go-duck-cli 1.1.42 → 1.1.44

package/generators/kratos.js

@@ -273,6 +273,8 @@ import (
     my_middleware "{{projectName}}/middleware"
 	"gorm.io/gorm"
 	"go.mongodb.org/mongo-driver/mongo"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 	"strings"
 	"fmt"
 	"sort"
@@ -297,13 +299,14 @@ func TenantServerInterceptor(conf *config.Config, db *gorm.DB) middleware.Middle
             rolesInterface, ok := ra["roles"].([]interface{})
             if !ok { return handler(ctx, req) }
 
+            superAdminRole := strings.ToLower(conf.GoDuck.Security.SuperAdminRole)
             // Normalize roles (lowercase)
             var lowerRoles []string
             isAdmin := false
             for _, r := range rolesInterface {
                 roleStr := strings.ToLower(fmt.Sprintf("%v", r))
                 lowerRoles = append(lowerRoles, roleStr)
-                if roleStr == "admin" || roleStr == "role_admin" { isAdmin = true }
+                if roleStr == "admin" || roleStr == "role_admin" || (superAdminRole != "" && roleStr == superAdminRole) { isAdmin = true }
             }
 
             var requestedTenant string
@@ -312,18 +315,12 @@ func TenantServerInterceptor(conf *config.Config, db *gorm.DB) middleware.Middle
             }
 
             var mappings []models.TenantRole
-            if requestedTenant != "" {
-                if isAdmin {
-                    db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles WHERE tenant_id = ?", requestedTenant).Scan(&mappings)
-                } else {
-                    db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles WHERE LOWER(role_name) IN ? AND tenant_id = ?", lowerRoles, requestedTenant).Scan(&mappings)
-                }
+            if isAdmin {
+                mappings = []models.TenantRole{}
+            } else if requestedTenant != "" {
+                db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles WHERE LOWER(role_name) IN ? AND tenant_id = ?", lowerRoles, requestedTenant).Scan(&mappings)
             } else {
-                if isAdmin {
-                    db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles").Scan(&mappings)
-                } else {
-                    db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles WHERE LOWER(role_name) IN ?", lowerRoles).Scan(&mappings)
-                }
+                db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles WHERE LOWER(role_name) IN ?", lowerRoles).Scan(&mappings)
             }
 
             siloConnections := make(map[string]*gorm.DB)
@@ -340,6 +337,9 @@ func TenantServerInterceptor(conf *config.Config, db *gorm.DB) middleware.Middle
             mappings = authorizedMappings
 
             if len(mappings) == 0 {
+                if !isAdmin {
+                    return nil, status.Error(codes.PermissionDenied, "Access denied. No tenant database provisioned for your roles.")
+                }
                 conn, _ := mgr.GetDB(fallbackDB)
                 siloConnections["fallback"] = conn
                 ctx = context.WithValue(ctx, "tenantDBConn", conn)

package/generators/multitenancy.js

@@ -147,12 +147,13 @@ func TenantMiddleware(db *gorm.DB, cfg *config.Config) gin.HandlerFunc {
 			return
 		}
 
+		superAdminRole := strings.ToLower(cfg.GoDuck.Security.SuperAdminRole)
 		var lowerRoles []string
 		isAdmin := false
 		for _, r := range roles {
 			roleStr := strings.ToLower(fmt.Sprintf("%v", r))
 			lowerRoles = append(lowerRoles, roleStr)
-			if roleStr == "admin" || roleStr == "role_admin" {
+			if roleStr == "admin" || roleStr == "role_admin" || (superAdminRole != "" && roleStr == superAdminRole) {
 				isAdmin = true
 			}
 		}
@@ -173,18 +174,12 @@ func TenantMiddleware(db *gorm.DB, cfg *config.Config) gin.HandlerFunc {
 			}
 		}
 
-		if len(requestedTenants) > 0 {
-			if isAdmin {
-				db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles WHERE tenant_id IN ?", requestedTenants).Scan(&mappings)
-			} else {
-				db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles WHERE LOWER(role_name) IN ? AND tenant_id IN ?", lowerRoles, requestedTenants).Scan(&mappings)
-			}
+		if isAdmin {
+			mappings = []models.TenantRole{}
+		} else if len(requestedTenants) > 0 {
+			db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles WHERE LOWER(role_name) IN ? AND tenant_id IN ?", lowerRoles, requestedTenants).Scan(&mappings)
 		} else {
-			if isAdmin {
-				db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles").Scan(&mappings)
-			} else {
-				db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles WHERE LOWER(role_name) IN ?", lowerRoles).Scan(&mappings)
-			}
+			db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles WHERE LOWER(role_name) IN ?", lowerRoles).Scan(&mappings)
 		}
 
 		// Filter out unauthorized mappings (e.g. admin_db for non-admins)
@@ -198,11 +193,16 @@ func TenantMiddleware(db *gorm.DB, cfg *config.Config) gin.HandlerFunc {
 		mappings = authorizedMappings
 
         if len(mappings) == 0 {
+             if !isAdmin {
+                  c.JSON(http.StatusForbidden, gin.H{"error": "Access denied. No tenant database provisioned for your roles."})
+                  c.Abort()
+                  return
+             }
              conn, err := mgr.GetDB(fallbackDB)
              if err != nil || conn == nil {
-                 c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to resolve tenant fallback database connection"})
-                 c.Abort()
-                 return
+                  c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to resolve tenant fallback database connection"})
+                  c.Abort()
+                  return
              }
              siloConnections["fallback"] = conn
              c.Set("tenantDBConn", conn)
@@ -355,6 +355,7 @@ import (
 )
 
 type DatabaseRequest struct {
+	TenantID  string \`json:"tenantId" form:"tenantId"\`
 	RoleName  string \`json:"roleName" form:"roleName" binding:"required"\`
 	DBName    string \`json:"dbName" form:"dbName" binding:"required"\`
     IsPrimary bool   \`json:"isPrimary" form:"isPrimary"\`
@@ -390,15 +391,25 @@ func CreateDatabaseAndMigrate(masterDB *gorm.DB) gin.HandlerFunc {
         if count == 0 {
             isPrimary = true
         }
+
+        tenantID := req.TenantID
+        if tenantID == "" {
+            tenantID = uuid.New().String()
+        }
+
         if err := masterDB.Where("LOWER(role_name) = LOWER(?) AND db_name = ?", req.RoleName, req.DBName).First(&existing).Error; err == nil {
             if count <= 1 {
                 isPrimary = true
             }
             existing.IsPrimary = isPrimary
+            if req.TenantID != "" {
+                existing.TenantID = req.TenantID
+            }
             masterDB.Save(&existing)
+            tenantID = existing.TenantID
         } else {
             masterDB.Create(&models.TenantRole{
-                TenantID:  uuid.New().String(),
+                TenantID:  tenantID,
                 RoleName:  req.RoleName,
                 DBName:    req.DBName,
                 IsPrimary: isPrimary,
@@ -414,7 +425,7 @@ func CreateDatabaseAndMigrate(masterDB *gorm.DB) gin.HandlerFunc {
             migrations.RunGoNativeMigrationsForTenant(tenantDB)
         }
 
-		c.JSON(http.StatusOK, gin.H{"message": "Role silo assigned successfully", "role": req.RoleName, "primary": isPrimary})
+		c.JSON(http.StatusOK, gin.H{"message": "Role silo assigned successfully", "role": req.RoleName, "tenantId": tenantID, "primary": isPrimary})
 	}
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "go-duck-cli",
-  "version": "1.1.42",
+  "version": "1.1.44",
   "description": "The Ultimate Evolutionary Go Microservice Scaffolder.",
   "main": "index.js",
   "type": "module",

package/templates/go/router.go.hbs

@@ -230,6 +230,13 @@ func SetupRouter(appConfig *config.Config) *gin.Engine {
     api := r.Group("/api")
     api.Use(middleware.JWTMiddleware())
     api.Use(middleware.TenantMiddleware(masterDB, appConfig))
+    // Log request DB resolution for debugging
+    api.Use(func(c *gin.Context) {
+        if dbName, ok := c.Get("resolvedDB"); ok {
+            fmt.Printf("[LOG] %s %s using DB: %s\n", c.Request.Method, c.Request.URL.Path, dbName.(string))
+        }
+        c.Next()
+    })
     api.Use(middleware.AuditMiddleware(masterDB))
     api.Use(middleware.MeteringMiddleware(masterDB))
     {