From d264924d1ee1c315e78408a2ab83620c95538908 Mon Sep 17 00:00:00 2001 From: mac Date: Fri, 17 Jul 2026 15:02:18 +0800 Subject: [PATCH] feat: add business line permissions and Wayne namespace mapping --- frontend/components.d.ts | 8 + frontend/src/api/auth.ts | 2 + frontend/src/api/businessLine.ts | 109 +++++ frontend/src/api/subsystem.ts | 11 +- frontend/src/api/user.ts | 23 + .../src/components/BusinessLineSwitcher.vue | 7 +- frontend/src/components/Layout/AppSidebar.vue | 12 + frontend/src/composables/useAuth.ts | 4 + frontend/src/router/index.ts | 20 + frontend/src/stores/businessLine.ts | 143 +++--- .../src/views/businessLine/Assignment.vue | 236 ++++++++++ frontend/src/views/businessLine/Manage.vue | 204 +++++++++ .../src/views/subsystem/SubsystemDetail.vue | 2 - server/.gitignore | 3 +- server/docs/mysql-init.sql | 47 ++ server/internal/database/database.go | 3 + server/internal/handler/business_line.go | 431 ++++++++++++++++++ server/internal/handler/user.go | 28 +- server/internal/handler/wayen.go | 57 ++- server/internal/model/models.go | 26 ++ server/internal/router/router.go | 12 +- server/internal/service/wayen.go | 8 +- server/internal/service/wayen_test.go | 28 +- 23 files changed, 1343 insertions(+), 81 deletions(-) create mode 100644 frontend/src/api/businessLine.ts create mode 100644 frontend/src/api/user.ts create mode 100644 frontend/src/views/businessLine/Assignment.vue create mode 100644 frontend/src/views/businessLine/Manage.vue create mode 100644 server/docs/mysql-init.sql create mode 100644 server/internal/handler/business_line.go diff --git a/frontend/components.d.ts b/frontend/components.d.ts index 4380d44..6f21ae0 100644 --- a/frontend/components.d.ts +++ b/frontend/components.d.ts @@ -13,12 +13,20 @@ declare module 'vue' { AuditLogTable: typeof import('./src/components/AuditLogTable.vue')['default'] BusinessLineSwitcher: typeof import('./src/components/BusinessLineSwitcher.vue')['default'] ElButton: typeof import('element-plus/es')['ElButton'] + ElForm: typeof import('element-plus/es')['ElForm'] + ElFormItem: typeof import('element-plus/es')['ElFormItem'] ElIcon: typeof import('element-plus/es')['ElIcon'] ElInput: typeof import('element-plus/es')['ElInput'] ElOption: typeof import('element-plus/es')['ElOption'] + ElSegmented: typeof import('element-plus/es')['ElSegmented'] ElSelect: typeof import('element-plus/es')['ElSelect'] + ElTable: typeof import('element-plus/es')['ElTable'] + ElTableColumn: typeof import('element-plus/es')['ElTableColumn'] RouterLink: typeof import('vue-router')['RouterLink'] RouterView: typeof import('vue-router')['RouterView'] SubsystemCard: typeof import('./src/components/SubsystemCard.vue')['default'] } + export interface ComponentCustomProperties { + vLoading: typeof import('element-plus/es')['ElLoadingDirective'] + } } diff --git a/frontend/src/api/auth.ts b/frontend/src/api/auth.ts index a9d70a1..deb0621 100644 --- a/frontend/src/api/auth.ts +++ b/frontend/src/api/auth.ts @@ -12,6 +12,7 @@ export interface UserInfo { display_name: string email: string business_line: string + is_admin: boolean } export interface LoginResponse { @@ -113,6 +114,7 @@ export const authApi = { display_name: data.display_name || data.username, email: data.email || '', business_line: data.business_line || '', + is_admin: data.is_admin === true, }, } }, diff --git a/frontend/src/api/businessLine.ts b/frontend/src/api/businessLine.ts new file mode 100644 index 0000000..ed0a073 --- /dev/null +++ b/frontend/src/api/businessLine.ts @@ -0,0 +1,109 @@ +import { getToken } from '@/utils/auth' + +export interface BusinessLine { + id: number + name: string + created_at: string + updated_at: string + permission?: 0 | 1 +} + +export interface WayneNamespace { + id: number + name: string + kubeNamespace: string +} + +export const businessLineApi = { + async listMine(): Promise { + const token = getToken() + const response = await fetch('/auth/api/v1/business-lines', { + headers: { + Accept: 'application/json', + ...(token ? { Authorization: `Bearer ${token}` } : {}), + }, + }) + const data = await response.json().catch(() => ({})) + if (!response.ok) { + throw new Error(data.error || `HTTP ${response.status}`) + } + return Array.isArray(data.items) ? data.items : [] + }, + + async listAll(): Promise { + const data = await request('/auth/api/v1/business-lines/all') + return Array.isArray(data.items) ? data.items : [] + }, + + async create(name: string): Promise { + return request('/auth/api/v1/business-lines', { + method: 'POST', + body: JSON.stringify({ name }), + }) + }, + + async update(id: number, name: string): Promise { + return request(`/auth/api/v1/business-lines/${id}`, { + method: 'PUT', + body: JSON.stringify({ name }), + }) + }, + + async remove(id: number): Promise { + await request(`/auth/api/v1/business-lines/${id}`, { + method: 'DELETE', + }) + }, + + async grant(payload: { + business_line_id: number + target_user_id: number + target_business_line_id: number + permission: 0 | 1 + }): Promise { + await request('/auth/api/v1/business-lines/authorizations', { + method: 'POST', + body: JSON.stringify(payload), + }) + }, + + async listWayneNamespaces(): Promise { + const data = await request('/auth/api/v1/wayne/namespaces') + const items = Array.isArray(data.data) ? data.data : Array.isArray(data.items) ? data.items : [] + return items.map((item: any) => ({ + id: Number(item.id), + name: item.name || '', + kubeNamespace: item.kubeNamespace || item.kube_namespace || '', + })) + }, + + async listMappedWayneNamespaces(businessLineId: number): Promise { + const data = await request(`/auth/api/v1/business-lines/${businessLineId}/wayne-namespaces`) + return Array.isArray(data.items) ? data.items : [] + }, + + async replaceMappedWayneNamespaces(businessLineId: number, namespaces: WayneNamespace[]): Promise { + await request(`/auth/api/v1/business-lines/${businessLineId}/wayne-namespaces`, { + method: 'PUT', + body: JSON.stringify({ namespaces }), + }) + }, +} + +async function request(path: string, init: RequestInit = {}) { + const token = getToken() + const response = await fetch(path, { + ...init, + headers: { + Accept: 'application/json', + 'Content-Type': 'application/json', + ...(token ? { Authorization: `Bearer ${token}` } : {}), + ...init.headers, + }, + }) + const data = await response.json().catch(() => ({})) + if (!response.ok) { + throw new Error(data.error || `HTTP ${response.status}`) + } + return data +} diff --git a/frontend/src/api/subsystem.ts b/frontend/src/api/subsystem.ts index 752b08c..18594b8 100644 --- a/frontend/src/api/subsystem.ts +++ b/frontend/src/api/subsystem.ts @@ -1,6 +1,7 @@ import type { ApiResponse } from '@/types/api' import { getToken, removeToken } from '@/utils/auth' import { redirectToSSO } from '@/utils/sso' +import { useBusinessLineStore } from '@/stores/businessLine' export interface Subsystem { id: number @@ -126,7 +127,7 @@ export const subsystemApi = { const token = getToken() const openApp = subsystem.name === 'CloudDM' ? 'clouddm' : 'wayne' - const path = subsystem.name === 'CloudDM' ? '/auth/api/v1/clouddm/login' : '/auth/api/v1/wayen/login' + const path = subsystem.name === 'CloudDM' ? '/auth/api/v1/clouddm/login' : wayneLoginPath() const response = await fetch(path, { headers: { Accept: 'application/json', @@ -164,3 +165,11 @@ export const subsystemApi = { } }, } + +function wayneLoginPath(): string { + const businessLineID = useBusinessLineStore().current?.id + if (!businessLineID) { + return '/auth/api/v1/wayen/login' + } + return `/auth/api/v1/wayen/login?business_line_id=${encodeURIComponent(String(businessLineID))}` +} diff --git a/frontend/src/api/user.ts b/frontend/src/api/user.ts new file mode 100644 index 0000000..7f3c85c --- /dev/null +++ b/frontend/src/api/user.ts @@ -0,0 +1,23 @@ +import { getToken } from '@/utils/auth' + +export interface UserOption { + uid: number + username: string +} + +export const userApi = { + async list(): Promise { + const token = getToken() + const response = await fetch('/auth/api/v1/users', { + headers: { + Accept: 'application/json', + ...(token ? { Authorization: `Bearer ${token}` } : {}), + }, + }) + const data = await response.json().catch(() => ({})) + if (!response.ok) { + throw new Error(data.error || `HTTP ${response.status}`) + } + return Array.isArray(data.items) ? data.items : [] + }, +} diff --git a/frontend/src/components/BusinessLineSwitcher.vue b/frontend/src/components/BusinessLineSwitcher.vue index c13e03e..9c3fc66 100644 --- a/frontend/src/components/BusinessLineSwitcher.vue +++ b/frontend/src/components/BusinessLineSwitcher.vue @@ -5,7 +5,7 @@ class="bl-ic" :style="{ background: currentBL?.iconBg, color: currentBL?.iconColor }" > - {{ currentBL?.iconText }} + {{ currentBL?.iconText || 'BL' }} {{ currentBL?.name || '未选择' }} {{ currentBL.role }} · 授权 {{ authCount }} 子系统 @@ -32,7 +32,7 @@
{{ bl.ou }} · {{ bl.role }}
✓ - 🔒 无权限 + 无权限 @@ -72,6 +72,9 @@ function onClickOutside(e: MouseEvent) { onMounted(() => { document.addEventListener('click', onClickOutside) + blStore.loadMine().catch(() => { + // 页面其他接口会统一展示登录状态，这里只保持切换器为空态。 + }) }) onUnmounted(() => { diff --git a/frontend/src/components/Layout/AppSidebar.vue b/frontend/src/components/Layout/AppSidebar.vue index 5680ba2..3e81b33 100644 --- a/frontend/src/components/Layout/AppSidebar.vue +++ b/frontend/src/components/Layout/AppSidebar.vue @@ -63,6 +63,12 @@ ▦子系统赋权 + + ▤业务线管理 + + + ▥业务线分配 +
审计
@@ -81,9 +87,15 @@ + + diff --git a/frontend/src/views/businessLine/Manage.vue b/frontend/src/views/businessLine/Manage.vue new file mode 100644 index 0000000..082e24c --- /dev/null +++ b/frontend/src/views/businessLine/Manage.vue @@ -0,0 +1,204 @@ + + + + + diff --git a/frontend/src/views/subsystem/SubsystemDetail.vue b/frontend/src/views/subsystem/SubsystemDetail.vue index 38315da..4d8b964 100644 --- a/frontend/src/views/subsystem/SubsystemDetail.vue +++ b/frontend/src/views/subsystem/SubsystemDetail.vue @@ -69,8 +69,6 @@ import { computed } from 'vue' import { useRoute } from 'vue-router' import { subsystemApi, type Subsystem } from '@/api/subsystem' -import { getToken } from '@/utils/auth' -import { redirectToSSO } from '@/utils/sso' const route = useRoute() diff --git a/server/.gitignore b/server/.gitignore index 6097006..275ff10 100644 --- a/server/.gitignore +++ b/server/.gitignore @@ -11,4 +11,5 @@ web/dist/ certs/ scripts/ data/ -docs/ +docs/* +!docs/mysql-init.sql diff --git a/server/docs/mysql-init.sql b/server/docs/mysql-init.sql new file mode 100644 index 0000000..4ee13e1 --- /dev/null +++ b/server/docs/mysql-init.sql @@ -0,0 +1,47 @@ +CREATE DATABASE IF NOT EXISTS authserver + DEFAULT CHARACTER SET utf8mb4 + DEFAULT COLLATE utf8mb4_unicode_ci; + +GRANT ALL PRIVILEGES ON authserver.* TO 'auth'@'localhost' IDENTIFIED BY 'auth'; +GRANT ALL PRIVILEGES ON authserver.* TO 'auth'@'127.0.0.1' IDENTIFIED BY 'auth'; +GRANT ALL PRIVILEGES ON authserver.* TO 'auth'@'192.168.65.%' IDENTIFIED BY 'auth'; +GRANT ALL PRIVILEGES ON authserver.* TO 'auth'@'%' IDENTIFIED BY 'auth'; + +FLUSH PRIVILEGES; + +USE authserver; + +CREATE TABLE IF NOT EXISTS `business_lines` ( + `id` bigint unsigned NOT NULL AUTO_INCREMENT, + `name` varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL, + `created_at` datetime(3) DEFAULT NULL, + `updated_at` datetime(3) DEFAULT NULL, + PRIMARY KEY (`id`), + UNIQUE KEY `idx_business_lines_name` (`name`) +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci; + +CREATE TABLE IF NOT EXISTS `business_line_users` ( + `id` bigint unsigned NOT NULL AUTO_INCREMENT, + `business_line_id` bigint unsigned NOT NULL, + `user_id` bigint unsigned NOT NULL, + `permission` bigint NOT NULL DEFAULT '1', + `created_at` datetime(3) DEFAULT NULL, + `updated_at` datetime(3) DEFAULT NULL, + PRIMARY KEY (`id`), + UNIQUE KEY `idx_business_line_users_unique` (`business_line_id`,`user_id`), + KEY `idx_business_line_users_business_line_id` (`business_line_id`), + KEY `idx_business_line_users_user_id` (`user_id`) +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci; + +CREATE TABLE IF NOT EXISTS `business_line_wayne_namespaces` ( + `id` bigint unsigned NOT NULL AUTO_INCREMENT, + `business_line_id` bigint unsigned NOT NULL, + `wayne_namespace_id` bigint unsigned NOT NULL, + `wayne_namespace_name` varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '', + `kube_namespace` varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '', + `created_at` datetime(3) DEFAULT NULL, + `updated_at` datetime(3) DEFAULT NULL, + PRIMARY KEY (`id`), + UNIQUE KEY `idx_business_line_wayne_namespaces_unique` (`business_line_id`,`wayne_namespace_id`), + KEY `idx_business_line_wayne_namespaces_business_line_id` (`business_line_id`) +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci; diff --git a/server/internal/database/database.go b/server/internal/database/database.go index c57fa40..435fe2d 100644 --- a/server/internal/database/database.go +++ b/server/internal/database/database.go @@ -15,6 +15,9 @@ func AutoMigrate(db *gorm.DB) error { return db.AutoMigrate( &model.User{}, &model.WayenCredential{}, + &model.BusinessLine{}, + &model.BusinessLineUser{}, + &model.BusinessLineWayneNamespace{}, &model.AccessToken{}, &model.AuditLog{}, ) diff --git a/server/internal/handler/business_line.go b/server/internal/handler/business_line.go new file mode 100644 index 0000000..4eb1603 --- /dev/null +++ b/server/internal/handler/business_line.go @@ -0,0 +1,431 @@ +package handler + +import ( + "errors" + "net/http" + "strconv" + "time" + + "github.com/1024XEngineer/xinfra/server/internal/model" + + "github.com/gin-gonic/gin" + "gorm.io/gorm" +) + +type BusinessLineHandler struct { + db *gorm.DB +} + +type BusinessLineWithPermission struct { + ID uint64 `json:"id"` + Name string `json:"name"` + CreatedAt string `json:"created_at"` + UpdatedAt string `json:"updated_at"` + Permission int `json:"permission"` +} + +type GrantBusinessLinePermissionRequest struct { + BusinessLineID uint64 `json:"business_line_id" binding:"required"` + TargetUserID uint64 `json:"target_user_id" binding:"required"` + TargetBusinessLineID uint64 `json:"target_business_line_id" binding:"required"` + Permission int `json:"permission"` +} + +type BusinessLinePayload struct { + Name string `json:"name" binding:"required"` +} + +type WayneNamespaceBindingPayload struct { + Namespaces []WayneNamespaceBindingItem `json:"namespaces"` +} + +type WayneNamespaceBindingItem struct { + ID uint64 `json:"id" binding:"required"` + Name string `json:"name"` + KubeNamespace string `json:"kubeNamespace"` +} + +func NewBusinessLineHandler(db *gorm.DB) *BusinessLineHandler { + return &BusinessLineHandler{db: db} +} + +func (h *BusinessLineHandler) ListCurrentUserBusinessLines(c *gin.Context) { + claims, ok := CurrentClaims(c) + if !ok { + c.JSON(http.StatusUnauthorized, gin.H{"error": "missing current user"}) + return + } + + if claims.IsAdmin { + var rows []model.BusinessLine + if err := h.db.Order("id ASC").Find(&rows).Error; err != nil { + c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) + return + } + + items := make([]BusinessLineWithPermission, 0, len(rows)) + for _, row := range rows { + items = append(items, BusinessLineWithPermission{ + ID: row.ID, + Name: row.Name, + CreatedAt: row.CreatedAt.Format(time.RFC3339), + UpdatedAt: row.UpdatedAt.Format(time.RFC3339), + Permission: 0, + }) + } + c.JSON(http.StatusOK, gin.H{"items": items}) + return + } + + var rows []struct { + ID uint64 + Name string + CreatedAt time.Time + UpdatedAt time.Time + Permission int + } + if err := h.db. + Table("business_line_users"). + Select("business_lines.id, business_lines.name, business_lines.created_at, business_lines.updated_at, business_line_users.permission"). + Joins("JOIN business_lines ON business_lines.id = business_line_users.business_line_id"). + Where("business_line_users.user_id = ?", claims.UserID). + Order("business_lines.id ASC"). + Scan(&rows).Error; err != nil { + c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) + return + } + + items := make([]BusinessLineWithPermission, 0, len(rows)) + for _, row := range rows { + items = append(items, BusinessLineWithPermission{ + ID: row.ID, + Name: row.Name, + CreatedAt: row.CreatedAt.Format(time.RFC3339), + UpdatedAt: row.UpdatedAt.Format(time.RFC3339), + Permission: row.Permission, + }) + } + + c.JSON(http.StatusOK, gin.H{"items": items}) +} + +func (h *BusinessLineHandler) ListAll(c *gin.Context) { + if !requirePlatformAdmin(c) { + return + } + + var rows []model.BusinessLine + if err := h.db.Order("id ASC").Find(&rows).Error; err != nil { + c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) + return + } + + items := make([]gin.H, 0, len(rows)) + for _, row := range rows { + items = append(items, gin.H{ + "id": row.ID, + "name": row.Name, + "created_at": row.CreatedAt.Format(time.RFC3339), + "updated_at": row.UpdatedAt.Format(time.RFC3339), + }) + } + c.JSON(http.StatusOK, gin.H{"items": items}) +} + +func (h *BusinessLineHandler) Create(c *gin.Context) { + if !requirePlatformAdmin(c) { + return + } + + var req BusinessLinePayload + if err := c.ShouldBindJSON(&req); err != nil { + c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()}) + return + } + + item := model.BusinessLine{Name: req.Name} + if err := h.db.Create(&item).Error; err != nil { + c.JSON(http.StatusConflict, gin.H{"error": err.Error()}) + return + } + writeBusinessLine(c, item) +} + +func (h *BusinessLineHandler) Update(c *gin.Context) { + if !requirePlatformAdmin(c) { + return + } + + var req BusinessLinePayload + if err := c.ShouldBindJSON(&req); err != nil { + c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()}) + return + } + + var item model.BusinessLine + if err := h.db.First(&item, "id = ?", c.Param("id")).Error; err != nil { + if errors.Is(err, gorm.ErrRecordNotFound) { + c.JSON(http.StatusNotFound, gin.H{"error": "business line not found"}) + return + } + c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) + return + } + if err := h.db.Model(&item).Update("name", req.Name).Error; err != nil { + c.JSON(http.StatusConflict, gin.H{"error": err.Error()}) + return + } + item.Name = req.Name + writeBusinessLine(c, item) +} + +func (h *BusinessLineHandler) Delete(c *gin.Context) { + if !requirePlatformAdmin(c) { + return + } + + var item model.BusinessLine + if err := h.db.First(&item, "id = ?", c.Param("id")).Error; err != nil { + if errors.Is(err, gorm.ErrRecordNotFound) { + c.JSON(http.StatusNotFound, gin.H{"error": "business line not found"}) + return + } + c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) + return + } + if err := h.db.Transaction(func(tx *gorm.DB) error { + if err := tx.Where("business_line_id = ?", item.ID).Delete(&model.BusinessLineUser{}).Error; err != nil { + return err + } + if err := tx.Where("business_line_id = ?", item.ID).Delete(&model.BusinessLineWayneNamespace{}).Error; err != nil { + return err + } + return tx.Delete(&item).Error + }); err != nil { + c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) + return + } + c.JSON(http.StatusOK, gin.H{"ok": true}) +} + +func (h *BusinessLineHandler) GrantPermission(c *gin.Context) { + claims, ok := CurrentClaims(c) + if !ok { + c.JSON(http.StatusUnauthorized, gin.H{"error": "missing current user"}) + return + } + + var req GrantBusinessLinePermissionRequest + if err := c.ShouldBindJSON(&req); err != nil { + c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()}) + return + } + if req.Permission != 0 && req.Permission != 1 { + c.JSON(http.StatusBadRequest, gin.H{"error": "permission must be 0 or 1"}) + return + } + + if !claims.IsAdmin { + var currentBinding model.BusinessLineUser + if err := h.db.Where("business_line_id = ? AND user_id = ? AND permission = ?", req.BusinessLineID, claims.UserID, 0). + First(¤tBinding).Error; err != nil { + if errors.Is(err, gorm.ErrRecordNotFound) { + c.JSON(http.StatusForbidden, gin.H{"error": "current user is not platform admin or business line admin"}) + return + } + c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) + return + } + } + + var businessLine model.BusinessLine + if err := h.db.First(&businessLine, "id = ?", req.BusinessLineID).Error; err != nil { + if errors.Is(err, gorm.ErrRecordNotFound) { + c.JSON(http.StatusNotFound, gin.H{"error": "business line not found"}) + return + } + c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) + return + } + + var targetUser model.User + if err := h.db.Where("id = ? AND deleted_at IS NULL", req.TargetUserID).First(&targetUser).Error; err != nil { + if errors.Is(err, gorm.ErrRecordNotFound) { + c.JSON(http.StatusNotFound, gin.H{"error": "target user not found"}) + return + } + c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) + return + } + + var targetBusinessLine model.BusinessLine + if err := h.db.First(&targetBusinessLine, "id = ?", req.TargetBusinessLineID).Error; err != nil { + if errors.Is(err, gorm.ErrRecordNotFound) { + c.JSON(http.StatusNotFound, gin.H{"error": "target business line not found"}) + return + } + c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) + return + } + + var binding model.BusinessLineUser + err := h.db.Where("business_line_id = ? AND user_id = ?", req.TargetBusinessLineID, req.TargetUserID).First(&binding).Error + if errors.Is(err, gorm.ErrRecordNotFound) { + binding = model.BusinessLineUser{ + BusinessLineID: req.TargetBusinessLineID, + UserID: req.TargetUserID, + Permission: req.Permission, + } + if err := h.db.Create(&binding).Error; err != nil { + c.JSON(http.StatusConflict, gin.H{"error": err.Error()}) + return + } + } else if err != nil { + c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) + return + } else if binding.Permission != req.Permission { + if err := h.db.Model(&binding).Update("permission", req.Permission).Error; err != nil { + c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) + return + } + binding.Permission = req.Permission + } + + c.JSON(http.StatusOK, gin.H{ + "id": binding.ID, + "business_line_id": binding.BusinessLineID, + "user_id": binding.UserID, + "permission": binding.Permission, + "created_at": binding.CreatedAt.Format(time.RFC3339), + "updated_at": binding.UpdatedAt.Format(time.RFC3339), + }) +} + +func (h *BusinessLineHandler) ListWayneNamespaces(c *gin.Context) { + businessLineID, ok := parseBusinessLineID(c) + if !ok { + return + } + if !h.canManageBusinessLine(c, businessLineID) { + return + } + + var rows []model.BusinessLineWayneNamespace + if err := h.db.Where("business_line_id = ?", businessLineID).Order("wayne_namespace_id ASC").Find(&rows).Error; err != nil { + c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) + return + } + + items := make([]gin.H, 0, len(rows)) + for _, row := range rows { + items = append(items, gin.H{ + "id": row.WayneNamespaceID, + "name": row.WayneNamespaceName, + "kubeNamespace": row.KubeNamespace, + }) + } + c.JSON(http.StatusOK, gin.H{"items": items}) +} + +func (h *BusinessLineHandler) ReplaceWayneNamespaces(c *gin.Context) { + businessLineID, ok := parseBusinessLineID(c) + if !ok { + return + } + if !h.canManageBusinessLine(c, businessLineID) { + return + } + + var req WayneNamespaceBindingPayload + if err := c.ShouldBindJSON(&req); err != nil { + c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()}) + return + } + + if err := h.db.Transaction(func(tx *gorm.DB) error { + if err := tx.Where("business_line_id = ?", businessLineID).Delete(&model.BusinessLineWayneNamespace{}).Error; err != nil { + return err + } + for _, item := range req.Namespaces { + row := model.BusinessLineWayneNamespace{ + BusinessLineID: businessLineID, + WayneNamespaceID: item.ID, + WayneNamespaceName: item.Name, + KubeNamespace: item.KubeNamespace, + } + if err := tx.Create(&row).Error; err != nil { + return err + } + } + return nil + }); err != nil { + c.JSON(http.StatusConflict, gin.H{"error": err.Error()}) + return + } + + c.JSON(http.StatusOK, gin.H{"ok": true}) +} + +func (h *BusinessLineHandler) canManageBusinessLine(c *gin.Context, businessLineID uint64) bool { + claims, ok := CurrentClaims(c) + if !ok { + c.JSON(http.StatusUnauthorized, gin.H{"error": "missing current user"}) + return false + } + + var businessLine model.BusinessLine + if err := h.db.First(&businessLine, "id = ?", businessLineID).Error; err != nil { + if errors.Is(err, gorm.ErrRecordNotFound) { + c.JSON(http.StatusNotFound, gin.H{"error": "business line not found"}) + return false + } + c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) + return false + } + if claims.IsAdmin { + return true + } + + var binding model.BusinessLineUser + if err := h.db.Where("business_line_id = ? AND user_id = ? AND permission = ?", businessLineID, claims.UserID, 0). + First(&binding).Error; err != nil { + if errors.Is(err, gorm.ErrRecordNotFound) { + c.JSON(http.StatusForbidden, gin.H{"error": "current user is not platform admin or business line admin"}) + return false + } + c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) + return false + } + return true +} + +func parseBusinessLineID(c *gin.Context) (uint64, bool) { + value, err := strconv.ParseUint(c.Param("id"), 10, 64) + if err != nil || value == 0 { + c.JSON(http.StatusBadRequest, gin.H{"error": "invalid business line id"}) + return 0, false + } + return value, true +} + +func requirePlatformAdmin(c *gin.Context) bool { + claims, ok := CurrentClaims(c) + if !ok { + c.JSON(http.StatusUnauthorized, gin.H{"error": "missing current user"}) + return false + } + if !claims.IsAdmin { + c.JSON(http.StatusForbidden, gin.H{"error": "platform admin required"}) + return false + } + return true +} + +func writeBusinessLine(c *gin.Context, item model.BusinessLine) { + c.JSON(http.StatusOK, gin.H{ + "id": item.ID, + "name": item.Name, + "created_at": item.CreatedAt.Format(time.RFC3339), + "updated_at": item.UpdatedAt.Format(time.RFC3339), + }) +} diff --git a/server/internal/handler/user.go b/server/internal/handler/user.go index 07e5056..e4f5e75 100644 --- a/server/internal/handler/user.go +++ b/server/internal/handler/user.go @@ -3,13 +3,18 @@ package handler import ( "net/http" + "github.com/1024XEngineer/xinfra/server/internal/model" + "github.com/gin-gonic/gin" + "gorm.io/gorm" ) -type UserHandler struct{} +type UserHandler struct { + db *gorm.DB +} -func NewUserHandler() *UserHandler { - return &UserHandler{} +func NewUserHandler(db *gorm.DB) *UserHandler { + return &UserHandler{db: db} } func (h *UserHandler) Me(c *gin.Context) { @@ -25,3 +30,20 @@ func (h *UserHandler) Me(c *gin.Context) { "is_admin": claims.IsAdmin, }) } + +func (h *UserHandler) List(c *gin.Context) { + var users []model.User + if err := h.db.Where("deleted_at IS NULL").Order("id ASC").Find(&users).Error; err != nil { + c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) + return + } + + items := make([]gin.H, 0, len(users)) + for _, user := range users { + items = append(items, gin.H{ + "uid": user.ID, + "username": user.Username, + }) + } + c.JSON(http.StatusOK, gin.H{"items": items}) +} diff --git a/server/internal/handler/wayen.go b/server/internal/handler/wayen.go index 18c1776..c555573 100644 --- a/server/internal/handler/wayen.go +++ b/server/internal/handler/wayen.go @@ -2,7 +2,9 @@ package handler import ( "errors" + "fmt" "net/http" + "strconv" "strings" "github.com/1024XEngineer/xinfra/server/internal/auth" @@ -40,7 +42,12 @@ func (h *WayenHandler) Login(c *gin.Context) { return } - result, err := h.wayen.Login(email, claims.Username) + refOverride, ok := h.resolveWayneRef(c, claims) + if !ok { + return + } + + result, err := h.wayen.Login(email, claims.Username, refOverride) if err != nil { h.writeAudit(c, claims.UserID, claims.Username, "deny", err.Error()) switch { @@ -73,6 +80,54 @@ func (h *WayenHandler) Login(c *gin.Context) { c.Redirect(http.StatusFound, result.TargetURL) } +func (h *WayenHandler) resolveWayneRef(c *gin.Context, claims *auth.Claims) (string, bool) { + rawBusinessLineID := strings.TrimSpace(c.Query("business_line_id")) + if rawBusinessLineID == "" { + return "", true + } + + businessLineID, err := strconv.ParseUint(rawBusinessLineID, 10, 64) + if err != nil || businessLineID == 0 { + c.JSON(http.StatusBadRequest, gin.H{"error": "invalid business_line_id"}) + return "", false + } + + var businessLine model.BusinessLine + if err := h.db.First(&businessLine, "id = ?", businessLineID).Error; err != nil { + if errors.Is(err, gorm.ErrRecordNotFound) { + c.JSON(http.StatusNotFound, gin.H{"error": "business line not found"}) + return "", false + } + c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) + return "", false + } + + if !claims.IsAdmin { + var binding model.BusinessLineUser + if err := h.db.Where("business_line_id = ? AND user_id = ?", businessLineID, claims.UserID).First(&binding).Error; err != nil { + if errors.Is(err, gorm.ErrRecordNotFound) { + c.JSON(http.StatusForbidden, gin.H{"error": "current user does not have business line permission"}) + return "", false + } + c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) + return "", false + } + } + + var mapping model.BusinessLineWayneNamespace + if err := h.db.Where("business_line_id = ?", businessLineID).Order("wayne_namespace_id ASC").First(&mapping).Error; err != nil { + if errors.Is(err, gorm.ErrRecordNotFound) { + return "", true + } + c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) + return "", false + } + if mapping.WayneNamespaceID == 0 { + return "", true + } + return fmt.Sprintf("/portal/namespace/%d/app", mapping.WayneNamespaceID), true +} + func (h *WayenHandler) GetCredential(c *gin.Context) { claims, ok := CurrentClaims(c) if !ok { diff --git a/server/internal/model/models.go b/server/internal/model/models.go index c6a052f..3c32231 100644 --- a/server/internal/model/models.go +++ b/server/internal/model/models.go @@ -32,6 +32,32 @@ type WayenCredential struct { DeletedAt gorm.DeletedAt `gorm:"index" json:"-"` } +type BusinessLine struct { + ID uint64 `gorm:"primaryKey" json:"id"` + Name string `gorm:"size:128;not null;uniqueIndex" json:"name"` + CreatedAt time.Time `json:"created_at"` + UpdatedAt time.Time `json:"updated_at"` +} + +type BusinessLineUser struct { + ID uint64 `gorm:"primaryKey" json:"id"` + BusinessLineID uint64 `gorm:"not null;uniqueIndex:idx_business_line_users_unique,priority:1;index" json:"business_line_id"` + UserID uint64 `gorm:"not null;uniqueIndex:idx_business_line_users_unique,priority:2;index" json:"user_id"` + Permission int `gorm:"not null;default:1" json:"permission"` + CreatedAt time.Time `json:"created_at"` + UpdatedAt time.Time `json:"updated_at"` +} + +type BusinessLineWayneNamespace struct { + ID uint64 `gorm:"primaryKey" json:"id"` + BusinessLineID uint64 `gorm:"not null;uniqueIndex:idx_business_line_wayne_namespaces_unique,priority:1;index" json:"business_line_id"` + WayneNamespaceID uint64 `gorm:"not null;uniqueIndex:idx_business_line_wayne_namespaces_unique,priority:2" json:"wayne_namespace_id"` + WayneNamespaceName string `gorm:"size:128;not null;default:''" json:"wayne_namespace_name"` + KubeNamespace string `gorm:"size:128;not null;default:''" json:"kube_namespace"` + CreatedAt time.Time `json:"created_at"` + UpdatedAt time.Time `json:"updated_at"` +} + type AccessToken struct { ID uint64 `gorm:"primaryKey" json:"id"` UserID uint64 `gorm:"not null;index" json:"user_id"` diff --git a/server/internal/router/router.go b/server/internal/router/router.go index d8effdf..b0045b2 100644 --- a/server/internal/router/router.go +++ b/server/internal/router/router.go @@ -73,7 +73,8 @@ func registerAuthServerRoutes(r *gin.Engine, deps Dependencies) { healthHandler := handler.NewHealthHandler(deps.DB) authHandler := handler.NewAuthHandler(deps.Config, authService) - userHandler := handler.NewUserHandler() + userHandler := handler.NewUserHandler(deps.DB) + businessLineHandler := handler.NewBusinessLineHandler(deps.DB) wayenHandler := handler.NewWayenHandler(deps.DB, wayenService, auditService) wayneRoleBindingHandler := handler.NewWayneRoleBindingHandler(wayneRoleBindingService, auditService) clouddmHandler := handler.NewCloudDMHandler(deps.Config, auditService) @@ -100,6 +101,15 @@ func registerAuthServerRoutes(r *gin.Engine, deps Dependencies) { protected := v1.Group("") protected.Use(handler.AuthMiddleware(deps.Config)) protected.GET("/users/me", userHandler.Me) + protected.GET("/users", userHandler.List) + protected.GET("/business-lines", businessLineHandler.ListCurrentUserBusinessLines) + protected.GET("/business-lines/all", businessLineHandler.ListAll) + protected.POST("/business-lines", businessLineHandler.Create) + protected.PUT("/business-lines/:id", businessLineHandler.Update) + protected.DELETE("/business-lines/:id", businessLineHandler.Delete) + protected.POST("/business-lines/authorizations", businessLineHandler.GrantPermission) + protected.GET("/business-lines/:id/wayne-namespaces", businessLineHandler.ListWayneNamespaces) + protected.PUT("/business-lines/:id/wayne-namespaces", businessLineHandler.ReplaceWayneNamespaces) protected.GET("/wayen/login", wayenHandler.Login) protected.GET("/wayen/credential", wayenHandler.GetCredential) protected.PUT("/wayen/credential", wayenHandler.SaveCredential) diff --git a/server/internal/service/wayen.go b/server/internal/service/wayen.go index f60e4e9..a011f67 100644 --- a/server/internal/service/wayen.go +++ b/server/internal/service/wayen.go @@ -48,7 +48,7 @@ func NewWayenService(cfg config.Config, db *gorm.DB) *WayenService { } } -func (s *WayenService) Login(email, username string) (*WayenLoginResult, error) { +func (s *WayenService) Login(email, username, refOverride string) (*WayenLoginResult, error) { email = strings.TrimSpace(email) if email == "" { return nil, ErrWayenEmailMissing @@ -58,7 +58,7 @@ func (s *WayenService) Login(email, username string) (*WayenLoginResult, error) oauthLoginURL = strings.TrimSpace(s.cfg.OAuthRedirectURI) } if oauthLoginURL != "" && strings.TrimSpace(s.cfg.WayenTargetURL) != "" { - target, err := s.oauthLoginURL(oauthLoginURL, s.cfg.WayenTargetURL) + target, err := s.oauthLoginURL(oauthLoginURL, s.cfg.WayenTargetURL, refOverride) if err != nil { return nil, err } @@ -111,7 +111,7 @@ func (s *WayenService) Login(email, username string) (*WayenLoginResult, error) }, nil } -func (s *WayenService) oauthLoginURL(redirectURI, targetURL string) (string, error) { +func (s *WayenService) oauthLoginURL(redirectURI, targetURL, refOverride string) (string, error) { parsed, err := url.Parse(strings.TrimSpace(redirectURI)) if err != nil { return "", err @@ -124,7 +124,7 @@ func (s *WayenService) oauthLoginURL(redirectURI, targetURL string) (string, err next.Path = "/sign-in" } values := next.Query() - values.Set("ref", defaultConfigValue(s.cfg.WayenOAuthRef, "/portal/namespace/1/app")) + values.Set("ref", defaultConfigValue(refOverride, defaultConfigValue(s.cfg.WayenOAuthRef, "/portal/namespace/1/app"))) next.RawQuery = values.Encode() query := parsed.Query() diff --git a/server/internal/service/wayen_test.go b/server/internal/service/wayen_test.go index 8fbdc8e..47179ab 100644 --- a/server/internal/service/wayen_test.go +++ b/server/internal/service/wayen_test.go @@ -15,7 +15,7 @@ func TestWayenLoginUsesDedicatedOAuthLoginURL(t *testing.T) { WayenOAuthRef: "/portal/namespace/1/app", }, nil) - result, err := service.Login("eastsales@qiniu.com", "eastsales@qiniu.com") + result, err := service.Login("eastsales@qiniu.com", "eastsales@qiniu.com", "") if err != nil { t.Fatalf("Login() error = %v", err) } @@ -55,7 +55,7 @@ func TestWayenLoginFallsBackToOAuthRedirectURI(t *testing.T) { WayenTargetURL: "http://218.11.5.223:32000/", }, nil) - result, err := service.Login("eastsales@qiniu.com", "eastsales@qiniu.com") + result, err := service.Login("eastsales@qiniu.com", "eastsales@qiniu.com", "") if err != nil { t.Fatalf("Login() error = %v", err) } @@ -67,3 +67,27 @@ func TestWayenLoginFallsBackToOAuthRedirectURI(t *testing.T) { t.Fatalf("target host = %q, want fallback redirect host", parsed.Host) } } + +func TestWayenLoginUsesRefOverride(t *testing.T) { + service := NewWayenService(config.Config{ + WayenOAuthLoginURL: "http://218.11.5.223:32000/login/oauth2/oauth2", + WayenTargetURL: "http://218.11.5.223:32000/", + WayenOAuthRef: "/portal/namespace/1/app", + }, nil) + + result, err := service.Login("eastsales@qiniu.com", "eastsales@qiniu.com", "/portal/namespace/3/app") + if err != nil { + t.Fatalf("Login() error = %v", err) + } + parsed, err := url.Parse(result.TargetURL) + if err != nil { + t.Fatalf("invalid target url: %v", err) + } + parsedNext, err := url.Parse(parsed.Query().Get("next")) + if err != nil { + t.Fatalf("invalid next url: %v", err) + } + if parsedNext.Query().Get("ref") != "/portal/namespace/3/app" { + t.Fatalf("next ref = %q", parsedNext.Query().Get("ref")) + } +}