feat: 多用户权限验证

Author: rehiy

api/passport/controller.go

@@ -18,6 +18,8 @@ func register(c *gin.Context) {
 		return
 	}
 
+	rq.Level = 0 //防止逃逸
+
 	if id, err := user.Create(rq); err == nil {
 		c.Set("Message", "注册成功")
 		c.Set("Payload", gin.H{"Id": id})
@@ -75,6 +77,7 @@ func updateInfo(c *gin.Context) {
 	}
 
 	rq.Id = c.GetUint("UserId")
+	rq.Level = 0 //防止逃逸
 
 	if err := user.Update(rq); err == nil {
 		c.Set("Message", "修改成功")

api/user/router.go

@@ -13,6 +13,7 @@ func Router(api *gin.RouterGroup) {
 	// 需授权接口
 
 	rg.Use(midware.AuthGuard())
+	rg.Use(midware.AdminGuard())
 
 	{
 		rg.GET("/user", list)

module/dborm/table.go

@@ -110,6 +110,7 @@ type User struct {
 	AppId       string `gorm:"uniqueIndex"`
 	Username    string `gorm:"uniqueIndex"`
 	Password    string `json:"-"`
+	Level       uint   `gorm:"default:5"`
 	Description string `gorm:"default:什么也没有"`
 	Sessions    []Session
 	Vendors     []Vendor

module/dborm/user/model.go

@@ -11,6 +11,7 @@ import (
 type CreateParam struct {
 	Username string `binding:"required"`
 	Password string `binding:"required"`
+	Level    uint
 }
 
 func Create(post *CreateParam) (uint, error) {
@@ -35,8 +36,9 @@ func Create(post *CreateParam) (uint, error) {
 
 type UpdateParam struct {
 	Id          uint
-	Description string
 	Password    string
+	Description string
+	Level       uint
 }
 
 func Update(post *UpdateParam) error {

module/midware/auth.go

@@ -4,6 +4,7 @@ import (
 	"github.com/gin-gonic/gin"
 
 	"tdp-cloud/module/dborm/session"
+	"tdp-cloud/module/dborm/user"
 )
 
 func AuthGuard() gin.HandlerFunc {
@@ -25,3 +26,23 @@ func AuthGuard() gin.HandlerFunc {
 	}
 
 }
+
+func AdminGuard() gin.HandlerFunc {
+
+	return func(c *gin.Context) {
+
+		rq := &user.FetchParam{
+			Id: c.GetUint("UserId"),
+		}
+
+		user, err := user.Fetch(rq)
+
+		if err != nil || user.Level != 1 {
+			c.Set("Error", "无权限")
+			c.Abort()
+			return
+		}
+
+	}
+
+}

module/migrator/v100001.go

@@ -23,6 +23,7 @@ func v100001AddUser() error {
 	_, err := user.Create(&user.CreateParam{
 		Username: "admin",
 		Password: "123456",
+		Level:    1,
 	})
 
 	return err