first push

app/middleware/PermissionMiddleware.php

@@ -0,0 +1,33 @@
+<?php
+namespace app\middleware;
+
+use Webman\MiddlewareInterface;
+use Webman\Http\Response;
+use Webman\Http\Request;
+use app\service\AuthService;
+
+class PermissionMiddleware implements MiddlewareInterface
+{
+    protected $permission_code;
+
+    // 支持传参（如 "user:view"），可以在路由闭包里传入
+    public function __construct($permission_code = null)
+    {
+        $this->permission_code = $permission_code;
+    }
+
+    public function process(Request $request, callable $next): Response
+    {
+        // 假设有 auth() helper 方法能获取当前登录用户ID
+        $user_id = $request->session()->get('user_id');
+        if (!$user_id) {
+            return json(['code' => 401, 'msg' => '未登录']);
+        }
+
+        if ($this->permission_code && !AuthService::check($user_id, $this->permission_code)) {
+            return json(['code' => 403, 'msg' => '没有权限']);
+        }
+
+        return $next($request);
+    }
+}

app/middleware/StaticFile.php

@@ -0,0 +1,42 @@
+<?php
+/**
+ * This file is part of webman.
+ *
+ * Licensed under The MIT License
+ * For full copyright and license information, please see the MIT-LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @author    walkor<walkor@workerman.net>
+ * @copyright walkor<walkor@workerman.net>
+ * @link      http://www.workerman.net/
+ * @license   http://www.opensource.org/licenses/mit-license.php MIT License
+ */
+
+namespace app\middleware;
+
+use Webman\MiddlewareInterface;
+use Webman\Http\Response;
+use Webman\Http\Request;
+
+/**
+ * Class StaticFile
+ * @package app\middleware
+ */
+class StaticFile implements MiddlewareInterface
+{
+    public function process(Request $request, callable $handler): Response
+    {
+        // Access to files beginning with. Is prohibited
+        if (strpos($request->path(), '/.') !== false) {
+            return response('<h1>403 forbidden</h1>', 403);
+        }
+        /** @var Response $response */
+        $response = $handler($request);
+        // Add cross domain HTTP header
+        /*$response->withHeaders([
+            'Access-Control-Allow-Origin'      => '*',
+            'Access-Control-Allow-Credentials' => 'true',
+        ]);*/
+        return $response;
+    }
+}