ebc507ee6c
- crypto.Service 增 fullBody 开关 + DecryptRequest/EncryptResponse（会话密钥双向加密） - 新增 middleware/APICrypto：请求整体解密 + 响应加密（public-key 豁免），未加密请求拒绝 - ResolveLogin/resolvePassword 增 fullBody 分支；admin 组中间件链调整 - injectEnv 支持 ENCRYPT_FULL_BODY/ENCRYPT_ALLOW_PLAIN（直接跑二进制需 env 注入）
94 lines
3.5 KiB
Go
94 lines
3.5 KiB
Go
package admin
|
||
|
||
import (
|
||
"context"
|
||
|
||
adminv1 "service.xpcool.com/api/admin/admin/admin"
|
||
"service.xpcool.com/internal/consts"
|
||
cryptolib "service.xpcool.com/internal/library/crypto"
|
||
"service.xpcool.com/internal/library/response"
|
||
"service.xpcool.com/internal/model/dto"
|
||
admin "service.xpcool.com/internal/service/admin/admin/admin"
|
||
)
|
||
|
||
// resolvePassword 解析创建/重置管理员时的密码：
|
||
// - 全量加密模式（fullBody）：传输层已整体解密，直接使用明文 password；
|
||
// - 仅密码加密模式：密文（encryptedKey+encryptedData，RSA+AES 混合加密）优先；明文仅开发 allowPlain。
|
||
func resolvePassword(ctx context.Context, encryptedKey, encryptedData, password string) (string, error) {
|
||
if cryptolib.Get().FullBody() {
|
||
return password, nil
|
||
}
|
||
if encryptedKey != "" && encryptedData != "" {
|
||
v, err := cryptolib.Get().DecryptField(ctx, encryptedKey, encryptedData)
|
||
if err != nil {
|
||
return "", response.Error(consts.CodeInvalidParam, err.Error())
|
||
}
|
||
return v, nil
|
||
}
|
||
if cryptolib.Get().AllowPlain() {
|
||
return password, nil
|
||
}
|
||
return "", response.Error(consts.CodeInvalidParam, "encrypted payload required")
|
||
}
|
||
|
||
// AdminList 分页查询管理员。
|
||
func (c *Controller) AdminList(ctx context.Context, req *adminv1.AdminListReq) (res *adminv1.AdminListRes, err error) {
|
||
items, total, err := admin.AdminManage().List(ctx, dto.PageQuery{Page: req.Page, Size: req.Size, Keyword: req.Keyword})
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
list := make([]*adminv1.AdminItem, 0, len(items))
|
||
for _, it := range items {
|
||
list = append(list, &adminv1.AdminItem{
|
||
Id: it.Id, Username: it.Username, Nickname: it.Nickname, Status: it.Status,
|
||
RoleIds: it.RoleIds, RoleNames: it.RoleNames, CreatedAt: it.CreatedAt,
|
||
})
|
||
}
|
||
return &adminv1.AdminListRes{List: list, Total: total}, nil
|
||
}
|
||
|
||
// AdminCreate 创建管理员。
|
||
func (c *Controller) AdminCreate(ctx context.Context, req *adminv1.AdminCreateReq) (res *adminv1.AdminCreateRes, err error) {
|
||
password, err := resolvePassword(ctx, req.EncryptedKey, req.EncryptedData, req.Password)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
id, err := admin.AdminManage().Create(ctx, dto.AdminCreateInput{
|
||
Username: req.Username, Password: password, Nickname: req.Nickname,
|
||
BarkDeviceId: req.BarkDeviceId, PushplusToken: req.PushplusToken, RoleIds: req.RoleIds,
|
||
})
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
return &adminv1.AdminCreateRes{Id: id}, nil
|
||
}
|
||
|
||
// AdminUpdate 更新管理员。
|
||
func (c *Controller) AdminUpdate(ctx context.Context, req *adminv1.AdminUpdateReq) (res *adminv1.AdminUpdateRes, err error) {
|
||
if err = admin.AdminManage().Update(ctx, dto.AdminUpdateInput{Id: req.Id, Nickname: req.Nickname, Status: req.Status,
|
||
BarkDeviceId: req.BarkDeviceId, PushplusToken: req.PushplusToken, RoleIds: req.RoleIds}); err != nil {
|
||
return nil, err
|
||
}
|
||
return &adminv1.AdminUpdateRes{}, nil
|
||
}
|
||
|
||
// AdminResetPwd 重置管理员密码。
|
||
func (c *Controller) AdminResetPwd(ctx context.Context, req *adminv1.AdminResetPwdReq) (res *adminv1.AdminResetPwdRes, err error) {
|
||
password, err := resolvePassword(ctx, req.EncryptedKey, req.EncryptedData, req.Password)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
if err = admin.AdminManage().ResetPassword(ctx, req.Id, password); err != nil {
|
||
return nil, err
|
||
}
|
||
return &adminv1.AdminResetPwdRes{}, nil
|
||
}
|
||
|
||
// AdminDelete 删除管理员。
|
||
func (c *Controller) AdminDelete(ctx context.Context, req *adminv1.AdminDeleteReq) (res *adminv1.AdminDeleteRes, err error) {
|
||
if err = admin.AdminManage().Delete(ctx, req.Id); err != nil {
|
||
return nil, err
|
||
}
|
||
return &adminv1.AdminDeleteRes{}, nil
|
||
}
|