修复会话安全与实时消息

server/internal/handler/knowledge.go

@@ -12,6 +12,36 @@ type KnowledgeHandler struct{}
 
 func NewKnowledgeHandler() *KnowledgeHandler { return &KnowledgeHandler{} }
 
+func requireKnowledgeManager(c *gin.Context) bool {
+	if middleware.HasAnyRole(c, "admin", "supervisor") {
+		return true
+	}
+	c.JSON(http.StatusForbidden, gin.H{"code": 403, "message": "仅主管或管理员可管理知识库"})
+	return false
+}
+
+func hasKnowledgeCapacity(tenantID uint) (bool, error) {
+	var tenant model.Tenant
+	if err := model.DB.First(&tenant, tenantID).Error; err != nil {
+		return false, err
+	}
+	if tenant.PlanID == nil {
+		return true, nil
+	}
+	var plan model.Plan
+	if err := model.DB.First(&plan, *tenant.PlanID).Error; err != nil {
+		return false, err
+	}
+	if plan.KBLimit == 0 {
+		return true, nil
+	}
+	var count int64
+	if err := model.DB.Model(&model.KnowledgeEntry{}).Where("tenant_id = ?", tenantID).Count(&count).Error; err != nil {
+		return false, err
+	}
+	return count < int64(plan.KBLimit), nil
+}
+
 func (h *KnowledgeHandler) ListCategories(c *gin.Context) {
 	tenantID := middleware.GetTenantID(c)
 
@@ -22,6 +52,9 @@ func (h *KnowledgeHandler) ListCategories(c *gin.Context) {
 }
 
 func (h *KnowledgeHandler) CreateCategory(c *gin.Context) {
+	if !requireKnowledgeManager(c) {
+		return
+	}
 	var category model.Category
 	if err := c.ShouldBindJSON(&category); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": "参数错误"})
@@ -65,12 +98,29 @@ func (h *KnowledgeHandler) ListEntries(c *gin.Context) {
 }
 
 func (h *KnowledgeHandler) CreateEntry(c *gin.Context) {
+	if !requireKnowledgeManager(c) {
+		return
+	}
 	var entry model.KnowledgeEntry
 	if err := c.ShouldBindJSON(&entry); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": "参数错误"})
 		return
 	}
 	entry.TenantID = middleware.GetTenantID(c)
+	available, err := hasKnowledgeCapacity(entry.TenantID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "校验知识库容量失败"})
+		return
+	}
+	if !available {
+		c.JSON(http.StatusConflict, gin.H{"code": 409, "message": "当前套餐知识库容量已达上限"})
+		return
+	}
+	var category model.Category
+	if err := model.DB.Where("id = ? AND tenant_id = ?", entry.CategoryID, entry.TenantID).First(&category).Error; err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": "知识分类不存在"})
+		return
+	}
 
 	if err := model.DB.Create(&entry).Error; err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "创建失败"})
@@ -81,6 +131,9 @@ func (h *KnowledgeHandler) CreateEntry(c *gin.Context) {
 }
 
 func (h *KnowledgeHandler) UpdateEntry(c *gin.Context) {
+	if !requireKnowledgeManager(c) {
+		return
+	}
 	tenantID := middleware.GetTenantID(c)
 	id := c.Param("id")
 
@@ -96,14 +149,36 @@ func (h *KnowledgeHandler) UpdateEntry(c *gin.Context) {
 		return
 	}
 
-	delete(updates, "tenant_id")
-	delete(updates, "id")
+	allowed := map[string]bool{"category_id": true, "title": true, "content": true, "status": true}
+	for key := range updates {
+		if !allowed[key] {
+			delete(updates, key)
+		}
+	}
+	if categoryID, exists := updates["category_id"]; exists {
+		var category model.Category
+		if err := model.DB.Where("id = ? AND tenant_id = ?", categoryID, tenantID).First(&category).Error; err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": "知识分类不存在"})
+			return
+		}
+	}
+	if len(updates) == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": "没有可更新字段"})
+		return
+	}
 
-	model.DB.Model(&entry).Updates(updates)
+	if err := model.DB.Model(&entry).Updates(updates).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "更新失败"})
+		return
+	}
+	model.DB.First(&entry, entry.ID)
 	middleware.JSON(c, entry)
 }
 
 func (h *KnowledgeHandler) DeleteEntry(c *gin.Context) {
+	if !requireKnowledgeManager(c) {
+		return
+	}
 	tenantID := middleware.GetTenantID(c)
 	id := c.Param("id")