实现多商户履约平台基础

backend/internal/middleware/auth.go

@@ -5,14 +5,16 @@ import (
 
 	"affiliate_dash/internal/pkg/jwt"
 	"affiliate_dash/internal/pkg/response"
+	"affiliate_dash/internal/service"
 
 	"github.com/gin-gonic/gin"
 )
 
 const (
-	CtxUserID   = "user_id"
-	CtxUsername = "username"
-	CtxRole     = "role"
+	CtxUserID       = "user_id"
+	CtxUsername     = "username"
+	CtxRole         = "role"
+	CtxMerchantRole = "merchant_role"
 )
 
 func Auth(jm *jwt.Manager) gin.HandlerFunc {
@@ -70,3 +72,42 @@ func GetRole(c *gin.Context) string {
 	role, _ := v.(string)
 	return role
 }
+
+// Tenant 根据 X-Merchant-ID（商户 ID 或编码）解析当前后台请求所属商户。
+// 未指定时选择该账号的默认商户，确保旧后台继续落到“自营商户”。
+func Tenant(tenantSvc *service.TenantService) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		member, err := tenantSvc.ResolveMember(GetUserID(c), c.GetHeader("X-Merchant-ID"))
+		if err != nil {
+			response.Forbidden(c, err.Error())
+			c.Abort()
+			return
+		}
+		c.Set(CtxMerchantID, member.MerchantID)
+		c.Set(CtxMerchantRole, member.Role)
+		c.Next()
+	}
+}
+
+func RequireMerchantRole(roles ...string) gin.HandlerFunc {
+	allowed := make(map[string]struct{}, len(roles))
+	for _, role := range roles {
+		allowed[role] = struct{}{}
+	}
+	return func(c *gin.Context) {
+		value, _ := c.Get(CtxMerchantRole)
+		role, _ := value.(string)
+		if _, ok := allowed[role]; !ok {
+			response.Forbidden(c, "商户权限不足")
+			c.Abort()
+			return
+		}
+		c.Next()
+	}
+}
+
+func GetMerchantRole(c *gin.Context) string {
+	value, _ := c.Get(CtxMerchantRole)
+	role, _ := value.(string)
+	return role
+}