博西

plugin/admin/app/middleware/AccessControl.php

@@ -0,0 +1,54 @@
+<?php
+namespace plugin\admin\app\middleware;
+
+use plugin\admin\api\Auth;
+use ReflectionException;
+use support\exception\BusinessException;
+use Webman\Http\Request;
+use Webman\Http\Response;
+use Webman\MiddlewareInterface;
+
+class AccessControl implements MiddlewareInterface
+{
+    /**
+     * @param Request $request
+     * @param callable $handler
+     * @return Response
+     * @throws ReflectionException|BusinessException
+     */
+    public function process(Request $request, callable $handler): Response
+    {
+        $controller = $request->controller;
+        $action = $request->action;
+
+        $code = 0;
+        $msg = '';
+        if (!Auth::canAccess($controller, $action, $code, $msg)) {
+            if ($request->expectsJson()) {
+                $response = json(['code' => $code, 'msg' => $msg, 'data' => []]);
+            } else {
+                if ($code === 401) {
+                    $response = response(<<<EOF
+<script>
+    if (self !== top) {
+        parent.location.reload();
+    }
+</script>
+EOF
+                    );
+                } else {
+                    $request->app = '';
+                    $request->plugin = 'admin';
+                    $response = view('common/error/403')->withStatus(403);
+                }
+            }
+
+        } else {
+            $response = $request->method() == 'OPTIONS' ? response('') : $handler($request);
+        }
+
+        return $response;
+
+    }
+
+}

plugin/admin/app/middleware/CrossDomain.php

@@ -0,0 +1,45 @@
+<?php
+namespace app\middleware;
+
+use Webman\Http\Request;
+use Webman\Http\Response;
+use Webman\MiddlewareInterface;
+
+class CrossDomain implements MiddlewareInterface
+{
+//    public function process(Request $request, callable $next): Response
+//    {
+//        // 动态允许请求来源（支持携带Cookie）
+//        $origin = $request->header('origin', '*');
+//        $response = $next($request);
+//
+//        // 设置跨域响应头
+//        $response->withHeaders([
+//            'Access-Control-Allow-Origin'      => $origin,
+//            'Access-Control-Allow-Methods'     => 'GET, POST, PUT, DELETE, OPTIONS',
+//            'Access-Control-Allow-Headers'     => 'Content-Type, Authorization, X-Requested-With',
+//            'Access-Control-Allow-Credentials' => 'true', // 允许携带Cookie
+//            'Access-Control-Max-Age'           => 86400, // 预检请求缓存时间（秒）
+//            'Vary'                             => 'Origin' // 避免缓存干扰
+//        ]);
+//
+//        return $response;
+//    }
+
+    public function process(Request $request, callable $handler) : Response
+    {
+        // 如果是options请求则返回一个空响应，否则继续向洋葱芯穿越，并得到一个响应
+        $response = $request->method() == 'OPTIONS' ? response('') : $handler($request);
+
+        // 给响应添加跨域相关的http头
+        $response->withHeaders([
+            'Access-Control-Allow-Credentials' => 'true',
+            'Access-Control-Allow-Origin' => $request->header('origin', '*'),
+            'Access-Control-Allow-Methods' => $request->header('access-control-request-method', '*'),
+            'Access-Control-Allow-Headers' => $request->header('access-control-request-headers', '*'),
+            'Vary'                             => 'Origin' // 避免缓存干扰
+        ]);
+
+        return $response;
+    }
+}