From 398a5e42821d3bef761898daee52294bbfa07a24 Mon Sep 17 00:00:00 2001 From: break Date: Thu, 17 Sep 2026 17:49:33 +0800 Subject: [PATCH] =?UTF-8?q?fix(=E8=B7=AF=E7=94=B1):=20=E4=BF=AE=E6=AD=A3?= =?UTF-8?q?=E5=A5=97=E9=A4=90=E7=9C=9F=E6=B5=81=E9=87=8F=E9=A2=84=E8=AD=A6?= =?UTF-8?q?=E4=B8=8E=E8=B5=84=E4=BA=A7=E8=87=AA=E5=8A=A8=E7=BB=AD=E8=B4=B9?= =?UTF-8?q?=E7=9A=84=E8=B6=85=E7=AE=A1/=E5=B9=B3=E5=8F=B0=20gate=20?= =?UTF-8?q?=E4=BD=9C=E7=94=A8=E5=9F=9F?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fiber 组中间件按路径前缀生效，两处 gate 挂在空路径组上实际落到 /api/admin 前缀， 注册顺序在其之后的后台接口对代理与企业账号一律返回 403（含代理充值、代理自充 支付方式与订单等）。gate 改为挂在各自功能路径组上，代理与企业仅被拒绝这两组功能入口。 --- internal/routes/asset_auto_renewal.go | 4 +++- internal/routes/package_traffic_alert.go | 10 ++++++---- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/internal/routes/asset_auto_renewal.go b/internal/routes/asset_auto_renewal.go index 29495d3..8584bed 100644 --- a/internal/routes/asset_auto_renewal.go +++ b/internal/routes/asset_auto_renewal.go @@ -13,8 +13,10 @@ import ( // registerAssetAutoRenewalRoutes 注册资产钱包自动续费配置的读写路由。 // 沿用超管/平台路由组级 gate 先例：代理、企业与个人客户账号一律 403，无任何读取或修改入口。 +// gate 必须挂在功能路径组上：Fiber 的组中间件按路径前缀生效，挂在空路径组上会落到 +// /api/admin 前缀，从而拦截该层其余全部接口。 func registerAssetAutoRenewalRoutes(router fiber.Router, handler *admin.AssetAutoRenewalConfigHandler, doc *openapi.Generator, basePath string) { - group := router.Group("", func(c *fiber.Ctx) error { + group := router.Group("/asset-auto-renewal-config", func(c *fiber.Ctx) error { userType := middleware.GetUserTypeFromContext(c.UserContext()) if userType != constants.UserTypeSuperAdmin && userType != constants.UserTypePlatform { return errors.New(errors.CodeForbidden, constants.PlatformManagementForbiddenMessage) diff --git a/internal/routes/package_traffic_alert.go b/internal/routes/package_traffic_alert.go index b5f6f21..014d2a6 100644 --- a/internal/routes/package_traffic_alert.go +++ b/internal/routes/package_traffic_alert.go @@ -13,16 +13,18 @@ import ( // registerPackageTrafficAlertRoutes 注册套餐真流量预警规则与达量预警路由。 // 沿用超管/平台路由组级 gate 先例：代理、企业与个人客户账号一律 403。 +// gate 必须挂在功能路径组上：Fiber 的组中间件按路径前缀生效，挂在空路径组上会落到 +// /api/admin 前缀，从而拦截该层其余全部接口。 func registerPackageTrafficAlertRoutes(router fiber.Router, handler *admin.PackageTrafficAlertHandler, doc *openapi.Generator, basePath string) { - group := router.Group("", func(c *fiber.Ctx) error { + gate := func(c *fiber.Ctx) error { userType := middleware.GetUserTypeFromContext(c.UserContext()) if userType != constants.UserTypeSuperAdmin && userType != constants.UserTypePlatform { return errors.New(errors.CodeForbidden, constants.PlatformManagementForbiddenMessage) } return c.Next() - }) + } - ruleGroup := group.Group("/package-traffic-alert-rules") + ruleGroup := router.Group("/package-traffic-alert-rules", gate) rulePath := basePath + "/package-traffic-alert-rules" Register(ruleGroup, doc, rulePath, "GET", "", handler.ListRules, RouteSpec{ @@ -52,7 +54,7 @@ func registerPackageTrafficAlertRoutes(router fiber.Router, handler *admin.Packa Auth: true, }) - alertGroup := group.Group("/package-traffic-alerts") + alertGroup := router.Group("/package-traffic-alerts", gate) alertPath := basePath + "/package-traffic-alerts" Register(alertGroup, doc, alertPath, "GET", "", handler.ListAlerts, RouteSpec{