ทำ JWT Authentication และ Casbin RBAC ใน Gin: Login, Middleware และสิทธิ์ตาม Role

func RequestTimer() gin.HandlerFunc {
	return func(c *gin.Context) {
		start := time.Now()
		c.Next() // run the remaining middleware and the handler
		log.Printf("%s %s -> %d in %s",
			c.Request.Method, c.FullPath(), c.Writer.Status(), time.Since(start))
	}
}

package models

import (
	"time"

	"golang.org/x/crypto/bcrypt"
)

type User struct {
	ID        uint      `gorm:"primaryKey" json:"id"`
	Email     string    `gorm:"size:255;uniqueIndex;not null" json:"email"`
	Name      string    `gorm:"size:100;not null" json:"name"`
	Password  string    `gorm:"size:60;not null" json:"-"`
	Role      string    `gorm:"size:20;not null;default:user" json:"role"`
	CreatedAt time.Time `json:"createdAt"`
	UpdatedAt time.Time `json:"updatedAt"`
}

func (u *User) SetPassword(plain string) error {
	hash, err := bcrypt.GenerateFromPassword([]byte(plain), bcrypt.DefaultCost)
	if err != nil {
		return err // includes bcrypt.ErrPasswordTooLong for > 72 bytes
	}
	u.Password = string(hash)
	return nil
}

func (u *User) CheckPassword(plain string) bool {
	return bcrypt.CompareHashAndPassword([]byte(u.Password), []byte(plain)) == nil
}

{
	ID: "202609250001_add_users",
	Migrate: func(tx *gorm.DB) error {
		type User struct {
			ID        uint   `gorm:"primaryKey"`
			Email     string `gorm:"size:255;uniqueIndex;not null"`
			Name      string `gorm:"size:100;not null"`
			Password  string `gorm:"size:60;not null"`
			Role      string `gorm:"size:20;not null;default:user"`
			CreatedAt time.Time
			UpdatedAt time.Time
		}
		type Article struct {
			UserID *uint `gorm:"index"`
			User   *User // creates the foreign key constraint
		}
		return tx.AutoMigrate(&User{}, &Article{})
	},
	Rollback: func(tx *gorm.DB) error {
		if err := tx.Migrator().DropColumn("articles", "user_id"); err != nil {
			return err
		}
		return tx.Migrator().DropTable("users")
	},
},

type registerRequest struct {
	Email    string `json:"email" binding:"required,email,max=255"`
	Name     string `json:"name" binding:"required,max=100"`
	Password string `json:"password" binding:"required,min=8,max=72"`
}

func (h *AuthHandler) Register(c *gin.Context) {
	var req registerRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}
	// Role is never taken from the request body.
	user := models.User{Email: strings.ToLower(req.Email), Name: req.Name, Role: "user"}
	if err := user.SetPassword(req.Password); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "password is too long"})
		return
	}
	err := h.db.WithContext(c.Request.Context()).Create(&user).Error
	switch {
	case errors.Is(err, gorm.ErrDuplicatedKey):
		c.JSON(http.StatusConflict, gin.H{"error": "email is already registered"})
	case err != nil:
		c.JSON(http.StatusInternalServerError, gin.H{"error": "could not create user"})
	default:
		c.JSON(http.StatusCreated, gin.H{"data": user})
	}
}

package middleware

import (
	"strings"
	"time"

	"example.com/articles-api/models"
	jwt "github.com/appleboy/gin-jwt/v2"
	"github.com/gin-gonic/gin"
	"gorm.io/gorm"
)

const identityKey = "id"

type AuthUser struct {
	ID   uint
	Role string
}

type loginRequest struct {
	Email    string `json:"email" binding:"required,email"`
	Password string `json:"password" binding:"required"`
}

func NewJWT(db *gorm.DB, secret []byte) (*jwt.GinJWTMiddleware, error) {
	return jwt.New(&jwt.GinJWTMiddleware{
		Realm:       "articles-api",
		Key:         secret,
		Timeout:     15 * time.Minute,
		MaxRefresh:  24 * time.Hour,
		IdentityKey: identityKey,
		Authenticator: func(c *gin.Context) (interface{}, error) {
			var req loginRequest
			if err := c.ShouldBindJSON(&req); err != nil {
				return nil, jwt.ErrMissingLoginValues
			}
			var user models.User
			err := db.WithContext(c.Request.Context()).
				Where("email = ?", strings.ToLower(req.Email)).First(&user).Error
			// Same error for "no such user" and "wrong password".
			if err != nil || !user.CheckPassword(req.Password) {
				return nil, jwt.ErrFailedAuthentication
			}
			return &user, nil
		},
		PayloadFunc: func(data interface{}) jwt.MapClaims {
			if u, ok := data.(*models.User); ok {
				return jwt.MapClaims{identityKey: u.ID, "role": u.Role}
			}
			return jwt.MapClaims{}
		},
		IdentityHandler: func(c *gin.Context) interface{} {
			claims := jwt.ExtractClaims(c)
			id, _ := claims[identityKey].(float64) // JSON numbers decode as float64
			role, _ := claims["role"].(string)
			return &AuthUser{ID: uint(id), Role: role}
		},
		Unauthorized: func(c *gin.Context, code int, message string) {
			c.JSON(code, gin.H{"error": message})
		},
		TokenLookup:   "header: Authorization",
		TokenHeadName: "Bearer",
	})
}

// CurrentUser returns the identity set by the JWT middleware.
func CurrentUser(c *gin.Context) *AuthUser {
	v, _ := c.Get(identityKey)
	u, _ := v.(*AuthUser)
	return u
}

# config/rbac_model.conf
[request_definition]
r = sub, obj, act

[policy_definition]
p = sub, obj, act

[role_definition]
g = _, _

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = g(r.sub, p.sub) && keyMatch2(r.obj, p.obj) && r.act == p.act

# config/rbac_policy.csv
p, editor, /api/v1/articles, POST
p, editor, /api/v1/articles/:id, PUT
p, admin, /api/v1/articles/:id, DELETE

g, admin, editor

func Authorize(e *casbin.Enforcer) gin.HandlerFunc {
	return func(c *gin.Context) {
		user := CurrentUser(c)
		if user == nil {
			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "not authenticated"})
			return
		}
		ok, err := e.Enforce(user.Role, c.FullPath(), c.Request.Method)
		if err != nil {
			c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{"error": "authorization failed"})
			return
		}
		if !ok {
			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "forbidden"})
			return
		}
		c.Next()
	}
}

func Register(r *gin.Engine, db *gorm.DB, authMW *jwt.GinJWTMiddleware, enforcer *casbin.Enforcer) {
	articles := controllers.NewArticleHandler(db)
	auth := controllers.NewAuthHandler(db)

	api := r.Group("/api/v1")

	a := api.Group("/auth")
	a.POST("/register", auth.Register)
	a.POST("/login", authMW.LoginHandler)
	a.GET("/refresh", authMW.RefreshHandler)
	a.GET("/me", authMW.MiddlewareFunc(), auth.Me) // any logged-in user

	// Public reads
	api.GET("/articles", articles.List)
	api.GET("/articles/:id", articles.Get)

	// Writes: valid token first, then role check
	protected := api.Group("")
	protected.Use(authMW.MiddlewareFunc(), middleware.Authorize(enforcer))
	protected.POST("/articles", articles.Create)
	protected.PUT("/articles/:id", articles.Update)
	protected.DELETE("/articles/:id", articles.Delete)
}

secret := []byte(os.Getenv("JWT_SECRET"))
if len(secret) < 32 {
	log.Fatal("JWT_SECRET must be at least 32 bytes")
}
authMW, err := middleware.NewJWT(db, secret)
if err != nil {
	log.Fatalf("jwt: %v", err)
}
enforcer, err := casbin.NewEnforcer("config/rbac_model.conf", "config/rbac_policy.csv")
if err != nil {
	log.Fatalf("casbin: %v", err)
}
routes.Register(r, db, authMW, enforcer)

TOKEN=$(curl -s -X POST localhost:8080/api/v1/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"[email protected]","password":"correct-horse"}' | jq -r .token)

curl -X DELETE localhost:8080/api/v1/articles/1 -H "Authorization: Bearer $TOKEN"
# 403 for an editor, 204 for an admin

me := middleware.CurrentUser(c)
if me.Role != "admin" && (article.UserID == nil || *article.UserID != me.ID) {
	c.JSON(http.StatusForbidden, gin.H{"error": "you can only edit your own articles"})
	return
}