82 lines
2.8 KiB
Go
82 lines
2.8 KiB
Go
package middleware
|
|
|
|
// Reference: P2E §2.6 — PolicyMiddleware
|
|
// Gin middleware that enforces RBAC permission checks for each request.
|
|
// Replaces Chatwoot's Pundit policy enforcement in controllers.
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
|
|
"github.com/gochat/gochat/internal/auth"
|
|
"github.com/gochat/gochat/pkg/response"
|
|
)
|
|
|
|
// PolicyMiddleware creates a Gin middleware that checks whether the current user
|
|
// (identified by PolicyContext in the Gin context) has permission to perform
|
|
// the specified action on the specified resource.
|
|
//
|
|
// Usage in routes:
|
|
// router.GET("/conversations", PolicyMiddleware("conversation", "read"), listConversations)
|
|
// router.POST("/conversations", PolicyMiddleware("conversation", "create"), createConversation)
|
|
// router.DELETE("/conversations/:id", PolicyMiddleware("conversation", "delete"), deleteConversation)
|
|
//
|
|
// The middleware expects a PolicyContext to be set in the Gin context under key "policy_context".
|
|
// This is typically set by the AccountScope middleware after loading AccountUser data.
|
|
func PolicyMiddleware(resource, action string) gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
pc, exists := c.Get("policy_context")
|
|
if !exists {
|
|
response.AbortWithStatusError(c, http.StatusForbidden, response.ErrForbidden,
|
|
"Policy context not found — ensure AccountScope middleware is applied first")
|
|
return
|
|
}
|
|
|
|
policyCtx, ok := pc.(*auth.PolicyContext)
|
|
if !ok {
|
|
response.AbortWithStatusError(c, http.StatusForbidden, response.ErrForbidden,
|
|
"Invalid policy context type")
|
|
return
|
|
}
|
|
|
|
if !policyCtx.Can(action, resource) {
|
|
response.AbortWithStatusError(c, http.StatusForbidden, response.ErrForbidden,
|
|
"Permission denied: cannot perform '"+action+"' on '"+resource+"'")
|
|
return
|
|
}
|
|
|
|
c.Next()
|
|
}
|
|
}
|
|
|
|
// PolicyScopeMiddleware injects a scope-filtered GORM DB instance into the Gin context.
|
|
// This allows handlers to use a pre-filtered DB that only returns records the user
|
|
// is allowed to see.
|
|
//
|
|
// Usage:
|
|
// router.GET("/conversations", PolicyScopeMiddleware("conversation"), listConversations)
|
|
//
|
|
// The handler can then retrieve the scoped DB:
|
|
// scopedDB := c.MustGet("scoped_db").(*gorm.DB)
|
|
func PolicyScopeMiddleware(resource string) gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
pc, exists := c.Get("policy_context")
|
|
if !exists {
|
|
response.AbortWithStatusError(c, http.StatusForbidden, response.ErrForbidden,
|
|
"Policy context not found — ensure AccountScope middleware is applied first")
|
|
return
|
|
}
|
|
|
|
policyCtx, ok := pc.(*auth.PolicyContext)
|
|
if !ok {
|
|
response.AbortWithStatusError(c, http.StatusForbidden, response.ErrForbidden,
|
|
"Invalid policy context type")
|
|
return
|
|
}
|
|
|
|
// Store policy context for downstream handlers/services
|
|
c.Set("policy_context", policyCtx)
|
|
c.Next()
|
|
}
|
|
} |