后端管理

app/admin/middleware/PermissionCheck.php

@@ -2,6 +2,8 @@
 
 namespace app\admin\middleware;
 
+use app\util\Util;
+use ReflectionClass;
 use Webman\MiddlewareInterface;
 use Webman\Http\Response;
 use Webman\Http\Request;
@@ -10,21 +12,40 @@ class PermissionCheck implements MiddlewareInterface
 {
     public function process(Request $request, callable $handler): Response
     {
-        $user = $request->user();
-        $route = $request->route;
+        $user = $request->user;
+//        $route = $request->route;
+        $route = $request->path();
 
-        // 检查角色
-        $roles = $route->param('roles');
-        if ($roles && !$user->roles()->whereIn('name', (array)$roles)->exists()) {
-            return json(['code' => 403, 'msg' => '需要特定角色才能访问']);
-        }
+        // 通过反射获取控制器哪些方法不需要登录
+        $controller = new ReflectionClass($request->controller);
+        $noNeedLogin = $controller->getDefaultProperties()['noNeedLogin'] ?? [];
 
-        // 检查权限
-        $permission = $route->param('permission');
-        if ($permission && !$user->hasPermission($permission)) {
-            return json(['code' => 403, 'msg' => '无权访问']);
+        $isLogin = !in_array($request->action, $noNeedLogin);
+
+        $permission = substr($route,7);
+
+        $is_auth = str_starts_with($permission, 'auth');
+        $permissions = $user?$user->permissions():true;
+        if($isLogin && $permission && (empty($permissions) && !$is_auth) && !$user->isPermission($permission)){
+            return Util::fail('','无权访问该资源',401);
         }
+//        // 检查角色
+//        $requiredRoles = $request->route->param('roles', []);
+//        if (!empty($requiredRoles) && !$user->hasAnyRole($requiredRoles)) {
+//            return $this->forbidden('需要特定角色才能访问');
+//        }
+//
+//        // 检查权限
+//        $requiredPermission = $route->param('permission');
+//        if ($requiredPermission && !$user->hasPermission($requiredPermission)) {
+//            return $this->forbidden('无权访问该资源');
+//        }
 
         return $handler($request);
     }
+
+    private function forbidden($msg)
+    {
+        return json(['code' => 403, 'msg' => $msg]);
+    }
 }