Skip to content

Commit 11f992c

Browse files
RSS1102RSS1102
committed
feat: 更新权限控制矩阵，添加博客和评论的权限说明；完善 Swagger 文档，增加错误响应描述
1 parent 9307e5f commit 11f992c

File tree

10 files changed

+239
-70
lines changed

10 files changed

+239
-70
lines changed

‎README.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,17 @@
11
# blog-backend-go
2+
3+
## 权限控制矩阵
4+
5+
| 操作 | 普通用户 | 博客作者 | 管理员 |
6+
|------|----------|----------|--------|
7+
| 查看博客 | ✅ | ✅ | ✅ |
8+
| 创建博客 | ✅ | ✅ | ✅ |
9+
| 更新自己博客 | ✅ | ✅ | ✅ |
10+
| 更新他人博客 | ❌ | ❌ | ✅ |
11+
| 删除自己博客 | ✅ | ✅ | ✅ |
12+
| 删除他人博客 | ❌ | ❌ | ✅ |
13+
| 修改作者字段 | ❌ | ❌ | ✅ |
14+
| 删除自己评论 | ✅ | ✅ | ✅ |
15+
| 删除他人评论 | ❌ | ❌ | ✅ |
16+
| 点赞 | ✅ | ✅ | ✅ |
17+
| 取消点赞 | ✅ | ✅ | ✅ |

docs/docker_commands.md renamed to docs/docker/docker_commands.md

File renamed without changes.

‎docs/docs.go‎

Lines changed: 45 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -206,6 +206,12 @@ const docTemplate = `{
206206
"type": "string"
207207
}
208208
},
209+
"403": {
210+
"description": "无权限操作他人博客",
211+
"schema": {
212+
"type": "string"
213+
}
214+
},
209215
"404": {
210216
"description": "文章未找到",
211217
"schema": {
@@ -242,6 +248,12 @@ const docTemplate = `{
242248
"type": "string"
243249
}
244250
},
251+
"403": {
252+
"description": "无权限操作他人博客",
253+
"schema": {
254+
"type": "string"
255+
}
256+
},
245257
"404": {
246258
"description": "文章未找到",
247259
"schema": {
@@ -288,8 +300,8 @@ const docTemplate = `{
288300
"type": "string"
289301
}
290302
},
291-
"500": {
292-
"description": "添加标签失败",
303+
"501": {
304+
"description": "功能未实现",
293305
"schema": {
294306
"type": "string"
295307
}
@@ -572,6 +584,24 @@ const docTemplate = `{
572584
"type": "string"
573585
}
574586
},
587+
"400": {
588+
"description": "无效请求",
589+
"schema": {
590+
"type": "string"
591+
}
592+
},
593+
"401": {
594+
"description": "未认证",
595+
"schema": {
596+
"type": "string"
597+
}
598+
},
599+
"403": {
600+
"description": "无权限",
601+
"schema": {
602+
"type": "string"
603+
}
604+
},
575605
"404": {
576606
"description": "未找到",
577607
"schema": {
@@ -650,8 +680,20 @@ const docTemplate = `{
650680
"type": "string"
651681
}
652682
},
683+
"400": {
684+
"description": "无效请求",
685+
"schema": {
686+
"type": "string"
687+
}
688+
},
689+
"401": {
690+
"description": "未认证",
691+
"schema": {
692+
"type": "string"
693+
}
694+
},
653695
"404": {
654-
"description": "未找到",
696+
"description": "点赞记录未找到",
655697
"schema": {
656698
"type": "string"
657699
}

‎docs/swagger.json‎

Lines changed: 45 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -203,6 +203,12 @@
203203
"type": "string"
204204
}
205205
},
206+
"403": {
207+
"description": "无权限操作他人博客",
208+
"schema": {
209+
"type": "string"
210+
}
211+
},
206212
"404": {
207213
"description": "文章未找到",
208214
"schema": {
@@ -239,6 +245,12 @@
239245
"type": "string"
240246
}
241247
},
248+
"403": {
249+
"description": "无权限操作他人博客",
250+
"schema": {
251+
"type": "string"
252+
}
253+
},
242254
"404": {
243255
"description": "文章未找到",
244256
"schema": {
@@ -285,8 +297,8 @@
285297
"type": "string"
286298
}
287299
},
288-
"500": {
289-
"description": "添加标签失败",
300+
"501": {
301+
"description": "功能未实现",
290302
"schema": {
291303
"type": "string"
292304
}
@@ -569,6 +581,24 @@
569581
"type": "string"
570582
}
571583
},
584+
"400": {
585+
"description": "无效请求",
586+
"schema": {
587+
"type": "string"
588+
}
589+
},
590+
"401": {
591+
"description": "未认证",
592+
"schema": {
593+
"type": "string"
594+
}
595+
},
596+
"403": {
597+
"description": "无权限",
598+
"schema": {
599+
"type": "string"
600+
}
601+
},
572602
"404": {
573603
"description": "未找到",
574604
"schema": {
@@ -647,8 +677,20 @@
647677
"type": "string"
648678
}
649679
},
680+
"400": {
681+
"description": "无效请求",
682+
"schema": {
683+
"type": "string"
684+
}
685+
},
686+
"401": {
687+
"description": "未认证",
688+
"schema": {
689+
"type": "string"
690+
}
691+
},
650692
"404": {
651-
"description": "未找到",
693+
"description": "点赞记录未找到",
652694
"schema": {
653695
"type": "string"
654696
}

‎docs/swagger.yaml‎

Lines changed: 31 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -304,6 +304,10 @@ paths:
304304
description: 未认证用户
305305
schema:
306306
type: string
307+
"403":
308+
description: 无权限操作他人博客
309+
schema:
310+
type: string
307311
"404":
308312
description: 文章未找到
309313
schema:
@@ -342,6 +346,10 @@ paths:
342346
description: 未认证用户
343347
schema:
344348
type: string
349+
"403":
350+
description: 无权限操作他人博客
351+
schema:
352+
type: string
345353
"404":
346354
description: 文章未找到
347355
schema:
@@ -401,8 +409,8 @@ paths:
401409
description: 无效的标签
402410
schema:
403411
type: string
404-
"500":
405-
description: 添加标签失败
412+
"501":
413+
description: 功能未实现
406414
schema:
407415
type: string
408416
summary: 新增标签
@@ -533,6 +541,18 @@ paths:
533541
description: 删除成功
534542
schema:
535543
type: string
544+
"400":
545+
description: 无效请求
546+
schema:
547+
type: string
548+
"401":
549+
description: 未认证
550+
schema:
551+
type: string
552+
"403":
553+
description: 无权限
554+
schema:
555+
type: string
536556
"404":
537557
description: 未找到
538558
schema:
@@ -584,8 +604,16 @@ paths:
584604
description: 取消成功
585605
schema:
586606
type: string
607+
"400":
608+
description: 无效请求
609+
schema:
610+
type: string
611+
"401":
612+
description: 未认证
613+
schema:
614+
type: string
587615
"404":
588-
description: 未找到
616+
description: 点赞记录未找到
589617
schema:
590618
type: string
591619
summary: 取消点赞

‎handlers/blogs_handlers.go‎

Lines changed: 35 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -107,20 +107,16 @@ func (h *BlogHandler) GetAllTagsHandler(w http.ResponseWriter, r *http.Request)
107107
// @Param data body TagRequest true "标签内容"
108108
// @Success 201 {string} string "创建成功"
109109
// @Failure 400 {string} string "无效的标签"
110-
// @Failure 500 {string} string "添加标签失败"
110+
// @Failure 501 {string} string "功能未实现"
111111
// @Router /api/admin/tag [post]
112112
func (h *BlogHandler) AddTagHandler(w http.ResponseWriter, r *http.Request) {
113113
var req TagRequest
114114
if err := json.NewDecoder(r.Body).Decode(&req); err != nil || req.Tag == "" {
115115
utils.SendError(w, http.StatusBadRequest, "无效的标签")
116116
return
117117
}
118-
err := h.blogService.AddTag(req.Tag)
119-
if err != nil {
120-
utils.SendError(w, http.StatusInternalServerError, "添加标签失败")
121-
return
122-
}
123-
w.WriteHeader(http.StatusCreated)
118+
// 标签管理已集成在博客创建/编辑中，此端点暂不实现单独的标签集合管理
119+
utils.SendError(w, http.StatusNotImplemented, "标签请直接在创建或编辑博客时管理")
124120
}
125121

126122
// DeleteTagHandler 删除标签（会从所有博客中移除该标签）
@@ -251,6 +247,7 @@ func (h *BlogHandler) CreateBlog(w http.ResponseWriter, r *http.Request) {
251247
// @Success 200 {object} BlogResponse
252248
// @Failure 400 {string} string "无效的请求数据"
253249
// @Failure 401 {string} string "未认证用户"
250+
// @Failure 403 {string} string "无权限操作他人博客"
254251
// @Failure 404 {string} string "文章未找到"
255252
// @Router /api/admin/blog/{id} [put]
256253
func (h *BlogHandler) UpdateBlog(w http.ResponseWriter, r *http.Request) {
@@ -272,13 +269,29 @@ func (h *BlogHandler) UpdateBlog(w http.ResponseWriter, r *http.Request) {
272269

273270
// 从认证上下文中获取用户信息（用于权限校验）
274271
username := middleware.GetUsername(r)
272+
role := middleware.GetUserRole(r)
275273
if username == "" {
276274
utils.SendError(w, http.StatusUnauthorized, "未认证用户")
277275
return
278276
}
279277

280-
// 检查是否是文章作者（这里简化了，实际应该从数据库检查）
281-
// TODO: 添加权限检查
278+
// 检查权限：只有管理员可以修改作者字段，普通用户只能修改自己的博客
279+
if req.Author != nil && role != "admin" {
280+
utils.SendError(w, http.StatusForbidden, "无权限修改作者信息")
281+
return
282+
}
283+
284+
// 检查是否是文章作者或管理员
285+
existingBlog, err := h.blogService.GetBlogByID(id)
286+
if err != nil {
287+
utils.SendError(w, http.StatusNotFound, "文章未找到")
288+
return
289+
}
290+
291+
if existingBlog.Author != username && role != "admin" {
292+
utils.SendError(w, http.StatusForbidden, "无权限操作他人博客")
293+
return
294+
}
282295

283296
blog, err := h.blogService.UpdateBlog(id, req.Title, req.Content, req.Author, req.Tags, req.Show, req.Views)
284297
if err != nil {
@@ -296,6 +309,7 @@ func (h *BlogHandler) UpdateBlog(w http.ResponseWriter, r *http.Request) {
296309
// @Param id path string true "博客ID"
297310
// @Success 204 {string} string "删除成功"
298311
// @Failure 401 {string} string "未认证用户"
312+
// @Failure 403 {string} string "无权限操作他人博客"
299313
// @Failure 404 {string} string "文章未找到"
300314
// @Router /api/admin/blog/{id} [delete]
301315
func (h *BlogHandler) DeleteBlog(w http.ResponseWriter, r *http.Request) {
@@ -304,13 +318,23 @@ func (h *BlogHandler) DeleteBlog(w http.ResponseWriter, r *http.Request) {
304318

305319
// 从认证上下文中获取用户信息
306320
username := middleware.GetUsername(r)
321+
role := middleware.GetUserRole(r)
307322
if username == "" {
308323
utils.SendError(w, http.StatusUnauthorized, "未认证用户")
309324
return
310325
}
311326

312-
// 检查是否是文章作者（这里简化了，实际应该从数据库检查）
313-
// TODO: 添加权限检查
327+
// 检查是否是文章作者或管理员
328+
existingBlog, err := h.blogService.GetBlogByID(id)
329+
if err != nil {
330+
utils.SendError(w, http.StatusNotFound, "文章未找到")
331+
return
332+
}
333+
334+
if existingBlog.Author != username && role != "admin" {
335+
utils.SendError(w, http.StatusForbidden, "无权限操作他人博客")
336+
return
337+
}
314338

315339
if err := h.blogService.DeleteBlog(id); err != nil {
316340
utils.SendError(w, http.StatusNotFound, "文章未找到")

0 commit comments

Comments
 (0)