f8c374a624
- 4 表设计: permissions, roles, role_permissions(m2m), user_roles - 多租户隔离: 角色和用户角色分配按 tenant_id 隔离 - 权限并集: 多角色用户取权限并集，无继承 - 系统角色保护: is_system 角色不可修改/删除 - 种子数据: 7 个默认权限 + 3 个系统角色(super_admin/tenant_admin/member) - 权限中间件: RequirePermission 支持按路由粒度控制 - API 路由: /api/v1/rbac/ 下完整 CRUD 端点 - fx 注册: RBAC Module 集成到 app.go
57 lines
1.5 KiB
Go
57 lines
1.5 KiB
Go
package interfaces
|
|
|
|
import (
|
|
"mengstack/internal/app/middleware"
|
|
"mengstack/internal/modules/rbac/application"
|
|
"mengstack/internal/modules/rbac/infrastructure"
|
|
rbacmiddleware "mengstack/internal/modules/rbac/middleware"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"go.uber.org/fx"
|
|
"go.uber.org/zap"
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
func SetupRoutes(
|
|
r *gin.Engine,
|
|
h *Handler,
|
|
authMW gin.HandlerFunc,
|
|
) {
|
|
rbac := r.Group("/api/v1/rbac")
|
|
rbac.Use(authMW, middleware.MultiTenant())
|
|
{
|
|
rbac.GET("/permissions", h.ListPermissions)
|
|
|
|
rbac.POST("/roles", h.CreateRole)
|
|
rbac.GET("/roles", h.ListRoles)
|
|
rbac.GET("/roles/:id", h.GetRole)
|
|
rbac.PUT("/roles/:id", h.UpdateRole)
|
|
rbac.DELETE("/roles/:id", h.DeleteRole)
|
|
rbac.PUT("/roles/:id/permissions", h.SetRolePermissions)
|
|
rbac.GET("/roles/:id/permissions", h.GetRolePermissions)
|
|
|
|
rbac.POST("/users/:userId/roles", h.AssignRole)
|
|
rbac.DELETE("/users/:userId/roles/:roleId", h.RemoveRole)
|
|
rbac.GET("/users/:userId/roles", h.GetUserRoles)
|
|
}
|
|
}
|
|
|
|
var Module = fx.Module("rbac",
|
|
fx.Provide(
|
|
infrastructure.NewPermissionRepository,
|
|
infrastructure.NewRoleRepository,
|
|
infrastructure.NewUserRoleRepository,
|
|
application.NewService,
|
|
NewHandler,
|
|
rbacmiddleware.NewPermissionMiddleware,
|
|
),
|
|
fx.Invoke(func(db *gorm.DB, log *zap.Logger) {
|
|
if err := infrastructure.Migrate(db); err != nil {
|
|
log.Fatal("rbac migration failed", zap.Error(err))
|
|
}
|
|
if err := infrastructure.Seed(db, log); err != nil {
|
|
log.Error("rbac seed failed", zap.Error(err))
|
|
}
|
|
}),
|
|
)
|