108 lines
3.1 KiB
Go
108 lines
3.1 KiB
Go
package impl
|
||
|
||
import (
|
||
"context"
|
||
|
||
"122.51.31.227/go-course/go18/devcloud/mcenter/apps/endpoint"
|
||
"122.51.31.227/go-course/go18/devcloud/mcenter/apps/namespace"
|
||
"122.51.31.227/go-course/go18/devcloud/mcenter/apps/policy"
|
||
"122.51.31.227/go-course/go18/devcloud/mcenter/apps/role"
|
||
"122.51.31.227/go-course/go18/devcloud/mcenter/apps/view"
|
||
"github.com/infraboard/mcube/v2/types"
|
||
)
|
||
|
||
// 查询用户可以访问的空间
|
||
func (i *PolicyServiceImpl) QueryNamespace(ctx context.Context, in *policy.QueryNamespaceRequest) (*types.Set[*namespace.Namespace], error) {
|
||
nsReq := namespace.NewQueryNamespaceRequest()
|
||
|
||
policies, err := i.QueryPolicy(ctx,
|
||
policy.NewQueryPolicyRequest().
|
||
SetSkipPage(true).
|
||
SetUserId(in.UserId).
|
||
SetExpired(false).
|
||
SetEnabled(true))
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
|
||
policies.ForEach(func(t *policy.Policy) {
|
||
if t.NamespaceId != nil {
|
||
nsReq.AddNamespaceIds(*t.NamespaceId)
|
||
}
|
||
})
|
||
|
||
return i.namespace.QueryNamespace(ctx, nsReq)
|
||
}
|
||
|
||
// 查询用户可以访问的Api接口
|
||
// 找到用户可以访问的角色列表，然后在找出角色对应的Api访问权限
|
||
func (i *PolicyServiceImpl) QueryEndpoint(ctx context.Context, in *policy.QueryEndpointRequest) (*types.Set[*endpoint.Endpoint], error) {
|
||
set := types.New[*endpoint.Endpoint]()
|
||
policies, err := i.QueryPolicy(ctx,
|
||
policy.NewQueryPolicyRequest().
|
||
SetSkipPage(true).
|
||
SetNamespaceId(in.NamespaceId).
|
||
SetUserId(in.UserId).
|
||
SetExpired(false).
|
||
SetEnabled(true))
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
|
||
roleReq := role.NewQueryMatchedEndpointRequest()
|
||
policies.ForEach(func(t *policy.Policy) {
|
||
roleReq.Add(t.RoleId)
|
||
})
|
||
|
||
if policies.Len() > 0 {
|
||
set, err = role.GetService().QueryMatchedEndpoint(ctx, roleReq)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
}
|
||
|
||
return set, nil
|
||
}
|
||
|
||
// 校验Api接口权限
|
||
func (i *PolicyServiceImpl) ValidateEndpointPermission(ctx context.Context, in *policy.ValidateEndpointPermissionRequest) (*policy.ValidateEndpointPermissionResponse, error) {
|
||
resp := policy.NewValidateEndpointPermissionResponse(*in)
|
||
|
||
// 空间Owner有所有权限
|
||
ns, err := namespace.GetService().DescribeNamespace(ctx, namespace.NewDescribeNamespaceRequest().SetNamespaceId(in.NamespaceId))
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
if ns.IsOwner(in.UserId) {
|
||
resp.HasPermission = true
|
||
return resp, nil
|
||
}
|
||
|
||
// 非空间管理员需要独立鉴权, 查询用户可以访问的API列表
|
||
endpointReq := policy.NewQueryEndpointRequest()
|
||
endpointReq.UserId = in.UserId
|
||
endpointReq.NamespaceId = in.NamespaceId
|
||
endpointSet, err := i.QueryEndpoint(ctx, endpointReq)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
for _, item := range endpointSet.Items {
|
||
if item.IsMatched(in.Service, in.Method, in.Path) {
|
||
resp.HasPermission = true
|
||
resp.Endpoint = item
|
||
break
|
||
}
|
||
}
|
||
return resp, nil
|
||
}
|
||
|
||
// 查询用户可以访问的菜单
|
||
func (i *PolicyServiceImpl) QueryMenu(ctx context.Context, in *policy.QueryMenuRequest) (*types.Set[*view.Menu], error) {
|
||
return nil, nil
|
||
}
|
||
|
||
// 校验Menu视图权限
|
||
func (i *PolicyServiceImpl) ValidatePagePermission(ctx context.Context, in *policy.ValidatePagePermissionRequest) (*policy.ValidatePagePermissionResponse, error) {
|
||
return nil, nil
|
||
}
|