@@ -0,0 +1,26 @@
+<?php
+
+namespace app\middleware;
+
+use Webman\MiddlewareInterface;
+use Webman\Http\Response;
+use Webman\Http\Request;
+
+class AccessControl implements MiddlewareInterface
+{
+    public function process(Request $request, callable $handler) : Response
+    {
+        // 如果是options请求则返回一个空响应，否则继续向洋葱芯穿越，并得到一个响应
+        $response = $request->method() == 'OPTIONS' ? response('') : $handler($request);
+
+        // 给响应添加跨域相关的http头
+        $response->withHeaders([
+            'Access-Control-Allow-Credentials' => 'true',
+            'Access-Control-Allow-Origin' => $request->header('origin', '*'),
+            'Access-Control-Allow-Methods' => $request->header('access-control-request-method', '*'),
+            'Access-Control-Allow-Headers' => $request->header('access-control-request-headers', '*'),
+        ]);
+
+        return $response;
+    }
+}
@@ -0,0 +1,114 @@
+<?php
+namespace app\middleware;
+
+use Webman\MiddlewareInterface;
+use Webman\Http\Response;
+use Webman\Http\Request;
+use app\common\audit\AuditBuffer;
+use app\common\model\User;
+use Webman\RedisQueue\Redis as Queue;
+use support\Log;
+
+class Audit implements MiddlewareInterface
+{
+    public function process(Request $request, callable $handler): Response
+    {
+        $start = microtime(true);
+        AuditBuffer::reset();
+
+        $httpCode = 200; $message = null; $status = 1;
+
+        try {
+            $response = $handler($request);
+            $httpCode = $response->getStatusCode();
+            return $response;
+        } catch (\Throwable $e) {
+            $httpCode = $e->getCode() ?: 500;
+            $message  = mb_substr($e->getMessage(), 0, 180);
+            $status   = 0;
+            throw $e;
+        } finally {
+            $latency = (int)((microtime(true) - $start) * 1000);
+            $this->enqueue($request, $httpCode, $status, $message, $latency);
+        }
+    }
+
+
+    protected function enqueue(Request $req, int $httpCode, int $status, ?string $message, int $latencyMs): void
+    {
+        $buf = AuditBuffer::instance();
+
+        $user = $this->currentUser($req->user);
+        $paramsBrief = $this->briefParams($req->all());
+        $ua = (string)($req->header('user-agent') ?? '');
+        if (mb_strlen($ua) > 191) $ua = mb_substr($ua, 0, 191);
+
+        $payload = [
+            'user_id'      => $user['id']   ?? null,
+            'user_name'    => $user['name'] ?? null,
+            'route'        => $req->path(),
+            'method'       => $req->method(),
+            'ip'           => $req->getRealIp(),
+            'ua'           => $ua,
+            'action'       => $buf->action ?? $req->action,
+            'status'       => $status,
+            'http_code'    => $httpCode,
+            'latency_ms'   => $latencyMs,
+            'params_brief' => $paramsBrief,   // 数组，消费者再编码
+            'changes'      => $buf->changes,  // 数组，消费者再编码
+            'message'      => $message,
+            'ts'           => time()
+        ];
+
+        try {
+            Queue::send('audit_log', $payload); // 异步
+        } catch (\Throwable $e) {
+            // 遵循“绝不回落同步写”，仅记录错误
+            Log::error('audit enqueue failed: '.$e->getMessage());
+        }
+    }
+
+    protected function briefParams(array $params): array
+    {
+        // $mask = ['password','pwd','token','secret','access_token','refresh_token','file','content','html'];
+        $mask = [];
+        $out = [];
+        foreach ($params as $k=>$v) {
+            if (in_array($k, $mask, true)) { $out[$k] = '***'; continue; }
+            if (is_array($v)) { $out[$k] = '[array('.count($v).')]'; continue; }
+            $s = (string)$v;
+            $out[$k] = mb_strlen($s) > 120 ? mb_substr($s, 0, 120).'…' : $s;
+        }
+        return $out;
+    }
+
+    protected function inferAction(Request $req): ?string
+    {
+        $m = strtoupper($req->method());
+        if ($m === 'POST') return 'create';
+        if ($m === 'PUT' || $m === 'PATCH') return 'update';
+        if ($m === 'DELETE') return 'delete';
+        return 'view';
+    }
+
+    protected function currentUser($user): array
+    {
+        $user = (array)$user;
+
+        if (!$user) {
+            return [
+                'id'   => 0,
+                'name' => 'guest'
+            ];
+        } else {
+            if (!isset($user['uname'])) {
+                $user['uname'] = User::where('id', $user['uid'])->value('name');
+            }
+        }
+
+        return [
+            'id'   => $user['uid'] ?? 0,
+            'name' => $user['uname'] ?? 'guest'
+        ];
+    }
+}
@@ -0,0 +1,50 @@
+<?php
+namespace app\middleware;
+
+use app\common\utils\Jwt;
+use ReflectionClass;
+use Webman\MiddlewareInterface;
+use Webman\Http\Response;
+use Webman\Http\Request;
+
+class AuthCheck implements MiddlewareInterface
+{
+    public function process(Request $request, callable $handler) : Response
+    {
+        $controller = new ReflectionClass($request->controller);
+        $properties = $controller->getDefaultProperties();
+        $noNeedLogin = $properties['noNeedLogin'] ?? [];
+        $noNeedAuth = $properties['noNeedAuth'] ?? [];
+        
+        if (in_array($request->action, $noNeedLogin)) {
+            // 白名单
+            return $handler($request);
+        } else {
+            try {
+                $authHeader = $request->header('Fdesk-Auth-Token');
+                if (!$authHeader || !preg_match('/Bearer\s(\S+)/', $authHeader, $matches)) {
+                    $body = [
+                        'status'  => 'fail',
+                        'code'    => 401,
+                        'message' => '未授权',
+                        'data'    => [],
+                    ];
+                    return response(json_encode($body, JSON_UNESCAPED_UNICODE), 401, ['Content-Type' => 'application/json']);
+                }
+                $token = $matches[1];
+                $request->user = (new Jwt())->verifyToken($token);
+                return $handler($request);
+            } catch (\Throwable $e) {
+                $body = [
+                    'status'  => 'fail',
+                    'code'    => 401,
+                    'message' => $e->getMessage(),
+                    'data'    => [],
+                ];
+                return response(json_encode($body, JSON_UNESCAPED_UNICODE), 401, ['Content-Type' => 'application/json']);
+            }
+        }
+
+        return $handler($request);
+    }
+}
@@ -0,0 +1,48 @@
+<?php
+namespace app\middleware;
+
+use Webman\MiddlewareInterface;
+use Webman\Http\Response;
+use Webman\Http\Request;
+use app\common\service\BasicDataService;
+use ReflectionClass;
+
+class BasicData implements MiddlewareInterface
+{
+    public function process(Request $request, callable $handler): Response
+    {
+        $controller = new ReflectionClass($request->controller);
+        $noNeedHeaderData = $controller->getDefaultProperties()['noNeedHeaderData'] ?? [];
+
+        if (in_array($request->action, $noNeedHeaderData)) {
+            // 白名单
+            return $handler($request);
+        } else {
+            try {
+                $corpAbbr = $request->header('Fdesk-Corp-Abbr');
+                $systemCode = $request->header('Fdesk-System-Code');
+                $loginType = $request->header('Fdesk-Login-Type');
+                $basicDataService = new BasicDataService();
+                if ($basicDataService->checkAndCacheBaseParams($loginType, $systemCode, $corpAbbr)) {
+                    $request->login_type = $loginType;
+                    $request->system_code = $systemCode;
+                    $request->corp_abbr = $corpAbbr;
+                    $request->basic_data = [
+                        'login_type' => $loginType,
+                        'system_code' => $systemCode,
+                        'corp_abbr' => $corpAbbr
+                    ];
+                }
+                return $handler($request);
+            } catch (\Throwable $th) {
+                $body = [
+                    'status'  => 'fail',
+                    'code'    => 403,
+                    'message' => $th->getMessage(),
+                    'data'    => [],
+                ];
+                return response(json_encode($body, JSON_UNESCAPED_UNICODE), 401, ['Content-Type' => 'application/json']);
+            }
+        }
+    }
+}
@@ -0,0 +1,42 @@
+<?php
+/**
+ * This file is part of webman.
+ *
+ * Licensed under The MIT License
+ * For full copyright and license information, please see the MIT-LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @author    walkor<walkor@workerman.net>
+ * @copyright walkor<walkor@workerman.net>
+ * @link      http://www.workerman.net/
+ * @license   http://www.opensource.org/licenses/mit-license.php MIT License
+ */
+
+namespace app\middleware;
+
+use Webman\MiddlewareInterface;
+use Webman\Http\Response;
+use Webman\Http\Request;
+
+/**
+ * Class StaticFile
+ * @package app\middleware
+ */
+class StaticFile implements MiddlewareInterface
+{
+    public function process(Request $request, callable $handler): Response
+    {
+        // Access to files beginning with. Is prohibited
+        if (strpos($request->path(), '/.') !== false) {
+            return response('<h1>403 forbidden</h1>', 403);
+        }
+        /** @var Response $response */
+        $response = $handler($request);
+        // Add cross domain HTTP header
+        /*$response->withHeaders([
+            'Access-Control-Allow-Origin'      => '*',
+            'Access-Control-Allow-Credentials' => 'true',
+        ]);*/
+        return $response;
+    }
+}