feat: complete pet SOP governance workflow

internal/middleware/http.go

@@ -63,7 +63,31 @@ func Authenticate(service *auth.Service) gin.HandlerFunc {
 			response.Error(c, http.StatusUnauthorized, "INVALID_TOKEN", "登录状态已失效")
 			return
 		}
+		principal, err = service.RefreshPrincipal(principal)
+		if err != nil {
+			response.Error(c, http.StatusUnauthorized, "INVALID_MEMBERSHIP", "账号或企业成员身份已失效")
+			return
+		}
 		auth.SetPrincipal(c, principal)
 		c.Next()
 	}
 }
+
+func RequireAnyPermission(permissions ...string) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		principal, ok := auth.PrincipalFromContext(c)
+		if !ok {
+			response.Error(c, http.StatusUnauthorized, "UNAUTHORIZED", "请先登录")
+			return
+		}
+		if !auth.HasAnyPermission(principal, permissions...) {
+			response.Error(c, http.StatusForbidden, "FORBIDDEN", "没有执行该操作的权限")
+			return
+		}
+		c.Next()
+	}
+}
+
+func RequirePermission(permission string) gin.HandlerFunc {
+	return RequireAnyPermission(permission)
+}