Super-frpc/backend
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

chore: add Auth function to handle all permission verification; remove all old auth codes

Browse Source
This commit is contained in:
NanamiAdmin
2026-03-30 13:50:52 +08:00
parent 839bad3c94
commit 67bea968c6
6 changed files with 97 additions and 411 deletions
Download Patch File Download Diff File Expand all files Collapse all files
userAct.go
+22 -131
View File
@@ -181,21 +181,10 @@ func LoginHandler(w http.ResponseWriter, r *http.Request) {
}
func LogoutHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodGet {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Warning(fmt.Sprintf("[LogoutHandler] Invalid request method: %s", r.Method))
return
}
if !ValidateTimeStamp(r.Header) {
SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
return
}
userID, err := GetUserIDFromToken(r.Header.Get("X-Token"))
userID, err := Auth(w, r, http.MethodGet)
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
postLog.Warning(fmt.Sprintf("[LogoutHandler] Invalid or missing token: %v", err))
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[LogoutHandler] Auth failed: %v", err))
return
}
@@ -226,15 +215,10 @@ func LogoutHandler(w http.ResponseWriter, r *http.Request) {
}
func RemoveSessionHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Invalid request method: %s", r.Method))
return
}
if !ValidateTimeStamp(r.Header) {
SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
postLog.Warning("[RemoveSessionHandler] Invalid or missing X-Timestamp in header")
userID, err := Auth(w, r, http.MethodPost, "superuser")
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Auth failed: %v", err))
return
}
@@ -259,19 +243,6 @@ func RemoveSessionHandler(w http.ResponseWriter, r *http.Request) {
return
}
userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Invalid or missing token: %v", err))
return
}
if err := CheckPermission(userID, "superuser"); err != nil {
SendErrorResponse(w, http.StatusForbidden, "Permission denied")
postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Permission denied for user [%d]%s: %v", userID, GetUsernameByID(userID), err))
return
}
if err := RemoveSession(req.SessionID); err != nil {
SendErrorResponse(w, http.StatusInternalServerError, fmt.Sprintf("Failed to remove session: %v", err))
postLog.Error(fmt.Sprintf("[RemoveSessionHandler] Failed to remove session %s: %v", req.SessionID, err))
@@ -283,31 +254,10 @@ func RemoveSessionHandler(w http.ResponseWriter, r *http.Request) {
}
func CreateUserHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Warning(fmt.Sprintf("[CreateUserHandler] Invalid request method: %s", r.Method))
return
}
if !ValidateTimeStamp(r.Header) {
SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
return
}
userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
_, err := Auth(w, r, http.MethodPost, "superuser")
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
postLog.Warning(fmt.Sprintf("[CreateUserHandler] Invalid or missing token: %v", err))
return
}
user, err := GetUserByID(userID)
if err != nil {
SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user info")
postLog.Error(fmt.Sprintf("[CreateUserHandler] Failed to get user info for user [%d]%s: %v", userID, GetUsernameByID(userID), err))
return
}
if user.Type != "superuser" {
SendErrorResponse(w, http.StatusForbidden, "Permission denied")
postLog.Warning(fmt.Sprintf("[CreateUserHandler] Permission denied: non-superuser token for user [%d]%s", userID, GetUsernameByID(userID)))
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[CreateUserHandler] Auth failed: %v", err))
return
}
@@ -338,14 +288,14 @@ func CreateUserHandler(w http.ResponseWriter, r *http.Request) {
return
}
userID, err = AddUser(req.Username, req.Passwd, req.Type)
userID, err := AddUser(req.Username, req.Passwd, req.Type)
if err != nil {
SendErrorResponse(w, http.StatusInternalServerError, err.Error())
postLog.Error(fmt.Sprintf("[RegisterHandler] Failed to register user \"%s\": %v", req.Username, err))
return
}
user, err = GetUserByID(userID)
user, err := GetUserByID(userID)
if err != nil {
SendErrorResponse(w, http.StatusInternalServerError, "Failed to retrieve user after creation")
postLog.Error(fmt.Sprintf("[CreateUserHandler] Failed to retrieve user \"%s\" after creation: %v", req.Username, err))
@@ -361,31 +311,10 @@ func CreateUserHandler(w http.ResponseWriter, r *http.Request) {
}
func RemoveUserHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Warning(fmt.Sprintf("[RemoveUserHandler] Invalid request method: %s", r.Method))
return
}
if !ValidateTimeStamp(r.Header) {
SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
return
}
userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
_, err := Auth(w, r, http.MethodPost, "superuser")
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
postLog.Warning(fmt.Sprintf("[RemoveUserHandler] Invalid or missing token: %v", err))
return
}
user, err := GetUserByID(userID)
if err != nil {
SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user info")
postLog.Error(fmt.Sprintf("[RemoveUserHandler] Failed to get user info for user [%d]%s: %v", userID, GetUsernameByID(userID), err))
return
}
if user.Type != "superuser" {
SendErrorResponse(w, http.StatusForbidden, "Permission denied")
postLog.Warning(fmt.Sprintf("[RemoveUserHandler] Permission denied: non-superuser token for user [%d]%s", userID, GetUsernameByID(userID)))
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[RemoveUserHandler] Auth failed: %v", err))
return
}
@@ -417,33 +346,13 @@ func RemoveUserHandler(w http.ResponseWriter, r *http.Request) {
}
func ListUserHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodGet {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Warning(fmt.Sprintf("[ListUserHandler] Invalid request method: %s", r.Method))
_, err := Auth(w, r, http.MethodGet, "superuser")
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[ListUserHandler] Auth failed: %v", err))
return
}
if !ValidateTimeStamp(r.Header) {
SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
return
}
userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
postLog.Warning(fmt.Sprintf("[ListUserHandler] Invalid or missing token: %v", err))
return
}
user, err := GetUserByID(userID)
if err != nil {
SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user info")
postLog.Error(fmt.Sprintf("[ListUserHandler] Failed to get user info for user [%d]%s: %v", userID, GetUsernameByID(userID), err))
return
}
if user.Type != "superuser" {
SendErrorResponse(w, http.StatusForbidden, "Permission denied")
postLog.Warning(fmt.Sprintf("[ListUserHandler] Permission denied: non-superuser token for user [%d]%s", userID, GetUsernameByID(userID)))
return
}
userList, err := DBQueryUsers()
if err != nil {
SendErrorResponse(w, http.StatusInternalServerError, "Failed to list users")
@@ -454,28 +363,10 @@ func ListUserHandler(w http.ResponseWriter, r *http.Request) {
}
func ListActiveSessionsHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodGet {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Warning(fmt.Sprintf("[ListActiveSessionsHandler] Invalid request method: %s", r.Method))
return
}
if !ValidateTimeStamp(r.Header) {
SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
postLog.Warning("[ListActiveSessionsHandler] Invalid or missing X-Timestamp in header")
return
}
userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
userID, err := Auth(w, r, http.MethodGet, "superuser", "admin")
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
postLog.Warning(fmt.Sprintf("[ListActiveSessionsHandler] Invalid or missing token: %v", err))
return
}
if err := CheckPermission(userID, "superuser"); err != nil {
SendErrorResponse(w, http.StatusForbidden, "Permission denied")
postLog.Warning(fmt.Sprintf("[ListActiveSessionsHandler] Permission denied for user [%d]%s: %v", userID, GetUsernameByID(userID), err))
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[ListActiveSessionsHandler] Auth failed: %v", err))
return
}