feat: 重建 Sense 认证权限与审计 (#64)

Sense/server/common/middleware/handler/auth.go

@@ -6,7 +6,6 @@ import (
 	"net/http"
 
 	"github.com/gin-gonic/gin"
-	"github.com/go-admin-team/go-admin-core/sdk"
 	"github.com/go-admin-team/go-admin-core/sdk/api"
 	"github.com/go-admin-team/go-admin-core/sdk/config"
 	"github.com/go-admin-team/go-admin-core/sdk/pkg"
@@ -15,7 +14,6 @@ import (
 	"github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth/user"
 	"github.com/go-admin-team/go-admin-core/sdk/pkg/response"
 	"github.com/mssola/user_agent"
-	"git.ilapage.cn/ila/yovision/Sense/server/common/global"
 )
 
 func PayloadFunc(data interface{}) jwt.MapClaims {
@@ -28,7 +26,7 @@ func PayloadFunc(data interface{}) jwt.MapClaims {
 			jwt.RoleKey:      r.RoleKey,
 			jwt.NiceKey:      u.Username,
 			jwt.DataScopeKey: r.DataScope,
-			jwt.RoleNameKey:  r.RoleName,
+			jwt.RoleNameKey:  r.RoleKey,
 		}
 	}
 	return jwt.MapClaims{}
@@ -108,36 +106,44 @@ func Authenticator(c *gin.Context) (interface{}, error) {
 
 // LoginLogToDB Write log to database
 func LoginLogToDB(c *gin.Context, status string, msg string, username string) {
-	if !config.LoggerConfig.EnabledDB {
+	WriteIdentityAudit(c, status, msg, username)
+}
+
+// WriteIdentityAudit persists identity/security events synchronously. It never
+// records request bodies, credentials, tokens, captcha answers, or cookies.
+func WriteIdentityAudit(c *gin.Context, status string, msg string, username string) {
+	log := api.GetRequestLogger(c)
+	db, err := pkg.GetOrm(c)
+	if err != nil {
+		log.Errorf("identity audit database unavailable: %s", err.Error())
 		return
 	}
-	log := api.GetRequestLogger(c)
-	l := make(map[string]interface{})
 
 	ua := user_agent.New(c.Request.UserAgent())
-	l["ipaddr"] = common.GetClientIP(c)
-	l["loginLocation"] = "" // pkg.GetLocation(common.GetClientIP(c),gaConfig.ExtConfig.AMap.Key)
-	l["loginTime"] = pkg.GetCurrentTime()
-	l["status"] = status
-	l["remark"] = c.Request.UserAgent()
 	browserName, browserVersion := ua.Browser()
-	l["browser"] = browserName + " " + browserVersion
-	l["os"] = ua.OS()
-	l["platform"] = ua.Platform()
-	l["username"] = username
-	l["msg"] = msg
-
-	q := sdk.Runtime.GetMemoryQueue(c.Request.Host)
-	message, err := sdk.Runtime.GetStreamMessage("", global.LoginLog, l)
-	if err != nil {
-		log.Errorf("GetStreamMessage error, %s", err.Error())
-		//日志报错错误，不中断请求
-	} else {
-		err = q.Append(message)
-		if err != nil {
-			log.Errorf("Append message error, %s", err.Error())
-		}
+	l := models.SysLoginLog{
+		Username:      truncateAuditText(username, 128),
+		Status:        status,
+		Ipaddr:        truncateAuditText(common.GetClientIP(c), 255),
+		LoginLocation: "",
+		Browser:       truncateAuditText(browserName+" "+browserVersion, 255),
+		Os:            truncateAuditText(ua.OS(), 255),
+		Platform:      truncateAuditText(ua.Platform(), 255),
+		LoginTime:     pkg.GetCurrentTime(),
+		Remark:        truncateAuditText(c.Request.Method+" "+c.FullPath(), 255),
+		Msg:           truncateAuditText(msg, 255),
 	}
+	if err = db.Create(&l).Error; err != nil {
+		log.Errorf("identity audit write failed: %s", err.Error())
+	}
+}
+
+func truncateAuditText(value string, limit int) string {
+	runes := []rune(value)
+	if len(runes) <= limit {
+		return value
+	}
+	return string(runes[:limit])
 }
 
 // LogOut
@@ -164,7 +170,7 @@ func Authorizator(data interface{}, c *gin.Context) bool {
 	if v, ok := data.(map[string]interface{}); ok {
 		u, _ := v["user"].(models.SysUser)
 		r, _ := v["role"].(models.SysRole)
-		c.Set("role", r.RoleName)
+		c.Set("role", r.RoleKey)
 		c.Set("roleIds", r.RoleId)
 		c.Set("userId", u.UserId)
 		c.Set("userName", u.Username)
@@ -175,6 +181,9 @@ func Authorizator(data interface{}, c *gin.Context) bool {
 }
 
 func Unauthorized(c *gin.Context, code int, message string) {
+	if c.FullPath() != "/api/v1/login" {
+		WriteIdentityAudit(c, "1", "未认证访问被拒绝", "")
+	}
 	c.JSON(http.StatusOK, gin.H{
 		"code": code,
 		"msg":  message,

Sense/server/common/middleware/handler/auth_test.go

@@ -0,0 +1,12 @@
+package handler
+
+import "testing"
+
+func TestTruncateAuditText(t *testing.T) {
+	if got := truncateAuditText("中文审计记录", 3); got != "中文审" {
+		t.Fatalf("unexpected truncation: %q", got)
+	}
+	if got := truncateAuditText("short", 10); got != "short" {
+		t.Fatalf("unexpected unchanged value: %q", got)
+	}
+}