weijuesen
76 lines
1.8 KiB
Go
76 lines
1.8 KiB
Go
package ws
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
|
|
"silk-server-go/internal/model"
|
|
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
// DeviceAuthorizer 校验用户是否有权读取指定设备。
|
|
type DeviceAuthorizer interface {
|
|
CanReadDevice(userID, deviceKey string) (bool, error)
|
|
}
|
|
|
|
// DBDeviceAuthorizer 使用 RBAC + 组织/房间归属判断设备读取权。
|
|
type DBDeviceAuthorizer struct {
|
|
db *gorm.DB
|
|
}
|
|
|
|
func NewDBDeviceAuthorizer(db *gorm.DB) *DBDeviceAuthorizer {
|
|
return &DBDeviceAuthorizer{db: db}
|
|
}
|
|
|
|
func (a *DBDeviceAuthorizer) CanReadDevice(userID, deviceKey string) (bool, error) {
|
|
if deviceKey == "" {
|
|
return false, nil
|
|
}
|
|
|
|
var user model.User
|
|
if err := a.db.Where("id = ?", userID).First(&user).Error; err != nil {
|
|
return false, err
|
|
}
|
|
if user.Role == model.RoleAdmin {
|
|
return true, nil
|
|
}
|
|
|
|
var roleCount int64
|
|
err := a.db.Table("role_permissions").
|
|
Joins("JOIN permissions ON permissions.id = role_permissions.permission_id").
|
|
Where("role_permissions.role = ? AND permissions.code = ?", user.Role, "device:read").
|
|
Count(&roleCount).Error
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
if roleCount == 0 {
|
|
return false, nil
|
|
}
|
|
|
|
var device model.Device
|
|
if err := a.db.Where("device_key = ?", deviceKey).First(&device).Error; err != nil {
|
|
return false, err
|
|
}
|
|
var roomCount int64
|
|
err = a.db.Table("rooms").
|
|
Joins("JOIN organization_members om ON om.organization_id = rooms.org_id").
|
|
Where("rooms.id = ? AND om.user_id = ?", device.RoomID, userID).
|
|
Count(&roomCount).Error
|
|
return roomCount > 0, err
|
|
}
|
|
|
|
func (h *Hub) authorizeSubscription(userID, deviceKey string) error {
|
|
if h.authorizer == nil {
|
|
return errors.New("device authorizer not configured")
|
|
}
|
|
ok, err := h.authorizer.CanReadDevice(userID, deviceKey)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if !ok {
|
|
return fmt.Errorf("device subscription denied: %s", deviceKey)
|
|
}
|
|
return nil
|
|
}
|