目录结构调整

app/middleware/AuthMiddleware.php

@@ -0,0 +1,88 @@
+<?php
+namespace app\middleware;
+
+
+use app\model\User;
+use app\util\JwtUtil;
+use app\util\Util;
+use ReflectionClass;
+use support\Redis;
+use Webman\Http\Request;
+use Webman\Http\Response;
+use Webman\MiddlewareInterface;
+use support\exception\BusinessException;
+
+//class AuthMiddleware implements MiddlewareInterface
+//{
+//    public function process(Request $request, callable $handler) : Response
+//    {
+//        //'这里是请求穿越阶段，也就是请求处理前';
+//
+//        //$response = $handler($request); // 继续向洋葱芯穿越，直至执行控制器得到响应
+//
+//        //composer require symfony/translation'这里是响应穿出阶段，也就是请求处理后';
+//
+//        $result = Redis::set('user_id',time());
+//
+//        $response = $handler($request); // 继续向洋葱芯穿越，直至执行控制器得到响应
+//
+//        echo '这里是响应穿出阶段，也就是请求处理后';
+//
+//        return $response;
+//    }
+//}
+
+class AuthMiddleware implements MiddlewareInterface
+{
+    public function process(Request $request, callable $handler): Response
+    {
+        // 跳过不需要鉴权的路由（如登录接口）
+//        if ($request->path() === '/api/login') {
+//            return $handler($request);
+//        }
+        // 通过反射获取控制器哪些方法不需要登录
+        $controller = new ReflectionClass($request->controller);
+        $noNeedLogin = $controller->getDefaultProperties()['noNeedLogin'] ?? [];
+
+        $isLogin = !in_array($request->action, $noNeedLogin);
+        // 访问的方法需要登录
+//        if ($isLogin) {
+//            // 拦截请求，返回一个重定向响应，请求停止向洋葱芯穿越
+//            throw new BusinessException('请先登录', 302);
+//        }
+
+        // 从 Header 获取 Token
+        $token = $request->header('Authorization');
+
+        //需要登录并且未提供token
+        if ($isLogin && (!$token || !str_starts_with($token, 'Bearer '))) {
+            throw new BusinessException('请先登录', 302);
+//            throw new BusinessException('未提供 Token'.$isLogin, 401);
+        }elseif(!$isLogin){
+            return $handler($request);
+        }
+
+
+        $token = substr($token, 7);
+        try {
+            // 验证 Token 并获取用户ID
+            $decoded = JwtUtil::verifyToken($token);
+
+            $userId = $decoded->sub;
+
+            $user = User::select(['id','name','sex','role','avatar','email','password'])
+                ->find($userId);
+            if(!$user){
+                return Util::fail(['user'=>$user],trans('user_none'));
+            }
+            $user = $user->toArray();
+
+            // 将用户ID存入请求对象，供后续使用
+//            $request->user = ['id' => $userId];
+            $request->user = $user;
+            return $handler($request);
+        } catch (BusinessException $e) {
+            return json(['code' => 401, 'msg' => $e->getMessage()]);
+        }
+    }
+}

app/middleware/CrossDomain.php

@@ -0,0 +1,28 @@
+<?php
+namespace app\middleware;
+
+use Webman\Http\Request;
+use Webman\Http\Response;
+use Webman\MiddlewareInterface;
+
+class CrossDomain implements MiddlewareInterface
+{
+    public function process(Request $request, callable $next): Response
+    {
+        // 动态允许请求来源（支持携带Cookie）
+        $origin = $request->header('origin', '*');
+        $response = $next($request);
+
+        // 设置跨域响应头
+        $response->withHeaders([
+            'Access-Control-Allow-Origin'      => $origin,
+            'Access-Control-Allow-Methods'     => 'GET, POST, PUT, DELETE, OPTIONS',
+            'Access-Control-Allow-Headers'     => 'Content-Type, Authorization, X-Requested-With',
+            'Access-Control-Allow-Credentials' => 'true', // 允许携带Cookie
+            'Access-Control-Max-Age'           => 86400, // 预检请求缓存时间（秒）
+            'Vary'                             => 'Origin' // 避免缓存干扰
+        ]);
+
+        return $response;
+    }
+}

app/middleware/StaticFile.php

@@ -0,0 +1,42 @@
+<?php
+/**
+ * This file is part of webman.
+ *
+ * Licensed under The MIT License
+ * For full copyright and license information, please see the MIT-LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @author    walkor<walkor@workerman.net>
+ * @copyright walkor<walkor@workerman.net>
+ * @link      http://www.workerman.net/
+ * @license   http://www.opensource.org/licenses/mit-license.php MIT License
+ */
+
+namespace app\middleware;
+
+use Webman\MiddlewareInterface;
+use Webman\Http\Response;
+use Webman\Http\Request;
+
+/**
+ * Class StaticFile
+ * @package app\middleware
+ */
+class StaticFile implements MiddlewareInterface
+{
+    public function process(Request $request, callable $next): Response
+    {
+        // Access to files beginning with. Is prohibited
+        if (strpos($request->path(), '/.') !== false) {
+            return response('<h1>403 forbidden</h1>', 403);
+        }
+        /** @var Response $response */
+        $response = $next($request);
+        // Add cross domain HTTP header
+        /*$response->withHeaders([
+            'Access-Control-Allow-Origin'      => '*',
+            'Access-Control-Allow-Credentials' => 'true',
+        ]);*/
+        return $response;
+    }
+}