x-server-mobile/backend/app/middleware/AuthMiddleware.php

<?php

namespace app\middleware;

use app\util\JwtUtil;
use Webman\Http\Request;
use Webman\Http\Response;

class AuthMiddleware
{
    public function process(Request $request, callable $next): Response
    {
        // 从请求头获取 token
        $token = $request->header('Authorization');

        // 移除 "Bearer " 前缀（如果存在）
        if ($token && str_starts_with($token, 'Bearer ')) {
            $token = substr($token, 7);
        }

        // 如果没有 token，返回 401
        if (!$token) {
            return json([
                'code' => 401,
                'message' => '未登录',
                'data' => null,
            ]);
        }

        // 验证 token
        $payload = JwtUtil::decode($token);
        if (!$payload) {
            return json([
                'code' => 401,
                'message' => '登录已过期',
                'data' => null,
            ]);
        }

        // 将用户ID注入到请求中
        $request->userId = (int) ($payload['user_id'] ?? 0);
        $request->companyId = (int) ($payload['company_id'] ?? 0);

        return $next($request);
    }
}