Function RequireModelAccess

core/http/auth/middleware.go:303–356

RequireModelAccess returns a global middleware that checks the user is allowed to use the resolved model. It extracts the model name directly from the request (path param, query param, JSON body, or form value) rather than relying on a context key set by downstream route-specific middleware.

(db *gorm.DB)

// (path param, query param, JSON body, or form value) rather than relying on a
// context key set by downstream route-specific middleware.
func RequireModelAccess(db *gorm.DB) echo.MiddlewareFunc {
	if db == nil {
		return NoopMiddleware()
	}
	return func(next echo.HandlerFunc) echo.HandlerFunc {
		return func(c echo.Context) error {
			user := GetUser(c)
			if user == nil {
				return next(c)
			}
			if user.Role == RoleAdmin {
				return next(c)
			}

			// Check if this user even has a model allowlist enabled before
			// doing the expensive body read. Most users won't have restrictions.
			// Uses request-scoped cache to avoid duplicate DB hit when
			// RequireRouteFeature already fetched permissions.
			perm, err := GetCachedUserPermissions(c, db, user.ID)
			if err != nil {
				return c.JSON(http.StatusInternalServerError, schema.ErrorResponse{
					Error: &schema.APIError{
						Message: "failed to check permissions",
						Code:    http.StatusInternalServerError,
						Type:    "server_error",
					},
				})
			}
			allowlist := perm.AllowedModels
			if !allowlist.Enabled {
				return next(c)
			}

			modelName := extractModelFromRequest(c)
			if modelName == "" {
				return next(c)
			}

			for _, m := range allowlist.Models {
				if m == modelName {
					return next(c)
				}
			}

			return c.JSON(http.StatusForbidden, schema.ErrorResponse{
				Error: &schema.APIError{
					Message: "access denied to model: " + modelName,
					Code:    http.StatusForbidden,
					Type:    "authorization_error",
				},
			})
		}
	}
}

// extractModelFromRequest extracts the model name from various request sources.
// It checks URL path params, query params, JSON body, and form values.