修复会话安全与实时消息

server/internal/handler/auth.go

@@ -4,9 +4,9 @@ import (
 	"net/http"
 
 	"github.com/gin-gonic/gin"
+	"golang.org/x/crypto/bcrypt"
 	"kefu-sys/server/internal/middleware"
 	"kefu-sys/server/internal/model"
-	"golang.org/x/crypto/bcrypt"
 )
 
 type AuthHandler struct{}
@@ -18,14 +18,6 @@ type LoginReq struct {
 	Password string `json:"password" binding:"required"`
 }
 
-type RegisterReq struct {
-	Username  string `json:"username" binding:"required"`
-	Password  string `json:"password" binding:"required"`
-	Nickname  string `json:"nickname" binding:"required"`
-	TenantID  uint   `json:"tenant_id" binding:"required"`
-	Role      string `json:"role"`
-}
-
 func (h *AuthHandler) Login(c *gin.Context) {
 	var req LoginReq
 	if err := c.ShouldBindJSON(&req); err != nil {
@@ -44,8 +36,8 @@ func (h *AuthHandler) Login(c *gin.Context) {
 		return
 	}
 
-	if user.Status == "disabled" {
-		c.JSON(http.StatusForbidden, gin.H{"code": 403, "message": "账号已被禁用"})
+	if status, message := middleware.ValidateUserAccess(user.ID, user.TenantID, user.Role); status != 0 {
+		c.JSON(status, gin.H{"code": status, "message": message})
 		return
 	}
 
@@ -67,37 +59,3 @@ func (h *AuthHandler) Login(c *gin.Context) {
 		},
 	})
 }
-
-func (h *AuthHandler) Register(c *gin.Context) {
-	var req RegisterReq
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": "参数错误"})
-		return
-	}
-
-	if req.Role == "" {
-		req.Role = "agent"
-	}
-
-	hash, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "加密失败"})
-		return
-	}
-
-	user := model.User{
-		Username:     req.Username,
-		PasswordHash: string(hash),
-		Nickname:     req.Nickname,
-		TenantID:     req.TenantID,
-		Role:         req.Role,
-		Status:       "online",
-	}
-
-	if err := model.DB.Create(&user).Error; err != nil {
-		c.JSON(http.StatusConflict, gin.H{"code": 409, "message": "用户名已存在"})
-		return
-	}
-
-	c.JSON(http.StatusOK, gin.H{"code": 0, "message": "注册成功"})
-}