feat: 完整游戏运维功能

platform/api/authorization.go

@@ -0,0 +1,75 @@
+package api
+
+import (
+	"net/http"
+	"strings"
+
+	"browser.local/platform/domain"
+	"browser.local/platform/service"
+)
+
+func (h *coreHandlers) requireAuthorizedAPI(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !strings.HasPrefix(r.URL.Path, "/api/v1/") || publicAPIRequest(r) || runServiceRequest(r) {
+			next.ServeHTTP(w, r)
+			return
+		}
+		user, err := h.core.GetCurrentUser(bearerToken(r))
+		if err != nil {
+			writeServiceError(w, err)
+			return
+		}
+		if platformAdminRequest(r) && !apiPlatformAdmin(user) {
+			writeServiceError(w, service.ErrForbidden)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+func publicAPIRequest(r *http.Request) bool {
+	path := r.URL.Path
+	if path == "/api/v1/auth/login" || path == "/api/v1/auth/register" || path == "/api/v1/client-managers/register" || path == "/api/v1/client-managers/heartbeat" {
+		return true
+	}
+	if r.Method != http.MethodGet {
+		return false
+	}
+	return path == "/api/v1/game-plugins" || strings.HasPrefix(path, "/api/v1/game-plugins/") ||
+		path == "/api/v1/plugin-marketplace/plugins" || strings.HasPrefix(path, "/api/v1/plugin-marketplace/plugins/")
+}
+
+func runServiceRequest(r *http.Request) bool {
+	return strings.HasPrefix(r.URL.Path, "/api/v1/run/control/") ||
+		strings.HasPrefix(r.URL.Path, "/api/v1/run/jobs/") ||
+		strings.HasPrefix(r.URL.Path, "/api/v1/run/logs/") ||
+		strings.HasPrefix(r.URL.Path, "/api/v1/run/artifacts/") ||
+		strings.HasPrefix(r.URL.Path, "/api/v1/run/metrics/")
+}
+
+func platformAdminRequest(r *http.Request) bool {
+	path := r.URL.Path
+	if path == "/api/v1/users/current" || strings.HasPrefix(path, "/api/v1/users/current/") {
+		return false
+	}
+	if path == "/api/v1/users" || strings.HasPrefix(path, "/api/v1/users/") ||
+		path == "/api/v1/ai-providers" || strings.HasPrefix(path, "/api/v1/ai-providers/") ||
+		path == "/api/v1/metrics/platform" ||
+		path == "/api/v1/run/endpoints" || strings.HasPrefix(path, "/api/v1/run/endpoints/") ||
+		path == "/api/v1/audit-events" || strings.HasPrefix(path, "/api/v1/audit-events/") {
+		return true
+	}
+	if r.Method != http.MethodGet && (path == "/api/v1/game-plugins" || strings.HasPrefix(path, "/api/v1/game-plugins/") || strings.Contains(path, "/plugin-marketplace/plugins/")) {
+		return true
+	}
+	return r.Method == http.MethodPost && (path == "/api/v1/jobs" || path == "/api/v1/artifacts" || path == "/api/v1/log-streams")
+}
+
+func apiPlatformAdmin(user domain.User) bool {
+	for _, role := range user.Roles {
+		if role == "platform-admin" || role == "admin" || role == "platformadmin" {
+			return true
+		}
+	}
+	return false
+}