@stackonward/cli 0.0.1 → 1.0.0

package/dist/resources/templates/go-backend/internal/common/middleware/resource_permission_test.go

@@ -0,0 +1,440 @@
+package middleware
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"sort"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"{{module}}/internal/common/iamscope"
+	"{{module}}/internal/common/ruleexpression"
+	"{{module}}/internal/common/types"
+	iamdomain "{{module}}/internal/integrations/onex/iam"
+	"{{module}}/pkg/apierror"
+)
+
+type resourcePermissionAuthorizer struct {
+	accessContext iamdomain.AdminAccessContext
+	assembleErr   error
+	decision      iamdomain.Decision
+	evaluateErr   error
+	evaluateCalls int
+	assembleInput iamdomain.AdminAccessContextInput
+}
+
+func (a *resourcePermissionAuthorizer) ResolvePrincipalByIdentity(
+	context.Context,
+	int64,
+) (*iamdomain.PrincipalRecord, error) {
+	return nil, iamdomain.ErrPrincipalNotFound
+}
+
+func (a *resourcePermissionAuthorizer) AssembleAdminAccessContext(
+	_ context.Context,
+	principal *iamdomain.PrincipalRecord,
+	input iamdomain.AdminAccessContextInput,
+) (iamdomain.AdminAccessContext, error) {
+	a.assembleInput = input
+	if a.assembleErr != nil {
+		return iamdomain.AdminAccessContext{}, a.assembleErr
+	}
+	accessCtx := a.accessContext
+	accessCtx.Principal.PrincipalID = principal.ID
+	accessCtx.Principal.PrincipalType = principal.PrincipalType
+	accessCtx.Principal.SourceIP = input.Principal.SourceIP
+	accessCtx.Workspace = input.Workspace
+	accessCtx.Request = input.Request
+	accessCtx.Resource = input.Resource
+	return accessCtx, nil
+}
+
+func (a *resourcePermissionAuthorizer) Evaluate(
+	_ context.Context,
+	req iamdomain.EvaluateRequest,
+) (iamdomain.Decision, error) {
+	a.evaluateCalls++
+	if a.evaluateErr != nil {
+		return iamdomain.Decision{}, a.evaluateErr
+	}
+	if a.decision.ReasonCode != "" {
+		return a.decision, nil
+	}
+	return iamdomain.NewAllowedDecision(req.Action, req.Resource, nil), nil
+}
+
+func (a *resourcePermissionAuthorizer) EvaluateMany(
+	_ context.Context,
+	reqs []iamdomain.EvaluateRequest,
+) ([]iamdomain.Decision, error) {
+	decisions := make([]iamdomain.Decision, len(reqs))
+	for i := range reqs {
+		decisions[i] = iamdomain.NewAllowedDecision(reqs[i].Action, reqs[i].Resource, nil)
+	}
+	return decisions, nil
+}
+
+func (a *resourcePermissionAuthorizer) ResolveScope(
+	context.Context,
+	int64,
+	string,
+	iamdomain.WorkspaceContext,
+) (iamscope.ScopeConstraint, error) {
+	return iamscope.NewUnboundedScope(), nil
+}
+
+func (a *resourcePermissionAuthorizer) ResolveProductScopes(
+	context.Context,
+	int64,
+	string,
+) ([]string, bool, error) {
+	return nil, true, nil
+}
+
+func TestRequireResourcePermissionRequiredCapabilityAdmission(t *testing.T) {
+	tests := []struct {
+		name         string
+		capabilities []string
+		wantStatus   int
+		wantEval     int
+	}{
+		{
+			name:         "active capability proceeds to IAM",
+			capabilities: []string{"physical_commerce"},
+			wantStatus:   http.StatusNoContent,
+			wantEval:     1,
+		},
+		{
+			name:         "absent capability denied before IAM",
+			capabilities: []string{},
+			wantStatus:   http.StatusForbidden,
+		},
+		{
+			name:         "inactive capability omitted from hydrated facts",
+			capabilities: []string{"scheduled_fulfillment"},
+			wantStatus:   http.StatusForbidden,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			authorizer := &resourcePermissionAuthorizer{accessContext: iamdomain.AdminAccessContext{
+				Product: resourcePermissionProductContext(tc.capabilities...),
+			}}
+			response, handled, captured := performResourcePermissionRequest(
+				t,
+				authorizer,
+				WithRequiredCapability("physical_commerce"),
+			)
+
+			assert.Equal(t, tc.wantStatus, response.Code)
+			assert.Equal(t, tc.wantStatus == http.StatusNoContent, handled)
+			assert.Equal(t, tc.wantEval, authorizer.evaluateCalls)
+			assert.Equal(t, "catalog", authorizer.assembleInput.Workspace.ProductCode)
+			assert.Equal(t, "order-update-42", authorizer.assembleInput.Request.IdempotencyKey)
+			if handled {
+				require.NotNil(t, captured)
+				assert.Equal(t, []string{"physical_commerce"}, captured.Product.Capabilities)
+			}
+		})
+	}
+}
+
+func TestRequireResourcePermissionCapabilityNeverOverridesIAMDecision(t *testing.T) {
+	authorizer := &resourcePermissionAuthorizer{
+		accessContext: iamdomain.AdminAccessContext{
+			Product: resourcePermissionProductContext("physical_commerce"),
+		},
+		decision: iamdomain.NewDeniedDecision(
+			"order:order:update",
+			"onex:product:catalog:order:order/42",
+			iamdomain.ReasonExplicitDeny,
+			nil,
+			"explicit deny",
+		),
+	}
+
+	response, handled, _ := performResourcePermissionRequest(
+		t,
+		authorizer,
+		WithRequiredCapability("physical_commerce"),
+	)
+	assert.Equal(t, http.StatusForbidden, response.Code)
+	assert.False(t, handled)
+	assert.Equal(t, 1, authorizer.evaluateCalls)
+	assertAPIErrorMessageContains(t, response, iamdomain.ReasonExplicitDeny)
+}
+
+func TestRequireResourcePermissionProductRequirementAdmission(t *testing.T) {
+	requirement := mustProductRequirement(t, `{
+		"schema_version": 1,
+		"root": {
+			"kind": "all",
+			"children": [
+				{"kind":"predicate","subject":"product","key":"code","operator":"eq","value":"catalog"},
+				{"kind":"predicate","subject":"attribute","key":"product_kind","operator":"eq","value":"commerce"},
+				{"kind":"predicate","subject":"capability","key":"physical_commerce","operator":"active"}
+			]
+		}
+	}`)
+	authorizer := &resourcePermissionAuthorizer{accessContext: iamdomain.AdminAccessContext{
+		Product: resourcePermissionProductContext("physical_commerce"),
+	}}
+
+	response, handled, _ := performResourcePermissionRequest(
+		t,
+		authorizer,
+		WithRequiredProductRequirement(requirement),
+	)
+	assert.Equal(t, http.StatusNoContent, response.Code)
+	assert.True(t, handled)
+	assert.Equal(t, 1, authorizer.evaluateCalls)
+}
+
+func TestRequireResourcePermissionProductRequirementFailsClosed(t *testing.T) {
+	unknownNegativeRequirement := mustProductRequirement(t, `{
+		"schema_version": 1,
+		"root": {
+			"kind": "not",
+			"child": {
+				"kind": "predicate",
+				"subject": "capability",
+				"key": "unknown_capability",
+				"operator": "active"
+			}
+		}
+	}`)
+	unsupportedSubjectRequirement := mustProductRequirement(t, `{
+		"schema_version": 1,
+		"root": {
+			"kind": "predicate",
+			"subject": "product_dataset",
+			"key": "catalog.orders",
+			"operator": "available"
+		}
+	}`)
+	tests := []struct {
+		name       string
+		authorizer *resourcePermissionAuthorizer
+		option     ResourcePermissionOption
+		wantStatus int
+		wantCode   string
+		wantReason string
+	}{
+		{
+			name:       "missing selected product",
+			authorizer: &resourcePermissionAuthorizer{},
+			option:     WithRequiredCapability("physical_commerce"),
+			wantStatus: http.StatusBadRequest,
+			wantCode:   apierror.CodeInvalidOperation,
+		},
+		{
+			name: "unknown fact remains indeterminate under not",
+			authorizer: &resourcePermissionAuthorizer{accessContext: iamdomain.AdminAccessContext{
+				Product: resourcePermissionProductContext("physical_commerce"),
+			}},
+			option:     WithRequiredProductRequirement(unknownNegativeRequirement),
+			wantStatus: http.StatusForbidden,
+			wantCode:   apierror.CodeAccessDenied,
+			wantReason: requiredProductRequirementIndeterminateReason,
+		},
+		{
+			name: "malformed expression",
+			authorizer: &resourcePermissionAuthorizer{accessContext: iamdomain.AdminAccessContext{
+				Product: resourcePermissionProductContext("physical_commerce"),
+			}},
+			option: WithRequiredProductRequirement(ProductRequirement{
+				Expression:     json.RawMessage(`{"schema_version":1,"root":`),
+				ExpressionHash: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+			}),
+			wantStatus: http.StatusInternalServerError,
+			wantCode:   apierror.CodeInternalError,
+		},
+		{
+			name: "stale expression hash",
+			authorizer: &resourcePermissionAuthorizer{accessContext: iamdomain.AdminAccessContext{
+				Product: resourcePermissionProductContext("physical_commerce"),
+			}},
+			option: WithRequiredProductRequirement(ProductRequirement{
+				Expression:     unknownNegativeRequirement.Expression,
+				ExpressionHash: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+			}),
+			wantStatus: http.StatusInternalServerError,
+			wantCode:   apierror.CodeInternalError,
+		},
+		{
+			name: "unsupported dataset subject",
+			authorizer: &resourcePermissionAuthorizer{accessContext: iamdomain.AdminAccessContext{
+				Product: resourcePermissionProductContext("physical_commerce"),
+			}},
+			option:     WithRequiredProductRequirement(unsupportedSubjectRequirement),
+			wantStatus: http.StatusInternalServerError,
+			wantCode:   apierror.CodeInternalError,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			response, handled, _ := performResourcePermissionRequest(t, tc.authorizer, tc.option)
+			assert.Equal(t, tc.wantStatus, response.Code)
+			assert.False(t, handled)
+			assert.Equal(t, 0, tc.authorizer.evaluateCalls)
+			assertAPIErrorCode(t, response, tc.wantCode)
+			if tc.wantReason != "" {
+				assertAPIErrorMessageContains(t, response, tc.wantReason)
+			}
+		})
+	}
+}
+
+func TestRequireResourcePermissionFailsClosedOnEvaluatorError(t *testing.T) {
+	authorizer := &resourcePermissionAuthorizer{
+		accessContext: iamdomain.AdminAccessContext{
+			Product: resourcePermissionProductContext("physical_commerce"),
+		},
+		evaluateErr: errors.New("policy resolver unavailable"),
+	}
+
+	response, handled, _ := performResourcePermissionRequest(t, authorizer)
+	assert.Equal(t, http.StatusInternalServerError, response.Code)
+	assert.False(t, handled)
+	assertAPIErrorCode(t, response, apierror.CodeInternalError)
+}
+
+func TestRequireResourcePermissionPropagatesProductAndScopeFailures(t *testing.T) {
+	tests := []struct {
+		name       string
+		authorizer *resourcePermissionAuthorizer
+		wantStatus int
+		wantCode   string
+	}{
+		{
+			name: "unknown product",
+			authorizer: &resourcePermissionAuthorizer{
+				assembleErr: fmt.Errorf("resolve catalog: %w", iamdomain.ErrProductContextNotFound),
+			},
+			wantStatus: http.StatusBadRequest,
+			wantCode:   apierror.CodeInvalidOperation,
+		},
+		{
+			name: "product scope mismatch",
+			authorizer: &resourcePermissionAuthorizer{
+				accessContext: iamdomain.AdminAccessContext{Product: iamdomain.ProductContext{Capabilities: []string{}}},
+				decision: iamdomain.NewDeniedDecision(
+					"order:order:update",
+					"onex:product:catalog:order:order/42",
+					iamdomain.ReasonScopeMismatch,
+					nil,
+					"workspace product mismatch",
+				),
+			},
+			wantStatus: http.StatusForbidden,
+			wantCode:   apierror.CodeAccessDenied,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			response, handled, _ := performResourcePermissionRequest(t, tc.authorizer)
+			assert.Equal(t, tc.wantStatus, response.Code)
+			assert.False(t, handled)
+			assertAPIErrorCode(t, response, tc.wantCode)
+		})
+	}
+}
+
+func performResourcePermissionRequest(
+	t *testing.T,
+	authorizer ResourceAuthorizer,
+	options ...ResourcePermissionOption,
+) (*httptest.ResponseRecorder, bool, *iamdomain.AdminAccessContext) {
+	t.Helper()
+	engine := gin.New()
+	engine.Use(func(c *gin.Context) {
+		c.Set(string(types.ContextKeyProductCode), types.Product("catalog"))
+		SetAuthenticatedIAMPrincipal(c, &AuthenticatedIAMPrincipal{
+			PrincipalID:   44,
+			PrincipalType: string(iamdomain.PrincipalTypeHumanUser),
+			SourceIP:      "127.0.0.1",
+		})
+		c.Next()
+	})
+	handled := false
+	var captured *iamdomain.AdminAccessContext
+	engine.POST(
+		"/orders/:id",
+		RequireResourcePermission(
+			authorizer,
+			"order:order:update",
+			"onex:product:{product_code}:order:order/{id}",
+			options...,
+		),
+		func(c *gin.Context) {
+			handled = true
+			accessCtx, ok := GetAdminAccessContext(c.Request.Context())
+			if ok {
+				captured = &accessCtx
+			}
+			c.Status(http.StatusNoContent)
+		},
+	)
+
+	request := httptest.NewRequest(http.MethodPost, "/orders/42", nil)
+	request.Header.Set(types.HeaderIdempotencyKey, "order-update-42")
+	response := httptest.NewRecorder()
+	engine.ServeHTTP(response, request)
+	return response, handled, captured
+}
+
+func assertAPIErrorCode(t *testing.T, response *httptest.ResponseRecorder, want string) {
+	t.Helper()
+	var body apierror.ErrorResponse
+	require.NoError(t, json.Unmarshal(response.Body.Bytes(), &body))
+	assert.Equal(t, want, body.Error.Code)
+}
+
+func assertAPIErrorMessageContains(t *testing.T, response *httptest.ResponseRecorder, want string) {
+	t.Helper()
+	var body apierror.ErrorResponse
+	require.NoError(t, json.Unmarshal(response.Body.Bytes(), &body))
+	assert.Contains(t, body.Error.Message, want)
+}
+
+func resourcePermissionProductContext(activeCapabilities ...string) iamdomain.ProductContext {
+	sort.Strings(activeCapabilities)
+	capabilityFacts := make([]iamdomain.ProductCapabilityFact, len(activeCapabilities))
+	for i := range activeCapabilities {
+		capabilityFacts[i] = iamdomain.ProductCapabilityFact{Code: activeCapabilities[i], Active: true}
+	}
+	return iamdomain.ProductContext{
+		ProductCode:        "catalog",
+		ProductKind:        "commerce",
+		Capabilities:       append([]string(nil), activeCapabilities...),
+		CapabilityFacts:    capabilityFacts,
+		AttributeFacts:     []iamdomain.ProductAttributeFact{{Code: "product_kind", Value: json.RawMessage(`"commerce"`)}},
+		LifecycleStatus:    "active",
+		ContextVersion:     42,
+		ContextFingerprint: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+		ResolvedAt:         time.Date(2026, time.July, 10, 8, 0, 0, 0, time.UTC),
+	}
+}
+
+func mustProductRequirement(t *testing.T, raw string) ProductRequirement {
+	t.Helper()
+	expression := json.RawMessage(raw)
+	decoded, err := ruleexpression.Decode(expression)
+	require.NoError(t, err)
+	hash, err := ruleexpression.CanonicalHash(decoded)
+	require.NoError(t, err)
+	return ProductRequirement{Expression: expression, ExpressionHash: hash}
+}
+
+var _ ResourceAuthorizer = (*resourcePermissionAuthorizer)(nil)

package/dist/resources/templates/go-backend/internal/common/middleware/service_credential_auth.go

@@ -0,0 +1,67 @@
+package middleware
+
+import (
+	"context"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"go.uber.org/zap"
+
+	"{{module}}/pkg/apierror"
+)
+
+const serviceCredentialHeader = "X-Service-Credential"
+
+// ServiceCredentialAuthenticator 只校验令牌交换端点使用的启动凭证。
+type ServiceCredentialAuthenticator interface {
+	AuthenticateServiceCredential(context.Context, ServiceCredentialAuthenticationInput) (*AuthenticatedIAMPrincipal, error)
+	RecordIAMRequest(context.Context, IAMRequestCompletionInput) error
+}
+
+// ServiceCredentialAuthenticationInput 定义启动凭证交换的认证上下文。
+type ServiceCredentialAuthenticationInput struct {
+	Credential  string
+	SourceIP    string
+	Origin      string
+	UserAgent   string
+	RequestID   string
+	TraceID     string
+	HTTPMethod  string
+	HTTPPath    string
+	RouteName   string
+	ProductCode string
+}
+
+// ServiceCredentialAuth 认证交换端点的 X-Service-Credential，拒绝任何 Authorization 并行机制。
+func ServiceCredentialAuth(authenticator ServiceCredentialAuthenticator, logger *zap.Logger) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		credential := strings.TrimSpace(c.GetHeader(serviceCredentialHeader))
+		if authenticator == nil || credential == "" || strings.TrimSpace(c.GetHeader("Authorization")) != "" || GetUserIdentity(c) != nil {
+			abortWithAPIError(c, apierror.Unauthorized("Service credential is required"))
+			return
+		}
+		principal, err := authenticator.AuthenticateServiceCredential(c.Request.Context(), ServiceCredentialAuthenticationInput{
+			Credential: credential, SourceIP: ResolveTrustedClientIP(c), Origin: strings.TrimSpace(c.GetHeader("Origin")),
+			UserAgent: c.Request.UserAgent(), RequestID: GetRequestID(c), TraceID: requestTraceID(c),
+			HTTPMethod: c.Request.Method, HTTPPath: c.Request.URL.Path, RouteName: c.FullPath(), ProductCode: string(GetProductCode(c)),
+		})
+		if err != nil {
+			abortWithAuthenticationError(c, err)
+			return
+		}
+		SetAuthenticatedIAMPrincipal(c, principal)
+		runWithIAMRequestAudit(c, authenticator.RecordIAMRequest, principal, logger)
+	}
+}
+
+// RequireServiceCredentialPrincipal 确保交换路由只能由启动凭证主体访问。
+func RequireServiceCredentialPrincipal() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		principal := GetAuthenticatedIAMPrincipal(c)
+		if principal == nil || principal.AuthMechanism != "iam_credential" {
+			abortWithAPIError(c, apierror.Unauthorized("Service credential is required"))
+			return
+		}
+		c.Next()
+	}
+}

package/dist/resources/templates/go-backend/internal/common/middleware/tenant.go

@@ -0,0 +1,148 @@
+package middleware
+
+import (
+	"regexp"
+
+	"github.com/gin-gonic/gin"
+
+	"{{module}}/internal/common/types"
+	"{{module}}/pkg/apierror"
+)
+
+const (
+	minTenantIDLength = 3
+	maxTenantIDLength = 64
+)
+
+var (
+	uuidRegex     = regexp.MustCompile(`^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$`)
+	tenantIDRegex = regexp.MustCompile(`^[a-zA-Z0-9][\w-]{2,63}$`)
+)
+
+// Tenant 租户上下文中间件
+// 从 X-Tenant-ID 头、路由参数、查询参数、用户身份中按优先级提取租户 ID
+// 验证格式后将租户信息写入 context
+func Tenant() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		tenantID := resolveTenantIDFromRequest(c)
+		if tenantID == "" {
+			abortWithAPIError(c, apierror.InvalidOperation(
+				"Tenant ID is required. Provide it via X-Tenant-ID header, route parameter, or query parameter.",
+				"tenantId",
+			))
+			return
+		}
+
+		if !isValidTenantID(tenantID) {
+			abortWithAPIError(c, apierror.InvalidOperation("Invalid tenant ID format", "tenantId"))
+			return
+		}
+
+		// 校验用户对租户的访问权限
+		identity := GetUserIdentity(c)
+		if identity != nil && !validateUserTenantAccess(identity, tenantID) {
+			abortWithAPIError(c, apierror.Forbidden("Access denied to this tenant"))
+			return
+		}
+
+		// 写入 context
+		c.Set(string(types.ContextKeyTenantID), tenantID)
+		c.Set(string(types.ContextKeyTenant), &types.TenantInfo{
+			ID:     tenantID,
+			Status: types.TenantStatusActive,
+		})
+
+		c.Next()
+	}
+}
+
+// OptionalTenant 可选租户中间件，租户信息缺失时不阻断请求
+func OptionalTenant() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		tenantID := resolveTenantIDFromRequest(c)
+		if tenantID != "" && isValidTenantID(tenantID) {
+			c.Set(string(types.ContextKeyTenantID), tenantID)
+			c.Set(string(types.ContextKeyTenant), &types.TenantInfo{
+				ID:     tenantID,
+				Status: types.TenantStatusActive,
+			})
+		}
+		c.Next()
+	}
+}
+
+// GetTenantID 从 gin.Context 获取租户 ID
+func GetTenantID(c *gin.Context) string {
+	if v, ok := c.Get(string(types.ContextKeyTenantID)); ok {
+		if id, ok := v.(string); ok {
+			return id
+		}
+	}
+	return ""
+}
+
+// GetTenantInfo 从 gin.Context 获取租户信息
+func GetTenantInfo(c *gin.Context) *types.TenantInfo {
+	if v, ok := c.Get(string(types.ContextKeyTenant)); ok {
+		if info, ok := v.(*types.TenantInfo); ok {
+			return info
+		}
+	}
+	return nil
+}
+
+// resolveTenantIDFromRequest 按优先级解析租户 ID：请求头 > 路由参数 > 查询参数 > 用户身份
+func resolveTenantIDFromRequest(c *gin.Context) string {
+	// 1. X-Tenant-ID 请求头
+	if h := c.GetHeader(types.HeaderTenantID); h != "" {
+		return h
+	}
+
+	// 2. 路由参数
+	if p := c.Param("tenantId"); p != "" {
+		return p
+	}
+
+	// 3. 查询参数
+	if q := c.Query("tenantId"); q != "" {
+		return q
+	}
+
+	// 4. 网关注入的用户身份中的 tenantId
+	identity := GetUserIdentity(c)
+	if identity != nil && identity.TenantID != "" {
+		return identity.TenantID
+	}
+
+	return ""
+}
+
+// isValidTenantID 校验租户 ID 格式：UUID 或字母数字
+func isValidTenantID(id string) bool {
+	if len(id) < minTenantIDLength || len(id) > maxTenantIDLength {
+		return false
+	}
+	return uuidRegex.MatchString(id) || tenantIDRegex.MatchString(id)
+}
+
+// validateUserTenantAccess 校验用户是否有权访问指定租户
+func validateUserTenantAccess(identity *types.UserIdentity, tenantID string) bool {
+	// 超级管理员可访问所有租户
+	if identity.Type == string(types.UserRoleSuperAdmin) {
+		return true
+	}
+
+	// 用户默认租户匹配
+	if identity.TenantID == tenantID {
+		return true
+	}
+
+	// 用户拥有多租户访问权限
+	for _, tid := range identity.TenantIDs {
+		if tid == tenantID {
+			return true
+		}
+	}
+
+	return false
+}