false positive: this is an error message, not hardcoded credentials
errGenerateTokenFailed = "生成令牌失败" //nolint:gosec // false positive: this is an error message, not hardcoded credentials
errInvalidTokenID = "无效的令牌ID" //nolint:gosec // false positive: this is an error message, not hardcoded credentials
errTokenNotFoundOrForbidden = "令牌不存在或无权操作" //nolint:gosec // false positive: this is an error message, not hardcoded credentials
errAdminTokenRequiresAdmin = "只有管理员才能创建具有管理员权限的令牌" //nolint:gosec // false positive: this is an error message, not hardcoded credentials
errTaskPayloadRequired = "任务参数不能为空"
errInvalidJSONFormat = "无效的 JSON 格式: %w"
errEmailTaskFieldsRequired = "to、subject、body 不能为空"