ai-workspace-services/accounts
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix admin permission helper usage (#447)

Browse Source
This commit is contained in:
shenlan 2025-10-07 09:41:27 +08:00 committed by GitHub
parent d8a1a0960a
commit 3d6afd37e0
1 changed files with 9 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
account/api/api.go
View File

@ -172,26 +172,26 @@ func RegisterRoutes(r *gin.Engine, opts ...Option) {
})
auth := r.Group("/api/auth")
auth.POST("/register", h.register)
auth.POST("/register/verify", h.verifyEmail)
auth.POST("/login", h.login)
auth.GET("/session", h.session)
auth.DELETE("/session", h.deleteSession)
auth.POST("/mfa/totp/provision", h.provisionTOTP)
auth.POST("/mfa/totp/verify", h.verifyTOTP)
auth.POST("/mfa/disable", h.disableMFA)
auth.GET("/mfa/status", h.mfaStatus)
auth.POST("/password/reset", h.requestPasswordReset)
auth.POST("/password/reset/confirm", h.confirmPasswordReset)
auth.GET("/admin/settings", h.getAdminSettings)
auth.POST("/admin/settings", h.updateAdminSettings)
registerAdminRoutes(auth, h)
}
@ -515,7 +515,7 @@ var allowedAdminRoles = map[string]struct{}{
}
func (h *handler) getAdminSettings(c *gin.Context) {
if !h.requireAdminOrOperator(c) {
if _, ok := h.requireAdminOrOperator(c); !ok {
return
}
settings, err := service.GetAdminSettings(c.Request.Context())
@ -534,7 +534,7 @@ func (h *handler) getAdminSettings(c *gin.Context) {
}
func (h *handler) updateAdminSettings(c *gin.Context) {
if !h.requireAdminOrOperator(c) {
if _, ok := h.requireAdminOrOperator(c); !ok {
return
}
@ -579,18 +579,6 @@ func (h *handler) updateAdminSettings(c *gin.Context) {
})
}
func (h *handler) requireAdminOrOperator(c *gin.Context) bool {
role := strings.ToLower(strings.TrimSpace(c.GetHeader("X-User-Role")))
if role == "" {
role = strings.ToLower(strings.TrimSpace(c.GetHeader("X-Role")))
}
if role == "admin" || role == "operator" {
return true
}
c.JSON(http.StatusForbidden, gin.H{"error": "forbidden"})
return false
}
func normalizeAdminMatrix(in map[string]map[string]bool) (map[string]map[string]bool, error) {
if in == nil {
return make(map[string]map[string]bool), nil