u

code/allapp/allapp-go/biz/router/middleware/auth.go

@@ -3,9 +3,11 @@ package middleware
 import (
 	"allapp/utils/jwtx"
 	"allapp/utils/pathx"
+	"allapp/utils/redisx"
 	"allapp/utils/response"
 	"context"
 	"strconv"
+	"strings"
 
 	"github.com/cloudwego/hertz/pkg/app"
 )
@@ -13,13 +15,14 @@ import (
 // 私有 key，防止冲突
 type ctxKeyUser struct{}
 
-// ContextUser 保存用户信息，包括 UserID 和 SpaceID
+// ContextUser 保存用户信息，包括 UserID、DeviceUUID 和当前 SpaceID
 type ContextUser struct {
-	UserID  int64
-	SpaceID int64
+	UserID     int64
+	DeviceUUID string
+	SpaceID    int64
 }
 
-// Auth 中间件，直接在中间件里过滤白名单路径
+// Auth 中间件，支持 header 中传 spaceid 并校验权限
 func Auth() app.HandlerFunc {
 	whitelistPaths := []string{
 		"/auth/login",
@@ -35,8 +38,8 @@ func Auth() app.HandlerFunc {
 			return
 		}
 
-		token := string(c.GetHeader("token"))
-		spaceId := string(c.GetHeader("x-space-id"))
+		// 校验 token
+		token := strings.TrimSpace(string(c.GetHeader("token")))
 		if token == "" {
 			response.Fail(c).Code(response.HttpCode.Unauthorized).Send()
 			c.Abort()
@@ -44,30 +47,39 @@ func Auth() app.HandlerFunc {
 		}
 
 		verifyToken, flag := jwtx.VerifyToken(token)
-
-		if flag {
-			user := &ContextUser{
-				UserID:  verifyToken.UserID,
-				SpaceID: 0,
-			}
-			if spaceId != "" {
-				i, err := strconv.ParseInt(spaceId, 10, 64)
-				if err != nil {
-					response.Fail(c).Message("Invalid x-space-id").Send()
-					c.Abort()
-					return
-				}
-
-				user.SpaceID = i
-			}
-
-			ctx = setContextUser(ctx, user)
-			c.Next(ctx)
+		if !flag {
+			response.Fail(c).Code(response.HttpCode.RefreshToken).Send()
+			c.Abort()
 			return
 		}
 
-		response.Fail(c).Code(response.HttpCode.RefreshToken).Send()
-		c.Abort()
+		userID := verifyToken.UserID
+
+		// 获取 header 中的 spaceid
+		spaceIDStr := strings.TrimSpace(string(c.GetHeader("spaceid")))
+		spaceID, err := strconv.ParseInt(spaceIDStr, 10, 64)
+		if err != nil || spaceID == 0 {
+			response.Fail(c).Message("缺少有效 spaceid").Send()
+			c.Abort()
+			return
+		}
+
+		// 判断用户是否在该空间
+		inSpace, err := redisx.HasUserSpace(ctx, userID, spaceID)
+		if err != nil || !inSpace {
+			response.Fail(c).Message("无权限访问该空间").Send()
+			c.Abort()
+			return
+		}
+
+		// 设置 context
+		user := &ContextUser{
+			UserID:  userID,
+			SpaceID: spaceID,
+		}
+		ctx = setContextUser(ctx, user)
+
+		c.Next(ctx)
 	}
 }
 
@@ -85,10 +97,9 @@ func GetUserID(ctx context.Context) int64 {
 	return GetContextUser(ctx).UserID
 }
 
-// GetSpaceID 从 context 获取 space_id，并返回是否有效
-func GetSpaceID(ctx context.Context) (int64, bool) {
-	spaceID := GetContextUser(ctx).SpaceID
-	return spaceID, spaceID != 0
+// GetSpaceID 从 context 获取当前 spaceid
+func GetSpaceID(ctx context.Context) int64 {
+	return GetContextUser(ctx).SpaceID
 }
 
 // 内部中间件设置 ContextUser