搭建Go后端框架：数据模型、JWT鉴权、租户隔离、WebSocket、REST API路由

server/internal/middleware/auth.go

@@ -0,0 +1,126 @@
+package middleware
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+)
+
+var jwtSecret []byte
+
+func InitJWT(secret string) {
+	jwtSecret = []byte(secret)
+}
+
+type Claims struct {
+	UserID   uint   `json:"user_id"`
+	TenantID uint   `json:"tenant_id"`
+	Role     string `json:"role"`
+	jwt.RegisteredClaims
+}
+
+func GenerateToken(userID, tenantID uint, role string) (string, error) {
+	claims := Claims{
+		UserID:   userID,
+		TenantID: tenantID,
+		Role:     role,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(24 * time.Hour)),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	return token.SignedString(jwtSecret)
+}
+
+func AuthRequired() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		auth := c.GetHeader("Authorization")
+		if auth == "" || !strings.HasPrefix(auth, "Bearer ") {
+			c.JSON(http.StatusUnauthorized, gin.H{"code": 401, "message": "未授权"})
+			c.Abort()
+			return
+		}
+
+		tokenStr := strings.TrimPrefix(auth, "Bearer ")
+		token, err := jwt.ParseWithClaims(tokenStr, &Claims{}, func(t *jwt.Token) (interface{}, error) {
+			return jwtSecret, nil
+		})
+		if err != nil || !token.Valid {
+			c.JSON(http.StatusUnauthorized, gin.H{"code": 401, "message": "token无效"})
+			c.Abort()
+			return
+		}
+
+		claims := token.Claims.(*Claims)
+		c.Set("user_id", claims.UserID)
+		c.Set("tenant_id", claims.TenantID)
+		c.Set("role", claims.Role)
+		c.Next()
+	}
+}
+
+func AdminRequired() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		role, _ := c.Get("role")
+		if role != "admin" && role != "platform_admin" {
+			c.JSON(http.StatusForbidden, gin.H{"code": 403, "message": "无权限"})
+			c.Abort()
+			return
+		}
+		c.Next()
+	}
+}
+
+func PlatformRequired() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		role, _ := c.Get("role")
+		if role != "platform_admin" {
+			c.JSON(http.StatusForbidden, gin.H{"code": 403, "message": "仅平台管理员可操作"})
+			c.Abort()
+			return
+		}
+		c.Next()
+	}
+}
+
+func GetTenantID(c *gin.Context) uint {
+	id, _ := c.Get("tenant_id")
+	return id.(uint)
+}
+
+func GetUserID(c *gin.Context) uint {
+	id, _ := c.Get("user_id")
+	return id.(uint)
+}
+
+func GetPageParams(c *gin.Context) (page, pageSize int) {
+	page, _ = strconv.Atoi(c.DefaultQuery("page", "1"))
+	pageSize, _ = strconv.Atoi(c.DefaultQuery("pageSize", "10"))
+	if page < 1 {
+		page = 1
+	}
+	if pageSize < 1 || pageSize > 100 {
+		pageSize = 10
+	}
+	return
+}
+
+func JSON(c *gin.Context, data interface{}) {
+	c.JSON(http.StatusOK, gin.H{"code": 0, "message": "ok", "data": data})
+}
+
+func JSONList(c *gin.Context, list interface{}, total int64, page, pageSize int) {
+	c.JSON(http.StatusOK, gin.H{
+		"code":     0,
+		"message":  "ok",
+		"list":     list,
+		"total":    total,
+		"page":     page,
+		"pageSize": pageSize,
+	})
+}