rbac

lib/midware/midhandle.go

@@ -2,12 +2,14 @@ package midware
 
 import (
 	"net/http"
+	"strings"
 
 	"ems.agt/lib/log"
 	"ems.agt/lib/services"
+	"github.com/gorilla/mux"
 )
 
-func LoggerTraceMiddleware(next http.Handler) http.Handler {
+func LoggerTrace(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		// Do stuff here
 		log.Trace("Http Trace Info:")
@@ -26,10 +28,48 @@ func LoggerTraceMiddleware(next http.Handler) http.Handler {
 		//r.Body = ioutil.NopCloser(bytes.NewReader(body))
 		//log.Trace("Body:", string(body))
 		// Call the next handler, which can be another middleware in the chain, or the final handler.
+		// if r.Method == "OPTIONS" {
+		// 	services.ResponseStatusOK201Accepted(w)
+		// 	return
+		// }
+
+		next.ServeHTTP(w, r)
+	})
+}
+
+func OptionProcess(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method == "OPTIONS" {
 			services.ResponseStatusOK201Accepted(w)
 			return
 		}
+
+		next.ServeHTTP(w, r)
+	})
+}
+
+func CheckPermission(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		token := r.Header.Get("AccessToken")
+		vars := mux.Vars(r)
+		management := vars["managedType"]
+		element := vars["elementTypeValue"]
+		object := vars["objectTypeValue"]
+		pack := "*"
+		if token != "" && element != "oauth" {
+			log.Debugf("token:%s, method:%s, management:%s, element:%s, object:%s, pack:%s", token, r.Method, management, element, object, pack)
+			exist, err := services.CheckUserPermission(token, strings.ToLower(r.Method), management, element, object, pack)
+			if err != nil {
+				log.Error("Failed to get permission:", err)
+				services.ResponseForbidden403NotPermission(w)
+				return
+			}
+			if !exist {
+				log.Error("Not permission!")
+				services.ResponseForbidden403NotPermission(w)
+				return
+			}
+		}
 		next.ServeHTTP(w, r)
 	})
 }