61 lines
1.5 KiB
Go
61 lines
1.5 KiB
Go
// 自动化运维写操作权限 — 脚本库 / 定时任务 // Logan.Li
|
|
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
|
|
"ezops/model"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
// AutomationWrite 创建/修改/删除/执行脚本与定时任务需具备自动化运维权限 // Logan.Li
|
|
func AutomationWrite(db *gorm.DB) gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
if isAdmin, _ := c.Get("isAdmin"); isAdmin == true {
|
|
c.Next()
|
|
return
|
|
}
|
|
userID, ok := c.Get("userID")
|
|
if !ok {
|
|
c.JSON(http.StatusUnauthorized, model.Response{Code: 401, Message: "未认证"})
|
|
c.Abort()
|
|
return
|
|
}
|
|
codes := collectPermissionCodes(db, userID.(uint))
|
|
for _, code := range codes {
|
|
if code == "*" || strings.HasPrefix(code, "auto:") {
|
|
c.Next()
|
|
return
|
|
}
|
|
}
|
|
c.JSON(http.StatusForbidden, model.Response{
|
|
Code: 403,
|
|
Message: "需要自动化运维权限（auto:script 或 auto:cron），请联系管理员分配角色",
|
|
})
|
|
c.Abort()
|
|
}
|
|
}
|
|
|
|
// collectPermissionCodes 查询用户有效权限码 // Logan.Li
|
|
func collectPermissionCodes(db *gorm.DB, userID uint) []string {
|
|
var rows []struct{ Code string }
|
|
db.Raw(`
|
|
SELECT DISTINCT p.code AS code
|
|
FROM iam_user_roles ur
|
|
JOIN iam_roles r ON r.id = ur.role_id AND r.status = 1
|
|
JOIN iam_role_permissions rp ON rp.role_id = r.id
|
|
JOIN iam_permissions p ON p.id = rp.permission_id AND p.status = 1
|
|
WHERE ur.user_id = ?
|
|
`, userID).Scan(&rows)
|
|
codes := make([]string, 0, len(rows))
|
|
for _, r := range rows {
|
|
if r.Code != "" {
|
|
codes = append(codes, r.Code)
|
|
}
|
|
}
|
|
return codes
|
|
}
|