更新

backend-tp8/app/middleware/AdminAuth.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace app\middleware;
+
+use think\exception\HttpResponseException;
+
+class AdminAuth
+{
+    public function handle($request, \Closure $next)
+    {
+        $user = $request->authUser ?? null;
+        if (!$user || ($user['role'] ?? '') !== 'admin') {
+            throw new HttpResponseException(json([
+                'code'    => 1,
+                'message' => '无管理员权限',
+                'data'    => null,
+            ], 403));
+        }
+
+        return $next($request);
+    }
+}

backend-tp8/app/middleware/Cors.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace app\middleware;
+
+use app\service\JwtService;
+use think\Response;
+
+class Cors
+{
+    public function handle($request, \Closure $next)
+    {
+        header('Access-Control-Allow-Origin: *');
+        header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
+        header('Access-Control-Allow-Headers: Content-Type, Authorization');
+
+        if ($request->method(true) === 'OPTIONS') {
+            return Response::create('', 'html', 204);
+        }
+
+        return $next($request);
+    }
+}

backend-tp8/app/middleware/JwtAuth.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace app\middleware;
+
+use app\model\User;
+use app\service\JwtService;
+use think\exception\HttpResponseException;
+use think\Response;
+
+class JwtAuth
+{
+    public function handle($request, \Closure $next)
+    {
+        $token = $request->header('Authorization', '');
+        $payload = JwtService::verifyToken($token);
+
+        if (!$payload || empty($payload['user_id'])) {
+            $this->abort('请先登录', 401);
+        }
+
+        $user = User::with(['membership'])->find($payload['user_id']);
+        if (!$user || $user->status !== 'active') {
+            $this->abort('请先登录', 401);
+        }
+
+        $request->authUser = $this->formatUser($user);
+
+        return $next($request);
+    }
+
+    private function formatUser(User $user): array
+    {
+        $level = $user->membership;
+        return [
+            'id'                     => $user->id,
+            'username'               => $user->username,
+            'email'                  => $user->email,
+            'nickname'               => $user->nickname,
+            'avatar'                 => $user->avatar,
+            'role'                   => $user->role,
+            'status'                 => $user->status,
+            'membership_level_id'    => $user->membership_level_id,
+            'membership_name'        => $level?->name,
+            'membership_slug'        => $level?->slug,
+            'max_conversations'      => $level?->max_conversations ?? 20,
+            'max_messages_per_day'   => $level?->max_messages_per_day ?? 50,
+            'max_upload_size_mb'     => $level?->max_upload_size_mb ?? 5,
+            'membership_permissions' => $level?->permissions ?? [],
+        ];
+    }
+
+    private function abort(string $message, int $httpCode = 400): void
+    {
+        throw new HttpResponseException(json([
+            'code'    => 1,
+            'message' => $message,
+            'data'    => null,
+        ], $httpCode));
+    }
+}