1f4ccfb54e
- JWT claims extended with tenantId; login enforces strict tenant verification - AuthorityMiddleware: tenant scope check + Casbin path permission + anti-spoofing - CRM relation API (upstream/downstream one-hop, create/update/history, full graph) - CrmRepo backed by PostgreSQL with $N placeholders - gRPC tenant propagation via UnaryClientInterceptor (x-tenant-id metadata) - All legacy tables (12) gain tenant_id column with indexes - All model queries inject WHERE tenant_id filter - Casbin gorm-adapter downgraded to v3.28.0 for v2 compatibility - GraphSyncWorker (Kafka -> Neo4j) with idempotent MERGE - Full graph API restricted to admin role only - Database migrations for MySQL (CRM tables + tenant columns) and PostgreSQL (CRM init) - Docker Compose: added postgres service to main stack, graph stack with Kafka/Debezium/Neo4j Made-with: Cursor
71 lines
1.5 KiB
Go
71 lines
1.5 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
|
|
"muyu-apiserver/gateway/internal/svc"
|
|
"muyu-apiserver/gateway/internal/types"
|
|
jwtpkg "muyu-apiserver/pkg/jwt"
|
|
"muyu-apiserver/rpc/system/pb"
|
|
|
|
"github.com/zeromicro/go-zero/core/logx"
|
|
)
|
|
|
|
type LoginLogic struct {
|
|
logx.Logger
|
|
ctx context.Context
|
|
svcCtx *svc.ServiceContext
|
|
}
|
|
|
|
func NewLoginLogic(ctx context.Context, svcCtx *svc.ServiceContext) *LoginLogic {
|
|
return &LoginLogic{
|
|
Logger: logx.WithContext(ctx),
|
|
ctx: ctx,
|
|
svcCtx: svcCtx,
|
|
}
|
|
}
|
|
|
|
func (l *LoginLogic) Login(req *types.LoginReq) (resp *types.LoginResp, err error) {
|
|
rpcResp, err := l.svcCtx.SystemRpc.Login(l.ctx, &pb.LoginReq{
|
|
Username: req.Username,
|
|
Password: req.Password,
|
|
})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if req.TenantId == "" {
|
|
return nil, errors.New("请选择要登录的租户")
|
|
}
|
|
|
|
verified, verr := l.svcCtx.CrmRepo.VerifyUserTenant(l.ctx, rpcResp.UserId, req.TenantId)
|
|
if verr != nil || !verified {
|
|
return nil, errors.New("用户不属于该租户，禁止登录")
|
|
}
|
|
tenantId := req.TenantId
|
|
|
|
token, err := jwtpkg.GenerateToken(
|
|
l.svcCtx.Config.Auth.AccessSecret,
|
|
l.svcCtx.Config.Auth.AccessExpire,
|
|
rpcResp.UserId,
|
|
rpcResp.RoleKey,
|
|
tenantId,
|
|
)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return &types.LoginResp{
|
|
Token: token,
|
|
UserInfo: types.UserInfo{
|
|
UserId: rpcResp.UserId,
|
|
Username: rpcResp.Username,
|
|
RealName: rpcResp.RealName,
|
|
Avatar: rpcResp.Avatar,
|
|
RoleName: rpcResp.RoleName,
|
|
TenantId: tenantId,
|
|
},
|
|
}, nil
|
|
}
|