410 lines
21 KiB
Go
410 lines
21 KiB
Go
package sys
|
|
|
|
import (
|
|
"context"
|
|
"net"
|
|
|
|
"hotgo/internal/consts"
|
|
"hotgo/internal/dao"
|
|
"hotgo/internal/library/contexts"
|
|
"hotgo/internal/library/imtenant"
|
|
"hotgo/internal/model/input/sysin"
|
|
"hotgo/internal/service"
|
|
|
|
"github.com/gogf/gf/v2/database/gdb"
|
|
"github.com/gogf/gf/v2/encoding/gjson"
|
|
"github.com/gogf/gf/v2/errors/gerror"
|
|
"github.com/gogf/gf/v2/frame/g"
|
|
"github.com/gogf/gf/v2/os/gtime"
|
|
)
|
|
|
|
type sSysImSecurityPolicy struct{}
|
|
|
|
func NewSysImSecurityPolicy() *sSysImSecurityPolicy { return &sSysImSecurityPolicy{} }
|
|
func init() { service.RegisterSysImSecurityPolicy(NewSysImSecurityPolicy()) }
|
|
|
|
func securityPolicyFields(alias string) []any {
|
|
c := dao.ImSecurityPolicy.Columns()
|
|
p := alias
|
|
if p != "" {
|
|
p += "."
|
|
}
|
|
return []any{p + c.Id, p + c.TenantId, p + c.PolicyVersion, p + c.PolicyName, p + c.PublishStatus, "CAST(" + p + c.PasswordPolicy + " AS CHAR) password_policy", "CAST(" + p + c.LoginRateLimit + " AS CHAR) login_rate_limit", "CAST(" + p + c.SensitiveWordPolicy + " AS CHAR) sensitive_word_policy", "CAST(" + p + c.FileReviewPolicy + " AS CHAR) file_review_policy", "CAST(" + p + c.RealnamePolicy + " AS CHAR) realname_policy", "CAST(" + p + c.RiskChallengePolicy + " AS CHAR) risk_challenge_policy", p + c.GlobalFriendEnabled, "CAST(" + p + c.FriendDisabledPolicy + " AS CHAR) friend_disabled_policy", p + c.MessageCurfewEnabled, p + c.Remark, p + c.PublishedAt, p + c.PublishedBy, p + c.CreatedAt, p + c.UpdatedAt}
|
|
}
|
|
|
|
func (s *sSysImSecurityPolicy) List(ctx context.Context, in *sysin.ImSecurityPolicyListInp) (list []*sysin.ImSecurityPolicyModel, total int, err error) {
|
|
if err = in.Filter(ctx); err != nil {
|
|
return
|
|
}
|
|
tenantID, _, err := resolveImPolicyTenant(ctx, in.TenantId)
|
|
if err != nil {
|
|
return nil, 0, err
|
|
}
|
|
c := dao.ImSecurityPolicy.Columns()
|
|
model := imtenant.RegistryDB().Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).Fields(securityPolicyFields("")...).Where(c.TenantId, tenantID).WhereNull(c.DeletedAt)
|
|
if in.PublishStatus != "" {
|
|
model = model.Where(c.PublishStatus, in.PublishStatus)
|
|
}
|
|
err = model.Page(in.Page, in.PerPage).OrderDesc(c.PolicyVersion).ScanAndCount(&list, &total, false)
|
|
return
|
|
}
|
|
|
|
func (s *sSysImSecurityPolicy) View(ctx context.Context, in *sysin.ImSecurityPolicyViewInp) (res *sysin.ImSecurityPolicyModel, err error) {
|
|
if err = in.Filter(ctx); err != nil {
|
|
return
|
|
}
|
|
c := dao.ImSecurityPolicy.Columns()
|
|
baseModel := imtenant.RegistryDB().Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).Fields(securityPolicyFields("")...).WhereNull(c.DeletedAt)
|
|
if in.Id > 0 {
|
|
err = baseModel.Where(c.Id, in.Id).Scan(&res)
|
|
} else {
|
|
tenantID, _, resolveErr := resolveImPolicyTenant(ctx, in.TenantId)
|
|
if resolveErr != nil {
|
|
return nil, resolveErr
|
|
}
|
|
err = baseModel.Where(c.TenantId, tenantID).
|
|
Where(c.PublishStatus, consts.ImSecurityPublishPublished).
|
|
OrderDesc(c.PolicyVersion).Scan(&res)
|
|
if err != nil {
|
|
return nil, gerror.Wrap(err, "获取安全策略失败")
|
|
}
|
|
if res == nil {
|
|
// 无自建策略时回落默认模板展示，保存后成为本商户自己的策略
|
|
tpl, tplErr := loadPolicyTemplateRow(imtenant.RegistryDB().Model(imPolicyTemplateTable).Safe().Ctx(ctx))
|
|
if tplErr != nil {
|
|
return nil, gerror.Wrap(tplErr, "读取安全策略模板失败")
|
|
}
|
|
if tpl != nil {
|
|
res = &sysin.ImSecurityPolicyModel{
|
|
TenantId: tenantID,
|
|
PolicyName: tpl["policy_name"].String(),
|
|
PasswordPolicy: tpl["password_policy"].String(),
|
|
LoginRateLimit: tpl["login_rate_limit"].String(),
|
|
SensitiveWordPolicy: tpl["sensitive_word_policy"].String(),
|
|
FileReviewPolicy: tpl["file_review_policy"].String(),
|
|
RealnamePolicy: tpl["realname_policy"].String(),
|
|
RiskChallengePolicy: tpl["risk_challenge_policy"].String(),
|
|
GlobalFriendEnabled: tpl["global_friend_enabled"].Int(),
|
|
FriendDisabledPolicy: tpl["friend_disabled_policy"].String(),
|
|
MessageCurfewEnabled: tpl["message_curfew_enabled"].Int(),
|
|
}
|
|
for _, rule := range templateCurfewRules(tpl) {
|
|
res.CurfewRules = append(res.CurfewRules, &sysin.ImMessageCurfewRuleModel{RuleCode: rule.RuleCode, RuleName: rule.RuleName, DateType: rule.DateType, CustomDates: rule.CustomDates.String(), Weekdays: rule.Weekdays.String(), Timezone: rule.Timezone, StartTime: rule.StartTime, EndTime: rule.EndTime, Scope: rule.Scope, WhitelistUserIds: rule.WhitelistUserIds.String(), WhitelistGroupIds: rule.WhitelistGroupIds.String(), Message: rule.Message, Status: rule.Status, Sort: rule.Sort})
|
|
}
|
|
}
|
|
return
|
|
}
|
|
}
|
|
if err != nil {
|
|
return nil, gerror.Wrap(err, "获取安全策略失败")
|
|
}
|
|
if res == nil {
|
|
return nil, gerror.New("安全策略不存在")
|
|
}
|
|
if _, _, err = resolveImPolicyTenant(ctx, res.TenantId); err != nil {
|
|
return nil, err
|
|
}
|
|
res.CurfewRules, err = s.curfewRules(ctx, res.Id)
|
|
return
|
|
}
|
|
|
|
func (s *sSysImSecurityPolicy) curfewRules(ctx context.Context, policyID int64) (list []*sysin.ImMessageCurfewRuleModel, err error) {
|
|
c := dao.ImMessageCurfewRules.Columns()
|
|
err = imtenant.RegistryDB().Model(dao.ImMessageCurfewRules.Table()).Safe().Ctx(ctx).Fields(c.Id, c.RuleCode, c.RuleName, c.DateType, "CAST("+c.CustomDates+" AS CHAR) custom_dates", "CAST("+c.Weekdays+" AS CHAR) weekdays", c.Timezone, "TIME_FORMAT("+c.StartTime+",'%H:%i') start_time", "TIME_FORMAT("+c.EndTime+",'%H:%i') end_time", c.Scope, "CAST("+c.WhitelistUserIds+" AS CHAR) whitelist_user_ids", "CAST("+c.WhitelistGroupIds+" AS CHAR) whitelist_group_ids", c.Message, c.Status, c.Sort).Where(c.PolicyId, policyID).WhereNull(c.DeletedAt).OrderAsc(c.Sort).OrderAsc(c.Id).Scan(&list)
|
|
return
|
|
}
|
|
|
|
// Save 保存安全策略并立即生效：每租户仅一条当前生效记录（单记录模型，无草稿/发布工作流）。
|
|
// 已有记录则原地更新（版本号自增仅作审计），无则创建；同步 im_tenant 冗余开关并投递策略变更事件。
|
|
func (s *sSysImSecurityPolicy) Save(ctx context.Context, in *sysin.ImSecurityPolicySaveInp) (id int64, err error) {
|
|
if err = in.Filter(ctx); err != nil {
|
|
return
|
|
}
|
|
tenantID, tenantCode, err := resolveImPolicyTenant(ctx, in.TenantId)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
if tenantID == 0 {
|
|
// 默认模板不可通过商户策略保存入口修改
|
|
return 0, gerror.New("默认模板不可修改，请选择具体商户")
|
|
}
|
|
db := imtenant.RegistryDB()
|
|
c := dao.ImSecurityPolicy.Columns()
|
|
rc := dao.ImMessageCurfewRules.Columns()
|
|
tc := dao.ImTenant.Columns()
|
|
operator := contexts.GetUserId(ctx)
|
|
now := gtime.Now()
|
|
version := uint(1)
|
|
err = db.Transaction(ctx, func(ctx context.Context, tx gdb.TX) error {
|
|
current, readErr := tx.Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).
|
|
Where(c.TenantId, tenantID).Where(c.PublishStatus, consts.ImSecurityPublishPublished).
|
|
WhereNull(c.DeletedAt).OrderDesc(c.PolicyVersion).One()
|
|
if readErr != nil {
|
|
return readErr
|
|
}
|
|
data := g.Map{c.PolicyName: in.PolicyName, c.PublishStatus: consts.ImSecurityPublishPublished, c.PasswordPolicy: policyJSON(in.PasswordPolicy, "{}"), c.LoginRateLimit: policyJSON(in.LoginRateLimit, "{}"), c.SensitiveWordPolicy: normalizedModerationPolicy(in.SensitiveWordPolicy, tenantCode), c.FileReviewPolicy: policyJSON(in.FileReviewPolicy, "{}"), c.RealnamePolicy: policyJSON(in.RealnamePolicy, "{}"), c.RiskChallengePolicy: policyJSON(in.RiskChallengePolicy, "{}"), c.GlobalFriendEnabled: in.GlobalFriendEnabled, c.FriendDisabledPolicy: policyJSON(in.FriendDisabledPolicy, `{"hide_profile":true,"block_qrcode":true,"block_group_member_entry":true,"blocked_entries":["search","profile_card","group_member","qrcode","invite_auto_add","recommendation"],"message":"当前时段暂不允许添加好友"}`), c.MessageCurfewEnabled: in.MessageCurfewEnabled, c.Remark: in.Remark, c.UpdatedAt: now, c.UpdatedBy: operator}
|
|
if in.LoginRateLimit == nil {
|
|
// 未提交登录失败策略时保留原值（登录失败锁定由独立配置入口管理，避免保存时清空配置）
|
|
delete(data, c.LoginRateLimit)
|
|
}
|
|
if current.IsEmpty() {
|
|
version = 1
|
|
data[c.TenantId] = tenantID
|
|
data[c.PolicyVersion] = version
|
|
data[c.CreatedAt] = now
|
|
data[c.CreatedBy] = operator
|
|
result, insertErr := tx.Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).Data(data).Insert()
|
|
if insertErr != nil {
|
|
return insertErr
|
|
}
|
|
if id, insertErr = result.LastInsertId(); insertErr != nil {
|
|
return insertErr
|
|
}
|
|
} else {
|
|
id = current[c.Id].Int64()
|
|
version = current[c.PolicyVersion].Uint() + 1
|
|
data[c.PolicyVersion] = version
|
|
if _, updateErr := tx.Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).Where(c.Id, id).Data(data).Update(); updateErr != nil {
|
|
return updateErr
|
|
}
|
|
}
|
|
// 规则整体重建：uk_im_message_curfew_rule 唯一键含 tenant_id+rule_code，软删行仍占键会冲突，必须硬删
|
|
if _, deleteErr := tx.Model(dao.ImMessageCurfewRules.Table()).Safe().Ctx(ctx).Where(rc.PolicyId, id).Unscoped().Delete(); deleteErr != nil {
|
|
return deleteErr
|
|
}
|
|
for _, rule := range in.CurfewRules {
|
|
_, insertErr := tx.Model(dao.ImMessageCurfewRules.Table()).Safe().Ctx(ctx).Data(g.Map{rc.TenantId: tenantID, rc.PolicyId: id, rc.RuleCode: rule.RuleCode, rc.RuleName: rule.RuleName, rc.DateType: rule.DateType, rc.CustomDates: policyJSON(rule.CustomDates, "[]"), rc.Weekdays: policyJSON(rule.Weekdays, "[]"), rc.Timezone: rule.Timezone, rc.StartTime: rule.StartTime, rc.EndTime: rule.EndTime, rc.Scope: rule.Scope, rc.WhitelistUserIds: policyJSON(rule.WhitelistUserIds, "[]"), rc.WhitelistGroupIds: policyJSON(rule.WhitelistGroupIds, "[]"), rc.Message: rule.Message, rc.Status: rule.Status, rc.Sort: rule.Sort, rc.CreatedAt: now, rc.CreatedBy: operator, rc.UpdatedAt: now, rc.UpdatedBy: operator}).Insert()
|
|
if insertErr != nil {
|
|
return insertErr
|
|
}
|
|
}
|
|
if tenantID > 0 {
|
|
// 上游已将商户配置并入 im_tenant 表，此处同步冗余开关与策略版本（商户行必然存在，无需补建）
|
|
if _, cfgErr := tx.Model(dao.ImTenant.Table()).Safe().Ctx(ctx).Where(tc.Id, tenantID).
|
|
Data(g.Map{tc.SecurityPolicyVersion: version, tc.GlobalFriendEnabled: in.GlobalFriendEnabled, tc.MessageCurfewEnabled: in.MessageCurfewEnabled, tc.UpdatedAt: now, tc.UpdatedBy: operator}).Update(); cfgErr != nil {
|
|
return cfgErr
|
|
}
|
|
}
|
|
return nil
|
|
})
|
|
if err != nil {
|
|
return 0, gerror.Wrap(err, "保存安全策略失败")
|
|
}
|
|
_ = writeImAdminAudit(ctx, tenantID, "im_security_policy_save", "im_security_policy", id, "success", g.Map{"version": version, "global_friend_enabled": in.GlobalFriendEnabled, "message_curfew_enabled": in.MessageCurfewEnabled})
|
|
// 保存即生效：投递策略变更事件，IM 端消费后失效策略缓存并回源拉取新配置
|
|
if err = publishImPolicyEvent(ctx, tenantID, tenantCode, "security.policy.updated", "security_policy", version); err != nil {
|
|
return id, err
|
|
}
|
|
return id, nil
|
|
}
|
|
|
|
func normalizedModerationPolicy(value *gjson.Json, _ string) string {
|
|
policy := map[string]any{
|
|
"scenes": map[string]bool{"user_nickname": true, "user_signature": true, "group_name": true, "group_nickname": true, "private_message": true, "group_message": true, "group_announcement": true},
|
|
"risk_actions": map[string]string{"high": "block", "medium": "block", "low": "audit_only", "none": "allow"},
|
|
"failure_mode": "allow", "block_message": "内容不符合平台规范，请修改后重试",
|
|
}
|
|
if value != nil && value.String() != "" && value.String() != "null" {
|
|
for key, item := range value.Map() {
|
|
policy[key] = item
|
|
}
|
|
}
|
|
return gjson.New(policy).String()
|
|
}
|
|
|
|
func (s *sSysImSecurityPolicy) RestoreDefault(ctx context.Context, in *sysin.ImSecurityPolicyRestoreInp) (int64, error) {
|
|
if err := in.Filter(ctx); err != nil {
|
|
return 0, err
|
|
}
|
|
tenantID, _, err := resolveImPolicyTenant(ctx, in.TenantId)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
// 读取安全策略模板，将模板内容覆盖为当前商户的策略（复制后商户可自行修改）
|
|
tpl, err := loadPolicyTemplateRow(imtenant.RegistryDB().Model(imPolicyTemplateTable).Safe().Ctx(ctx))
|
|
if err != nil {
|
|
return 0, gerror.Wrap(err, "读取安全策略模板失败")
|
|
}
|
|
if tpl == nil {
|
|
return 0, gerror.New("安全策略模板未初始化")
|
|
}
|
|
id, err := s.Save(ctx, &sysin.ImSecurityPolicySaveInp{TenantId: tenantID, PolicyName: tpl["policy_name"].String(), PasswordPolicy: gjson.New(tpl["password_policy"].String()), LoginRateLimit: gjson.New(tpl["login_rate_limit"].String()), SensitiveWordPolicy: gjson.New(tpl["sensitive_word_policy"].String()), FileReviewPolicy: gjson.New(tpl["file_review_policy"].String()), RealnamePolicy: gjson.New(tpl["realname_policy"].String()), RiskChallengePolicy: gjson.New(tpl["risk_challenge_policy"].String()), GlobalFriendEnabled: tpl["global_friend_enabled"].Int(), FriendDisabledPolicy: gjson.New(tpl["friend_disabled_policy"].String()), MessageCurfewEnabled: tpl["message_curfew_enabled"].Int(), Remark: in.Reason, CurfewRules: templateCurfewRules(tpl)})
|
|
if err == nil {
|
|
_ = writeImAdminAudit(ctx, tenantID, "im_security_policy_restore_default", "im_security_policy", id, "success", g.Map{"reason": in.Reason})
|
|
}
|
|
return id, err
|
|
}
|
|
|
|
// GetLoginLockoutConfig 读取租户已发布策略中的登录失败锁定配置，无配置时返回默认值。
|
|
func (s *sSysImSecurityPolicy) GetLoginLockoutConfig(ctx context.Context, in *sysin.ImLoginLockoutConfigGetInp) (res *sysin.ImLoginLockoutConfigModel, err error) {
|
|
if err = in.Filter(ctx); err != nil {
|
|
return nil, err
|
|
}
|
|
tenantID, _, err := resolveImPolicyTenant(ctx, in.TenantId)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
res = &sysin.ImLoginLockoutConfigModel{Enabled: false, PasswordMaxAttempts: 5, LockMinutes: 1440, WindowMinutes: 60}
|
|
c := dao.ImSecurityPolicy.Columns()
|
|
var row gdb.Record
|
|
if row, err = imtenant.RegistryDB().Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).
|
|
Fields(c.Id, c.PolicyVersion, "CAST("+c.LoginRateLimit+" AS CHAR) login_rate_limit").
|
|
Where(c.TenantId, tenantID).Where(c.PublishStatus, consts.ImSecurityPublishPublished).
|
|
WhereNull(c.DeletedAt).OrderDesc(c.PolicyVersion).One(); err != nil {
|
|
return nil, gerror.Wrap(err, "获取登录失败策略配置失败")
|
|
}
|
|
if row.IsEmpty() {
|
|
return res, nil
|
|
}
|
|
res.PolicyId = row[c.Id].Int64()
|
|
res.PolicyVersion = row[c.PolicyVersion].Uint()
|
|
policy := gjson.New(row["login_rate_limit"].String())
|
|
res.Enabled = policy.Get("enabled").Bool()
|
|
if v := policy.Get("password_max_attempts").Int(); v >= 1 {
|
|
res.PasswordMaxAttempts = int(v)
|
|
}
|
|
if v := policy.Get("lock_seconds").Int(); v >= 60 {
|
|
res.LockMinutes = int(v / 60)
|
|
}
|
|
if v := policy.Get("window_seconds").Int(); v >= 60 {
|
|
res.WindowMinutes = int(v / 60)
|
|
}
|
|
return res, nil
|
|
}
|
|
|
|
// SaveLoginLockoutConfig 保存租户登录失败锁定配置：直接更新已发布策略，保存后通过策略变更事件即时生效。
|
|
func (s *sSysImSecurityPolicy) SaveLoginLockoutConfig(ctx context.Context, in *sysin.ImLoginLockoutConfigSaveInp) error {
|
|
if err := in.Filter(ctx); err != nil {
|
|
return err
|
|
}
|
|
tenantID, tenantCode, err := resolveImPolicyTenant(ctx, in.TenantId)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
value := map[string]any{"enabled": false}
|
|
if in.Enabled {
|
|
value = map[string]any{"enabled": true, "password_max_attempts": in.PasswordMaxAttempts, "lock_seconds": in.LockMinutes * 60, "window_seconds": in.WindowMinutes * 60}
|
|
}
|
|
loginRateLimit := gjson.New(value).String()
|
|
c := dao.ImSecurityPolicy.Columns()
|
|
db := imtenant.RegistryDB()
|
|
var row gdb.Record
|
|
if row, err = db.Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).
|
|
Fields(c.Id, c.PolicyVersion).
|
|
Where(c.TenantId, tenantID).Where(c.PublishStatus, consts.ImSecurityPublishPublished).
|
|
WhereNull(c.DeletedAt).OrderDesc(c.PolicyVersion).One(); err != nil {
|
|
return gerror.Wrap(err, "获取登录失败策略配置失败")
|
|
}
|
|
operator := contexts.GetUserId(ctx)
|
|
now := gtime.Now()
|
|
if !row.IsEmpty() {
|
|
policyID := row[c.Id].Int64()
|
|
version := row[c.PolicyVersion].Uint()
|
|
if _, err = db.Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).Where(c.Id, policyID).
|
|
Data(g.Map{c.LoginRateLimit: loginRateLimit, c.UpdatedAt: now, c.UpdatedBy: operator}).Update(); err != nil {
|
|
return gerror.Wrap(err, "保存登录失败策略配置失败")
|
|
}
|
|
_ = writeImAdminAudit(ctx, tenantID, "im_security_policy_login_lockout_save", "im_security_policy", policyID, "success", g.Map{"enabled": in.Enabled, "password_max_attempts": in.PasswordMaxAttempts, "lock_minutes": in.LockMinutes, "window_minutes": in.WindowMinutes})
|
|
return publishImPolicyEvent(ctx, tenantID, tenantCode, "security.policy.updated", "security_policy", version)
|
|
}
|
|
// 租户尚无策略：保存默认策略，保存即生效并投递策略变更事件
|
|
id, saveErr := s.Save(ctx, &sysin.ImSecurityPolicySaveInp{TenantId: tenantID, PolicyName: "默认安全策略", LoginRateLimit: gjson.New(value), GlobalFriendEnabled: 1, MessageCurfewEnabled: 0})
|
|
if saveErr != nil {
|
|
return saveErr
|
|
}
|
|
_ = writeImAdminAudit(ctx, tenantID, "im_security_policy_login_lockout_save", "im_security_policy", id, "success", g.Map{"enabled": in.Enabled, "password_max_attempts": in.PasswordMaxAttempts, "lock_minutes": in.LockMinutes, "window_minutes": in.WindowMinutes})
|
|
return nil
|
|
}
|
|
|
|
func (s *sSysImSecurityPolicy) IPRuleList(ctx context.Context, in *sysin.ImSecurityIPRuleListInp) (list []*sysin.ImSecurityIPRuleModel, total int, err error) {
|
|
if err = in.Filter(ctx); err != nil {
|
|
return
|
|
}
|
|
tenantID, _, err := resolveImPolicyTenant(ctx, in.TenantId)
|
|
if err != nil {
|
|
return nil, 0, err
|
|
}
|
|
c := dao.ImSecurityIpRules.Columns()
|
|
model := imtenant.RegistryDB().Model(dao.ImSecurityIpRules.Table()).Safe().Ctx(ctx).Fields(c.Id, c.TenantId, c.RuleType, c.IpCidr, c.Action, "CAST("+c.SceneJson+" AS CHAR) scene_json", c.RiskLevel, c.Status, c.ExpiresAt, c.Remark, c.CreatedAt, c.UpdatedAt).Where(c.TenantId, tenantID).WhereNull(c.DeletedAt)
|
|
if in.RuleType != "" {
|
|
model = model.Where(c.RuleType, in.RuleType)
|
|
}
|
|
if in.IpCidr != "" {
|
|
model = model.WhereLike(c.IpCidr, "%"+in.IpCidr+"%")
|
|
}
|
|
if in.Status != 0 {
|
|
model = model.Where(c.Status, in.Status)
|
|
}
|
|
err = model.Page(in.Page, in.PerPage).OrderDesc(c.Id).ScanAndCount(&list, &total, false)
|
|
return
|
|
}
|
|
|
|
func (s *sSysImSecurityPolicy) IPRuleEdit(ctx context.Context, in *sysin.ImSecurityIPRuleEditInp) error {
|
|
if err := in.Filter(ctx); err != nil {
|
|
return err
|
|
}
|
|
if net.ParseIP(in.IpCidr) == nil {
|
|
if _, _, err := net.ParseCIDR(in.IpCidr); err != nil {
|
|
return gerror.New("IP或CIDR格式不合法")
|
|
}
|
|
}
|
|
tenantID, tenantCode, err := resolveImPolicyTenant(ctx, in.TenantId)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
c := dao.ImSecurityIpRules.Columns()
|
|
db := imtenant.RegistryDB()
|
|
now := gtime.Now()
|
|
data := g.Map{c.TenantId: tenantID, c.RuleType: in.RuleType, c.IpCidr: in.IpCidr, c.Action: in.Action, c.SceneJson: policyJSON(in.SceneJson, "[]"), c.RiskLevel: in.RiskLevel, c.Status: in.Status, c.ExpiresAt: in.ExpiresAt, c.Remark: in.Remark, c.UpdatedAt: now, c.UpdatedBy: contexts.GetUserId(ctx)}
|
|
targetID := in.Id
|
|
if in.Id > 0 {
|
|
var row gdb.Record
|
|
if row, err = db.Model(dao.ImSecurityIpRules.Table()).Safe().Ctx(ctx).Where(c.Id, in.Id).WhereNull(c.DeletedAt).One(); err != nil {
|
|
return err
|
|
}
|
|
if row.IsEmpty() || row[c.TenantId].Int64() != tenantID {
|
|
return gerror.New("IP规则不存在")
|
|
}
|
|
_, err = db.Model(dao.ImSecurityIpRules.Table()).Safe().Ctx(ctx).Where(c.Id, in.Id).Data(data).Update()
|
|
} else {
|
|
data[c.CreatedAt] = now
|
|
data[c.CreatedBy] = contexts.GetUserId(ctx)
|
|
result, insertErr := db.Model(dao.ImSecurityIpRules.Table()).Safe().Ctx(ctx).Data(data).Insert()
|
|
err = insertErr
|
|
if err == nil {
|
|
targetID, err = result.LastInsertId()
|
|
}
|
|
}
|
|
if err != nil {
|
|
return gerror.Wrap(err, "保存IP规则失败")
|
|
}
|
|
_ = writeImAdminAudit(ctx, tenantID, "im_security_ip_rule_edit", "im_security_ip_rule", targetID, "success", g.Map{"ip_cidr": in.IpCidr, "rule_type": in.RuleType})
|
|
return publishImPolicyEvent(ctx, tenantID, tenantCode, "security.policy.updated", "security_policy", uint(targetID))
|
|
}
|
|
|
|
func (s *sSysImSecurityPolicy) IPRuleDelete(ctx context.Context, in *sysin.ImSecurityIPRuleDeleteInp) error {
|
|
if err := in.Filter(ctx); err != nil {
|
|
return err
|
|
}
|
|
c := dao.ImSecurityIpRules.Columns()
|
|
db := imtenant.RegistryDB()
|
|
var row gdb.Record
|
|
var err error
|
|
if row, err = db.Model(dao.ImSecurityIpRules.Table()).Safe().Ctx(ctx).Where(c.Id, in.Id).WhereNull(c.DeletedAt).One(); err != nil {
|
|
return err
|
|
}
|
|
if row.IsEmpty() {
|
|
return gerror.New("IP规则不存在")
|
|
}
|
|
tenantID, tenantCode, err := resolveImPolicyTenant(ctx, row[c.TenantId].Int64())
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_, err = db.Model(dao.ImSecurityIpRules.Table()).Safe().Ctx(ctx).Where(c.Id, in.Id).Data(g.Map{c.Status: consts.StatusDisable, c.DeletedAt: gtime.Now(), c.DeletedBy: contexts.GetUserId(ctx), c.UpdatedAt: gtime.Now(), c.UpdatedBy: contexts.GetUserId(ctx)}).Update()
|
|
if err != nil {
|
|
return gerror.Wrap(err, "删除IP规则失败")
|
|
}
|
|
_ = writeImAdminAudit(ctx, tenantID, "im_security_ip_rule_delete", "im_security_ip_rule", in.Id, "success", nil)
|
|
return publishImPolicyEvent(ctx, tenantID, tenantCode, "security.policy.updated", "security_policy", uint(in.Id))
|
|
}
|