34 lines
952 B
PHP
34 lines
952 B
PHP
|
<?php
|
||
|
|
namespace app\middleware;
|
||
|
|
|
||
|
|
use Webman\MiddlewareInterface;
|
||
|
|
use Webman\Http\Response;
|
||
|
|
use Webman\Http\Request;
|
||
|
|
use app\service\AuthService;
|
||
|
|
|
||
|
|
class PermissionMiddleware implements MiddlewareInterface
|
||
|
|
{
|
||
|
|
protected $permission_code;
|
||
|
|
|
||
|
|
// 支持传参（如 "user:view"），可以在路由闭包里传入
|
||
|
|
public function __construct($permission_code = null)
|
||
|
|
{
|
||
|
|
$this->permission_code = $permission_code;
|
||
|
|
}
|
||
|
|
|
||
|
|
public function process(Request $request, callable $next): Response
|
||
|
|
{
|
||
|
|
// 假设有 auth() helper 方法能获取当前登录用户ID
|
||
|
|
$user_id = $request->session()->get('user_id');
|
||
|
|
if (!$user_id) {
|
||
|
|
return json(['code' => 401, 'msg' => '未登录']);
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($this->permission_code && !AuthService::check($user_id, $this->permission_code)) {
|
||
|
|
return json(['code' => 403, 'msg' => '没有权限']);
|
||
|
|
}
|
||
|
|
|
||
|
|
return $next($request);
|
||
|
|
}
|
||
|
|
}
|