From 0575bdfbd36a5918cd53a86fe0d5bab0ec9a7fac Mon Sep 17 00:00:00 2001
From: zijiren233 <pyh1670605849@gmail.com>
Date: Sat, 11 Nov 2023 14:47:47 +0800
Subject: [PATCH] Opt: auth admin root middleware

---
 server/middlewares/auth.go | 38 ++++++++++++--------------------------
 1 file changed, 12 insertions(+), 26 deletions(-)

diff --git a/server/middlewares/auth.go b/server/middlewares/auth.go
index 8d15a0c..98ecc67 100644
--- a/server/middlewares/auth.go
+++ b/server/middlewares/auth.go
@@ -106,28 +106,6 @@ func AuthUser(Authorization string) (*op.User, error) {
 	return u, nil
 }
 
-func AuthAdmin(Authorization string) (*op.User, error) {
-	u, err := AuthUser(Authorization)
-	if err != nil {
-		return nil, err
-	}
-	if !u.IsAdmin() {
-		return nil, errors.New("user is not admin")
-	}
-	return u, nil
-}
-
-func AuthRoot(Authorization string) (*op.User, error) {
-	u, err := AuthUser(Authorization)
-	if err != nil {
-		return nil, err
-	}
-	if !u.IsRoot() {
-		return nil, errors.New("user is not admin")
-	}
-	return u, nil
-}
-
 func NewAuthUserToken(user *op.User) (string, error) {
 	if user.IsBanned() {
 		return "", errors.New("user banned")
@@ -206,9 +184,13 @@ func AuthUserMiddleware(ctx *gin.Context) {
 }
 
 func AuthAdminMiddleware(ctx *gin.Context) {
-	user, err := AuthAdmin(ctx.GetHeader("Authorization"))
+	user, err := AuthUser(ctx.GetHeader("Authorization"))
 	if err != nil {
-		ctx.AbortWithStatusJSON(http.StatusForbidden, model.NewApiErrorResp(err))
+		ctx.AbortWithStatusJSON(http.StatusUnauthorized, model.NewApiErrorResp(err))
+		return
+	}
+	if !user.IsAdmin() {
+		ctx.AbortWithStatusJSON(http.StatusForbidden, model.NewApiErrorStringResp("user is not admin"))
 		return
 	}
 
@@ -217,9 +199,13 @@ func AuthAdminMiddleware(ctx *gin.Context) {
 }
 
 func AuthRootMiddleware(ctx *gin.Context) {
-	user, err := AuthRoot(ctx.GetHeader("Authorization"))
+	user, err := AuthUser(ctx.GetHeader("Authorization"))
 	if err != nil {
-		ctx.AbortWithStatusJSON(http.StatusForbidden, model.NewApiErrorResp(err))
+		ctx.AbortWithStatusJSON(http.StatusUnauthorized, model.NewApiErrorResp(err))
+		return
+	}
+	if !user.IsRoot() {
+		ctx.AbortWithStatusJSON(http.StatusForbidden, model.NewApiErrorStringResp("user is not root"))
 		return
 	}