From 4889590b355c57a710c8aa451ec6152483713d75 Mon Sep 17 00:00:00 2001
From: momo <1012651275@qq.com>
Date: Mon, 27 Nov 2023 14:46:50 +0800
Subject: [PATCH] =?UTF-8?q?=E6=9D=83=E9=99=90=E6=A3=80=E9=AA=8C=E4=B8=AD?=
=?UTF-8?q?=E9=97=B4=E4=BB=B6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
---
model/gmodel/fs_product_template_v2_gen.go | 4 +-
model/gmodel/ldap_apis_gen.go | 1 +
.../internal/handler/saveapihandler.go | 4 +-
.../ldap-admin/internal/logic/saveapilogic.go | 13 ++-
.../ldap-admin/internal/svc/servicecontext.go | 3 +-
server/ldap-admin/internal/types/types.go | 1 +
server_api/ldap-admin.api | 5 +-
utils/ldap_lib/auth.go | 82 ++++++++++++++++++-
utils/ldap_lib/ldap_group.go | 5 +-
9 files changed, 107 insertions(+), 11 deletions(-)
diff --git a/model/gmodel/fs_product_template_v2_gen.go b/model/gmodel/fs_product_template_v2_gen.go
index fc297d40..5689ee7b 100644
--- a/model/gmodel/fs_product_template_v2_gen.go
+++ b/model/gmodel/fs_product_template_v2_gen.go
@@ -11,9 +11,9 @@ type FsProductTemplateV2 struct {
ModelId *int64 `gorm:"default:0;" json:"model_id"` // 模型ID
Title *string `gorm:"default:'';" json:"title"` // 模板（sku）,预留字段
Name *string `gorm:"default:'';" json:"name"` // 名称
- CoverImg *string `gorm:"default:'';" json:"cover_img"` // 模板背景图
+ CoverImg *string `gorm:"default:'';" json:"cover_img"` //
TemplateInfo *string `gorm:"default:'';" json:"template_info"` // 模板详情
- MaterialImg *string `gorm:"default:'';" json:"material_img"` // 合成好的贴图
+ MaterialImg *string `gorm:"default:'';" json:"material_img"` //
Sort *int64 `gorm:"default:0;" json:"sort"` // 排序
LogoWidth *int64 `gorm:"default:0;" json:"logo_width"` // logo图最大宽度
LogoHeight *int64 `gorm:"default:0;" json:"logo_height"` // logo图最大高度
diff --git a/model/gmodel/ldap_apis_gen.go b/model/gmodel/ldap_apis_gen.go
index 3787591f..9eeddb54 100644
--- a/model/gmodel/ldap_apis_gen.go
+++ b/model/gmodel/ldap_apis_gen.go
@@ -8,6 +8,7 @@ import (
// ldap_apis api表
type LdapApis struct {
Id int64 `gorm:"primary_key;default:0;auto_increment;" json:"id"` //
+ Name *string `gorm:"default:'';" json:"name"` //
Method *string `gorm:"default:'';" json:"method"` //
Path *string `gorm:"default:'';" json:"path"` //
Category *string `gorm:"default:'';" json:"category"` //
diff --git a/server/ldap-admin/internal/handler/saveapihandler.go b/server/ldap-admin/internal/handler/saveapihandler.go
index 6048cb85..9388673c 100644
--- a/server/ldap-admin/internal/handler/saveapihandler.go
+++ b/server/ldap-admin/internal/handler/saveapihandler.go
@@ -15,7 +15,7 @@ func SaveApiHandler(svcCtx *svc.ServiceContext) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
var req types.SaveApiReq
- userinfo, err := basic.RequestParse(w, r, svcCtx, &req)
+ _, err := basic.RequestParse(w, r, svcCtx, &req)
if err != nil {
return
}
@@ -26,7 +26,7 @@ func SaveApiHandler(svcCtx *svc.ServiceContext) http.HandlerFunc {
rl := reflect.ValueOf(l)
basic.BeforeLogic(w, r, rl)
- resp := l.SaveApi(&req, userinfo)
+ resp := l.SaveApi(&req, r)
if !basic.AfterLogic(w, r, rl, resp) {
basic.NormalAfterLogic(w, r, resp)
diff --git a/server/ldap-admin/internal/logic/saveapilogic.go b/server/ldap-admin/internal/logic/saveapilogic.go
index 395aa01c..75976081 100644
--- a/server/ldap-admin/internal/logic/saveapilogic.go
+++ b/server/ldap-admin/internal/logic/saveapilogic.go
@@ -3,8 +3,8 @@ package logic
import (
"errors"
"fusenapi/model/gmodel"
- "fusenapi/utils/auth"
"fusenapi/utils/basic"
+ "net/http"
"context"
@@ -33,9 +33,14 @@ func NewSaveApiLogic(ctx context.Context, svcCtx *svc.ServiceContext) *SaveApiLo
// func (l *SaveApiLogic) BeforeLogic(w http.ResponseWriter, r *http.Request) {
// }
-func (l *SaveApiLogic) SaveApi(req *types.SaveApiReq, userinfo *auth.UserInfo) (resp *basic.Response) {
+func (l *SaveApiLogic) SaveApi(req *types.SaveApiReq, r *http.Request) (resp *basic.Response) {
// 返回值必须调用Set重新返回, resp可以空指针调用 resp.SetStatus(basic.CodeOK, data)
// userinfo 传入值时, 一定不为null
+
+ if !l.svcCtx.Ldap.VerifyAuthorityGroup(r) {
+ return resp.SetStatusWithMessage(basic.CodeUnAuth, "无权限，请联系管理员开通")
+ }
+
var err1 error
if req.Id > 0 {
resOne, err := l.svcCtx.AllModels.LdapApis.FindOneById(l.ctx, req.Id)
@@ -48,6 +53,9 @@ func (l *SaveApiLogic) SaveApi(req *types.SaveApiReq, userinfo *auth.UserInfo) (
return resp.SetStatus(basic.CodeServiceErr)
}
var updateMap = make(map[string]interface{})
+ if req.Name != "" {
+ updateMap["name"] = req.Name
+ }
if req.Method != "" {
updateMap["method"] = req.Method
}
@@ -63,6 +71,7 @@ func (l *SaveApiLogic) SaveApi(req *types.SaveApiReq, userinfo *auth.UserInfo) (
err1 = l.svcCtx.AllModels.LdapApis.UpdateOne(l.ctx, resOne, updateMap)
} else {
err1 = l.svcCtx.AllModels.LdapApis.InsertOne(l.ctx, gmodel.LdapApis{
+ Name: &req.Name,
Method: &req.Method,
Path: &req.Path,
Category: &req.Category,
diff --git a/server/ldap-admin/internal/svc/servicecontext.go b/server/ldap-admin/internal/svc/servicecontext.go
index 064d9e5c..9a87b808 100644
--- a/server/ldap-admin/internal/svc/servicecontext.go
+++ b/server/ldap-admin/internal/svc/servicecontext.go
@@ -5,6 +5,7 @@ import (
"fusenapi/model/gmodel"
"fusenapi/server/ldap-admin/internal/config"
"fusenapi/utils/ldap_lib"
+
"gorm.io/gorm"
)
@@ -24,6 +25,6 @@ func NewServiceContext(c config.Config) *ServiceContext {
MysqlConn: conn,
AllModels: gmodel.NewAllModels(initalize.InitMysql(c.SourceMysql)),
RabbitMq: initalize.InitRabbitMq(c.SourceRabbitMq, nil),
- Ldap: ldap_lib.NewLdap(ldapConn, c.Ldap.BaseDN, c.Ldap.RootDN, c.Ldap.PeopleGroupDN, c.Auth.AccessSecret),
+ Ldap: ldap_lib.NewLdap(ldapConn, c.Ldap.BaseDN, c.Ldap.RootDN, c.Ldap.PeopleGroupDN, c.Auth.AccessSecret, conn),
}
}
diff --git a/server/ldap-admin/internal/types/types.go b/server/ldap-admin/internal/types/types.go
index 55c589df..0e6de870 100644
--- a/server/ldap-admin/internal/types/types.go
+++ b/server/ldap-admin/internal/types/types.go
@@ -67,6 +67,7 @@ type GetApisReq struct {
type SaveApiReq struct {
Id int64 `json:"id"`
+ Name string `json:"name"`
Method string `json:"method"`
Path string `json:"path"`
Category string `json:"category"`
diff --git a/server_api/ldap-admin.api b/server_api/ldap-admin.api
index 93be5c6e..f18f90c8 100644
--- a/server_api/ldap-admin.api
+++ b/server_api/ldap-admin.api
@@ -22,7 +22,7 @@ service ldap-admin {
//删除权限组
@handler DeleteLdapGroupHandler
post /api/ldap-admin/delete_ldap_group(DeleteLdapGroupReq) returns (response);
-
+
//权限组授权
@handler SetLdapGroupAuthHandler
post /api/ldap-admin/set_ldap_group_auth(SetLdapGroupAuthReq) returns (response);
@@ -35,7 +35,7 @@ service ldap-admin {
//删除API
@handler DeleteApiHandler
post /api/ldap-admin/delete_api(DeleteApiReq) returns (response);
-
+
//保存菜单
@handler SaveMenuHandler
post /api/ldap-admin/save_menu(SaveMenuReq) returns (response);
@@ -153,6 +153,7 @@ type GetApisReq {
type SaveApiReq {
Id int64 `json:"id"`
+ Name string `json:"name"`
Method string `json:"method"`
Path string `json:"path"`
Category string `json:"category"`
diff --git a/utils/ldap_lib/auth.go b/utils/ldap_lib/auth.go
index 7b725867..79e86581 100644
--- a/utils/ldap_lib/auth.go
+++ b/utils/ldap_lib/auth.go
@@ -1,8 +1,12 @@
package ldap_lib
import (
- "github.com/zeromicro/go-zero/core/logx"
+ "encoding/json"
+ "fusenapi/model/gmodel"
+ "fusenapi/utils/basic"
"net/http"
+
+ "github.com/zeromicro/go-zero/core/logx"
)
type LdapVerifyType string
@@ -39,3 +43,79 @@ func (l *Ldap) VerifyAuthority(r *http.Request, options ...LdapOptions) bool {
}
return true
}
+
+// 验证权限组
+func (l *Ldap) VerifyAuthorityGroup(r *http.Request, options ...LdapOptions) bool {
+ token := r.Header.Get("Ldap-Authorization")
+ info, err := l.ParseJwtToken(token, l.jwtSecret)
+ if err != nil {
+ logx.Error("解析token失败", err, "----token:", token)
+ return false
+ }
+ //查询ldap
+ userInfo, err := l.GetLdapUserInfo(info.UserDN)
+ if err != nil {
+ logx.Error("获取ldap用户信息失败", err, "----user_dn:", info.UserDN)
+ }
+ if userInfo.GroupId != 0 {
+ return false
+ }
+ var groupId = userInfo.GroupId
+
+ // var err error
+ // var groupId = 6
+
+ // 当前API路由
+ path := r.URL.Path
+ var infoLdapApis gmodel.LdapApis
+ resLdapApis := l.MysqlConn.Model(gmodel.LdapApis{}).Where("path = ? AND method = ?", path, r.Method).Take(&infoLdapApis)
+ if resLdapApis.Error != nil {
+ err = resLdapApis.Error
+ logx.Error("获取ldap用户信息权限组失败", err)
+ return false
+ }
+ apiId := infoLdapApis.Id
+
+ var infoLdapGroup gmodel.LdapGroup
+ resLdapGroup := l.MysqlConn.Model(gmodel.LdapGroup{}).Where("id = ?", groupId).Take(&infoLdapGroup)
+ if resLdapGroup.Error != nil {
+ err = resLdapGroup.Error
+ logx.Error("获取ldap用户信息权限组失败", err)
+ return false
+ }
+ var apiMaps = make(map[int64]string, 100)
+ var metadata []*GroupAuthMetadata
+ if infoLdapGroup.Metadata != nil {
+ err := json.Unmarshal(*infoLdapGroup.Metadata, &metadata)
+ if err != nil {
+ basic.CodeServiceErr.Message = "系统出错"
+ return false
+ }
+ getAllApis(metadata, &apiMaps)
+ }
+ if _, ok := apiMaps[apiId]; ok {
+ return true
+ } else {
+ return false
+ }
+}
+
+func getAllApis(metadata []*GroupAuthMetadata, apiMaps *map[int64]string) {
+ apiMapsData := *apiMaps
+ for _, v := range metadata {
+ if v.Type == "api" {
+ apiMapsData[v.Id] = v.Name
+ } else if v.Type == "group" {
+ getAllApis(v.Metadata, apiMaps)
+ } else {
+ continue
+ }
+ }
+}
+
+type GroupAuthMetadata struct {
+ Id int64 `json:"id"`
+ Name string `json:"name"`
+ Type string `json:"type"`
+ Metadata []*GroupAuthMetadata `json:"metadata"`
+}
diff --git a/utils/ldap_lib/ldap_group.go b/utils/ldap_lib/ldap_group.go
index a94acefb..ba249c99 100644
--- a/utils/ldap_lib/ldap_group.go
+++ b/utils/ldap_lib/ldap_group.go
@@ -5,6 +5,7 @@ import (
"strings"
"github.com/go-ldap/ldap/v3"
+ "gorm.io/gorm"
)
type Ldap struct {
@@ -13,15 +14,17 @@ type Ldap struct {
conn *ldap.Conn
peopleGroupDN string
jwtSecret string
+ MysqlConn *gorm.DB
}
-func NewLdap(conn *ldap.Conn, baseDN, rootDN, peopleGroupDN, jwtSecret string) *Ldap {
+func NewLdap(conn *ldap.Conn, baseDN, rootDN, peopleGroupDN, jwtSecret string, mysqlConn *gorm.DB) *Ldap {
return &Ldap{
baseDN: baseDN,
rootDN: rootDN,
conn: conn,
peopleGroupDN: peopleGroupDN,
jwtSecret: jwtSecret,
+ MysqlConn: mysqlConn,
}
}