后端管理

app/admin/middleware/AuthMiddleware.php

@@ -0,0 +1,49 @@
+<?php
+namespace app\admin\middleware;
+
+use Webman\MiddlewareInterface;
+use Webman\Http\Response;
+use Webman\Http\Request;
+use Tymon\JWTAuth\Exceptions\JWTException;
+
+class AuthMiddleware implements MiddlewareInterface
+{
+    public function process(Request $request, callable $handler): Response
+    {
+        try {
+            $token = $this->getTokenFromRequest($request);
+
+            if (!$token) {
+                return $this->unauthorized('缺少访问令牌');
+            }
+
+            if (!$user = auth('api')->setToken($token)->user()) {
+                return $this->unauthorized('用户不存在');
+            }
+
+            // 将用户信息存入请求
+            $request->user = $user;
+
+        } catch (\Tymon\JWTAuth\Exceptions\TokenExpiredException $e) {
+            return $this->unauthorized('令牌已过期');
+        } catch (JWTException $e) {
+            return $this->unauthorized('令牌无效');
+        }
+
+        return $handler($request);
+    }
+
+    private function getTokenFromRequest(Request $request)
+    {
+        $header = $request->header('Authorization', '');
+        if (preg_match('/Bearer\s+(\S+)/', $header, $matches)) {
+            return $matches[1];
+        }
+        return $request->input('token');
+    }
+
+    private function unauthorized($msg)
+    {
+        return json(['code' => 401, 'msg' => $msg]);
+    }
+}

app/admin/middleware/PermissionCheck.php

@@ -2,6 +2,8 @@
 
 namespace app\admin\middleware;
 
+use app\util\Util;
+use ReflectionClass;
 use Webman\MiddlewareInterface;
 use Webman\Http\Response;
 use Webman\Http\Request;
@@ -10,21 +12,40 @@ class PermissionCheck implements MiddlewareInterface
 {
     public function process(Request $request, callable $handler): Response
     {
-        $user = $request->user();
-        $route = $request->route;
+        $user = $request->user;
+//        $route = $request->route;
+        $route = $request->path();
 
-        // 检查角色
-        $roles = $route->param('roles');
-        if ($roles && !$user->roles()->whereIn('name', (array)$roles)->exists()) {
-            return json(['code' => 403, 'msg' => '需要特定角色才能访问']);
-        }
+        // 通过反射获取控制器哪些方法不需要登录
+        $controller = new ReflectionClass($request->controller);
+        $noNeedLogin = $controller->getDefaultProperties()['noNeedLogin'] ?? [];
 
-        // 检查权限
-        $permission = $route->param('permission');
-        if ($permission && !$user->hasPermission($permission)) {
-            return json(['code' => 403, 'msg' => '无权访问']);
+        $isLogin = !in_array($request->action, $noNeedLogin);
+
+        $permission = substr($route,7);
+
+        $is_auth = str_starts_with($permission, 'auth');
+        $permissions = $user?$user->permissions():true;
+        if($isLogin && $permission && (empty($permissions) && !$is_auth) && !$user->isPermission($permission)){
+            return Util::fail('','无权访问该资源',401);
         }
+//        // 检查角色
+//        $requiredRoles = $request->route->param('roles', []);
+//        if (!empty($requiredRoles) && !$user->hasAnyRole($requiredRoles)) {
+//            return $this->forbidden('需要特定角色才能访问');
+//        }
+//
+//        // 检查权限
+//        $requiredPermission = $route->param('permission');
+//        if ($requiredPermission && !$user->hasPermission($requiredPermission)) {
+//            return $this->forbidden('无权访问该资源');
+//        }
 
         return $handler($request);
     }
+
+    private function forbidden($msg)
+    {
+        return json(['code' => 403, 'msg' => $msg]);
+    }
 }