kang
e3ffffad9c
- 在 SyncAdminAuthorizationCommand 中新增对代理线路和结算菜单操作的同步功能，确保缺失的菜单操作行能够被创建。 - 更新多个控制器中的权限检查逻辑，使用 hasPermissionCode 替代原有的权限验证方式，提升权限管理的灵活性。 - 在 AdminPlayerStoreController 中引入对玩家创建能力的验证，确保只有具备相应权限的管理员能够创建玩家。 - 更新请求验证逻辑，新增 credit_limit、rebate_rate 和 extra_rebate_rate 字段，以支持更细粒度的玩家管理。 - 在 AdminUser 和 AgentNode 模型中增强角色与用户的权限管理功能，支持更细粒度的权限控制。
98 lines
3.3 KiB
PHP
98 lines
3.3 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use Closure;
|
|
use App\Models\AdminUser;
|
|
use App\Lottery\ErrorCode;
|
|
use App\Support\ApiMessage;
|
|
use App\Support\ApiResponse;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
final class EnsureAdminApiResourcePermission
|
|
{
|
|
public function handle(Request $request, Closure $next): Response
|
|
{
|
|
$admin = $request->lotteryAdmin();
|
|
if (! $admin instanceof AdminUser) {
|
|
return ApiResponse::error(
|
|
trans('admin.unauthenticated', [], $request->lotteryLocale()),
|
|
ErrorCode::AdminUnauthenticated->value,
|
|
null,
|
|
401,
|
|
);
|
|
}
|
|
|
|
$route = $request->route();
|
|
$routeName = is_object($route) ? $route->getName() : null;
|
|
if (! is_string($routeName) || $routeName === '') {
|
|
return ApiMessage::errorResponse($request, 'admin.route_name_missing_for_permission', ErrorCode::InternalError->value, null, 500);
|
|
}
|
|
|
|
$normalizedRouteName = $this->normalizeAdminRouteName($routeName);
|
|
$resource = DB::table('admin_api_resources')
|
|
->where('route_name', $normalizedRouteName)
|
|
->where('status', 1)
|
|
->first(['id', 'code', 'auth_mode']);
|
|
|
|
if ($resource === null) {
|
|
return ApiMessage::errorResponse(
|
|
$request,
|
|
'admin.api_resource_not_configured',
|
|
ErrorCode::InternalError->value,
|
|
['route_name' => $normalizedRouteName],
|
|
500,
|
|
['route' => $normalizedRouteName],
|
|
);
|
|
}
|
|
|
|
if ($resource->auth_mode === 'login_only') {
|
|
return $next($request);
|
|
}
|
|
|
|
$permissionCodes = DB::table('admin_api_resource_bindings as arb')
|
|
->join('admin_menu_actions as ma', 'ma.id', '=', 'arb.menu_action_id')
|
|
->where('arb.api_resource_id', (int) $resource->id)
|
|
->where('ma.status', 1)
|
|
->pluck('ma.permission_code')
|
|
->filter(static fn ($code): bool => is_string($code) && $code !== '')
|
|
->values()
|
|
->all();
|
|
|
|
if ($permissionCodes === []) {
|
|
if ($admin->isSuperAdmin()) {
|
|
return $next($request);
|
|
}
|
|
|
|
return ApiMessage::errorResponse(
|
|
$request,
|
|
'admin.api_resource_no_permission_binding',
|
|
ErrorCode::InternalError->value,
|
|
['resource_code' => $resource->code],
|
|
500,
|
|
['code' => (string) $resource->code],
|
|
);
|
|
}
|
|
|
|
foreach ($permissionCodes as $permissionCode) {
|
|
if ($admin->hasAdminPermission((string) $permissionCode)) {
|
|
return $next($request);
|
|
}
|
|
}
|
|
|
|
return ApiResponse::error(
|
|
trans('admin.permission_denied', [], $request->lotteryLocale()),
|
|
ErrorCode::AdminForbidden->value,
|
|
['required_any_codes' => $permissionCodes, 'resource_code' => $resource->code],
|
|
403,
|
|
);
|
|
}
|
|
|
|
private function normalizeAdminRouteName(string $routeName): string
|
|
{
|
|
return preg_replace('/^(api\.v1\.admin\.)+/', 'api.v1.admin.', $routeName) ?? $routeName;
|
|
}
|
|
}
|