更新

go/controllers/password_store.go

@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"server/models"
+	"server/pkg/identity"
 	"server/pkg/jwtutil"
 
 	"github.com/beego/beego/v2/client/orm"
@@ -73,15 +74,13 @@ func accountsFromJSON(raw string) []models.PasswordAccountItem {
 }
 
 func passwordClaims(c *beego.Controller, kind string) (*jwtutil.Claims, error) {
-	p := strings.SplitN(c.Ctx.Request.Header.Get("Authorization"), " ", 2)
-	if len(p) != 2 || p[0] != "Bearer" {
+	// 口令保险柜按端隔离：平台账号存的口令和租户账号存的口令互不可见，
+	// 所以 kind（platform/backend）必须由令牌证实，而不只是形参对得上。
+	claims, err := identity.Claims(c.Ctx.Request.Header.Get("Authorization"), identity.End(kind))
+	if err != nil || claims.UserID <= 0 {
 		return nil, orm.ErrNoRows
 	}
-	cl, e := jwtutil.ParseToken(p[1])
-	if e != nil || cl.UserType != kind || cl.UserID <= 0 {
-		return nil, orm.ErrNoRows
-	}
-	return cl, nil
+	return claims, nil
 }
 
 func parsePassword(c *beego.Controller) (passwordPayload, error) {