t
2bbf42b741
Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.
73 lines
2.3 KiB
Go
73 lines
2.3 KiB
Go
package services
|
|
|
|
import (
|
|
"code.tczkiot.com/wlw/ai-agent/identity"
|
|
"code.tczkiot.com/wlw/ai-agent/internal/pkg/constants"
|
|
"code.tczkiot.com/wlw/ai-agent/internal/pkg/dto"
|
|
"code.tczkiot.com/wlw/ai-agent/internal/pkg/enums"
|
|
"code.tczkiot.com/wlw/ai-agent/internal/pkg/errorsx"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
const authPrincipalContextKey = "externalAuthPrincipal"
|
|
|
|
// AuthService adapts identity data authenticated by the host application and
|
|
// delegates every operation authorization back to that host.
|
|
var AuthService = &externalPrincipalService{}
|
|
|
|
type externalPrincipalService struct{}
|
|
|
|
func (s *externalPrincipalService) GetAuthPrincipal(ctx *gin.Context) *dto.AuthPrincipal {
|
|
if ctx == nil {
|
|
return nil
|
|
}
|
|
value, _ := ctx.Get(authPrincipalContextKey)
|
|
principal, _ := value.(*dto.AuthPrincipal)
|
|
return principal
|
|
}
|
|
|
|
func (s *externalPrincipalService) Authenticate(ctx *gin.Context) (*dto.AuthPrincipal, error) {
|
|
if principal := s.GetAuthPrincipal(ctx); principal != nil {
|
|
return principal, nil
|
|
}
|
|
if ctx == nil || ctx.Request == nil {
|
|
return nil, errorsx.UnauthorizedI18n("error.auth.expired")
|
|
}
|
|
|
|
subject, err := SubjectService.Current(ctx.Request.Context())
|
|
if err != nil || subject == nil || subject.Category != identity.CategorySystem || !subject.Enabled {
|
|
return nil, errorsx.UnauthorizedI18n("error.auth.expired")
|
|
}
|
|
|
|
principal := &dto.AuthPrincipal{
|
|
SubjectType: subject.Type,
|
|
UserID: subject.ID,
|
|
Username: subject.Username,
|
|
Nickname: subject.Name,
|
|
Avatar: subject.Avatar,
|
|
Status: enums.StatusOk,
|
|
Roles: []string{string(subject.Type)},
|
|
}
|
|
ctx.Set(authPrincipalContextKey, principal)
|
|
return principal, nil
|
|
}
|
|
|
|
func (s *externalPrincipalService) RequirePermission(ctx *gin.Context, permission constants.Permission) (*dto.AuthPrincipal, error) {
|
|
principal, err := s.Authenticate(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if err := SubjectService.Authorize(ctx.Request.Context(), permission.Code); err != nil {
|
|
return nil, errorsx.ForbiddenI18n("error.auth.forbidden")
|
|
}
|
|
return principal, nil
|
|
}
|
|
|
|
func (s *externalPrincipalService) HasPermission(ctx *gin.Context, operation string) bool {
|
|
if _, err := s.Authenticate(ctx); err != nil {
|
|
return false
|
|
}
|
|
return SubjectService.Authorize(ctx.Request.Context(), operation) == nil
|
|
}
|