Add files via upload

internal/handler/vulnerability.go

@@ -9,6 +9,7 @@ import (
 
 	"cyberstrike-ai/internal/audit"
 	"cyberstrike-ai/internal/database"
+	"cyberstrike-ai/internal/security"
 	"github.com/gin-gonic/gin"
 	"go.uber.org/zap"
 )
@@ -60,6 +61,16 @@ func (h *VulnerabilityHandler) CreateVulnerability(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
+	if session, ok := security.CurrentSession(c); ok && session.Scope != database.RBACScopeAll {
+		if strings.TrimSpace(req.ConversationID) != "" && !h.db.UserCanAccessResource(session.UserID, session.Scope, "conversation", strings.TrimSpace(req.ConversationID)) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "无权在该对话下创建漏洞"})
+			return
+		}
+		if strings.TrimSpace(req.ProjectID) != "" && !h.db.UserCanAccessResource(session.UserID, session.Scope, "project", strings.TrimSpace(req.ProjectID)) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "无权在该项目下创建漏洞"})
+			return
+		}
+	}
 
 	vuln := &database.Vulnerability{
 		ConversationID:  req.ConversationID,
@@ -86,6 +97,10 @@ func (h *VulnerabilityHandler) CreateVulnerability(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
+	if session, ok := security.CurrentSession(c); ok {
+		_ = h.db.SetResourceOwner("vulnerability", created.ID, session.UserID)
+		_ = h.db.AssignResourceToUser(session.UserID, "vulnerability", created.ID)
+	}
 
 	if h.audit != nil {
 		h.audit.RecordOK(c, "vulnerability", "create", "创建漏洞记录", "vulnerability", created.ID, map[string]interface{}{
@@ -142,6 +157,7 @@ func (h *VulnerabilityHandler) ListVulnerabilities(c *gin.Context) {
 	offsetStr := c.DefaultQuery("offset", "0")
 	pageStr := c.Query("page")
 	filter := parseVulnerabilityListFilter(c)
+	access := vulnerabilityAccessFromContext(c)
 
 	limit, _ := strconv.Atoi(limitStr)
 	offset, _ := strconv.Atoi(offsetStr)
@@ -163,7 +179,7 @@ func (h *VulnerabilityHandler) ListVulnerabilities(c *gin.Context) {
 	}
 
 	// 获取总数
-	total, err := h.db.CountVulnerabilities(filter)
+	total, err := h.db.CountVulnerabilitiesForAccess(filter, access)
 	if err != nil {
 		h.logger.Error("获取漏洞总数失败", zap.Error(err))
 		// 继续执行，使用0作为总数
@@ -171,7 +187,7 @@ func (h *VulnerabilityHandler) ListVulnerabilities(c *gin.Context) {
 	}
 
 	// 获取漏洞列表
-	vulnerabilities, err := h.db.ListVulnerabilities(limit, offset, filter)
+	vulnerabilities, err := h.db.ListVulnerabilitiesForAccess(limit, offset, filter, access)
 	if err != nil {
 		h.logger.Error("获取漏洞列表失败", zap.Error(err))
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
@@ -332,8 +348,9 @@ func (h *VulnerabilityHandler) DeleteVulnerability(c *gin.Context) {
 // BatchDeleteVulnerabilities 按当前筛选条件批量删除漏洞
 func (h *VulnerabilityHandler) BatchDeleteVulnerabilities(c *gin.Context) {
 	filter := parseVulnerabilityListFilter(c)
+	access := vulnerabilityAccessFromContext(c)
 
-	total, err := h.db.CountVulnerabilities(filter)
+	total, err := h.db.CountVulnerabilitiesForAccess(filter, access)
 	if err != nil {
 		h.logger.Error("统计待删除漏洞失败", zap.Error(err))
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
@@ -344,7 +361,7 @@ func (h *VulnerabilityHandler) BatchDeleteVulnerabilities(c *gin.Context) {
 		return
 	}
 
-	deleted, err := h.db.DeleteVulnerabilitiesByFilter(filter)
+	deleted, err := h.db.DeleteVulnerabilitiesByFilterForAccess(filter, access)
 	if err != nil {
 		h.logger.Error("批量删除漏洞失败", zap.Error(err), zap.Int("count", total))
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
@@ -364,8 +381,9 @@ func (h *VulnerabilityHandler) BatchDeleteVulnerabilities(c *gin.Context) {
 // GetVulnerabilityStats 获取漏洞统计
 func (h *VulnerabilityHandler) GetVulnerabilityStats(c *gin.Context) {
 	filter := parseVulnerabilityListFilter(c)
+	access := vulnerabilityAccessFromContext(c)
 
-	stats, err := h.db.GetVulnerabilityStats(filter)
+	stats, err := h.db.GetVulnerabilityStatsForAccess(filter, access)
 	if err != nil {
 		h.logger.Error("获取漏洞统计失败", zap.Error(err))
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
@@ -377,7 +395,7 @@ func (h *VulnerabilityHandler) GetVulnerabilityStats(c *gin.Context) {
 
 // GetVulnerabilityFilterOptions 获取漏洞筛选建议项
 func (h *VulnerabilityHandler) GetVulnerabilityFilterOptions(c *gin.Context) {
-	options, err := h.db.GetVulnerabilityFilterOptions()
+	options, err := h.db.GetVulnerabilityFilterOptionsForAccess(vulnerabilityAccessFromContext(c))
 	if err != nil {
 		h.logger.Error("获取漏洞筛选建议失败", zap.Error(err))
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
@@ -400,8 +418,9 @@ func (h *VulnerabilityHandler) ExportVulnerabilities(c *gin.Context) {
 	}
 
 	filter := parseVulnerabilityListFilter(c)
+	access := vulnerabilityAccessFromContext(c)
 
-	total, err := h.db.CountVulnerabilities(filter)
+	total, err := h.db.CountVulnerabilitiesForAccess(filter, access)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -411,7 +430,7 @@ func (h *VulnerabilityHandler) ExportVulnerabilities(c *gin.Context) {
 		return
 	}
 
-	items, err := h.db.ListVulnerabilities(total, 0, filter)
+	items, err := h.db.ListVulnerabilitiesForAccess(total, 0, filter, access)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -477,6 +496,14 @@ func (h *VulnerabilityHandler) ExportVulnerabilities(c *gin.Context) {
 	})
 }
 
+func vulnerabilityAccessFromContext(c *gin.Context) database.RBACListAccess {
+	session, ok := security.CurrentSession(c)
+	if !ok {
+		return database.RBACListAccess{}
+	}
+	return database.RBACListAccess{UserID: session.UserID, Scope: session.Scope}
+}
+
 // appendVulnerabilityMarkdown 单条漏洞的 Markdown 片段（与单文件下载字段对齐，缺省字段不写）
 func appendVulnerabilityMarkdown(b *strings.Builder, v *database.Vulnerability, titleHeading string) {
 	b.WriteString(fmt.Sprintf("%s %s\n\n", titleHeading, v.Title))