first push

app/middleware/PermissionMiddleware.php

@@ -0,0 +1,33 @@
+<?php
+namespace app\middleware;
+
+use Webman\MiddlewareInterface;
+use Webman\Http\Response;
+use Webman\Http\Request;
+use app\service\AuthService;
+
+class PermissionMiddleware implements MiddlewareInterface
+{
+    protected $permission_code;
+
+    // 支持传参（如 "user:view"），可以在路由闭包里传入
+    public function __construct($permission_code = null)
+    {
+        $this->permission_code = $permission_code;
+    }
+
+    public function process(Request $request, callable $next): Response
+    {
+        // 假设有 auth() helper 方法能获取当前登录用户ID
+        $user_id = $request->session()->get('user_id');
+        if (!$user_id) {
+            return json(['code' => 401, 'msg' => '未登录']);
+        }
+
+        if ($this->permission_code && !AuthService::check($user_id, $this->permission_code)) {
+            return json(['code' => 403, 'msg' => '没有权限']);
+        }
+
+        return $next($request);
+    }
+}