优化客服云权限安全与访客IP解析

2026-08-31 13:43:45 +08:00
parent 523a306d5e
commit bdf67395ab
24 changed files with 365 additions and 48 deletions
@@ -24,9 +24,9 @@ const (
 	defaultAgentNickname  = "在线客服"
 	defaultTimezone       = "Asia/Shanghai"

-	maxWelcomeSegments   = 10
-	maxWelcomeTextLen    = 1000 // 纯文字上限（HTML 标签不计）
-	maxWelcomeHTMLLen    = 8000 // 富文本原始 HTML 上限
+	maxWelcomeSegments = 10
+	maxWelcomeTextLen  = 1000 // 纯文字上限（HTML 标签不计）
+	maxWelcomeHTMLLen  = 8000 // 富文本原始 HTML 上限
 )

 // stripHTMLTags 粗暴去标签，用于字数与摘要（欢迎语 HTML）。
@@ -54,7 +54,7 @@ func stripHTMLTags(s string) string {

 // WelcomeSegment 单段欢迎语：文本或图片（content 为正文或对象存储 URL）。
 type WelcomeSegment struct {
-	Type    string `json:"type"`    // text | image
+	Type    string `json:"type"` // text | image
 	Content string `json:"content"`
 }

@@ -311,20 +311,20 @@ func settingsResponse(setting *model.TenantSetting) gin.H {
 	}
 	welcomeSegs := resolveWelcomeSegments(setting)
 	return gin.H{
-		"tenant_id":             setting.TenantID,
-		"display_name":          setting.DisplayName,
-		"agent_nickname":        setting.AgentNickname,
-		"timezone":              setting.Timezone,
-		"welcome_message":       firstWelcomeText(welcomeSegs),
-		"welcome_messages":      welcomeSegs,
-		"offline_prompt":        setting.OfflinePrompt,
-		"work_hours":            parseWorkHours(setting.WorkHoursJSON),
-		"worktime_prompt":       setting.WorktimePrompt,
-		"notify_new_session":    setting.NotifyNewSession,
-		"notify_offline_leave":  setting.NotifyOfflineLeave,
-		"notify_daily_report":   setting.NotifyDailyReport,
-		"assign_strategy":       strategy,
-		"max_active_per_agent":  maxActive,
+		"tenant_id":            setting.TenantID,
+		"display_name":         setting.DisplayName,
+		"agent_nickname":       setting.AgentNickname,
+		"timezone":             setting.Timezone,
+		"welcome_message":      firstWelcomeText(welcomeSegs),
+		"welcome_messages":     welcomeSegs,
+		"offline_prompt":       setting.OfflinePrompt,
+		"work_hours":           parseWorkHours(setting.WorkHoursJSON),
+		"worktime_prompt":      setting.WorktimePrompt,
+		"notify_new_session":   setting.NotifyNewSession,
+		"notify_offline_leave": setting.NotifyOfflineLeave,
+		"notify_daily_report":  setting.NotifyDailyReport,
+		"assign_strategy":      strategy,
+		"max_active_per_agent": maxActive,
 	}
 }

@@ -379,6 +379,31 @@ func (h *SettingsHandler) Update(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": "参数错误"})
 		return
 	}
+	// 设置权限按字段分区校验，避免仅拥有基本设置权限即可修改分配、工作时间或通知策略。
+	if req.AssignStrategy != nil || req.MaxActivePerAgent != nil {
+		if !middleware.HasPermission(c, "settings.assign_rule") {
+			c.JSON(http.StatusForbidden, gin.H{"code": 403, "message": "无权修改客服分配规则"})
+			return
+		}
+	}
+	if req.WelcomeMessage != nil || req.WelcomeMessages != nil || req.OfflinePrompt != nil {
+		if !middleware.HasPermission(c, "settings.auto_reply") {
+			c.JSON(http.StatusForbidden, gin.H{"code": 403, "message": "无权修改自动回复设置"})
+			return
+		}
+	}
+	if req.WorkHours != nil || req.WorktimePrompt != nil {
+		if !middleware.HasPermission(c, "settings.worktime") {
+			c.JSON(http.StatusForbidden, gin.H{"code": 403, "message": "无权修改工作时间设置"})
+			return
+		}
+	}
+	if req.NotifyNewSession != nil || req.NotifyOfflineLeave != nil || req.NotifyDailyReport != nil {
+		if !middleware.HasPermission(c, "settings.notification") {
+			c.JSON(http.StatusForbidden, gin.H{"code": 403, "message": "无权修改通知设置"})
+			return
+		}
+	}

 	updates := map[string]interface{}{}
 	if req.DisplayName != nil {