pro/im_manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add tenant login IP whitelist management

Browse Source
This commit is contained in:
richjohnrambo
2026-09-09 09:39:55 +08:00
parent 99307f1c98
commit 964746c19b
12 changed files with 400 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/api/admin/imconfiginternal/im_config.go
+11
View File
@@ -57,3 +57,14 @@ type ThirdPartyReq struct {
type ThirdPartyRes struct {
Values map[string]string `json:"values" dc:"配置值"`
}
type TenantLoginIPWhitelistReq struct {
g.Meta `path:"/internal/im-config/tenants/by-id/{id}/login-ip-whitelist" method:"get" tags:"IM内部配置" summary:"获取租户渠道登录IP白名单"`
Id int64 `json:"id" in:"path" dc:"租户ID"`
}
type TenantLoginIPWhitelistRes struct {
TenantId int64 `json:"tenant_id" dc:"租户ID"`
AppList []string `json:"app_list" dc:"APP登录IP白名单"`
WebList []string `json:"web_list" dc:"Web登录IP白名单"`
}
server/api/admin/imuserpolicygroup/im_user_policy_group.go
+13
View File
@@ -55,3 +55,16 @@ type MemberRemoveReq struct {
sysin.ImUserPolicyGroupMemberRemoveInp
}
type MemberRemoveRes struct{}
type LoginIPWhitelistReq struct {
g.Meta `path:"/imUserPolicyGroup/loginIPWhitelist" method:"get" tags:"IM用户策略分组" summary:"获取租户登录IP白名单"`
sysin.ImTenantLoginIPWhitelistInp
}
type LoginIPWhitelistRes struct {
*sysin.ImTenantLoginIPWhitelistModel
}
type LoginIPWhitelistSaveReq struct {
g.Meta `path:"/imUserPolicyGroup/loginIPWhitelistSave" method:"post" tags:"IM用户策略分组" summary:"保存租户登录IP白名单"`
sysin.ImTenantLoginIPWhitelistSaveInp
}
type LoginIPWhitelistSaveRes struct{}
server/internal/consts/im_user.go
+2
View File
@@ -20,6 +20,8 @@ const (
ImUserRegisterTypeAdmin = "admin"
ImUserRegisterTypeMobile = "mobile"
ImUserRegisterTypeInviteCode = "invite_code"
ImLoginChannelApp = "app"
ImLoginChannelWeb = "web"
)
var ImUserRegisterTypeOptions = []*model.Option{
server/internal/controller/admin/sys/im_user_policy_group.go
+13
View File
@@ -64,3 +64,16 @@ func (c *cImUserPolicyGroup) MemberRemove(ctx context.Context, req *imuserpolicy
err = service.SysImUserPolicyGroup().MemberRemove(ctx, &req.ImUserPolicyGroupMemberRemoveInp)
return
}
func (c *cImUserPolicyGroup) LoginIPWhitelist(ctx context.Context, req *imuserpolicygroup.LoginIPWhitelistReq) (res *imuserpolicygroup.LoginIPWhitelistRes, err error) {
data, err := service.SysImUserPolicyGroup().LoginIPWhitelist(ctx, &req.ImTenantLoginIPWhitelistInp)
if err != nil {
return nil, err
}
return &imuserpolicygroup.LoginIPWhitelistRes{ImTenantLoginIPWhitelistModel: data}, nil
}
func (c *cImUserPolicyGroup) LoginIPWhitelistSave(ctx context.Context, req *imuserpolicygroup.LoginIPWhitelistSaveReq) (res *imuserpolicygroup.LoginIPWhitelistSaveRes, err error) {
err = service.SysImUserPolicyGroup().LoginIPWhitelistSave(ctx, &req.ImTenantLoginIPWhitelistSaveInp)
return
}
server/internal/controller/internalapi/imconfig/im_config.go
+12
View File
@@ -6,6 +6,7 @@ import (
"hotgo/internal/dao"
"hotgo/internal/library/imtenant"
"hotgo/internal/model/entity"
"hotgo/internal/service"
"strings"
"github.com/gogf/gf/v2/errors/gerror"
@@ -90,6 +91,17 @@ func (c *cConfig) ThirdParty(ctx context.Context, req *api.ThirdPartyReq) (res *
return &api.ThirdPartyRes{Values: values}, nil
}
func (c *cConfig) TenantLoginIPWhitelist(ctx context.Context, req *api.TenantLoginIPWhitelistReq) (res *api.TenantLoginIPWhitelistRes, err error) {
if _, err = getTenant(ctx, dao.ImTenant.Columns().Id, req.Id); err != nil {
return nil, err
}
data, err := service.SysImUserPolicyGroup().LoginIPWhitelistByTenant(ctx, req.Id)
if err != nil {
return nil, err
}
return &api.TenantLoginIPWhitelistRes{TenantId: data.TenantId, AppList: data.AppList, WebList: data.WebList}, nil
}
func getTenant(ctx context.Context, field string, value any) (*entity.ImTenant, error) {
var tenant *entity.ImTenant
if err := imtenant.RegistryDB().Model(dao.ImTenant.Table()).Safe().Ctx(ctx).Where(field, value).Scan(&tenant); err != nil {
server/internal/logic/sys/im_user_policy_group.go
+84
View File
@@ -18,6 +18,8 @@ import (
type sSysImUserPolicyGroup struct{}
const imTenantLoginIPWhitelistTable = "im_tenant_login_ip_whitelists"
func NewSysImUserPolicyGroup() *sSysImUserPolicyGroup { return &sSysImUserPolicyGroup{} }
func init() { service.RegisterSysImUserPolicyGroup(NewSysImUserPolicyGroup()) }
@@ -288,3 +290,85 @@ func (s *sSysImUserPolicyGroup) MemberRemove(ctx context.Context, in *sysin.ImUs
_ = writeImAdminAudit(ctx, tenantID, "im_user_policy_group_member_remove", "im_user_policy_group", groupID, "success", g.Map{"user_id": row[mc.UserId].Int64()})
return publishImPolicyEvent(ctx, tenantID, tenantCode, "user_policy_group.updated", "user_policy_groups", uint(groupID))
}
func (s *sSysImUserPolicyGroup) LoginIPWhitelist(ctx context.Context, in *sysin.ImTenantLoginIPWhitelistInp) (res *sysin.ImTenantLoginIPWhitelistModel, err error) {
if err = in.Filter(ctx); err != nil {
return nil, err
}
tenantID, _, err := resolveImPolicyTenant(ctx, in.TenantId)
if err != nil {
return nil, err
}
return s.LoginIPWhitelistByTenant(ctx, tenantID)
}
func (s *sSysImUserPolicyGroup) LoginIPWhitelistByTenant(ctx context.Context, tenantID int64) (res *sysin.ImTenantLoginIPWhitelistModel, err error) {
if tenantID <= 0 {
return nil, gerror.New("租户ID不合法")
}
rows, err := imtenant.RegistryDB().Model(imTenantLoginIPWhitelistTable).Safe().Ctx(ctx).
Fields("channel", "ip_cidr").
Where("tenant_id", tenantID).
Where("status", consts.StatusEnabled).
WhereNull("deleted_at").
OrderAsc("channel").OrderAsc("id").All()
if err != nil {
return nil, gerror.Wrap(err, "获取租户登录IP白名单失败")
}
res = &sysin.ImTenantLoginIPWhitelistModel{
TenantId: tenantID,
AppList: make([]string, 0),
WebList: make([]string, 0),
}
for _, row := range rows {
switch row["channel"].String() {
case consts.ImLoginChannelApp:
res.AppList = append(res.AppList, row["ip_cidr"].String())
case consts.ImLoginChannelWeb:
res.WebList = append(res.WebList, row["ip_cidr"].String())
}
}
return res, nil
}
func (s *sSysImUserPolicyGroup) LoginIPWhitelistSave(ctx context.Context, in *sysin.ImTenantLoginIPWhitelistSaveInp) (err error) {
if err = in.Filter(ctx); err != nil {
return err
}
tenantID, _, err := resolveImPolicyTenant(ctx, in.TenantId)
if err != nil {
return err
}
now := gtime.Now()
operatorID := contexts.GetUserId(ctx)
db := imtenant.RegistryDB()
err = db.Transaction(ctx, func(ctx context.Context, tx gdb.TX) error {
if _, txErr := tx.Model(imTenantLoginIPWhitelistTable).Safe().Ctx(ctx).
Where("tenant_id", tenantID).WhereNull("deleted_at").
Data(g.Map{"status": consts.StatusDisable, "deleted_at": now, "deleted_by": operatorID, "updated_at": now, "updated_by": operatorID}).Update(); txErr != nil {
return txErr
}
for channel, values := range map[string][]string{
consts.ImLoginChannelApp: in.AppList,
consts.ImLoginChannelWeb: in.WebList,
} {
for _, value := range values {
if _, txErr := tx.Exec(`INSERT INTO im_tenant_login_ip_whitelists
(tenant_id,channel,ip_cidr,status,created_by,updated_by)
VALUES(?,?,?,?,?,?)
ON DUPLICATE KEY UPDATE status=VALUES(status),deleted_at=NULL,deleted_by=NULL,updated_at=CURRENT_TIMESTAMP(3),updated_by=VALUES(updated_by)`,
tenantID, channel, value, consts.StatusEnabled, operatorID, operatorID); txErr != nil {
return txErr
}
}
}
return nil
})
if err != nil {
return gerror.Wrap(err, "保存租户登录IP白名单失败")
}
_ = writeImAdminAudit(ctx, tenantID, "im_tenant_login_ip_whitelist_save", "im_tenant", tenantID, "success", g.Map{
"app_count": len(in.AppList), "web_count": len(in.WebList),
})
return nil
}
server/internal/model/input/sysin/im_policy_test.go
+18
View File
@@ -143,3 +143,21 @@ func TestImUserPolicyGroupInputFilter(t *testing.T) {
t.Fatal("无效用户ID应被拒绝")
}
}
func TestImTenantLoginIPWhitelistSaveFilter(t *testing.T) {
in := &ImTenantLoginIPWhitelistSaveInp{
TenantId: 1,
AppList: []string{" 203.0.113.10 ", "2001:db8::/32", "203.0.113.10"},
WebList: []string{"198.51.100.7/24"},
}
if err := in.Filter(context.Background()); err != nil {
t.Fatalf("合法租户登录白名单不应报错: %v", err)
}
if len(in.AppList) != 2 || in.AppList[0] != "203.0.113.10" || in.WebList[0] != "198.51.100.0/24" {
t.Fatalf("IP白名单未正确规范化: app=%v web=%v", in.AppList, in.WebList)
}
in.AppList = []string{"not-an-ip"}
if err := in.Filter(context.Background()); err == nil {
t.Fatal("非法IP地址应被拒绝")
}
}
server/internal/model/input/sysin/im_user_policy_group.go
+64
View File
@@ -2,6 +2,7 @@ package sysin
import (
"context"
"net/netip"
"regexp"
"strings"
@@ -155,3 +156,66 @@ type ImUserPolicyGroupMemberRemoveInp struct {
}
func (in *ImUserPolicyGroupMemberRemoveInp) Filter(ctx context.Context) error { return nil }
type ImTenantLoginIPWhitelistInp struct {
TenantId int64 `json:"tenantId" dc:"租户ID"`
}
func (in *ImTenantLoginIPWhitelistInp) Filter(ctx context.Context) error {
if in.TenantId < 0 {
return gerror.New("租户ID不合法")
}
return nil
}
type ImTenantLoginIPWhitelistSaveInp struct {
TenantId int64 `json:"tenantId" dc:"租户ID"`
AppList []string `json:"appList" dc:"APP登录IP白名单"`
WebList []string `json:"webList" dc:"Web登录IP白名单"`
}
func (in *ImTenantLoginIPWhitelistSaveInp) Filter(ctx context.Context) (err error) {
if in.TenantId < 0 {
return gerror.New("租户ID不合法")
}
if in.AppList, err = normalizeTenantLoginIPList(in.AppList); err != nil {
return gerror.Wrap(err, "APP登录白名单不合法")
}
if in.WebList, err = normalizeTenantLoginIPList(in.WebList); err != nil {
return gerror.Wrap(err, "Web登录白名单不合法")
}
return nil
}
type ImTenantLoginIPWhitelistModel struct {
TenantId int64 `json:"tenantId" dc:"租户ID"`
AppList []string `json:"appList" dc:"APP登录IP白名单"`
WebList []string `json:"webList" dc:"Web登录IP白名单"`
}
func normalizeTenantLoginIPList(values []string) ([]string, error) {
if len(values) > 500 {
return nil, gerror.New("单个渠道最多配置500条IP或CIDR")
}
result := make([]string, 0, len(values))
seen := make(map[string]struct{}, len(values))
for _, value := range values {
value = strings.TrimSpace(value)
if value == "" {
continue
}
if prefix, err := netip.ParsePrefix(value); err == nil {
value = prefix.Masked().String()
} else if address, addressErr := netip.ParseAddr(value); addressErr == nil {
value = address.String()
} else {
return nil, gerror.Newf("%s 不是有效的IPv4、IPv6或CIDR", value)
}
if _, ok := seen[value]; ok {
continue
}
seen[value] = struct{}{}
result = append(result, value)
}
return result, nil
}
server/internal/service/sys.go
+3
View File
@@ -377,6 +377,9 @@ type (
MemberList(ctx context.Context, in *sysin.ImUserPolicyGroupMemberListInp) (list []*sysin.ImUserPolicyGroupMemberModel, totalCount int, err error)
MemberAdd(ctx context.Context, in *sysin.ImUserPolicyGroupMemberAddInp) (err error)
MemberRemove(ctx context.Context, in *sysin.ImUserPolicyGroupMemberRemoveInp) (err error)
LoginIPWhitelist(ctx context.Context, in *sysin.ImTenantLoginIPWhitelistInp) (res *sysin.ImTenantLoginIPWhitelistModel, err error)
LoginIPWhitelistByTenant(ctx context.Context, tenantId int64) (res *sysin.ImTenantLoginIPWhitelistModel, err error)
LoginIPWhitelistSave(ctx context.Context, in *sysin.ImTenantLoginIPWhitelistSaveInp) (err error)
}
ISysImSensitiveWord interface {
List(ctx context.Context, in *sysin.ImSensitiveWordListInp) (list []*sysin.ImSensitiveWordListModel, totalCount int, err error)
server/storage/data/generate/im_tenant_login_ip_whitelist.sql
+42
View File
@@ -0,0 +1,42 @@
-- Tenant-scoped APP/Web login IP whitelist and admin permissions.
-- Empty whitelist for a channel means unrestricted access.
SET NAMES utf8mb4;
USE `hotgo`;
CREATE TABLE IF NOT EXISTS `im_tenant_login_ip_whitelists` (
`id` bigint NOT NULL AUTO_INCREMENT,
`tenant_id` bigint NOT NULL COMMENT 'IM tenant ID',
`channel` varchar(16) NOT NULL COMMENT 'app or web',
`ip_cidr` varchar(64) NOT NULL COMMENT 'IPv4, IPv6 or CIDR',
`status` tinyint NOT NULL DEFAULT 1 COMMENT '1 enabled, 2 disabled',
`created_at` datetime(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
`created_by` bigint NOT NULL DEFAULT 0,
`updated_at` datetime(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
`updated_by` bigint NOT NULL DEFAULT 0,
`deleted_at` datetime(3) DEFAULT NULL,
`deleted_by` bigint DEFAULT NULL,
PRIMARY KEY (`id`),
UNIQUE KEY `uk_im_tenant_login_ip` (`tenant_id`, `channel`, `ip_cidr`),
KEY `idx_im_tenant_login_ip_active` (`tenant_id`, `channel`, `status`, `deleted_at`),
CONSTRAINT `chk_im_tenant_login_ip_channel` CHECK (`channel` IN ('app', 'web'))
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='Tenant APP/Web login IP whitelist';
SET @now = NOW();
SELECT @groupMenuId := `id` FROM `hg_admin_menu` WHERE `name` = 'imUserPolicyGroupIndex' LIMIT 1;
INSERT INTO `hg_admin_menu` (`id`, `pid`, `title`, `name`, `path`, `icon`, `type`, `redirect`, `permissions`, `permission_name`, `component`, `always_show`, `active_menu`, `is_root`, `is_frame`, `frame_src`, `keep_alive`, `hidden`, `affix`, `level`, `tree`, `sort`, `remark`, `status`, `created_at`, `updated_at`)
SELECT NULL, @groupMenuId, '查看租户登录IP白名单', 'imTenantLoginIPWhitelist', '', '', '3', '', '/imUserPolicyGroup/loginIPWhitelist', '', '', '1', '', '0', '0', '', '0', '1', '0', '4', CONCAT(`tree`, 'tr_', `id`, ' '), '9', '', '1', @now, @now
FROM `hg_admin_menu` WHERE `id` = @groupMenuId
AND NOT EXISTS (SELECT 1 FROM `hg_admin_menu` WHERE `name` = 'imTenantLoginIPWhitelist');
INSERT INTO `hg_admin_menu` (`id`, `pid`, `title`, `name`, `path`, `icon`, `type`, `redirect`, `permissions`, `permission_name`, `component`, `always_show`, `active_menu`, `is_root`, `is_frame`, `frame_src`, `keep_alive`, `hidden`, `affix`, `level`, `tree`, `sort`, `remark`, `status`, `created_at`, `updated_at`)
SELECT NULL, @groupMenuId, '保存租户登录IP白名单', 'imTenantLoginIPWhitelistSave', '', '', '3', '', '/imUserPolicyGroup/loginIPWhitelistSave', '', '', '1', '', '0', '0', '', '0', '1', '0', '4', CONCAT(`tree`, 'tr_', `id`, ' '), '10', '', '1', @now, @now
FROM `hg_admin_menu` WHERE `id` = @groupMenuId
AND NOT EXISTS (SELECT 1 FROM `hg_admin_menu` WHERE `name` = 'imTenantLoginIPWhitelistSave');
INSERT IGNORE INTO `hg_admin_role_menu` (`role_id`, `menu_id`)
SELECT parent_role.`role_id`, child.`id`
FROM `hg_admin_role_menu` parent_role
JOIN `hg_admin_menu` parent ON parent.`id` = parent_role.`menu_id` AND parent.`name` = 'imUserPolicyGroupIndex'
JOIN `hg_admin_menu` child ON child.`pid` = parent.`id`
WHERE child.`name` IN ('imTenantLoginIPWhitelist', 'imTenantLoginIPWhitelistSave');