87 lines
2.1 KiB
PHP
87 lines
2.1 KiB
PHP
<?php
|
|
|
|
namespace App\Admin\Middleware;
|
|
|
|
use Closure;
|
|
use Dcat\Admin\Admin;
|
|
use Illuminate\Http\Request;
|
|
use Dcat\Admin\Http\Middleware\Authenticate;
|
|
use Dcat\Admin\Layout\Content;
|
|
use Dcat\Admin\Support\Helper;
|
|
|
|
class Permissions
|
|
{
|
|
/**
|
|
* Handle an incoming request.
|
|
*
|
|
* @param \Illuminate\Http\Request $request
|
|
* @param \Closure $next
|
|
* @return mixed
|
|
*/
|
|
public function handle(Request $request, Closure $next)
|
|
{
|
|
$routeName = $request->route()->getName();
|
|
$user = Admin::user();
|
|
|
|
if (!$this->shouldPassThrough($request) //路由是否是白名单
|
|
&& !$user?->hasPermission($routeName)//是否有权限
|
|
) {
|
|
if (Helper::isAjaxRequest()) {
|
|
abort(403, trans('admin.deny'));
|
|
}
|
|
|
|
admin_exit(
|
|
Content::make()->withError(trans('admin.deny'))
|
|
);
|
|
}
|
|
return $next($request);
|
|
}
|
|
|
|
/**
|
|
* @param \Illuminate\Http\Request $request
|
|
*
|
|
* @return bool
|
|
*/
|
|
protected function isApiRoute($request)
|
|
{
|
|
return $request->routeIs(admin_api_route_name('*'));
|
|
}
|
|
|
|
/**
|
|
* Determine if the request has a URI that should pass through verification.
|
|
*
|
|
* @param \Illuminate\Http\Request $request
|
|
*
|
|
* @return bool
|
|
*/
|
|
public function shouldPassThrough($request)
|
|
{
|
|
if ($this->isApiRoute($request) || Authenticate::shouldPassThrough($request)) {
|
|
return true;
|
|
}
|
|
|
|
$excepts = array_merge(
|
|
(array) config('admin.permission.except', []),
|
|
Admin::context()->getArray('permission.except')
|
|
);
|
|
|
|
foreach ($excepts as $except) {
|
|
if ($request->routeIs($except) || $request->routeIs(admin_route_name($except))) {
|
|
return true;
|
|
}
|
|
|
|
$except = admin_base_path($except);
|
|
|
|
if ($except !== '/') {
|
|
$except = trim($except, '/');
|
|
}
|
|
|
|
if (Helper::matchRequestPath($except)) {
|
|
return true;
|
|
}
|
|
}
|
|
|
|
return false;
|
|
}
|
|
}
|