28 lines
689 B
Go
28 lines
689 B
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
|
|
"everypublish/server/internal/api/response"
|
|
)
|
|
|
|
// WorkspaceRoles enforces the member role from the current JWT. Resource
|
|
// handlers still apply workspace_id predicates; this middleware only handles
|
|
// the action-level permission boundary.
|
|
func WorkspaceRoles(roles ...string) gin.HandlerFunc {
|
|
allowed := make(map[string]struct{}, len(roles))
|
|
for _, role := range roles {
|
|
allowed[role] = struct{}{}
|
|
}
|
|
return func(c *gin.Context) {
|
|
if _, ok := allowed[c.GetString("mrole")]; !ok {
|
|
response.Fail(c, http.StatusForbidden, 1003, "当前角色无权执行此操作")
|
|
c.Abort()
|
|
return
|
|
}
|
|
c.Next()
|
|
}
|
|
}
|