switchboard/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Releases 9 Wiki Activity

Changeset 0.29.0 (#195)

Browse Source
This commit is contained in:
xcaliber
2026-03-17 16:28:47 +00:00
parent 128cbb8174
commit 5d637d3a90
129 changed files with 9418 additions and 3016 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
server/middleware/session_auth.go
View File

@@ -70,12 +70,7 @@ func AuthOrSession(cfg *config.Config, stores store.Stores, cache *UserStatusCac
}
// Verify channel exists, is workflow type, and allows anonymous
var chType string
var allowAnon bool
err := database.DB.QueryRowContext(c.Request.Context(),
database.Q(`SELECT type, allow_anonymous FROM channels WHERE id = $1`),
channelID,
).Scan(&chType, &allowAnon)
chType, allowAnon, err := stores.Channels.GetTypeAndAllowAnonymous(c.Request.Context(), channelID)
if err != nil {
c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "authentication required"})
return

32
server/middleware/team.go
View File

@@ -5,16 +5,14 @@ import (
"github.com/gin-gonic/gin"
"git.gobha.me/xcaliber/chat-switchboard/database"
"git.gobha.me/xcaliber/chat-switchboard/store"
)
// RequireTeamAdmin returns middleware that restricts access to users who are
// admins of the team identified by :teamId in the URL path.
// System admins (role=admin) are always allowed through.
// Must be used after Auth() middleware.
func RequireTeamAdmin() gin.HandlerFunc {
// RequireTeamAdmin returns middleware that restricts access to team admins.
// System admins are always allowed through.
// v0.29.0: accepts TeamStore instead of using database.DB directly.
func RequireTeamAdmin(teams store.TeamStore) gin.HandlerFunc {
return func(c *gin.Context) {
// System admins bypass team check
role, _ := c.Get("role")
if role == "admin" {
c.Next()
@@ -30,13 +28,8 @@ func RequireTeamAdmin() gin.HandlerFunc {
return
}
var teamRole string
err := database.DB.QueryRow(`
SELECT role FROM team_members
WHERE team_id = $1 AND user_id = $2
`, teamID, userID).Scan(&teamRole)
if err != nil || teamRole != "admin" {
isAdmin, err := teams.IsTeamAdmin(c.Request.Context(), teamID, userID.(string))
if err != nil || !isAdmin {
c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
"error": "team admin access required",
})
@@ -50,7 +43,8 @@ func RequireTeamAdmin() gin.HandlerFunc {
// RequireTeamMember returns middleware that restricts access to users who
// belong to the team identified by :teamId (any role).
// System admins are always allowed through.
func RequireTeamMember() gin.HandlerFunc {
// v0.29.0: accepts TeamStore instead of using database.DB directly.
func RequireTeamMember(teams store.TeamStore) gin.HandlerFunc {
return func(c *gin.Context) {
role, _ := c.Get("role")
if role == "admin" {
@@ -67,12 +61,8 @@ func RequireTeamMember() gin.HandlerFunc {
return
}
var exists bool
database.DB.QueryRow(`
SELECT EXISTS(SELECT 1 FROM team_members WHERE team_id = $1 AND user_id = $2)
`, teamID, userID).Scan(&exists)
if !exists {
isMember, _ := teams.IsMember(c.Request.Context(), teamID, userID.(string))
if !isMember {
c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
"error": "team membership required",
})