feat: 修复 WebSocket 越权与 AI 流 SSRF

server-go/internal/ws/authorizer.go

@@ -0,0 +1,59 @@
+package ws
+
+import (
+	"errors"
+	"fmt"
+
+	"silk-server-go/internal/model"
+
+	"gorm.io/gorm"
+)
+
+// DeviceAuthorizer 校验用户是否有权读取指定设备。
+type DeviceAuthorizer interface {
+	CanReadDevice(userID, deviceKey string) (bool, error)
+}
+
+// DBDeviceAuthorizer 使用现有 RBAC 权限判断设备读取权；当前未做用户级资源 ACL。
+type DBDeviceAuthorizer struct {
+	db *gorm.DB
+}
+
+func NewDBDeviceAuthorizer(db *gorm.DB) *DBDeviceAuthorizer {
+	return &DBDeviceAuthorizer{db: db}
+}
+
+func (a *DBDeviceAuthorizer) CanReadDevice(userID, deviceKey string) (bool, error) {
+	if deviceKey == "" {
+		return false, nil
+	}
+
+	var user model.User
+	if err := a.db.Where("id = ?", userID).First(&user).Error; err != nil {
+		return false, err
+	}
+	if user.Role == model.RoleAdmin {
+		return true, nil
+	}
+
+	var count int64
+	err := a.db.Table("role_permissions").
+		Joins("JOIN permissions ON permissions.id = role_permissions.permission_id").
+		Where("role_permissions.role = ? AND permissions.code = ?", user.Role, "device:read").
+		Count(&count).Error
+	return count > 0, err
+}
+
+func (h *Hub) authorizeSubscription(userID, deviceKey string) error {
+	if h.authorizer == nil {
+		return errors.New("device authorizer not configured")
+	}
+	ok, err := h.authorizer.CanReadDevice(userID, deviceKey)
+	if err != nil {
+		return err
+	}
+	if !ok {
+		return fmt.Errorf("device subscription denied: %s", deviceKey)
+	}
+	return nil
+}