weijuesen
60 lines
1.4 KiB
Go
60 lines
1.4 KiB
Go
package ws
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
|
|
"silk-server-go/internal/model"
|
|
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
// DeviceAuthorizer 校验用户是否有权读取指定设备。
|
|
type DeviceAuthorizer interface {
|
|
CanReadDevice(userID, deviceKey string) (bool, error)
|
|
}
|
|
|
|
// DBDeviceAuthorizer 使用现有 RBAC 权限判断设备读取权；当前未做用户级资源 ACL。
|
|
type DBDeviceAuthorizer struct {
|
|
db *gorm.DB
|
|
}
|
|
|
|
func NewDBDeviceAuthorizer(db *gorm.DB) *DBDeviceAuthorizer {
|
|
return &DBDeviceAuthorizer{db: db}
|
|
}
|
|
|
|
func (a *DBDeviceAuthorizer) CanReadDevice(userID, deviceKey string) (bool, error) {
|
|
if deviceKey == "" {
|
|
return false, nil
|
|
}
|
|
|
|
var user model.User
|
|
if err := a.db.Where("id = ?", userID).First(&user).Error; err != nil {
|
|
return false, err
|
|
}
|
|
if user.Role == model.RoleAdmin {
|
|
return true, nil
|
|
}
|
|
|
|
var count int64
|
|
err := a.db.Table("role_permissions").
|
|
Joins("JOIN permissions ON permissions.id = role_permissions.permission_id").
|
|
Where("role_permissions.role = ? AND permissions.code = ?", user.Role, "device:read").
|
|
Count(&count).Error
|
|
return count > 0, err
|
|
}
|
|
|
|
func (h *Hub) authorizeSubscription(userID, deviceKey string) error {
|
|
if h.authorizer == nil {
|
|
return errors.New("device authorizer not configured")
|
|
}
|
|
ok, err := h.authorizer.CanReadDevice(userID, deviceKey)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if !ok {
|
|
return fmt.Errorf("device subscription denied: %s", deviceKey)
|
|
}
|
|
return nil
|
|
}
|