Initial commit

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

web/middleware/checkPermission/checkPermission.go

@@ -0,0 +1,51 @@
+package checkPermission
+
+import (
+	"net/http"
+	"strings"
+	"time"
+
+	"91porn-server/common"
+
+	"github.com/gin-gonic/gin"
+	"github.com/storyicon/grbac"
+)
+
+// 白名单，不需要验证token的api
+var whitelist = map[string]bool{
+	"/swagger": true,
+}
+
+func QueryRolesByHeaders(c *gin.Context) (roles []string, err error) {
+	role, _ := common.GetAdminRole(c)
+	roles = append(roles, role)
+	return roles, err
+}
+
+var rbac *grbac.Controller
+
+func init() {
+	var err error
+	rbac, err = grbac.New(grbac.WithJSON("config/rules.json", 10*time.Minute))
+	if err != nil {
+		panic(err)
+	}
+}
+
+func CheckPermission(c *gin.Context) {
+	for url, ok := range whitelist {
+		if ok && strings.HasPrefix(c.Request.URL.Path, url) {
+			return
+		}
+	}
+
+	roles, _ := QueryRolesByHeaders(c)
+	state, _ := rbac.IsRequestGranted(c.Request, roles)
+	if !state.IsGranted() {
+		c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
+			"code": http.StatusUnauthorized,
+			"msg":  "没有操作权限",
+		})
+		return
+	}
+}