9c39c8cbd7
Go workspace (go.work) with 5 microservices + shared library: - gateway (8080), auth-service (8081), purchaser-service (8082) - textile-service (8083), washing-service (8084) - shared: proto definitions, common packages Infrastructure: docker-compose for local dev, K8s manifests for K3s cluster deployment (mysql/redis/etcd + traefik ingress). Frontend (iloom-flatten) added as git submodule. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
66 lines
1.7 KiB
Go
66 lines
1.7 KiB
Go
package middleware
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/golang-jwt/jwt/v5"
|
|
"github.com/muyuqingfeng/iloom/shared/pkg/auth"
|
|
"github.com/muyuqingfeng/iloom/shared/pkg/response"
|
|
)
|
|
|
|
func AuthRequired(jwtSecret string) gin.HandlerFunc {
|
|
secret := []byte(jwtSecret)
|
|
|
|
return func(c *gin.Context) {
|
|
header := c.GetHeader("Authorization")
|
|
if header == "" {
|
|
response.Unauthorized(c, "missing authorization header")
|
|
c.Abort()
|
|
return
|
|
}
|
|
|
|
parts := strings.SplitN(header, " ", 2)
|
|
if len(parts) != 2 || !strings.EqualFold(parts[0], "bearer") {
|
|
response.Unauthorized(c, "invalid authorization format")
|
|
c.Abort()
|
|
return
|
|
}
|
|
|
|
tokenStr := parts[1]
|
|
token, err := jwt.ParseWithClaims(tokenStr, &auth.Claims{}, func(t *jwt.Token) (interface{}, error) {
|
|
if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
|
|
return nil, fmt.Errorf("unexpected signing method: %v", t.Header["alg"])
|
|
}
|
|
return secret, nil
|
|
})
|
|
if err != nil {
|
|
response.Error(c, 401, response.ErrCodeTokenExpired, "token expired or invalid")
|
|
c.Abort()
|
|
return
|
|
}
|
|
|
|
claims, ok := token.Claims.(*auth.Claims)
|
|
if !ok || !token.Valid {
|
|
response.Error(c, 401, response.ErrCodeTokenInvalid, "invalid token")
|
|
c.Abort()
|
|
return
|
|
}
|
|
|
|
c.Set("user_id", claims.UserID)
|
|
c.Set("company_id", claims.CompanyID)
|
|
c.Set("role", claims.Role)
|
|
c.Set("is_master", claims.IsMaster)
|
|
c.Set("username", claims.Username)
|
|
|
|
c.Request.Header.Set("X-User-ID", claims.UserID)
|
|
c.Request.Header.Set("X-Company-ID", claims.CompanyID)
|
|
c.Request.Header.Set("X-User-Role", claims.Role)
|
|
c.Request.Header.Set("X-Is-Master", fmt.Sprintf("%t", claims.IsMaster))
|
|
c.Request.Header.Set("X-Username", claims.Username)
|
|
|
|
c.Next()
|
|
}
|
|
}
|