feat(authz): scope admin data by user and channel permissions

controller/admin_scope.go

@@ -0,0 +1,84 @@
+package controller
+
+import (
+	"net/http"
+
+	"github.com/QuantumNous/new-api/common"
+	"github.com/QuantumNous/new-api/i18n"
+	"github.com/QuantumNous/new-api/model"
+	"github.com/QuantumNous/new-api/service/authz"
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+func canViewAllChannels(c *gin.Context) bool {
+	return authz.Can(c.GetInt("id"), c.GetInt("role"), authz.ChannelReadAll)
+}
+
+func canReadUsers(c *gin.Context) bool {
+	return authz.Can(c.GetInt("id"), c.GetInt("role"), authz.UserRead)
+}
+
+func applyChannelScope(c *gin.Context, query *gorm.DB) *gorm.DB {
+	if canViewAllChannels(c) {
+		return query
+	}
+	return query.Where("creator_id = ?", c.GetInt("id"))
+}
+
+func visibleChannelIDs(c *gin.Context) (ids []int, unrestricted bool, err error) {
+	if canViewAllChannels(c) {
+		return nil, true, nil
+	}
+	err = model.DB.Model(&model.Channel{}).
+		Where("creator_id = ?", c.GetInt("id")).
+		Pluck("id", &ids).Error
+	return ids, false, err
+}
+
+func ensureChannelVisible(c *gin.Context, channelID int) bool {
+	if canViewAllChannels(c) {
+		return true
+	}
+	var count int64
+	err := model.DB.Model(&model.Channel{}).
+		Where("id = ? AND creator_id = ?", channelID, c.GetInt("id")).
+		Count(&count).Error
+	if err == nil && count > 0 {
+		return true
+	}
+	c.JSON(http.StatusForbidden, gin.H{
+		"success": false,
+		"message": common.TranslateMessage(c, i18n.MsgAuthInsufficientPrivilege),
+	})
+	return false
+}
+
+func ensureChannelsVisible(c *gin.Context, channelIDs []int) bool {
+	if len(channelIDs) == 0 || canViewAllChannels(c) {
+		return true
+	}
+	var count int64
+	err := model.DB.Model(&model.Channel{}).
+		Where("id IN ? AND creator_id = ?", channelIDs, c.GetInt("id")).
+		Count(&count).Error
+	if err == nil && count == int64(len(channelIDs)) {
+		return true
+	}
+	c.JSON(http.StatusForbidden, gin.H{
+		"success": false,
+		"message": common.TranslateMessage(c, i18n.MsgAuthInsufficientPrivilege),
+	})
+	return false
+}
+
+func requireAllChannelScope(c *gin.Context) bool {
+	if canViewAllChannels(c) {
+		return true
+	}
+	c.JSON(http.StatusForbidden, gin.H{
+		"success": false,
+		"message": common.TranslateMessage(c, i18n.MsgAuthInsufficientPrivilege),
+	})
+	return false
+}

controller/channel-billing.go

@@ -427,6 +427,9 @@ func UpdateChannelBalance(c *gin.Context) {
 		common.ApiError(c, err)
 		return
 	}
+	if !ensureChannelVisible(c, id) {
+		return
+	}
 	channel, err := model.CacheGetChannel(id)
 	if err != nil {
 		common.ApiError(c, err)
@@ -482,6 +485,9 @@ func updateAllChannelsBalance() error {
 }
 
 func UpdateAllChannelsBalance(c *gin.Context) {
+	if !requireAllChannelScope(c) {
+		return
+	}
 	// TODO: make it async
 	err := updateAllChannelsBalance()
 	if err != nil {

controller/channel-test.go

@@ -831,6 +831,9 @@ func TestChannel(c *gin.Context) {
 		common.ApiError(c, err)
 		return
 	}
+	if !ensureChannelVisible(c, channelId) {
+		return
+	}
 	channel, err := model.CacheGetChannel(channelId)
 	if err != nil {
 		channel, err = model.GetChannelById(channelId, true)
@@ -1033,6 +1036,9 @@ func selectChannelsForAutomaticTest(channels []*model.Channel, mode string) []*m
 // test loop inline. If any channel_test task is already active, the manual run is
 // rejected so the caller does not mistake a scheduled run for this manual one.
 func TestAllChannels(c *gin.Context) {
+	if !requireAllChannelScope(c) {
+		return
+	}
 	task, created, err := service.EnqueueSystemTask(model.SystemTaskTypeChannelTest, channelTestTaskPayload{
 		Mode:   operation_setting.ChannelTestModeScheduledAll,
 		Notify: true,