新增邮件发送和管理员功能

mail-worker/src/security/security.js

@@ -2,59 +2,152 @@ import BizError from '../error/biz-error';
 import constant from '../const/constant';
 import jwtUtils from '../utils/jwt-utils';
 import KvConst from '../const/kv-const';
-import { userConst } from '../const/entity-const';
 import dayjs from 'dayjs';
+import userService from '../service/user-service';
+import permService from '../service/perm-service';
+import app from '../hono/hono';
 
 const exclude = [
 	'/login',
 	'/register',
-	'/setting/query'
+	'/setting/query',
+	'/file',
+	'/webhooks',
+	'/init'
 ];
 
-const adminPerm  = [
-	'/setting/set'
-]
+const requirePerms = [
+	'/email/send',
+	'/email/delete',
+	'/account/list',
+	'/account/delete',
+	'/account/add',
+	'/my/delete',
+	'/role/add',
+	'/role/list',
+	'/role/delete',
+	'/role/tree',
+	'/role/set',
+	'/role/setDefault',
+	'/sys-email/list',
+	'/sys-email/delete',
+	'/setting/physicsDeleteAll',
+	'/setting/setBackground',
+	'/setting/set',
+	'/user/delete',
+	'/user/setPwd',
+	'/user/setStatus',
+	'/user/setType',
+	'/user/star',
+	'/user/list',
+	'/user/resetSendCount',
+	'/user/add'
+];
 
-const verify = async (c) => {
+const premKey = {
+	'email:delete': ['/email/delete'],
+	'email:send': ['/email/send'],
+	'account:add': ['/account/add'],
+	'account:query': ['/account/list'],
+	'account:delete': ['/account/delete'],
+	'my:delete': ['/my/delete'],
+	'role:add': ['/role/add'],
+	'role:set': ['/role/set','/role/setDefault'],
+	'role:query': ['/role/list', '/role/tree'],
+	'role:delete': ['/role/delete'],
+	'user:query': ['/user/list'],
+	'user:add': ['/user/add'],
+	'user:reset-send': ['/user/resetSendCount'],
+	'user:set-pwd': ['/user/setPwd'],
+	'user:set-status': ['/user/setStatus'],
+	'user:set-type': ['/user/setType'],
+	'user:star': ['/user/star'],
+	'user:delete': ['/user/delete'],
+	'sys-email:query': ['/sys-email/list'],
+	'sys-email:delete': ['/sys-email/delete'],
+	'setting:query': [],
+	'setting:set': ['/setting/set', '/setting/setBackground'],
+	'setting:clean': ['/setting/physicsDeleteAll']
+};
 
-	if (c.req.path.startsWith('/test')) {
-		return true
+app.use('*', async (c, next) => {
+
+	const path = c.req.path;
+
+	if (path.startsWith('/test')) {
+		return await next();
 	}
 
-	if (exclude.includes(c.req.path)) {
-		return true;
+	const index = exclude.findIndex(item => {
+		return path.startsWith(item);
+	});
+
+	if (index > -1) {
+		return await next();
 	}
 
+
 	const jwt = c.req.header(constant.TOKEN_HEADER);
 
-	const result  = await jwtUtils.verifyToken(c, jwt)
+	const result = await jwtUtils.verifyToken(c, jwt);
 
 	if (!result) {
-		throw new BizError('身份认证失效,请重新登录',401)
+		throw new BizError('身份认证失效,请重新登录', 401);
 	}
 
-	const {userId, token} = result
-	const authInfo = await c.env.kv.get(KvConst.AUTH_INFO + userId,{ type: 'json' });
+	const { userId, token } = result;
+	const authInfo = await c.env.kv.get(KvConst.AUTH_INFO + userId, { type: 'json' });
 
 	if (!authInfo) {
-		throw new BizError('身份认证失效,请重新登录',401)
+		throw new BizError('身份认证失效,请重新登录', 401);
 	}
 
-	if(!authInfo.tokens.includes(token)) {
-		throw new BizError('身份认证失效,请重新登录',401)
+	if (!authInfo.tokens.includes(token)) {
+		throw new BizError('身份认证失效,请重新登录', 401);
 	}
 
-	if (adminPerm.includes(c.req.path) && c.env.admin !== authInfo.user.email) {
-		throw new BizError('权限不足',403)
+
+	const permIndex = requirePerms.findIndex(item => {
+		return path.startsWith(item);
+	});
+
+	if (permIndex > -1) {
+
+		const permKeys = await permService.userPermKeys(c, authInfo.user.userId);
+
+		const userPaths = permKeyToPaths(permKeys);
+
+		const userPermIndex = userPaths.findIndex(item => {
+			return path.startsWith(item);
+		});
+
+		if (userPermIndex === -1 && authInfo.user.email !== c.env.admin) {
+			throw new BizError('权限不足', 403);
+		}
+
 	}
 
-	if (dayjs().diff(dayjs(authInfo.createTime), 'day') >= 1) {
-		authInfo.refreshTime = new Date().toISOString()
+	const refreshTime = dayjs(authInfo.refreshTime).startOf('day');
+	const nowTime = dayjs().startOf('day')
+
+	if (!nowTime.isSame(refreshTime)) {
+		authInfo.refreshTime = dayjs().toISOString();
+		await userService.updateUserInfo(c, authInfo.user.userId);
 		await c.env.kv.put(KvConst.AUTH_INFO + userId, JSON.stringify(authInfo), { expirationTtl: constant.TOKEN_EXPIRE });
 	}
 
-	return true
+	c.set('user',authInfo.user)
 
-};
+	return await next();
+});
 
-export default verify;
+function permKeyToPaths(permKeys) {
+	const paths = [];
+	for (const key of permKeys) {
+		const routeList = premKey[key];
+		if (routeList && Array.isArray(routeList)) {
+			paths.push(...routeList);
+		}
+	}
+	return paths;
+}