feat: add tenant login IP whitelist management

2026-09-09 09:39:55 +08:00
parent 99307f1c98
commit 964746c19b
12 changed files with 400 additions and 9 deletions
@@ -18,6 +18,8 @@ import (

 type sSysImUserPolicyGroup struct{}

+const imTenantLoginIPWhitelistTable = "im_tenant_login_ip_whitelists"
+
 func NewSysImUserPolicyGroup() *sSysImUserPolicyGroup { return &sSysImUserPolicyGroup{} }
 func init()                                           { service.RegisterSysImUserPolicyGroup(NewSysImUserPolicyGroup()) }

@@ -288,3 +290,85 @@ func (s *sSysImUserPolicyGroup) MemberRemove(ctx context.Context, in *sysin.ImUs
 	_ = writeImAdminAudit(ctx, tenantID, "im_user_policy_group_member_remove", "im_user_policy_group", groupID, "success", g.Map{"user_id": row[mc.UserId].Int64()})
 	return publishImPolicyEvent(ctx, tenantID, tenantCode, "user_policy_group.updated", "user_policy_groups", uint(groupID))
 }
+
+func (s *sSysImUserPolicyGroup) LoginIPWhitelist(ctx context.Context, in *sysin.ImTenantLoginIPWhitelistInp) (res *sysin.ImTenantLoginIPWhitelistModel, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return nil, err
+	}
+	tenantID, _, err := resolveImPolicyTenant(ctx, in.TenantId)
+	if err != nil {
+		return nil, err
+	}
+	return s.LoginIPWhitelistByTenant(ctx, tenantID)
+}
+
+func (s *sSysImUserPolicyGroup) LoginIPWhitelistByTenant(ctx context.Context, tenantID int64) (res *sysin.ImTenantLoginIPWhitelistModel, err error) {
+	if tenantID <= 0 {
+		return nil, gerror.New("租户ID不合法")
+	}
+	rows, err := imtenant.RegistryDB().Model(imTenantLoginIPWhitelistTable).Safe().Ctx(ctx).
+		Fields("channel", "ip_cidr").
+		Where("tenant_id", tenantID).
+		Where("status", consts.StatusEnabled).
+		WhereNull("deleted_at").
+		OrderAsc("channel").OrderAsc("id").All()
+	if err != nil {
+		return nil, gerror.Wrap(err, "获取租户登录IP白名单失败")
+	}
+	res = &sysin.ImTenantLoginIPWhitelistModel{
+		TenantId: tenantID,
+		AppList:  make([]string, 0),
+		WebList:  make([]string, 0),
+	}
+	for _, row := range rows {
+		switch row["channel"].String() {
+		case consts.ImLoginChannelApp:
+			res.AppList = append(res.AppList, row["ip_cidr"].String())
+		case consts.ImLoginChannelWeb:
+			res.WebList = append(res.WebList, row["ip_cidr"].String())
+		}
+	}
+	return res, nil
+}
+
+func (s *sSysImUserPolicyGroup) LoginIPWhitelistSave(ctx context.Context, in *sysin.ImTenantLoginIPWhitelistSaveInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return err
+	}
+	tenantID, _, err := resolveImPolicyTenant(ctx, in.TenantId)
+	if err != nil {
+		return err
+	}
+	now := gtime.Now()
+	operatorID := contexts.GetUserId(ctx)
+	db := imtenant.RegistryDB()
+	err = db.Transaction(ctx, func(ctx context.Context, tx gdb.TX) error {
+		if _, txErr := tx.Model(imTenantLoginIPWhitelistTable).Safe().Ctx(ctx).
+			Where("tenant_id", tenantID).WhereNull("deleted_at").
+			Data(g.Map{"status": consts.StatusDisable, "deleted_at": now, "deleted_by": operatorID, "updated_at": now, "updated_by": operatorID}).Update(); txErr != nil {
+			return txErr
+		}
+		for channel, values := range map[string][]string{
+			consts.ImLoginChannelApp: in.AppList,
+			consts.ImLoginChannelWeb: in.WebList,
+		} {
+			for _, value := range values {
+				if _, txErr := tx.Exec(`INSERT INTO im_tenant_login_ip_whitelists
+					(tenant_id,channel,ip_cidr,status,created_by,updated_by)
+					VALUES(?,?,?,?,?,?)
+					ON DUPLICATE KEY UPDATE status=VALUES(status),deleted_at=NULL,deleted_by=NULL,updated_at=CURRENT_TIMESTAMP(3),updated_by=VALUES(updated_by)`,
+					tenantID, channel, value, consts.StatusEnabled, operatorID, operatorID); txErr != nil {
+					return txErr
+				}
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return gerror.Wrap(err, "保存租户登录IP白名单失败")
+	}
+	_ = writeImAdminAudit(ctx, tenantID, "im_tenant_login_ip_whitelist_save", "im_tenant", tenantID, "success", g.Map{
+		"app_count": len(in.AppList), "web_count": len(in.WebList),
+	})
+	return nil
+}