From a715828a2ac5259a60a57395430bffc58d931b69 Mon Sep 17 00:00:00 2001 From: simonzhangsz Date: Thu, 24 Aug 2023 10:00:27 +0800 Subject: [PATCH] rbac --- features/aaaa/aaaa.go | 2 +- features/dbrest/dbrest.go | 103 +++++++++++++---------------------- features/mml/mml.go | 8 +-- features/security/account.go | 10 ++-- lib/midware/midhandle.go | 42 +++++++++++++- lib/oauth/oauth.go | 11 +++- lib/routes/routes.go | 67 +++++++++++------------ lib/session/session.go | 2 +- 8 files changed, 130 insertions(+), 115 deletions(-) diff --git a/features/aaaa/aaaa.go b/features/aaaa/aaaa.go index 15dc8c41..0893f422 100644 --- a/features/aaaa/aaaa.go +++ b/features/aaaa/aaaa.go @@ -110,7 +110,7 @@ func GetSSOFromAAAA(w http.ResponseWriter, r *http.Request) { services.ResponseInternalServerError500ProcessError(w, err) return } - token := oauth.GenRandToken() // Generate new token to session ID + token := oauth.GenRandToken("aaaa") // Generate new token to session ID affected, err := dborm.XormInsertSession(accid, r.RemoteAddr, token, config.GetExpiresFromConfig(), config.GetYamlConfig().Auth.Session) if err != nil { diff --git a/features/dbrest/dbrest.go b/features/dbrest/dbrest.go index 4afcd3e1..609c9e16 100644 --- a/features/dbrest/dbrest.go +++ b/features/dbrest/dbrest.go @@ -29,26 +29,26 @@ type XormInsertResponse struct { var ( // database management rest pattern， discard - XormGetDataUri = config.DefaultUriPrefix + "/databaseManagement/{apiVersion}/elementType/{databaseName}/objectType/{tableName}" - XormSelectDataUri = config.DefaultUriPrefix + "/databaseManagement/{apiVersion}/select/{databaseName}/{tableName}" - XormInsertDataUri = config.DefaultUriPrefix + "/databaseManagement/{apiVersion}/insert/{databaseName}/{tableName}" - XormUpdateDataUri = config.DefaultUriPrefix + "/databaseManagement/{apiVersion}/update/{databaseName}/{tableName}" - XormDeleteDataUri = config.DefaultUriPrefix + "/databaseManagement/{apiVersion}/delete/{databaseName}/{tableName}" + XormGetDataUri = config.DefaultUriPrefix + "/databaseManagement/{apiVersion}/elementType/{elementTypeValue}/objectType/{objectTypeValue}" + XormSelectDataUri = config.DefaultUriPrefix + "/databaseManagement/{apiVersion}/select/{elementTypeValue}/{objectTypeValue}" + XormInsertDataUri = config.DefaultUriPrefix + "/databaseManagement/{apiVersion}/insert/{elementTypeValue}/{objectTypeValue}" + XormUpdateDataUri = config.DefaultUriPrefix + "/databaseManagement/{apiVersion}/update/{elementTypeValue}/{objectTypeValue}" + XormDeleteDataUri = config.DefaultUriPrefix + "/databaseManagement/{apiVersion}/delete/{elementTypeValue}/{objectTypeValue}" - CustomXormGetDataUri = config.UriPrefix + "/databaseManagement/{apiVersion}/elementType/{databaseName}/objectType/{tableName}" - CustomXormSelectDataUri = config.UriPrefix + "/databaseManagement/{apiVersion}/select/{databaseName}/{tableName}" - CustomXormInsertDataUri = config.UriPrefix + "/databaseManagement/{apiVersion}/insert/{databaseName}/{tableName}" - CustomXormUpdateDataUri = config.UriPrefix + "/databaseManagement/{apiVersion}/update/{databaseName}/{tableName}" - CustomXormDeleteDataUri = config.UriPrefix + "/databaseManagement/{apiVersion}/delete/{databaseName}/{tableName}" + CustomXormGetDataUri = config.UriPrefix + "/databaseManagement/{apiVersion}/elementType/{elementTypeValue}/objectType/{objectTypeValue}" + CustomXormSelectDataUri = config.UriPrefix + "/databaseManagement/{apiVersion}/select/{elementTypeValue}/{objectTypeValue}" + CustomXormInsertDataUri = config.UriPrefix + "/databaseManagement/{apiVersion}/insert/{elementTypeValue}/{objectTypeValue}" + CustomXormUpdateDataUri = config.UriPrefix + "/databaseManagement/{apiVersion}/update/{elementTypeValue}/{objectTypeValue}" + CustomXormDeleteDataUri = config.UriPrefix + "/databaseManagement/{apiVersion}/delete/{elementTypeValue}/{objectTypeValue}" - XormCommonUri = config.DefaultUriPrefix + "/databaseManagement/{apiVersion}/{databaseName}/{tableName}" // for internal - XormDatabaseUri = config.DefaultUriPrefix + "/database/{apiVersion}/{databaseName}/{tableName}" // for crontask - XormExtDataUri = config.DefaultUriPrefix + "/dataManagement/{apiVersion}/{dataStorage}/{dataObject}" // for external - XormDataSQLUri = config.DefaultUriPrefix + "/dataManagement/{apiVersion}/{dataStorage}/{dataObject}" // for external + XormCommonUri = config.DefaultUriPrefix + "/databaseManagement/{apiVersion}/{elementTypeValue}/{objectTypeValue}" // for internal + XormDatabaseUri = config.DefaultUriPrefix + "/database/{apiVersion}/{elementTypeValue}/{objectTypeValue}" // for crontask + XormExtDataUri = config.DefaultUriPrefix + "/dataManagement/{apiVersion}/{elementTypeValue}/{objectTypeValue}" // for external + XormDataSQLUri = config.DefaultUriPrefix + "/dataManagement/{apiVersion}/{elementTypeValue}/{objectTypeValue}" // for external - CustomXormCommonUri = config.UriPrefix + "/databaseManagement/{apiVersion}/{databaseName}/{tableName}" // for internal - CustomXormExtDataUri = config.UriPrefix + "/dataManagement/{apiVersion}/{dataStorage}/{dataObject}" // for external - CustomXormDataSQLUri = config.UriPrefix + "/dataManagement/{apiVersion}/{dataStorage}/{dataObject}" // for external + CustomXormCommonUri = config.UriPrefix + "/databaseManagement/{apiVersion}/{elementTypeValue}/{objectTypeValue}" // for internal + CustomXormExtDataUri = config.UriPrefix + "/dataManagement/{apiVersion}/{elementTypeValue}/{objectTypeValue}" // for external + CustomXormDataSQLUri = config.UriPrefix + "/dataManagement/{apiVersion}/{elementTypeValue}/{objectTypeValue}" // for external // 查询数据库连接情况 UriDbConnection = config.DefaultUriPrefix + "/dataManagement/{apiVersion}/dbConnection" @@ -58,33 +58,6 @@ var ( var xormResponse XormResponse -// func init() { -// // database management -// routes.Register("GET", XormGetDataUri, DatabaseGetData, nil) -// routes.Register("GET", XormSelectDataUri, DatabaseGetData, nil) -// routes.Register("POST", XormInsertDataUri, DatabaseInsertData, nil) -// routes.Register("PUT", XormUpdateDataUri, DatabaseUpdateData, nil) -// routes.Register("DELETE", XormDeleteDataUri, DatabaseDeleteData, nil) -// // corss orgin domain -// routes.Register("OPTIONS", XormGetDataUri, routes.OptionsProc, nil) -// routes.Register("OPTIONS", XormSelectDataUri, routes.OptionsProc, nil) -// routes.Register("OPTIONS", XormInsertDataUri, routes.OptionsProc, nil) -// routes.Register("OPTIONS", XormUpdateDataUri, routes.OptionsProc, nil) -// routes.Register("OPTIONS", XormDeleteDataUri, routes.OptionsProc, nil) - -// routes.Register("GET", XormCommonUri, DatabaseGetData, nil) -// routes.Register("POST", XormCommonUri, DatabaseInsertData, nil) -// routes.Register("PUT", XormCommonUri, DatabaseUpdateData, nil) -// routes.Register("DELETE", XormCommonUri, DatabaseDeleteData, nil) - -// // corss orgin domain -// routes.Register("OPTIONS", XormInsertDataUri, routes.OptionsProc, nil) -// routes.Register("OPTIONS", XormUpdateDataUri, routes.OptionsProc, nil) -// routes.Register("OPTIONS", XormDeleteDataUri, routes.OptionsProc, nil) - -// routes.Register("OPTIONS", XormCommonUri, routes.OptionsProc, nil) -// } - var XEngine *xorm.Engine type DatabaseClient struct { @@ -203,7 +176,7 @@ func ExtDatabaseExecSQL(w http.ResponseWriter, r *http.Request) { } //vars := mux.Vars(r) - //tblName := vars["dataObject"] + //tblName := vars["objectTypeValue"] sql = GetUriSQLArray(r) // select as must, todo ... @@ -263,9 +236,9 @@ func ExtDatabaseGetData(w http.ResponseWriter, r *http.Request) { pack := "dbrest" vars := mux.Vars(r) - module := vars["managementModule"] - dbname := vars["dataStorage"] - tbname := vars["dataObject"] + module := "" + dbname := vars["elementTypeValue"] + tbname := vars["objectTypeValue"] log.Debugf("token:%s, method:%s, dbname:%s, tbname:%s", token, r.Method, module, dbname, tbname, pack) @@ -352,9 +325,9 @@ func ExtDatabaseInsertData(w http.ResponseWriter, r *http.Request) { } vars := mux.Vars(r) - module := vars["managementModule"] - dbname := vars["dataStorage"] - tbname := vars["dataObject"] + module := "" + dbname := vars["elementTypeValue"] + tbname := vars["objectTypeValue"] pack := "dbrest" log.Debugf("token:%s, method:%s, dbname:%s, tbname:%s pack:%s", token, r.Method, module, dbname, tbname, pack) @@ -408,9 +381,9 @@ func ExtDatabaseUpdateData(w http.ResponseWriter, r *http.Request) { } vars := mux.Vars(r) - module := vars["managementModule"] - dbname := vars["dataStorage"] - tbname := vars["dataObject"] + module := "" + dbname := vars["elementTypeValue"] + tbname := vars["objectTypeValue"] pack := "dbrest" log.Debugf("token:%s, method:%s, dbname:%s, tbname:%s pack:%s", token, r.Method, module, dbname, tbname, pack) @@ -471,9 +444,9 @@ func ExtDatabaseDeleteData(w http.ResponseWriter, r *http.Request) { } vars := mux.Vars(r) - module := vars["managementModule"] - dbname := vars["dataStorage"] - tbname := vars["dataObject"] + module := "" + dbname := vars["elementTypeValue"] + tbname := vars["objectTypeValue"] pack := "dbreset" log.Debugf("token:%s, method:%s, module:%, dbname:%s, tbname:%s pack:%s", token, r.Method, module, dbname, tbname, pack) @@ -524,7 +497,7 @@ func DatabaseGetData(w http.ResponseWriter, r *http.Request) { } vars := mux.Vars(r) - tblName := vars["tableName"] + tblName := vars["objectTypeValue"] sql = GetUriSQLArray(r) // select as must, todo ... @@ -591,7 +564,7 @@ func DatabaseInsertData(w http.ResponseWriter, r *http.Request) { } vars := mux.Vars(r) - tableName := vars["tableName"] + tableName := vars["objectTypeValue"] log.Debug("Request body:", string(body), "tableName:", tableName) insertData := make(map[string]interface{}) _ = json.Unmarshal(body, &insertData) @@ -631,7 +604,7 @@ func DatabaseUpdateData(w http.ResponseWriter, r *http.Request) { } vars := mux.Vars(r) - tblName := vars["tableName"] + tblName := vars["objectTypeValue"] wc := services.GetUriWhereString(r) log.Debug("Request body:", string(body), "Table name:", tblName, "wc:", wc) @@ -664,7 +637,7 @@ func DatabaseDeleteData(w http.ResponseWriter, r *http.Request) { log.Debug("DatabaseDeleteData processing... ") vars := mux.Vars(r) - tblName := vars["tableName"] + tblName := vars["objectTypeValue"] wc := services.GetUriWhereString(r) log.Debug("Table name:", tblName, "wc:", wc) @@ -743,7 +716,7 @@ func TaskDatabaseGetData(w http.ResponseWriter, r *http.Request) { var err error vars := mux.Vars(r) - tblName := vars["tableName"] + tblName := vars["objectTypeValue"] sql = GetUriSQLArray(r) // select as must, todo ... @@ -810,7 +783,7 @@ func TaskDatabaseInsertData(w http.ResponseWriter, r *http.Request) { } vars := mux.Vars(r) - tableName := vars["tableName"] + tableName := vars["objectTypeValue"] log.Debug("Request body:", string(body), "tableName:", tableName) insertData := make(map[string]interface{}) _ = json.Unmarshal(body, &insertData) @@ -850,7 +823,7 @@ func TaskDatabaseUpdateData(w http.ResponseWriter, r *http.Request) { } vars := mux.Vars(r) - tblName := vars["tableName"] + tblName := vars["objectTypeValue"] wc := services.GetUriWhereString(r) log.Debug("Request body:", string(body), "Table name:", tblName, "wc:", wc) @@ -883,7 +856,7 @@ func TaskDatabaseDeleteData(w http.ResponseWriter, r *http.Request) { log.Debug("DatabaseDeleteData processing... ") vars := mux.Vars(r) - tblName := vars["tableName"] + tblName := vars["objectTypeValue"] wc := services.GetUriWhereString(r) log.Debug("Table name:", tblName, "wc:", wc) diff --git a/features/mml/mml.go b/features/mml/mml.go index c49dccc3..9bcf020f 100644 --- a/features/mml/mml.go +++ b/features/mml/mml.go @@ -36,9 +36,9 @@ type MMLRequest struct { var ( // MML interface - UriMML = config.DefaultUriPrefix + "/{managementModule}/{apiVersion}/elementType/{elementTypeValue}/objectType/mml" + UriMML = config.DefaultUriPrefix + "/operationManagement/{apiVersion}/elementType/{elementTypeValue}/objectType/mml" UriNeOmMml = config.DefaultUriPrefix + "/omManagement/{apiVersion}/mml/{netype}/{neid}" - UriOmMmlExt = config.DefaultUriPrefix + "/{managementModule}/{apiVersion}/elementType/OMC/objectType/mml" + UriOmMmlExt = config.DefaultUriPrefix + "/{managedType}/{apiVersion}/elementType/OMC/objectType/mml" UriOmMmlInt = config.DefaultUriPrefix + "/omManagement/{apiVersion}/mml/{neType}/{neId}" CustomUriMML = config.UriPrefix + "/operationManagement/{apiVersion}/elementType/{elementTypeValue}/objectType/mml" @@ -58,7 +58,7 @@ func PostMMLToNF(w http.ResponseWriter, r *http.Request) { } pack := "mml" vars := mux.Vars(r) - module := vars["managementModule"] + module := vars["managedType"] neType := vars["elementTypeValue"] params := r.URL.Query() neId := params["ne_id"] @@ -69,7 +69,7 @@ func PostMMLToNF(w http.ResponseWriter, r *http.Request) { } log.Debug("neType:", neType, "neId", neId) - log.Debugf("token:%s, method:%s, managementModule:%s dbname:%s, tbname:%s pack:%s", + log.Debugf("token:%s, method:%s, managementType:%s dbname:%s, tbname:%s pack:%s", token, r.Method, module, neType, neId[0], pack) var buf [8192]byte diff --git a/features/security/account.go b/features/security/account.go index 3ce5c7cb..a9475074 100644 --- a/features/security/account.go +++ b/features/security/account.go @@ -14,11 +14,11 @@ import ( ) var ( - UriOauthToken = config.DefaultUriPrefix + "/securityManagement/{apiVersion}/oauth/token" - UriOauthHandshake = config.DefaultUriPrefix + "/securityManagement/{apiVersion}/oauth/handshake" + UriOauthToken = config.DefaultUriPrefix + "/securityManagement/{apiVersion}/{elementTypeValue}/token" + UriOauthHandshake = config.DefaultUriPrefix + "/securityManagement/{apiVersion}/{elementTypeValue}/handshake" - CustomUriOauthToken = config.UriPrefix + "/securityManagement/{apiVersion}/oauth/token" - CustomUriOauthHandshake = config.UriPrefix + "/securityManagement/{apiVersion}/oauth/handshake" + CustomUriOauthToken = config.UriPrefix + "/securityManagement/{apiVersion}/{elementTypeValue}/token" + CustomUriOauthHandshake = config.UriPrefix + "/securityManagement/{apiVersion}/{elementTypeValue}/handshake" ) func LoginFromOMC(w http.ResponseWriter, r *http.Request) { @@ -87,7 +87,7 @@ func LoginFromOMC(w http.ResponseWriter, r *http.Request) { return } - token := oauth.GenRandToken() // Generate new token to session ID + token := oauth.GenRandToken("omc") // Generate new token to session ID sourceAddr := r.RemoteAddr affected, err := dborm.XormInsertSession(oAuthBody.UserName, sourceAddr, token, config.GetExpiresFromConfig(), config.GetYamlConfig().Auth.Session) diff --git a/lib/midware/midhandle.go b/lib/midware/midhandle.go index 26cadaae..eb7be9af 100644 --- a/lib/midware/midhandle.go +++ b/lib/midware/midhandle.go @@ -2,12 +2,14 @@ package midware import ( "net/http" + "strings" "ems.agt/lib/log" "ems.agt/lib/services" + "github.com/gorilla/mux" ) -func LoggerTraceMiddleware(next http.Handler) http.Handler { +func LoggerTrace(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { // Do stuff here log.Trace("Http Trace Info:") @@ -26,10 +28,48 @@ func LoggerTraceMiddleware(next http.Handler) http.Handler { //r.Body = ioutil.NopCloser(bytes.NewReader(body)) //log.Trace("Body:", string(body)) // Call the next handler, which can be another middleware in the chain, or the final handler. + // if r.Method == "OPTIONS" { + // services.ResponseStatusOK201Accepted(w) + // return + // } + + next.ServeHTTP(w, r) + }) +} + +func OptionProcess(next http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { if r.Method == "OPTIONS" { services.ResponseStatusOK201Accepted(w) return } + + next.ServeHTTP(w, r) + }) +} + +func CheckPermission(next http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + token := r.Header.Get("AccessToken") + vars := mux.Vars(r) + management := vars["managedType"] + element := vars["elementTypeValue"] + object := vars["objectTypeValue"] + pack := "*" + if token != "" && element != "oauth" { + log.Debugf("token:%s, method:%s, management:%s, element:%s, object:%s, pack:%s", token, r.Method, management, element, object, pack) + exist, err := services.CheckUserPermission(token, strings.ToLower(r.Method), management, element, object, pack) + if err != nil { + log.Error("Failed to get permission:", err) + services.ResponseForbidden403NotPermission(w) + return + } + if !exist { + log.Error("Not permission!") + services.ResponseForbidden403NotPermission(w) + return + } + } next.ServeHTTP(w, r) }) } diff --git a/lib/oauth/oauth.go b/lib/oauth/oauth.go index 77829269..4cabf08a 100644 --- a/lib/oauth/oauth.go +++ b/lib/oauth/oauth.go @@ -78,9 +78,14 @@ func RandStringBytes(n int) string { return string(b) } -func GenRandToken() string { - return RandStringBytes(8) + "-" + RandStringBytes(4) + "-" + - RandStringBytes(4) + "-" + RandStringBytes(4) + "-" + RandStringBytes(12) +func GenRandToken(prefix string) string { + if prefix == "" { + return RandStringBytes(8) + "-" + RandStringBytes(4) + "-" + + RandStringBytes(4) + "-" + RandStringBytes(4) + "-" + RandStringBytes(12) + } else { + return prefix + "-" + RandStringBytes(8) + "-" + RandStringBytes(4) + "-" + + RandStringBytes(4) + "-" + RandStringBytes(4) + "-" + RandStringBytes(12) + } } type OAuthBody struct { diff --git a/lib/routes/routes.go b/lib/routes/routes.go index c5298d76..fb080b03 100644 --- a/lib/routes/routes.go +++ b/lib/routes/routes.go @@ -59,46 +59,42 @@ func init() { Register("GET", state.CustomUriLicenseInfoOne, state.GetOneLicenseInfoFromNF, nil) // database management - Register("GET", dbrest.XormGetDataUri, dbrest.DatabaseGetData, nil) - Register("GET", dbrest.XormSelectDataUri, dbrest.DatabaseGetData, nil) - Register("POST", dbrest.XormInsertDataUri, dbrest.DatabaseInsertData, nil) - Register("PUT", dbrest.XormUpdateDataUri, dbrest.DatabaseUpdateData, nil) - Register("DELETE", dbrest.XormDeleteDataUri, dbrest.DatabaseDeleteData, nil) + Register("GET", dbrest.XormGetDataUri, dbrest.DatabaseGetData, midware.CheckPermission) + Register("GET", dbrest.XormSelectDataUri, dbrest.DatabaseGetData, midware.CheckPermission) + Register("POST", dbrest.XormInsertDataUri, dbrest.DatabaseInsertData, midware.CheckPermission) + Register("PUT", dbrest.XormUpdateDataUri, dbrest.DatabaseUpdateData, midware.CheckPermission) + Register("DELETE", dbrest.XormDeleteDataUri, dbrest.DatabaseDeleteData, midware.CheckPermission) - Register("GET", dbrest.CustomXormGetDataUri, dbrest.DatabaseGetData, nil) - Register("GET", dbrest.CustomXormSelectDataUri, dbrest.DatabaseGetData, nil) - Register("POST", dbrest.CustomXormInsertDataUri, dbrest.DatabaseInsertData, nil) - Register("PUT", dbrest.CustomXormUpdateDataUri, dbrest.DatabaseUpdateData, nil) - Register("DELETE", dbrest.CustomXormDeleteDataUri, dbrest.DatabaseDeleteData, nil) - // 系统备份-数据库备份 - Register("POST", dbrest.UriDbBackup, dbrest.DbBackup, nil) - // 系统备份-文件备份 - Register("POST", dbrest.UriConfBackup, dbrest.ConfBackup, nil) + Register("GET", dbrest.CustomXormGetDataUri, dbrest.DatabaseGetData, midware.CheckPermission) + Register("GET", dbrest.CustomXormSelectDataUri, dbrest.DatabaseGetData, midware.CheckPermission) + Register("POST", dbrest.CustomXormInsertDataUri, dbrest.DatabaseInsertData, midware.CheckPermission) + Register("PUT", dbrest.CustomXormUpdateDataUri, dbrest.DatabaseUpdateData, midware.CheckPermission) + Register("DELETE", dbrest.CustomXormDeleteDataUri, dbrest.DatabaseDeleteData, midware.CheckPermission) - Register("GET", dbrest.XormCommonUri, dbrest.DatabaseGetData, nil) - Register("POST", dbrest.XormCommonUri, dbrest.DatabaseInsertData, nil) - Register("PUT", dbrest.XormCommonUri, dbrest.DatabaseUpdateData, nil) - Register("DELETE", dbrest.XormCommonUri, dbrest.DatabaseDeleteData, nil) + Register("GET", dbrest.XormCommonUri, dbrest.DatabaseGetData, midware.CheckPermission) + Register("POST", dbrest.XormCommonUri, dbrest.DatabaseInsertData, midware.CheckPermission) + Register("PUT", dbrest.XormCommonUri, dbrest.DatabaseUpdateData, midware.CheckPermission) + Register("DELETE", dbrest.XormCommonUri, dbrest.DatabaseDeleteData, midware.CheckPermission) - Register("GET", dbrest.XormDatabaseUri, dbrest.TaskDatabaseGetData, nil) - Register("POST", dbrest.XormDatabaseUri, dbrest.TaskDatabaseInsertData, nil) - Register("PUT", dbrest.XormDatabaseUri, dbrest.TaskDatabaseUpdateData, nil) - Register("DELETE", dbrest.XormDatabaseUri, dbrest.TaskDatabaseDeleteData, nil) + Register("GET", dbrest.XormDatabaseUri, dbrest.TaskDatabaseGetData, midware.CheckPermission) + Register("POST", dbrest.XormDatabaseUri, dbrest.TaskDatabaseInsertData, midware.CheckPermission) + Register("PUT", dbrest.XormDatabaseUri, dbrest.TaskDatabaseUpdateData, midware.CheckPermission) + Register("DELETE", dbrest.XormDatabaseUri, dbrest.TaskDatabaseDeleteData, midware.CheckPermission) - Register("GET", dbrest.CustomXormCommonUri, dbrest.DatabaseGetData, nil) - Register("POST", dbrest.CustomXormCommonUri, dbrest.DatabaseInsertData, nil) - Register("PUT", dbrest.CustomXormCommonUri, dbrest.DatabaseUpdateData, nil) - Register("DELETE", dbrest.CustomXormCommonUri, dbrest.DatabaseDeleteData, nil) + Register("GET", dbrest.CustomXormCommonUri, dbrest.DatabaseGetData, midware.CheckPermission) + Register("POST", dbrest.CustomXormCommonUri, dbrest.DatabaseInsertData, midware.CheckPermission) + Register("PUT", dbrest.CustomXormCommonUri, dbrest.DatabaseUpdateData, midware.CheckPermission) + Register("DELETE", dbrest.CustomXormCommonUri, dbrest.DatabaseDeleteData, midware.CheckPermission) - Register("GET", dbrest.XormExtDataUri, dbrest.ExtDatabaseGetData, nil) - Register("POST", dbrest.XormExtDataUri, dbrest.ExtDatabaseInsertData, nil) - Register("PUT", dbrest.XormExtDataUri, dbrest.ExtDatabaseUpdateData, nil) - Register("DELETE", dbrest.XormExtDataUri, dbrest.ExtDatabaseDeleteData, nil) + Register("GET", dbrest.XormExtDataUri, dbrest.ExtDatabaseGetData, midware.CheckPermission) + Register("POST", dbrest.XormExtDataUri, dbrest.ExtDatabaseInsertData, midware.CheckPermission) + Register("PUT", dbrest.XormExtDataUri, dbrest.ExtDatabaseUpdateData, midware.CheckPermission) + Register("DELETE", dbrest.XormExtDataUri, dbrest.ExtDatabaseDeleteData, midware.CheckPermission) - Register("GET", dbrest.CustomXormExtDataUri, dbrest.ExtDatabaseGetData, nil) - Register("POST", dbrest.CustomXormExtDataUri, dbrest.ExtDatabaseInsertData, nil) - Register("PUT", dbrest.CustomXormExtDataUri, dbrest.ExtDatabaseUpdateData, nil) - Register("DELETE", dbrest.CustomXormExtDataUri, dbrest.ExtDatabaseDeleteData, nil) + Register("GET", dbrest.CustomXormExtDataUri, dbrest.ExtDatabaseGetData, midware.CheckPermission) + Register("POST", dbrest.CustomXormExtDataUri, dbrest.ExtDatabaseInsertData, midware.CheckPermission) + Register("PUT", dbrest.CustomXormExtDataUri, dbrest.ExtDatabaseUpdateData, midware.CheckPermission) + Register("DELETE", dbrest.CustomXormExtDataUri, dbrest.ExtDatabaseDeleteData, midware.CheckPermission) // alarm restful Register Register("POST", fm.UriAlarms, fm.PostAlarmFromNF, nil) @@ -267,7 +263,8 @@ func NewRouter() *mux.Router { r.NotFoundHandler = services.CustomResponseNotFound404Handler() r.MethodNotAllowedHandler = services.CustomResponseMethodNotAllowed405Handler() - r.Use(midware.LoggerTraceMiddleware) + r.Use(midware.LoggerTrace) + r.Use(midware.OptionProcess) for _, router := range routers { r.Methods(router.Method). diff --git a/lib/session/session.go b/lib/session/session.go index 32d7b7b6..1d186752 100644 --- a/lib/session/session.go +++ b/lib/session/session.go @@ -43,7 +43,7 @@ func NewSessManager(name string) *SessManager { func (smgr *SessManager) NewSession(w http.ResponseWriter, r *http.Request, plist []bool) string { smgr.lock.Lock() defer smgr.lock.Unlock() - token := oauth.GenRandToken() // Generate new token to session ID + token := oauth.GenRandToken("omc") // Generate new token to session ID session := &Session{token: token, time: time.Now(), permission: plist, values: make(map[interface{}]interface{})} smgr.sessions[token] = session