Skip to content

feat(auth): enhance user role handling and context management #2533

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
NoahCodeGG wants to merge 1 commit into
base: main
Choose a base branch
from
+20 −12
Open

feat(auth): enhance user role handling and context management #2533

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions constant/context_key.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,7 @@ const (
ContextKeyUserGroup ContextKey = "user_group"
ContextKeyUsingGroup ContextKey = "group"
ContextKeyUserName ContextKey = "username"
ContextKeyUserRole ContextKey = "role"

ContextKeyLocalCountTokens ContextKey = "local_count_tokens"

Expand Down
27 changes: 15 additions & 12 deletions middleware/auth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,9 +32,7 @@ func validUserInfo(username string, role int) bool {
func authHelper(c *gin.Context, minRole int) {
session := sessions.Default(c)
username := session.Get("username")
role := session.Get("role")
id := session.Get("id")
status := session.Get("status")
useAccessToken := false
if username == nil {
// Check access token
Expand All @@ -59,9 +57,7 @@ func authHelper(c *gin.Context, minRole int) {
}
// Token is valid
username = user.Username
role = user.Role
id = user.Id
status = user.Status
useAccessToken = true
} else {
c.JSON(http.StatusOK, gin.H{
Expand Down Expand Up @@ -100,35 +96,42 @@ func authHelper(c *gin.Context, minRole int) {
c.Abort()
return
}
if status.(int) == common.UserStatusDisabled {

userCache, err := model.GetUserCache(id.(int))
if err != nil {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": err.Error(),
})
c.Abort()
return
}
Comment on lines +99 to +108
Copy link
Contributor

@coderabbitai coderabbitai bot Dec 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Potential panic on type assertion.

Line 100 performs id.(int) which could panic if id was retrieved from the session with a different underlying type (e.g., int64 or float64 depending on session serialization). Consider using a safe type assertion or common.GetIntFromInterface() if available.

Additionally, exposing err.Error() directly to the client (line 104) may leak internal details. Consider returning a generic error message.

🔎 Proposed fix 
-	userCache, err := model.GetUserCache(id.(int))
+	userId, ok := id.(int)
+	if !ok {
+		c.JSON(http.StatusUnauthorized, gin.H{
+			"success": false,
+			"message": "无权进行此操作，用户ID无效",
+		})
+		c.Abort()
+		return
+	}
+	userCache, err := model.GetUserCache(userId)
 	if err != nil {
 		c.JSON(http.StatusOK, gin.H{
 			"success": false,
-			"message": err.Error(),
+			"message": "获取用户信息失败",
 		})
 		c.Abort()
 		return
 	}
🤖 Prompt for AI Agents 
In middleware/auth.go around lines 99 to 108, the code does an unsafe type
assertion id.(int) which can panic if the session value is another numeric type
and it returns err.Error() to the client exposing internal details; change to a
safe conversion (use a type switch or the existing
common.GetIntFromInterface(id) helper) to obtain an int without panicking,
handle the conversion error path cleanly, and replace the client-facing message
with a generic error string (log the detailed err internally) before aborting.


if userCache.Status == common.UserStatusDisabled {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "用户已被封禁",
})
c.Abort()
return
}
if role.(int) < minRole {
if userCache.Role < minRole {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "无权进行此操作，权限不足",
})
c.Abort()
return
}
if !validUserInfo(username.(string), role.(int)) {
if !validUserInfo(userCache.Username, userCache.Role) {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "无权进行此操作，用户信息无效",
})
c.Abort()
return
}
c.Set("username", username)
c.Set("role", role)
c.Set("id", id)
c.Set("group", session.Get("group"))
c.Set("user_group", session.Get("group"))
userCache.WriteContext(c)
c.Set("use_access_token", useAccessToken)

//userCache, err := model.GetUserCache(id.(int))
Expand Down
4 changes: 4 additions & 0 deletions model/user_cache.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,15 +22,18 @@ type UserBase struct {
Status int `json:"status"`
Username string `json:"username"`
Setting string `json:"setting"`
Role int `json:"role"`
}

func (user *UserBase) WriteContext(c *gin.Context) {
common.SetContextKey(c, constant.ContextKeyUserId, user.Id)
common.SetContextKey(c, constant.ContextKeyUserGroup, user.Group)
common.SetContextKey(c, constant.ContextKeyUserQuota, user.Quota)
common.SetContextKey(c, constant.ContextKeyUserStatus, user.Status)
common.SetContextKey(c, constant.ContextKeyUserEmail, user.Email)
common.SetContextKey(c, constant.ContextKeyUserName, user.Username)
common.SetContextKey(c, constant.ContextKeyUserSetting, user.GetSetting())
common.SetContextKey(c, constant.ContextKeyUserRole, user.Role)
}

func (user *UserBase) GetSetting() dto.UserSetting {
Expand Down Expand Up @@ -107,6 +110,7 @@ func GetUserCache(userId int) (userCache *UserBase, err error) {
Username: user.Username,
Setting: user.Setting,
Email: user.Email,
Role: user.Role,
}

return userCache, nil
Expand Down