feat: check for server-only operations

Author: Subilan

common/router.go

@@ -65,11 +65,12 @@ func (r *Router) Init() {
 
 	r.Router.Use(cors.New(cors.Config{
 		AllowOrigins:     utils.GlobalConfig.AllowedOrigins,
-		AllowMethods:     []string{"POST", "GET"},
+		AllowMethods:     []string{"POST", "GET", "PATCH", "DELETE"},
 		AllowCredentials: true,
 		MaxAge:           time.Duration(utils.GlobalConfig.Token.Expiration) * time.Minute,
 	}))
 	r.Router.Use(middleware.TokenCheck)
+	r.Router.Use(middleware.ServerCheck)
 }
 
 func (r *Router) Run() {

errors/model.go

@@ -30,7 +30,7 @@ const (
 	RespErrMsgUnauth  = "Authentication Failed"
 
 	RespErrCodeForbidden = 1202
-	RespErrMsgForbidden  = "No permission"
+	RespErrMsgForbidden  = "Forbidden"
 
 	RespErrCodeInvalidToken = 1203
 	RespErrMsgInvalidToken  = "Invalid token"

handlers/response.go

@@ -3,6 +3,7 @@ package handlers
 import (
 	"github.com/gin-gonic/gin"
 	"net/http"
+	"seatimc/backend/errors"
 )
 
 type Response struct {
@@ -38,3 +39,13 @@ func RespTokenError(ctx *gin.Context, errCode int, errMsg string) {
 	}
 	ctx.JSON(resp.HttpCode, resp)
 }
+
+func RespForbidden(ctx *gin.Context) {
+	resp := Response{
+		HttpCode: http.StatusForbidden,
+		Code:     errors.RespErrCodeForbidden,
+		Msg:      errors.RespErrMsgForbidden,
+		Data:     false,
+	}
+	ctx.JSON(resp.HttpCode, resp)
+}

handlers/user/verify-mcid.go

@@ -7,7 +7,7 @@ import (
 	"seatimc/backend/utils"
 )
 
-func HandleVerifyMCID(ctx *gin.Context) *errors.CustomErr {
+func HandleMCIDVerify(ctx *gin.Context) *errors.CustomErr {
 	playername := ctx.DefaultQuery("playername", "")
 
 	if playername == "" {

middleware/servercheck.go

@@ -0,0 +1,20 @@
+package middleware
+
+import (
+	"github.com/gin-gonic/gin"
+	"seatimc/backend/handlers"
+	"seatimc/backend/utils"
+)
+
+func ServerCheck(ctx *gin.Context) {
+	if !utils.IsServerOnly(ctx.Request.RequestURI) {
+		return
+	}
+
+	// Header naming conventions considered from https://stackoverflow.com/questions/3561381/custom-http-headers-naming-conventions
+	if ctx.Request.Header.Get("Seati-Server-Secret") != utils.GlobalConfig.ServerSecret {
+		handlers.RespForbidden(ctx)
+		ctx.Abort()
+		return
+	}
+}

utils/booleans.go

@@ -15,6 +15,19 @@ func NeedAuthorize(uri string) bool {
 	return false
 }
 
+// 根据 URI 前缀判断该 URI 请求是否必须来自服务器
+func IsServerOnly(uri string) bool {
+	needs := GlobalConfig.ServerOnlyEndpoints
+
+	for i := 0; i < len(needs); i++ {
+		if strings.HasPrefix(uri, needs[i]) {
+			return true
+		}
+	}
+
+	return false
+}
+
 func IsTrue(boolean string) bool {
 	return strings.EqualFold(boolean, "true")
 }

utils/config.go

@@ -28,6 +28,8 @@ type Config struct {
 	Version                string         `yaml:"version"`
 	EnableConfigWhitelist  bool           `yaml:"enable-config-whitelist"`
 	NeedAuthorizeEndpoints []string       `yaml:"need-authorize-endpoints"`
+	ServerOnlyEndpoints    []string       `yaml:"server-only-endpoints"`
+	ServerSecret           string         `yaml:"server-secret"`
 }
 
 var GlobalConfig *Config

utils/database-user.go

@@ -1,6 +1,10 @@
 package utils
 
-import "seatimc/backend/errors"
+import (
+	errs "errors"
+	"gorm.io/gorm"
+	"seatimc/backend/errors"
+)
 
 func IsUsernameUsed(username string) (bool, *errors.CustomErr) {
 	conn := GetDBConn()
@@ -28,6 +32,30 @@ func IsMCIDUsed(mcid string) (bool, *errors.CustomErr) {
 	return count > 0, nil
 }
 
+func GetMCIDUsage(mcid string) (*MCIDUsage, *errors.CustomErr) {
+	conn := GetDBConn()
+	var user Users
+
+	result := conn.Model(&Users{}).Where(&Users{MCID: mcid}).First(&user)
+
+	if result.Error != nil {
+		if errs.Is(result.Error, gorm.ErrRecordNotFound) {
+			return &MCIDUsage{
+				Used:     false,
+				Verified: false,
+				With:     "",
+			}, nil
+		}
+		return nil, errors.DbError(result.Error)
+	}
+
+	return &MCIDUsage{
+		Used:     true,
+		Verified: user.MCIDVerified,
+		With:     user.Username,
+	}, nil
+}
+
 func GetUserByUsername(username string) (*Users, *errors.CustomErr) {
 	conn := GetDBConn()
 	var user Users

utils/structs.go

@@ -15,6 +15,12 @@ type JWTClaims struct {
 	Payload JWTPayload `json:"payload"`
 }
 
+type MCIDUsage struct {
+	Used     bool   `json:"used"`
+	Verified bool   `json:"verified"`
+	With     string `json:"with"`
+}
+
 /**
  * Status:
  * 1 - Pending - 创建中