chore: add Auth function to handle all permission verification; remove all old auth codes

frpAct.go

@@ -23,9 +23,10 @@ func CloseFrpcDatabase() error {
 }
 
 func CreateInstanceHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
+	userID, err := Auth(w, r, http.MethodPost, "superuser", "admin")
-		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
+	if err != nil {
-		postLog.Debug(fmt.Sprintf("[CreateInstanceHandler] Invalid request method: %s", r.Method))
+		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
+		postLog.Warning(fmt.Sprintf("[CreateInstanceHandler] Auth failed: %v", err))
 		return
 	}
 
@@ -74,13 +75,6 @@ func CreateInstanceHandler(w http.ResponseWriter, r *http.Request) {
 		instanceInfo.Additional = additional
 	}
 
-	userID, _, err := ValidateRequestWithHeader(w, r)
-	if err != nil {
-		postLog.Error(fmt.Sprintf("[CreateInstanceHandler] Failed to validate request header: %v", err))
-		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
-		return
-	}
-
 	req := CreateInstanceRequest{
 		InstanceInfo: instanceInfo,
 		BootAtStart:  bootAtStart,
@@ -88,12 +82,6 @@ func CreateInstanceHandler(w http.ResponseWriter, r *http.Request) {
 		Additional:   instanceInfo.Additional,
 	}
 
-	if err := CheckPermission(userID, "superuser", "admin"); err != nil {
-		postLog.Error(fmt.Sprintf("[CreateInstanceHandler] Failed to check permission: %v", err))
-		SendErrorResponse(w, http.StatusForbidden, err.Error())
-		return
-	}
-
 	if req.InstanceInfo.Name == "" || req.InstanceInfo.ServerAddr == "" ||
 		req.InstanceInfo.ServerPort == "" || req.InstanceInfo.AuthMethod == "" {
 		SendErrorResponse(w, http.StatusBadRequest, "Missing required fields in instanceInfo")
@@ -177,8 +165,10 @@ func CreateInstanceHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func DeleteInstanceHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
+	userID, err := Auth(w, r, http.MethodPost, "superuser", "admin")
-		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
+	if err != nil {
+		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
+		postLog.Warning(fmt.Sprintf("[DeleteInstanceHandler] Auth failed: %v", err))
 		return
 	}
 
@@ -209,19 +199,6 @@ func DeleteInstanceHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	userID, _, err := ValidateRequestWithHeader(w, r)
-	if err != nil {
-		postLog.Error(fmt.Sprintf("[DeleteInstanceHandler] Failed to validate request header: %v", err))
-		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
-		return
-	}
-
-	if err := CheckPermission(userID, "superuser", "admin"); err != nil {
-		postLog.Error(fmt.Sprintf("[DeleteInstanceHandler] Failed to check permission: %v", err))
-		SendErrorResponse(w, http.StatusForbidden, err.Error())
-		return
-	}
-
 	instance, err := DBQueryFrpcInstanceByID(instanceID)
 	if err == sql.ErrNoRows {
 		SendErrorResponse(w, http.StatusNotFound, "Instance not found")
@@ -261,9 +238,10 @@ func DeleteInstanceHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func ModifyInstanceHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
+	userID, err := Auth(w, r, http.MethodPost, "superuser", "admin")
-		postLog.Error(fmt.Sprintf("[ModifyInstanceHandler] Invalid request method: %s", r.Method))
+	if err != nil {
-		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
+		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
+		postLog.Warning(fmt.Sprintf("[ModifyInstanceHandler] Auth failed: %v", err))
 		return
 	}
 
@@ -311,19 +289,6 @@ func ModifyInstanceHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	userID, _, err := ValidateRequestWithHeader(w, r)
-	if err != nil {
-		postLog.Error(fmt.Sprintf("[ModifyInstanceHandler] Failed to validate request header: %v", err))
-		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
-		return
-	}
-
-	if err := CheckPermission(userID, "superuser", "admin"); err != nil {
-		postLog.Error(fmt.Sprintf("[ModifyInstanceHandler] Failed to check permission: %v", err))
-		SendErrorResponse(w, http.StatusForbidden, err.Error())
-		return
-	}
-
 	instance, err := DBQueryFrpcInstanceByID(instanceID)
 	if err == sql.ErrNoRows {
 		postLog.Error(fmt.Sprintf("[ModifyInstanceHandler] User %d tried to modify a not existed instance: %d", userID, instanceID))
@@ -526,16 +491,10 @@ func getStringFromMap(m map[string]interface{}, key string) string {
 }
 
 func ListInstancesHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
+	userID, err := Auth(w, r, http.MethodGet)
-		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
-		postLog.Debug(fmt.Sprintf("[ListInstancesHandler] Invalid request method: %s", r.Method))
-		return
-	}
-
-	userID, _, err := ValidateRequestWithHeader(w, r)
 	if err != nil {
-		postLog.Error(fmt.Sprintf("[ListInstancesHandler] Failed to validate request header: %v", err))
+		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
-		SendErrorResponse(w, http.StatusBadRequest, "Invalid request header")
+		postLog.Warning(fmt.Sprintf("[ListInstancesHandler] Auth failed: %v", err))
 		return
 	}
 
@@ -564,9 +523,10 @@ func ListInstancesHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func StartInstanceHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
+	userID, err := Auth(w, r, http.MethodPost, "superuser", "admin")
-		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
+	if err != nil {
-		postLog.Debug(fmt.Sprintf("[StartInstanceHandler] Invalid request method: %s", r.Method))
+		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
+		postLog.Warning(fmt.Sprintf("[StartInstanceHandler] Auth failed: %v", err))
 		return
 	}
 
@@ -597,25 +557,6 @@ func StartInstanceHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	userID, _, err := ValidateRequestWithHeader(w, r)
-	if err != nil {
-		postLog.Error(fmt.Sprintf("[StartInstanceHandler] Failed to validate request header: %v", err))
-		SendErrorResponse(w, http.StatusBadRequest, "Invalid request header")
-		return
-	}
-
-	userType, err := GetUserType(userID)
-	if err != nil {
-		postLog.Error(fmt.Sprintf("[StartInstanceHandler] Failed to get user type: %v", err))
-		SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user type")
-		return
-	}
-	if userType != "admin" && userType != "superuser" {
-		SendErrorResponse(w, http.StatusForbidden, "Permission Denied")
-		postLog.Error(fmt.Sprintf("[StartInstanceHandler] Permission Denied for user %d (type: %s)", userID, userType))
-		return
-	}
-
 	instance, err := DBQueryFrpcInstanceByID(instanceID)
 	if err == sql.ErrNoRows {
 		SendErrorResponse(w, http.StatusNotFound, "Instance not found")
@@ -678,9 +619,10 @@ func StartInstanceHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func StopInstanceHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
+	userID, err := Auth(w, r, http.MethodPost, "superuser", "admin")
-		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
+	if err != nil {
-		postLog.Debug(fmt.Sprintf("[StopInstanceHandler] Invalid request method: %s", r.Method))
+		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
+		postLog.Warning(fmt.Sprintf("[StopInstanceHandler] Auth failed: %v", err))
 		return
 	}
 
@@ -711,25 +653,6 @@ func StopInstanceHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	userID, _, err := ValidateRequestWithHeader(w, r)
-	if err != nil {
-		postLog.Error(fmt.Sprintf("[StopInstanceHandler] Failed to validate request header: %v", err))
-		SendErrorResponse(w, http.StatusBadRequest, "Invalid request header")
-		return
-	}
-
-	userType, err := GetUserType(userID)
-	if err != nil {
-		postLog.Error(fmt.Sprintf("[StopInstanceHandler] Failed to get user type: %v", err))
-		SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user type")
-		return
-	}
-	if userType != "admin" && userType != "superuser" {
-		SendErrorResponse(w, http.StatusForbidden, "Permission Denied")
-		postLog.Error(fmt.Sprintf("[StopInstanceHandler] Permission Denied for user %d (type: %s)", userID, userType))
-		return
-	}
-
 	instance, err := DBQueryFrpcInstanceByID(instanceID)
 	if err == sql.ErrNoRows {
 		SendErrorResponse(w, http.StatusNotFound, "Instance not found")
@@ -792,9 +715,10 @@ func StopInstanceHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func RestartInstanceHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
+	userID, err := Auth(w, r, http.MethodPost, "superuser", "admin")
-		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
+	if err != nil {
-		postLog.Debug(fmt.Sprintf("[RestartInstanceHandler] Invalid request method: %s", r.Method))
+		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
+		postLog.Warning(fmt.Sprintf("[RestartInstanceHandler] Auth failed: %v", err))
 		return
 	}
 
@@ -825,25 +749,6 @@ func RestartInstanceHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	userID, _, err := ValidateRequestWithHeader(w, r)
-	if err != nil {
-		postLog.Error(fmt.Sprintf("[RestartInstanceHandler] Failed to validate request header: %v", err))
-		SendErrorResponse(w, http.StatusBadRequest, "Invalid request header")
-		return
-	}
-
-	userType, err := GetUserType(userID)
-	if err != nil {
-		postLog.Error(fmt.Sprintf("[RestartInstanceHandler] Failed to get user type: %v", err))
-		SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user type")
-		return
-	}
-	if userType != "admin" && userType != "superuser" {
-		SendErrorResponse(w, http.StatusForbidden, "Permission Denied")
-		postLog.Error(fmt.Sprintf("[RestartInstanceHandler] Permission Denied for user %d (type: %s)", userID, userType))
-		return
-	}
-
 	instance, err := DBQueryFrpcInstanceByID(instanceID)
 	if err == sql.ErrNoRows {
 		SendErrorResponse(w, http.StatusNotFound, "Instance not found")
@@ -906,9 +811,10 @@ func RestartInstanceHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func GetInstanceStatusHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
+	userID, err := Auth(w, r, http.MethodGet)
-		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
+	if err != nil {
-		postLog.Debug(fmt.Sprintf("[GetInstanceStatusHandler] Invalid request method: %s", r.Method))
+		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
+		postLog.Warning(fmt.Sprintf("[GetInstanceStatusHandler] Auth failed: %v", err))
 		return
 	}
 
@@ -925,13 +831,6 @@ func GetInstanceStatusHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	userID, _, err := ValidateRequestWithHeader(w, r)
-	if err != nil {
-		postLog.Error(fmt.Sprintf("[GetInstanceStatusHandler] Failed to validate request header: %v", err))
-		SendErrorResponse(w, http.StatusBadRequest, "Invalid request header")
-		return
-	}
-
 	instance, err := DBQueryFrpcInstanceByID(instanceID)
 	if err == sql.ErrNoRows {
 		SendErrorResponse(w, http.StatusNotFound, "Instance not found")
@@ -974,9 +873,10 @@ func GetInstanceStatusHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func GetInstanceInfoHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
+	userID, err := Auth(w, r, http.MethodGet)
-		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
+	if err != nil {
-		postLog.Debug(fmt.Sprintf("[GetInstanceInfoHandler] Invalid request method: %s", r.Method))
+		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
+		postLog.Warning(fmt.Sprintf("[GetInstanceInfoHandler] Auth failed: %v", err))
 		return
 	}
 
@@ -993,13 +893,6 @@ func GetInstanceInfoHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	userID, _, err := ValidateRequestWithHeader(w, r)
-	if err != nil {
-		postLog.Error(fmt.Sprintf("[GetInstanceInfoHandler] Failed to validate request header: %v", err))
-		SendErrorResponse(w, http.StatusBadRequest, "Invalid request header")
-		return
-	}
-
 	instance, err := DBQueryFrpcInstanceByID(instanceID)
 	if err == sql.ErrNoRows {
 		SendErrorResponse(w, http.StatusNotFound, "Instance not found")

frpLogger/initd.go

@@ -1,6 +1,3 @@
-//go:build linux
-// +build linux
-
 package frpLogger
 
 import (

frpLogger/systemd.go

@@ -1,6 +1,3 @@
-//go:build linux
-// +build linux
-
 package frpLogger
 
 import (

frpcProxyAct.go

@@ -13,9 +13,10 @@ import (
 )
 
 func CreateProxyHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
+	userID, err := Auth(w, r, http.MethodPost, "superuser", "admin")
-		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
+	if err != nil {
-		postLog.Debug(fmt.Sprintf("[CreateProxyHandler] Invalid request method: %s", r.Method))
+		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
+		postLog.Warning(fmt.Sprintf("[CreateProxyHandler] Auth failed: %v", err))
 		return
 	}
 
@@ -63,23 +64,6 @@ func CreateProxyHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	userID, _, err := ValidateRequestWithHeader(w, r)
-	if err != nil {
-		postLog.Error(fmt.Sprintf("[CreateProxyHandler] Failed to validate request header: %v", err))
-		SendErrorResponse(w, http.StatusBadRequest, "Invalid request header")
-		return
-	}
-
-	userType, err := GetUserType(userID)
-	if err != nil {
-		postLog.Error(fmt.Sprintf("[CreateProxyHandler] Failed to get user type: %v", err))
-		SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user type")
-		return
-	} else if userType != "admin" && userType != "superuser" {
-		SendErrorResponse(w, http.StatusForbidden, "Permission Denied")
-		return
-	}
-
 	var instance FrpcInstance
 	instanceIDInt, _ := strconv.Atoi(instanceID)
 	instance, err = DBQueryFrpcInstanceByID(instanceIDInt)
@@ -124,9 +108,10 @@ func CreateProxyHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func DeleteProxyHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
+	userID, err := Auth(w, r, http.MethodPost, "superuser", "admin")
-		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
+	if err != nil {
-		postLog.Debug(fmt.Sprintf("[DeleteProxyHandler] Invalid request method: %s", r.Method))
+		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
+		postLog.Warning(fmt.Sprintf("[DeleteProxyHandler] Auth failed: %v", err))
 		return
 	}
 
@@ -159,23 +144,6 @@ func DeleteProxyHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	userID, _, err := ValidateRequestWithHeader(w, r)
-	if err != nil {
-		postLog.Error(fmt.Sprintf("[DeleteProxyHandler] Failed to validate request header: %v", err))
-		SendErrorResponse(w, http.StatusBadRequest, "Invalid request header")
-		return
-	}
-
-	userType, err := GetUserType(userID)
-	if err != nil {
-		postLog.Error(fmt.Sprintf("[DeleteProxyHandler] Failed to get user type: %v", err))
-		SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user type")
-		return
-	} else if userType != "admin" && userType != "superuser" {
-		SendErrorResponse(w, http.StatusForbidden, "Permission Denied")
-		return
-	}
-
 	var instance FrpcInstance
 	instanceIDInt, _ := strconv.Atoi(instanceID)
 	instance, err = DBQueryFrpcInstanceByID(instanceIDInt)
@@ -220,9 +188,10 @@ func DeleteProxyHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func ListProxiesHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
+	userID, err := Auth(w, r, http.MethodGet)
-		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
+	if err != nil {
-		postLog.Debug(fmt.Sprintf("[ListProxiesHandler] Invalid request method: %s", r.Method))
+		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
+		postLog.Warning(fmt.Sprintf("[ListProxiesHandler] Auth failed: %v", err))
 		return
 	}
 
@@ -234,13 +203,6 @@ func ListProxiesHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	userID, _, err := ValidateRequestWithHeader(w, r)
-	if err != nil {
-		postLog.Error(fmt.Sprintf("[ListProxiesHandler] Failed to validate request header: %v", err))
-		SendErrorResponse(w, http.StatusBadRequest, "Invalid request header")
-		return
-	}
-
 	var instance FrpcInstance
 	instanceIDInt, _ := strconv.Atoi(instanceID)
 	instance, err = DBQueryFrpcInstanceByID(instanceIDInt)

handlers.go

@@ -3,7 +3,6 @@ package main
 import (
 	"encoding/json"
 	"fmt"
-	"io"
 	"net/http"
 	"strconv"
 	"super-frpc/postLog"
@@ -50,80 +49,42 @@ func SendSuccessResponse(w http.ResponseWriter, message string, data interface{}
 	w.Write(jsonResp)
 }
 
-func ValidateRequest(w http.ResponseWriter, r *http.Request, requiredFields ...string) (int, string, error) { // ValidateRequest validates the request body and header
+func Auth(w http.ResponseWriter, r *http.Request, targetMethod string, allowedUserLevels ...string) (int, error) {
-	body, err := io.ReadAll(r.Body)
+	if r.Method != targetMethod {
+		return 0, fmt.Errorf("Method not allowed: %s", targetMethod)
+	}
+
+	if !isDebug && !ValidateTimeStamp(r.Header) {
+		return 0, fmt.Errorf("Invalid or missing X-Timestamp in header")
+	}
+
+	userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
 	if err != nil {
-		return 0, "", fmt.Errorf("Failed to read request body: %w", err)
+		return 0, fmt.Errorf("Invalid token format: %w", err)
-	}
-	defer r.Body.Close()
-
-	return ValidateRequestWithBody(w, r, body, requiredFields...)
-}
-
-func ValidateRequestWithBody(w http.ResponseWriter, r *http.Request, body []byte, requiredFields ...string) (int, string, error) {
-	var reqMap map[string]interface{}
-	if err := json.Unmarshal(body, &reqMap); err != nil {
-		return 0, "", fmt.Errorf("Invalid request format: %w", err)
 	}
 
-	token := r.Header.Get("X-Token")
+	if err := ValidateToken(userID, r.Header.Get("X-Token")); err != nil {
-	if token == "" {
+		return 0, fmt.Errorf("Token validation failed: %w", err)
-		return 0, "", fmt.Errorf("Token is required in header: %s", token)
 	}
 
-	if !isDebug {
+	if len(allowedUserLevels) > 0 {
-		if !ValidateTimeStamp(r.Header) {
+		currentUser, err := DBQuerySpecificUser(userID)
-			return 0, "", fmt.Errorf("Invalid or missing X-Timestamp in header")
-		}
-	}
-
-	userID, err := extractUserIDFromToken(token)
 		if err != nil {
-		return 0, "", fmt.Errorf("Invalid token format: %w", err)
+			return 0, fmt.Errorf("Failed to query user: %w", err)
 		}
-
+		allowed := false
-	if err := ValidateToken(userID, token); err != nil {
+		for _, level := range allowedUserLevels {
-		return 0, "", fmt.Errorf("Token validation failed: %w", err)
+			if currentUser.Type == level {
+				allowed = true
+				break
 			}
-
+		}
-	for _, field := range requiredFields {
+		if !allowed {
-		if _, ok := reqMap[field]; !ok {
+			return 0, fmt.Errorf("User level not allowed: required one of %v, got %s", allowedUserLevels, currentUser.Type)
-			return 0, "", fmt.Errorf("required field %s is missing: %s", field, reqMap[field])
 		}
 	}
 
-	return userID, token, nil
+	return userID, nil
-}
-
-func ValidateRequestWithHeader(w http.ResponseWriter, r *http.Request, requiredFields ...string) (int, string, error) {
-	token := r.Header.Get("X-Token")
-	if token == "" {
-		return 0, "", fmt.Errorf("Token is required in header: %s", token)
-	}
-
-	if !isDebug {
-		if !ValidateTimeStamp(r.Header) {
-			return 0, "", fmt.Errorf("Invalid or missing X-Timestamp in header")
-		}
-	}
-
-	userID, err := extractUserIDFromToken(token)
-	if err != nil {
-		return 0, "", fmt.Errorf("Invalid token format in header: %w", err)
-	}
-
-	if err := ValidateToken(userID, token); err != nil {
-		return 0, "", fmt.Errorf("Token validation failed in header: %w", err)
-	}
-
-	for _, field := range requiredFields {
-		headerValue := r.Header.Get(fmt.Sprintf("X-%s", field))
-		if headerValue == "" {
-			return 0, "", fmt.Errorf("required field %s is missing in header: %s", field, headerValue)
-		}
-	}
-
-	return userID, token, nil
 }
 
 func GetUserType(userID int) (string, error) {
@@ -134,21 +95,6 @@ func GetUserType(userID int) (string, error) {
 	return user.Type, nil
 }
 
-func CheckPermission(userID int, requiredTypes ...string) error {
-	userType, err := GetUserType(userID)
-	if err != nil {
-		return fmt.Errorf("Failed to check permission: %w", err)
-	}
-
-	for _, t := range requiredTypes {
-		if userType == t {
-			return nil
-		}
-	}
-
-	return fmt.Errorf("Permission denied for user type %s", userType)
-}
-
 func GetClientIP(r *http.Request) string {
 	forwarded := r.Header.Get("X-Forwarded-For")
 	if forwarded != "" {

userAct.go

@@ -181,21 +181,10 @@ func LoginHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func LogoutHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
+	userID, err := Auth(w, r, http.MethodGet)
-		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
-		postLog.Warning(fmt.Sprintf("[LogoutHandler] Invalid request method: %s", r.Method))
-		return
-	}
-
-	if !ValidateTimeStamp(r.Header) {
-		SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
-		return
-	}
-
-	userID, err := GetUserIDFromToken(r.Header.Get("X-Token"))
 	if err != nil {
-		SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
+		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
-		postLog.Warning(fmt.Sprintf("[LogoutHandler] Invalid or missing token: %v", err))
+		postLog.Warning(fmt.Sprintf("[LogoutHandler] Auth failed: %v", err))
 		return
 	}
 
@@ -226,15 +215,10 @@ func LogoutHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func RemoveSessionHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
+	userID, err := Auth(w, r, http.MethodPost, "superuser")
-		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
+	if err != nil {
-		postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Invalid request method: %s", r.Method))
+		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
-		return
+		postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Auth failed: %v", err))
-	}
-
-	if !ValidateTimeStamp(r.Header) {
-		SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
-		postLog.Warning("[RemoveSessionHandler] Invalid or missing X-Timestamp in header")
 		return
 	}
 
@@ -259,19 +243,6 @@ func RemoveSessionHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
-	if err != nil {
-		SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
-		postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Invalid or missing token: %v", err))
-		return
-	}
-
-	if err := CheckPermission(userID, "superuser"); err != nil {
-		SendErrorResponse(w, http.StatusForbidden, "Permission denied")
-		postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Permission denied for user [%d]%s: %v", userID, GetUsernameByID(userID), err))
-		return
-	}
-
 	if err := RemoveSession(req.SessionID); err != nil {
 		SendErrorResponse(w, http.StatusInternalServerError, fmt.Sprintf("Failed to remove session: %v", err))
 		postLog.Error(fmt.Sprintf("[RemoveSessionHandler] Failed to remove session %s: %v", req.SessionID, err))
@@ -283,31 +254,10 @@ func RemoveSessionHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func CreateUserHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
+	_, err := Auth(w, r, http.MethodPost, "superuser")
-		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
-		postLog.Warning(fmt.Sprintf("[CreateUserHandler] Invalid request method: %s", r.Method))
-		return
-	}
-
-	if !ValidateTimeStamp(r.Header) {
-		SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
-		return
-	}
-	userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
 	if err != nil {
-		SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
+		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
-		postLog.Warning(fmt.Sprintf("[CreateUserHandler] Invalid or missing token: %v", err))
+		postLog.Warning(fmt.Sprintf("[CreateUserHandler] Auth failed: %v", err))
-		return
-	}
-	user, err := GetUserByID(userID)
-	if err != nil {
-		SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user info")
-		postLog.Error(fmt.Sprintf("[CreateUserHandler] Failed to get user info for user [%d]%s: %v", userID, GetUsernameByID(userID), err))
-		return
-	}
-	if user.Type != "superuser" {
-		SendErrorResponse(w, http.StatusForbidden, "Permission denied")
-		postLog.Warning(fmt.Sprintf("[CreateUserHandler] Permission denied: non-superuser token for user [%d]%s", userID, GetUsernameByID(userID)))
 		return
 	}
 
@@ -338,14 +288,14 @@ func CreateUserHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	userID, err = AddUser(req.Username, req.Passwd, req.Type)
+	userID, err := AddUser(req.Username, req.Passwd, req.Type)
 	if err != nil {
 		SendErrorResponse(w, http.StatusInternalServerError, err.Error())
 		postLog.Error(fmt.Sprintf("[RegisterHandler] Failed to register user \"%s\": %v", req.Username, err))
 		return
 	}
 
-	user, err = GetUserByID(userID)
+	user, err := GetUserByID(userID)
 	if err != nil {
 		SendErrorResponse(w, http.StatusInternalServerError, "Failed to retrieve user after creation")
 		postLog.Error(fmt.Sprintf("[CreateUserHandler] Failed to retrieve user \"%s\" after creation: %v", req.Username, err))
@@ -361,31 +311,10 @@ func CreateUserHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func RemoveUserHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
+	_, err := Auth(w, r, http.MethodPost, "superuser")
-		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
-		postLog.Warning(fmt.Sprintf("[RemoveUserHandler] Invalid request method: %s", r.Method))
-		return
-	}
-
-	if !ValidateTimeStamp(r.Header) {
-		SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
-		return
-	}
-	userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
 	if err != nil {
-		SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
+		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
-		postLog.Warning(fmt.Sprintf("[RemoveUserHandler] Invalid or missing token: %v", err))
+		postLog.Warning(fmt.Sprintf("[RemoveUserHandler] Auth failed: %v", err))
-		return
-	}
-	user, err := GetUserByID(userID)
-	if err != nil {
-		SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user info")
-		postLog.Error(fmt.Sprintf("[RemoveUserHandler] Failed to get user info for user [%d]%s: %v", userID, GetUsernameByID(userID), err))
-		return
-	}
-	if user.Type != "superuser" {
-		SendErrorResponse(w, http.StatusForbidden, "Permission denied")
-		postLog.Warning(fmt.Sprintf("[RemoveUserHandler] Permission denied: non-superuser token for user [%d]%s", userID, GetUsernameByID(userID)))
 		return
 	}
 
@@ -417,33 +346,13 @@ func RemoveUserHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func ListUserHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
+	_, err := Auth(w, r, http.MethodGet, "superuser")
-		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
+	if err != nil {
-		postLog.Warning(fmt.Sprintf("[ListUserHandler] Invalid request method: %s", r.Method))
+		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
+		postLog.Warning(fmt.Sprintf("[ListUserHandler] Auth failed: %v", err))
 		return
 	}
 
-	if !ValidateTimeStamp(r.Header) {
-		SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
-		return
-	}
-	userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
-	if err != nil {
-		SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
-		postLog.Warning(fmt.Sprintf("[ListUserHandler] Invalid or missing token: %v", err))
-		return
-	}
-	user, err := GetUserByID(userID)
-	if err != nil {
-		SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user info")
-		postLog.Error(fmt.Sprintf("[ListUserHandler] Failed to get user info for user [%d]%s: %v", userID, GetUsernameByID(userID), err))
-		return
-	}
-	if user.Type != "superuser" {
-		SendErrorResponse(w, http.StatusForbidden, "Permission denied")
-		postLog.Warning(fmt.Sprintf("[ListUserHandler] Permission denied: non-superuser token for user [%d]%s", userID, GetUsernameByID(userID)))
-		return
-	}
 	userList, err := DBQueryUsers()
 	if err != nil {
 		SendErrorResponse(w, http.StatusInternalServerError, "Failed to list users")
@@ -454,28 +363,10 @@ func ListUserHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func ListActiveSessionsHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
+	userID, err := Auth(w, r, http.MethodGet, "superuser", "admin")
-		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
-		postLog.Warning(fmt.Sprintf("[ListActiveSessionsHandler] Invalid request method: %s", r.Method))
-		return
-	}
-
-	if !ValidateTimeStamp(r.Header) {
-		SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
-		postLog.Warning("[ListActiveSessionsHandler] Invalid or missing X-Timestamp in header")
-		return
-	}
-
-	userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
 	if err != nil {
-		SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
+		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
-		postLog.Warning(fmt.Sprintf("[ListActiveSessionsHandler] Invalid or missing token: %v", err))
+		postLog.Warning(fmt.Sprintf("[ListActiveSessionsHandler] Auth failed: %v", err))
-		return
-	}
-
-	if err := CheckPermission(userID, "superuser"); err != nil {
-		SendErrorResponse(w, http.StatusForbidden, "Permission denied")
-		postLog.Warning(fmt.Sprintf("[ListActiveSessionsHandler] Permission denied for user [%d]%s: %v", userID, GetUsernameByID(userID), err))
 		return
 	}