23 lines
526 B
Go
23 lines
526 B
Go
package radar
|
||
|
||
import (
|
||
"context"
|
||
|
||
"apps/backend/internal/middleware"
|
||
"apps/backend/internal/response"
|
||
)
|
||
|
||
/*
|
||
ownerUID 取登入 uid，是 radar 全部資源的隔離依據。
|
||
|
||
request 若帶了 uid 一律忽略：整個 group 只讀寫自己的資料（spec §5.1、§7），
|
||
少了這道就等於開放任意越權讀寫。
|
||
*/
|
||
func ownerUID(ctx context.Context) (int64, error) {
|
||
uid, ok := middleware.UIDFrom(ctx)
|
||
if !ok || uid <= 0 {
|
||
return 0, response.Biz(401, 401001, "missing authorization")
|
||
}
|
||
return uid, nil
|
||
}
|