更新

go/controllers/backend_site_settings.go

@@ -2,13 +2,13 @@ package controllers
 
 import (
 	"encoding/json"
-	"fmt"
 	"io"
 	"strconv"
 	"strings"
 	"time"
 
 	"server/models"
+	"server/pkg/identity"
 	"server/pkg/jwtutil"
 
 	beego "github.com/beego/beego/v2/server/web"
@@ -31,31 +31,7 @@ func (c *BackendSiteSettingsController) jsonErr(httpStatus, bizCode int, msg str
 }
 
 func (c *BackendSiteSettingsController) claimsByPath() (*jwtutil.Claims, error) {
-	auth := c.Ctx.Request.Header.Get("Authorization")
-	if auth == "" {
-		return nil, fmt.Errorf("未登录")
-	}
-	parts := strings.SplitN(auth, " ", 2)
-	if len(parts) != 2 || parts[0] != "Bearer" {
-		return nil, fmt.Errorf("认证信息格式错误")
-	}
-	claims, err := jwtutil.ParseToken(parts[1])
-	if err != nil {
-		return nil, fmt.Errorf("无效的token")
-	}
-
-	path := strings.ToLower(c.Ctx.Request.URL.Path)
-	if strings.HasPrefix(path, "/platform/") {
-		if claims.UserType != "platform" {
-			return nil, fmt.Errorf("无权访问")
-		}
-	} else if strings.HasPrefix(path, "/backend/") {
-		if claims.UserType != "backend" {
-			return nil, fmt.Errorf("无权访问")
-		}
-	}
-
-	return claims, nil
+	return identity.ClaimsByPath(c.Ctx.Request.Header.Get("Authorization"), c.Ctx.Request.URL.Path)
 }
 
 func parseBackendUint64Flexible(v interface{}) uint64 {
@@ -102,20 +78,13 @@ type backendNormalInfosOutput struct {
 func (c *BackendSiteSettingsController) GetNormalInfos() {
 	claims, err := c.claimsByPath()
 	if err != nil {
-		c.jsonErr(401, 401, err.Error())
+		code := identity.Status(err)
+		c.jsonErr(code, code, err.Error())
 		return
 	}
 
-	// 优先使用 token 中的租户 id；若为 0，则允许前端通过查询参数传入（兼容历史/平台端）。
-	tid := uint64(claims.TenantId)
-	if tid == 0 {
-		tidStr := strings.TrimSpace(c.GetString("tid"))
-		if tidStr != "" {
-			if n, err := strconv.ParseUint(tidStr, 10, 64); err == nil {
-				tid = n
-			}
-		}
-	}
+	// 归属租户由 resolveBackendTenantID 统一裁决（backend 端只认令牌）
+	tid := c.resolveBackendTenantID(claims, nil)
 
 	out := backendNormalInfosOutput{
 		Sitename:            "",
@@ -194,7 +163,8 @@ type backendNormalInfosPayload struct {
 func (c *BackendSiteSettingsController) SaveNormalInfos() {
 	claims, err := c.claimsByPath()
 	if err != nil {
-		c.jsonErr(401, 401, err.Error())
+		code := identity.Status(err)
+		c.jsonErr(code, code, err.Error())
 		return
 	}
 
@@ -210,10 +180,7 @@ func (c *BackendSiteSettingsController) SaveNormalInfos() {
 		return
 	}
 
-	tid := uint64(claims.TenantId)
-	if tid == 0 {
-		tid = parseBackendUint64Flexible(p.Tid)
-	}
+	tid := c.resolveBackendTenantID(claims, p.Tid)
 	if tid == 0 {
 		c.jsonErr(400, 400, "tid不能为空")
 		return
@@ -295,20 +262,20 @@ func (c *BackendSiteSettingsController) SaveNormalInfos() {
 	_ = c.ServeJSON()
 }
 
+// resolveBackendTenantID 取站点设置归属租户：
+//   - backend 路径只认登录态，忽略 ?tid= 与请求体里的 tid——否则改一个参数就能读写别的企业站点设置；
+//   - platform 路径下平台管理员令牌的 tenant_id 为 0，需要按参数指定要维护哪家企业。
 func (c *BackendSiteSettingsController) resolveBackendTenantID(claims *jwtutil.Claims, payloadTid interface{}) uint64 {
-	tid := uint64(claims.TenantId)
-	if tid == 0 {
-		tid = parseBackendUint64Flexible(payloadTid)
+	if claims != nil && claims.TenantId > 0 {
+		return uint64(claims.TenantId)
 	}
-	if tid == 0 {
-		tidStr := strings.TrimSpace(c.GetString("tid"))
-		if tidStr != "" {
-			if n, err := strconv.ParseUint(tidStr, 10, 64); err == nil {
-				tid = n
-			}
-		}
+	if !strings.HasPrefix(strings.ToLower(c.Ctx.Request.URL.Path), "/platform/") {
+		return 0
 	}
-	return tid
+	if tid := parseBackendUint64Flexible(payloadTid); tid > 0 {
+		return tid
+	}
+	return parseBackendUint64Flexible(strings.TrimSpace(c.GetString("tid")))
 }
 
 func (c *BackendSiteSettingsController) getBackendSettingItems(tid uint64, keys []string) (map[string]string, error) {
@@ -354,7 +321,8 @@ ON DUPLICATE KEY UPDATE setting_value = VALUES(setting_value), update_time = NOW
 func (c *BackendSiteSettingsController) GetLegalInfos() {
 	claims, err := c.claimsByPath()
 	if err != nil {
-		c.jsonErr(401, 401, err.Error())
+		code := identity.Status(err)
+		c.jsonErr(code, code, err.Error())
 		return
 	}
 
@@ -391,7 +359,8 @@ type backendLegalInfosPayload struct {
 func (c *BackendSiteSettingsController) SaveLegalInfos() {
 	claims, err := c.claimsByPath()
 	if err != nil {
-		c.jsonErr(401, 401, err.Error())
+		code := identity.Status(err)
+		c.jsonErr(code, code, err.Error())
 		return
 	}
 
@@ -429,7 +398,8 @@ func (c *BackendSiteSettingsController) SaveLegalInfos() {
 func (c *BackendSiteSettingsController) GetCompanyInfos() {
 	claims, err := c.claimsByPath()
 	if err != nil {
-		c.jsonErr(401, 401, err.Error())
+		code := identity.Status(err)
+		c.jsonErr(code, code, err.Error())
 		return
 	}
 
@@ -486,7 +456,8 @@ type backendCompanyInfosPayload struct {
 func (c *BackendSiteSettingsController) SaveCompanyInfos() {
 	claims, err := c.claimsByPath()
 	if err != nil {
-		c.jsonErr(401, 401, err.Error())
+		code := identity.Status(err)
+		c.jsonErr(code, code, err.Error())
 		return
 	}
 
@@ -530,7 +501,8 @@ func (c *BackendSiteSettingsController) SaveCompanyInfos() {
 func (c *BackendSiteSettingsController) GetCompanySeo() {
 	claims, err := c.claimsByPath()
 	if err != nil {
-		c.jsonErr(401, 401, err.Error())
+		code := identity.Status(err)
+		c.jsonErr(code, code, err.Error())
 		return
 	}
 
@@ -570,7 +542,8 @@ type backendCompanySeoPayload struct {
 func (c *BackendSiteSettingsController) SaveCompanySeo() {
 	claims, err := c.claimsByPath()
 	if err != nil {
-		c.jsonErr(401, 401, err.Error())
+		code := identity.Status(err)
+		c.jsonErr(code, code, err.Error())
 		return
 	}