43 lines
1.3 KiB
Go
43 lines
1.3 KiB
Go
package controllers
|
|
|
|
import (
|
|
"context"
|
|
"strconv"
|
|
|
|
"git.pcux.cn/xuans/Smail/db"
|
|
"git.pcux.cn/xuans/Smail/models"
|
|
"git.pcux.cn/xuans/Smail/services/access"
|
|
"git.pcux.cn/xuans/Smail/services/logstore"
|
|
appcontext "git.pcux.cn/xuans/Smail/utils/context"
|
|
)
|
|
|
|
func authorizeLogs(ctx *appcontext.Context) error {
|
|
if ctx == nil || ctx.UserID <= 0 {
|
|
return &access.Denial{Code: access.CodeAccessDenied}
|
|
}
|
|
// 此授权只允许进入已实施数据范围过滤的日志接口，不影响旧的全局审计接口。
|
|
return access.Authorize(access.Request{ActorRole: ctx.EffectiveRole(), Capability: access.CapabilityAuditRead, OwnResource: true})
|
|
}
|
|
|
|
func runtimeLogActors(requestContext context.Context, ctx *appcontext.Context) (map[string]bool, error) {
|
|
if ctx.EffectiveRole() == access.RoleSuperAdmin {
|
|
return nil, nil
|
|
}
|
|
actors := map[string]bool{strconv.Itoa(ctx.UserID): true}
|
|
if ctx.EffectiveRole() == access.RoleAdmin {
|
|
if db.Instance == nil {
|
|
return nil, logstore.ErrUnavailable
|
|
}
|
|
var users []models.User
|
|
if err := db.Instance.Context(requestContext).Cols("id").Where(models.OrdinaryUserPredicate).Find(&users); err != nil {
|
|
return nil, logstore.ErrUnavailable
|
|
}
|
|
for _, user := range users {
|
|
if user.ID != ctx.UserID {
|
|
actors[strconv.Itoa(user.ID)] = false
|
|
}
|
|
}
|
|
}
|
|
return actors, nil
|
|
}
|