rbac

internal/router/router.go

@@ -3,6 +3,9 @@
 package router
 
 import (
+	"context"
+	"log/slog"
+	"os"
 	"time"
 
 	"github.com/gin-gonic/gin"
@@ -10,6 +13,7 @@ import (
 
 	adminhdl "portal-mini-go/internal/handler/admin"
 	miniapphdl "portal-mini-go/internal/handler/admin/miniapp"
+	rbachdl "portal-mini-go/internal/handler/admin/rbac"
 	userhdl "portal-mini-go/internal/handler/admin/user"
 	app1hdl "portal-mini-go/internal/handler/miniapp/app1"
 	"portal-mini-go/internal/middleware"
@@ -17,9 +21,12 @@ import (
 	"portal-mini-go/internal/pkg/response"
 	"portal-mini-go/internal/pkg/session"
 	"portal-mini-go/internal/pkg/wechat"
+	adminrepo "portal-mini-go/internal/repository/admin"
 	miniapprepo "portal-mini-go/internal/repository/miniapp"
 	"portal-mini-go/internal/repository/user"
+	authsvc "portal-mini-go/internal/service/admin/auth"
 	miniappsvc "portal-mini-go/internal/service/admin/miniapp"
+	adminrbac "portal-mini-go/internal/service/admin/rbac"
 	usersvc "portal-mini-go/internal/service/admin/user"
 	app1svc "portal-mini-go/internal/service/miniapp/app1"
 )
@@ -48,29 +55,65 @@ func New(cfg *config.Config, db *gorm.DB, store session.Store) *gin.Engine {
 	{
 		app1Svc := app1svc.New(userRepo, miniRepo, wx, store)
 		app1hdl.Register(ma, app1hdl.NewHandler(app1Svc), middleware.MiniUserAuth(store))
-		// 新增小程序时，在此依次注册 app2..app10：
-		// app2Svc := app2svc.New(userRepo, miniRepo, wx, store)
-		// app2hdl.Register(ma, app2hdl.NewHandler(app2Svc))
 	}
 
-	// 后台管理分组：JWT 鉴权。
+	// 后台 RBAC 基础设施：仓储、缓存、权限 Provider、种子初始化。
+	adminUserRepo := adminrepo.NewUserRepository(db)
+	adminRoleRepo := adminrepo.NewRoleRepository(db)
+	adminPermRepo := adminrepo.NewPermissionRepository(db)
+	permCache := adminrbac.NewMemoryCache(5 * time.Minute)
+	provider := adminrbac.NewProvider(adminUserRepo, adminRoleRepo, adminPermRepo, permCache)
+	if err := provider.Seed(context.Background(),
+		seedDefault("ADMIN_SEED_USERNAME", "admin"),
+		seedDefault("ADMIN_SEED_PASSWORD", "Admin@123456"),
+	); err != nil {
+		slog.Error("rbac seed", slog.Any("err", err))
+	}
+
+	// 后台管理：登录为公开接口，其余均经 JWT 鉴权 + 权限加载（注入角色/权限集到 context）。
 	ad := r.Group("/api/admin")
-	ad.Use(middleware.AdminAuth(cfg.Admin.JWTSecret))
 	{
-		adminhdl.Register(ad, adminhdl.NewHandler(cfg.Admin.JWTSecret, parseTTL(cfg.Admin.TokenTTL)))
+		authSvc := authsvc.New(adminUserRepo, provider, cfg.Admin.JWTSecret, parseTTL(cfg.Admin.TokenTTL))
+		adminHandler := adminhdl.NewHandler(authSvc)
+		// 登录公开，不挂 JWT 鉴权中间件。
+		adminhdl.RegisterLogin(ad, adminHandler)
 
-		// 小程序管理：被后台纳管的微信小程序配置（增删改查）。
-		miniSvc := miniappsvc.New(miniRepo)
-		miniapphdl.Register(ad, miniapphdl.NewHandler(miniSvc))
+		// 鉴权后分组：AdminAuth + PermissionLoader。
+		authAd := ad.Group("")
+		authAd.Use(middleware.AdminAuth(cfg.Admin.JWTSecret))
+		authAd.Use(middleware.PermissionLoader(provider))
+		{
+			adminhdl.Register(authAd, adminHandler)
 
-		// 用户管理：各小程序端用户（列表、详情、编辑、禁用/启用）。
-		userSvc := usersvc.New(userRepo)
-		userhdl.Register(ad, userhdl.NewHandler(userSvc))
+			// RBAC 管理接口（自身受 PermAdminManage / PermRoleManage / PermPermManage 守卫）。
+			rbacHandler := rbachdl.NewHandler(
+				adminrbac.NewAdminService(adminUserRepo, provider),
+				adminrbac.NewRoleService(adminRoleRepo, provider),
+				adminrbac.NewPermissionService(adminPermRepo, provider),
+			)
+			rbachdl.Register(authAd, rbacHandler)
+
+			// 小程序管理：被后台纳管的微信小程序配置（增删改查）。
+			miniSvc := miniappsvc.New(miniRepo)
+			miniapphdl.Register(authAd, miniapphdl.NewHandler(miniSvc))
+
+			// 用户管理：各小程序端用户（列表、详情、编辑、禁用/启用）。
+			userSvc := usersvc.New(userRepo)
+			userhdl.Register(authAd, userhdl.NewHandler(userSvc))
+		}
 	}
 
 	return r
 }
 
+// seedDefault 读取环境变量，缺失时回退到默认值（仅用于首次种子初始化）。
+func seedDefault(key, def string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return def
+}
+
 func parseTTL(s string) time.Duration {
 	if d, err := time.ParseDuration(s); err == nil {
 		return d