如何在Plumier中基于用户权限创建可重用的自定义授权

import { Middleware, Context, DefaultFacility, HttpStatusError } from "plumier";

export class AuthorizationMiddleware implements Middleware {
  execute = async (ctx: Context, next: () => Promise<void>) => {
    // 从请求中获取用户的角色和权限信息
    const { user } = ctx.state;
    const { role, permissions } = user;

    // 从路由配置中获取所需的角色和权限信息
    const { roles, permissions: requiredPermissions } = ctx.route.meta;

    // 验证用户是否具有所需的角色
    if (roles && !roles.includes(role)) {
      throw new HttpStatusError(403, "Access denied");
    }

    // 验证用户是否具有所需的权限
    if (requiredPermissions && !permissions.some((p) => requiredPermissions.includes(p))) {
      throw new HttpStatusError(403, "Access denied");
    }

    await next();
  };
}

import { route, authorize } from "plumier";

@route.controller("/api")
@authorize.roles("admin")
export class MyController {
  @route.get("/")
  @authorize.permissions("read:resource")
  index() {
    // 处理路由逻辑
  }
}

import { PlumierApplication } from "plumier";

const app = new PlumierApplication({
  middlewares: [AuthorizationMiddleware],
});

// 其他配置和路由注册...

app.listen(3000);