27 lines
693 B
Go
27 lines
693 B
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
|
|
)
|
|
|
|
// RequireRoleKey adds defense in depth for administrator-only operations.
|
|
// Casbin remains the primary API permission layer; this guard prevents a
|
|
// future policy/configuration mistake from widening a sensitive operation.
|
|
func RequireRoleKey(roleKey string) gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
role, _ := jwt.ExtractClaims(c)["rolekey"].(string)
|
|
if role != roleKey {
|
|
c.JSON(http.StatusForbidden, gin.H{
|
|
"code": "FORBIDDEN",
|
|
"message": "只有管理员可以执行此操作",
|
|
})
|
|
c.Abort()
|
|
return
|
|
}
|
|
c.Next()
|
|
}
|
|
}
|