mono
63e0457886
Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.
69 lines
2.4 KiB
Go
69 lines
2.4 KiB
Go
package repositories
|
|
|
|
import (
|
|
"agent-desk/internal/models"
|
|
"agent-desk/internal/pkg/enums"
|
|
"time"
|
|
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
// These handwritten queries supplement the generated CRUD repositories.
|
|
func (r *roleRepository) FindEnabledByUser(db *gorm.DB, userID int64) ([]models.Role, error) {
|
|
roles := make([]models.Role, 0)
|
|
err := db.Table("t_role AS r").
|
|
Select("r.*").
|
|
Joins("JOIN t_user_role AS ur ON ur.role_id = r.id").
|
|
Where("ur.user_id = ? AND r.status = ?", userID, enums.StatusOk).
|
|
Order("r.sort_no ASC, r.id ASC").
|
|
Scan(&roles).Error
|
|
return roles, err
|
|
}
|
|
|
|
func (r *permissionRepository) FindEnabledCodesByUserRoles(db *gorm.DB, userID int64) ([]string, error) {
|
|
codes := make([]string, 0)
|
|
err := db.Table("t_permission AS p").
|
|
Joins("JOIN t_role_permission AS rp ON rp.permission_id = p.id").
|
|
Joins("JOIN t_role AS r ON r.id = rp.role_id").
|
|
Joins("JOIN t_user_role AS ur ON ur.role_id = r.id").
|
|
Where("ur.user_id = ? AND r.status = ? AND p.status = ?", userID, enums.StatusOk, enums.StatusOk).
|
|
Distinct().Pluck("p.code", &codes).Error
|
|
return codes, err
|
|
}
|
|
|
|
type UserPermissionOverride struct {
|
|
Code string
|
|
Effect int
|
|
}
|
|
|
|
func (r *userPermissionRepository) FindActiveEnabledOverrides(db *gorm.DB, userID int64, now time.Time) ([]UserPermissionOverride, error) {
|
|
overrides := make([]UserPermissionOverride, 0)
|
|
err := db.Table("t_user_permission AS up").
|
|
Select("p.code, up.effect").
|
|
Joins("JOIN t_permission AS p ON p.id = up.permission_id").
|
|
Where("up.user_id = ? AND p.status = ?", userID, enums.StatusOk).
|
|
Where("up.expired_at IS NULL OR up.expired_at > ?", now).
|
|
Scan(&overrides).Error
|
|
return overrides, err
|
|
}
|
|
|
|
// GetAuthState deliberately excludes the bearer token; revalidation only needs
|
|
// the identity binding, revocation status, and absolute expiry.
|
|
func (r *loginSessionRepository) GetAuthState(db *gorm.DB, sessionID, userID int64) (*models.LoginSession, error) {
|
|
session := &models.LoginSession{}
|
|
if err := db.Select("id", "user_id", "expired_at", "revoked_at").
|
|
Take(session, "id = ? AND user_id = ?", sessionID, userID).Error; err != nil {
|
|
return nil, err
|
|
}
|
|
return session, nil
|
|
}
|
|
|
|
func (r *userRepository) GetAuthState(db *gorm.DB, userID int64) (*models.User, error) {
|
|
user := &models.User{}
|
|
if err := db.Select("id", "username", "nickname", "avatar", "user_type", "status", "deleted_at").
|
|
Take(user, "id = ?", userID).Error; err != nil {
|
|
return nil, err
|
|
}
|
|
return user, nil
|
|
}
|