97 lines
3.1 KiB
Go
97 lines
3.1 KiB
Go
package middleware
|
|
|
|
// Reference: P2E §2.9 — SuperAdmin middleware
|
|
// Middleware that verifies the user is a super_admin (platform-level administrator).
|
|
// Corresponds to Chatwoot's SuperAdmin access control for platform management endpoints.
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
|
|
"github.com/gochat/gochat/internal/auth"
|
|
"github.com/gochat/gochat/pkg/response"
|
|
)
|
|
|
|
// SuperAdmin creates a middleware that verifies the current user has super_admin type.
|
|
// Super admins are platform-level administrators that can manage all accounts,
|
|
// platform apps, and system configuration.
|
|
//
|
|
// This checks the user's type field (not the account-level role).
|
|
// user.type = "super_admin" is set at the User model level, not AccountUser.
|
|
//
|
|
// Usage:
|
|
// router.GET("/platform/accounts", SuperAdmin(), listAllAccounts)
|
|
// router.POST("/platform/apps", SuperAdmin(), createPlatformApp)
|
|
// router.GET("/platform/analytics", SuperAdmin(), viewPlatformAnalytics)
|
|
func SuperAdmin() gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
// Check for super_admin flag in context (set by AuthRequired middleware)
|
|
userType, exists := c.Get("user_type")
|
|
if !exists {
|
|
// No user_type in context — check claims for super_admin indication
|
|
_, claimsExists := c.Get("auth_claims")
|
|
if claimsExists {
|
|
// Claims exist but user_type not set — not super_admin
|
|
}
|
|
response.AbortWithStatusError(c, http.StatusForbidden, response.ErrForbidden,
|
|
"Super admin access required")
|
|
return
|
|
}
|
|
|
|
typeStr, ok := userType.(string)
|
|
if !ok || typeStr != "super_admin" {
|
|
response.AbortWithStatusError(c, http.StatusForbidden, response.ErrForbidden,
|
|
"Super admin access required. Your account does not have platform administration privileges.")
|
|
return
|
|
}
|
|
|
|
// Mark the context as super_admin for downstream handlers
|
|
c.Set("is_super_admin", true)
|
|
c.Next()
|
|
}
|
|
}
|
|
|
|
// SuperAdminOrAdministrator creates a middleware that allows either super_admin
|
|
// users or administrators within the current account context.
|
|
// Useful for endpoints that should be accessible to account admins and platform admins.
|
|
//
|
|
// Usage:
|
|
// router.DELETE("/accounts/:id", SuperAdminOrAdministrator(), deleteAccount)
|
|
func SuperAdminOrAdministrator() gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
// Check super_admin first
|
|
userType, exists := c.Get("user_type")
|
|
if exists {
|
|
typeStr, ok := userType.(string)
|
|
if ok && typeStr == "super_admin" {
|
|
c.Set("is_super_admin", true)
|
|
c.Next()
|
|
return
|
|
}
|
|
}
|
|
|
|
// Check administrator role in policy context
|
|
pc, exists := c.Get("policy_context")
|
|
if !exists {
|
|
response.AbortWithStatusError(c, http.StatusForbidden, response.ErrForbidden,
|
|
"Super admin or administrator access required")
|
|
return
|
|
}
|
|
|
|
policyCtx, ok := pc.(*auth.PolicyContext)
|
|
if !ok {
|
|
response.AbortWithStatusError(c, http.StatusForbidden, response.ErrForbidden,
|
|
"Invalid policy context")
|
|
return
|
|
}
|
|
|
|
if !policyCtx.IsAdministrator() {
|
|
response.AbortWithStatusError(c, http.StatusForbidden, response.ErrForbidden,
|
|
"Super admin or administrator access required")
|
|
return
|
|
}
|
|
|
|
c.Next()
|
|
}
|
|
} |