selfrelease
83 lines
2.3 KiB
Go
83 lines
2.3 KiB
Go
package api
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/tcs-iptv/tcs/internal/httpx"
|
|
)
|
|
|
|
// RBACHandler RBAC 权限管理 API 处理器。
|
|
type RBACHandler struct {
|
|
rbac *httpx.RBACManager
|
|
}
|
|
|
|
// NewRBACHandler 创建 RBAC 管理 API 处理器。
|
|
func NewRBACHandler(rbac *httpx.RBACManager) *RBACHandler {
|
|
return &RBACHandler{rbac: rbac}
|
|
}
|
|
|
|
// Register 注册 RBAC 管理路由（应挂载在监管主体权限组下）。
|
|
func (h *RBACHandler) Register(rg *gin.RouterGroup) {
|
|
rg.GET("/admin/rbac/roles", h.listRoles)
|
|
rg.GET("/admin/rbac/permissions/:role", h.listPermissions)
|
|
rg.PUT("/admin/rbac/roles/:role", h.setRolePermissions)
|
|
rg.POST("/admin/rbac/grant", h.grantPermission)
|
|
rg.POST("/admin/rbac/revoke", h.revokePermission)
|
|
}
|
|
|
|
func (h *RBACHandler) listRoles(c *gin.Context) {
|
|
roles := h.rbac.ListRoles()
|
|
httpx.OK(c, roles)
|
|
}
|
|
|
|
func (h *RBACHandler) listPermissions(c *gin.Context) {
|
|
role := c.Param("role")
|
|
perms := h.rbac.ListPermissions(role)
|
|
httpx.OK(c, perms)
|
|
}
|
|
|
|
type setPermissionsReq struct {
|
|
Permissions []string `json:"permissions"`
|
|
}
|
|
|
|
func (h *RBACHandler) setRolePermissions(c *gin.Context) {
|
|
role := c.Param("role")
|
|
var req setPermissionsReq
|
|
if err := c.ShouldBindJSON(&req); err != nil {
|
|
httpx.Error(c, http.StatusBadRequest, "INVALID_REQUEST", err.Error())
|
|
return
|
|
}
|
|
perms := make([]httpx.Permission, len(req.Permissions))
|
|
for i, p := range req.Permissions {
|
|
perms[i] = httpx.Permission(p)
|
|
}
|
|
h.rbac.SetRolePermissions(role, perms)
|
|
httpx.OK(c, gin.H{"role": role, "permissions": req.Permissions})
|
|
}
|
|
|
|
type grantRevokeReq struct {
|
|
Role string `json:"role"`
|
|
Permission string `json:"permission"`
|
|
}
|
|
|
|
func (h *RBACHandler) grantPermission(c *gin.Context) {
|
|
var req grantRevokeReq
|
|
if err := c.ShouldBindJSON(&req); err != nil {
|
|
httpx.Error(c, http.StatusBadRequest, "INVALID_REQUEST", err.Error())
|
|
return
|
|
}
|
|
h.rbac.GrantPermission(req.Role, httpx.Permission(req.Permission))
|
|
httpx.OK(c, gin.H{"role": req.Role, "permission": req.Permission, "granted": true})
|
|
}
|
|
|
|
func (h *RBACHandler) revokePermission(c *gin.Context) {
|
|
var req grantRevokeReq
|
|
if err := c.ShouldBindJSON(&req); err != nil {
|
|
httpx.Error(c, http.StatusBadRequest, "INVALID_REQUEST", err.Error())
|
|
return
|
|
}
|
|
h.rbac.RevokePermission(req.Role, httpx.Permission(req.Permission))
|
|
httpx.OK(c, gin.H{"role": req.Role, "permission": req.Permission, "revoked": true})
|
|
}
|