mzl92
35d98c16e9
- 新增 ApiKeyAuth 中间件（hash_equals 防时序攻击） - 新增 PublicApiController（piList/vinList 两个只读接口） - 仅返回已审批通过（approval_status=2）的数据，支持分页和模糊搜索 - LIKE 通配符已转义，异常信息不暴露内部细节 - 附对接文档 docs/public-stock-api.md Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
29 lines
805 B
PHP
29 lines
805 B
PHP
<?php
|
|
|
|
namespace app\middleware;
|
|
|
|
use Webman\MiddlewareInterface;
|
|
use Webman\Http\Response;
|
|
use Webman\Http\Request;
|
|
|
|
class ApiKeyAuth implements MiddlewareInterface
|
|
{
|
|
public function process(Request $request, callable $handler): Response
|
|
{
|
|
$apiKey = $request->header('Fdesk-Api-Key', '');
|
|
$validKey = getenv('PUBLIC_API_KEY');
|
|
|
|
if ($validKey === false || $apiKey === '' || !hash_equals($validKey, $apiKey)) {
|
|
$body = [
|
|
'status' => 'fail',
|
|
'code' => 401,
|
|
'message' => '无效的 API Key',
|
|
'data' => [],
|
|
];
|
|
return response(json_encode($body, JSON_UNESCAPED_UNICODE), 401, ['Content-Type' => 'application/json']);
|
|
}
|
|
|
|
return $handler($request);
|
|
}
|
|
}
|