first commit

server/app/adminapi/http/middleware/AuthMiddleware.php

@@ -0,0 +1,211 @@
+<?php
+// +----------------------------------------------------------------------
+// | likeadmin快速开发前后端分离管理后台（PHP版）
+// +----------------------------------------------------------------------
+// | 欢迎阅读学习系统程序代码，建议反馈是我们前进的动力
+// | 开源版本可自由商用，可去除界面版权logo
+// | gitee下载：https://gitee.com/likeshop_gitee/likeadmin
+// | github下载：https://github.com/likeshop-github/likeadmin
+// | 访问官网：https://www.likeadmin.cn
+// | likeadmin团队 版权所有 拥有最终解释权
+// +----------------------------------------------------------------------
+// | author: likeadminTeam
+// +----------------------------------------------------------------------
+
+declare (strict_types=1);
+
+namespace app\adminapi\http\middleware;
+
+use app\adminapi\logic\LoginLogic;
+use app\common\service\pharmacy\PharmacyUploadPermissionAlias;
+use app\common\{
+    cache\AdminAuthCache,
+    service\JsonService
+};
+use think\helper\Str;
+
+/**
+ * 权限验证中间件
+ * Class AuthMiddleware
+ * @package app\adminapi\http\middleware
+ */
+class AuthMiddleware
+{
+    /**
+     * @notes 权限验证
+     * @param $request
+     * @param \Closure $next
+     * @return mixed
+     * @author 令狐冲
+     * @date 2021/7/2 19:29
+     */
+    public function handle($request, \Closure $next)
+    {
+        //不登录访问，无需权限验证
+        if ($request->controllerObject->isNotNeedLogin()) {
+            return $next($request);
+        }
+
+        if ($request->adminInfo['login_ip'] != request()->ip()) {
+            return JsonService::fail('ip地址发生变化，请重新登录', [], -1);
+        }
+
+        // 非 root 待绑企微：放行绑定 / 解绑 / 个人信息 / 退出（避免无菜单权限；action 与路由大小写一致）
+        if (LoginLogic::adminMustBindWorkWechat($request->adminInfo)) {
+            if (LoginLogic::isWorkWechatBindExemptActionName((string) $request->action())) {
+                return $next($request);
+            }
+        }
+
+        //系统默认超级管理员，无需权限验证
+        if (1 === $request->adminInfo['root']) {
+            return $next($request);
+        }
+
+        // 面诊进度看板：仅登录即可拉医生列表 + 预约列表（须带 progress_board=1，见 AdminLists / AppointmentLists 内限制）
+        if ($this->isFaceProgressBoardPublicLists($request)) {
+            return $next($request);
+        }
+
+        $adminAuthCache = new AdminAuthCache($request->adminInfo['admin_id']);
+
+        // 当前访问路径
+        $accessUri = strtolower($request->controller() . '/' . $request->action());
+        // 全部路由
+        $allUri = $this->formatUrl($adminAuthCache->getAllUri());
+
+        // 判断该当前访问的uri是否存在，不存在无需验证
+        if (!in_array($accessUri, $allUri, true)
+            && !PharmacyUploadPermissionAlias::allows($accessUri, $allUri)) {
+            return $next($request);
+        }
+
+        // 当前管理员拥有的路由权限
+        $AdminUris = $adminAuthCache->getAdminUri() ?? [];
+        $AdminUris = $this->formatUrl($AdminUris);
+
+        if (in_array($accessUri, $AdminUris) || $this->matchPermissionAlias($accessUri, $AdminUris)) {
+            return $next($request);
+        }
+        return JsonService::fail('权限不足，无法访问或操作');
+    }
+
+
+    /**
+     * @notes 格式化URL
+     * @param array $data
+     * @return array|string[]
+     * @author 段誉
+     * @date 2022/7/7 15:39
+     */
+    public function formatUrl(array $data)
+    {
+        return array_map(function ($item) {
+            return strtolower(Str::camel($item));
+        }, $data);
+    }
+
+    /**
+     * 日常记录权限域：前端统一收口到 tcm.diagnosis/dailyRecord，
+     * 但待办/跟踪备注接口仍保留历史路由名，故在鉴权层做精确别名映射。
+     */
+    private function matchPermissionAlias(string $accessUri, array $adminUris): bool
+    {
+        if (PharmacyUploadPermissionAlias::isControlled($accessUri)) {
+            return PharmacyUploadPermissionAlias::allows($accessUri, $adminUris);
+        }
+
+        if (in_array('tcm.diagnosis/dailyrecord', $adminUris, true)
+            && in_array($accessUri, [
+                'tcm.diagnosistodo/lists',
+                'tcm.diagnosistodo/add',
+                'tcm.diagnosistodo/cancel',
+                'tcm.diagnosis/trackingnotes',
+                'tcm.diagnosis/addtrackingnote',
+            ], true)) {
+            return true;
+        }
+
+        // 导出与列表共用 PrescriptionOrderLists 数据域；角色漏勾「导出订单」子权限时仍返回 权限不足
+        if ($accessUri === 'tcm.prescriptionorder/export'
+            && in_array('tcm.prescriptionorder/lists', $adminUris, true)) {
+            return true;
+        }
+
+        // 京东物流接口刷新：与「物流轨迹」同一数据域，复用 logisticsTrace 权限
+        if ($accessUri === 'tcm.prescriptionorder/logisticsjdupdate'
+            && in_array('tcm.prescriptionorder/logisticstrace', $adminUris, true)) {
+            return true;
+        }
+
+        // 挂号列表批量改渠道：与单条编辑同一数据域，复用 doctor.appointment/edit
+        if ($accessUri === 'doctor.appointment/batcheditchannel'
+            && in_array('doctor.appointment/edit', $adminUris, true)) {
+            return true;
+        }
+
+        // 自录转化统计：自媒体来源下拉，复用总览或账户消耗列表权限
+        if ($accessUri === 'stats.selfinput/mediasourceoptions') {
+            $selfInputAliases = [
+                'stats.selfinput/overview',
+                'stats.self_input/overview',
+                'stats.personalaccountcost/lists',
+                'stats.personal_account_cost/lists',
+            ];
+            if (count(array_intersect($selfInputAliases, $AdminUris)) > 0) {
+                return true;
+            }
+        }
+
+        // 处方库列表：消费者开方页/处方库页导入共用，复用开方或处方库菜单权限
+        if ($accessUri === 'tcm.prescriptionlibrary/lists'
+            && $this->matchPrescriptionLibraryListsPermission($adminUris)) {
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * 处方库 lists：与开方、处方库维护菜单权限互通（避免开方页「从处方库导入」403）
+     */
+    private function matchPrescriptionLibraryListsPermission(array $adminUris): bool
+    {
+        $aliases = [
+            'tcm.prescriptionlibrary/lists',
+            'tcm.prescription/lists',
+            'tcm.prescription/add',
+            'tcm.prescription/edit',
+            'tcm.prescription/detail',
+            'cf.prescription/lists',
+            'cf.prescription/add',
+            'cf.prescription/edit',
+            'cf.prescription/read',
+            'cf.prescription/del',
+            'cf.prescription/audit',
+            'wcf.prescription/lists',
+            'wcf.prescription/read',
+            'wcf.prescription/add',
+            'wcf.prescription/edit',
+            'wcf.prescription/delete',
+        ];
+
+        return count(array_intersect($aliases, $adminUris)) > 0;
+    }
+
+    /**
+     * 面诊进度专用：auth.admin/lists、doctor.appointment/lists + progress_board=1，不校验菜单权限
+     */
+    private function isFaceProgressBoardPublicLists($request): bool
+    {
+        if ((int) $request->param('progress_board', 0) !== 1) {
+            return false;
+        }
+        if (strtolower((string) $request->action()) !== 'lists') {
+            return false;
+        }
+        $c = strtolower((string) $request->controller());
+
+        return in_array($c, ['auth.admin', 'doctor.appointment'], true);
+    }
+}

server/app/adminapi/http/middleware/CheckDemoMiddleware.php

@@ -0,0 +1,50 @@
+<?php
+// +----------------------------------------------------------------------
+// | likeadmin快速开发前后端分离管理后台（PHP版）
+// +----------------------------------------------------------------------
+// | 欢迎阅读学习系统程序代码，建议反馈是我们前进的动力
+// | 开源版本可自由商用，可去除界面版权logo
+// | gitee下载：https://gitee.com/likeshop_gitee/likeadmin
+// | github下载：https://github.com/likeshop-github/likeadmin
+// | 访问官网：https://www.likeadmin.cn
+// | likeadmin团队 版权所有 拥有最终解释权
+// +----------------------------------------------------------------------
+// | author: likeadminTeam
+// +----------------------------------------------------------------------
+
+declare (strict_types=1);
+
+namespace app\adminapi\http\middleware;
+
+
+use app\common\service\JsonService;
+
+/**
+ * 校验演示环境
+ * Class CheckDemoMiddleware
+ * @package app\adminapi\http\middleware
+ */
+class CheckDemoMiddleware
+{
+
+    // 允许post的接口
+    protected $ablePost = [
+        'login/account',
+        'login/logout',
+    ];
+
+    public function handle($request, \Closure $next)
+    {
+        if ($request->method() != 'POST') {
+            return $next($request);
+        }
+
+        $accessUri = strtolower($request->controller() . '/' . $request->action());
+        if (!in_array($accessUri, $this->ablePost) && env('project.demo_env')) {
+            return JsonService::fail('演示环境不支持修改数据，请下载源码本地部署体验');
+        }
+
+        return $next($request);
+    }
+
+}

server/app/adminapi/http/middleware/EncryDemoDataMiddleware.php

@@ -0,0 +1,114 @@
+<?php
+// +----------------------------------------------------------------------
+// | likeadmin快速开发前后端分离管理后台（PHP版）
+// +----------------------------------------------------------------------
+// | 欢迎阅读学习系统程序代码，建议反馈是我们前进的动力
+// | 开源版本可自由商用，可去除界面版权logo
+// | gitee下载：https://gitee.com/likeshop_gitee/likeadmin
+// | github下载：https://github.com/likeshop-github/likeadmin
+// | 访问官网：https://www.likeadmin.cn
+// | likeadmin团队 版权所有 拥有最终解释权
+// +----------------------------------------------------------------------
+// | author: likeadminTeam
+// +----------------------------------------------------------------------
+
+declare (strict_types=1);
+
+namespace app\adminapi\http\middleware;
+
+/**
+ * 演示环境数据加密
+ * Class DemoDataMiddleware
+ * @package app\adminapi\http\middleware
+ */
+class EncryDemoDataMiddleware
+{
+
+    // 需要过滤的接口
+    protected $needCheck = [
+        // 存储配置
+        'setting.storage/detail',
+        // 短信配置
+        'notice.smsConfig/detail',
+        // 公众号配置
+        'channel.official_account_setting/getConfig',
+        // 小程序配置
+        'channel.mnp_settings/getConfig',
+        // 开放平台配置
+        'channel.open_setting/getConfig',
+        // 支付配置
+        'setting.pay.pay_config/getConfig',
+    ];
+
+    // 可以排除字段
+    protected $excludeParams = [
+        'name',
+        'icon',
+        'image',
+        'qr_code',
+        'interface_version',
+        'merchant_type',
+    ];
+
+
+    public function handle($request, \Closure $next)
+    {
+        $response = $next($request);
+
+        // 非需校验的接口 或者 未开启演示模式
+        $accessUri = strtolower($request->controller() . '/' . $request->action());
+        if (!in_array($accessUri, lower_uri($this->needCheck)) || !env('project.demo_env')) {
+            return $response;
+        }
+
+        // 非json数据
+        if (!method_exists($response, 'header') || !in_array('application/json; charset=utf-8', $response->getHeader())) {
+            return $response;
+        }
+
+        $data = $response->getData();
+        if (!is_array($data) || empty($data)) {
+            return $response;
+        }
+
+        foreach ($data['data'] as $key => $item) {
+            // 字符串
+            if (is_string($item)) {
+                $data['data'][$key] = $this->getEncryData($key, $item);
+                continue;
+            }
+            // 数组
+            if (is_array($item)) {
+                foreach ($item as $itemKey => $itemValue) {
+                    $data['data'][$key][$itemKey] = $this->getEncryData($itemKey, $itemValue);
+                }
+            }
+        }
+
+        return $response->data($data);
+    }
+
+
+    /**
+     * @notes 加密配置
+     * @param $key
+     * @param $value
+     * @return mixed|string
+     * @author 段誉
+     * @date 2023/3/6 11:49
+     */
+    protected function getEncryData($key, $value)
+    {
+        // 非隐藏字段
+        if (in_array($key, $this->excludeParams)) {
+            return $value;
+        }
+
+        // 隐藏字段
+        if (is_string($value)) {
+            return '******';
+        }
+        return $value;
+    }
+
+}

server/app/adminapi/http/middleware/InitMiddleware.php

@@ -0,0 +1,57 @@
+<?php
+// +----------------------------------------------------------------------
+// | likeadmin快速开发前后端分离管理后台（PHP版）
+// +----------------------------------------------------------------------
+// | 欢迎阅读学习系统程序代码，建议反馈是我们前进的动力
+// | 开源版本可自由商用，可去除界面版权logo
+// | gitee下载：https://gitee.com/likeshop_gitee/likeadmin
+// | github下载：https://github.com/likeshop-github/likeadmin
+// | 访问官网：https://www.likeadmin.cn
+// | likeadmin团队 版权所有 拥有最终解释权
+// +----------------------------------------------------------------------
+// | author: likeadminTeam
+// +----------------------------------------------------------------------
+declare (strict_types=1);
+
+namespace app\adminapi\http\middleware;
+
+use app\adminapi\controller\BaseAdminController;
+use app\common\exception\ControllerExtendException;
+use think\exception\ClassNotFoundException;
+use think\exception\HttpException;
+
+/**
+ * 初始化验证中间件
+ * Class InitMiddleware
+ * @package app\adminapi\http\middleware
+ */
+class InitMiddleware
+{
+    /**
+     * @notes 初始化
+     * @param $request
+     * @param \Closure $next
+     * @return mixed
+     * @author 令狐冲
+     * @date 2021/7/2 19:29
+     */
+    public function handle($request, \Closure $next)
+    {
+        //获取控制器
+        try {
+            $controller = str_replace('.', '\\', $request->controller());
+            $controller = '\\app\\adminapi\\controller\\' . $controller . 'Controller';
+            $controllerClass = invoke($controller);
+            if (($controllerClass instanceof BaseAdminController) === false) {
+                throw new ControllerExtendException($controller, '404');
+            }
+        } catch (ClassNotFoundException $e) {
+            throw new HttpException(404, 'controller not exists:' . $e->getClass());
+        }
+
+        //创建控制器对象
+        $request->controllerObject = invoke($controller);
+
+        return $next($request);
+    }
+}

server/app/adminapi/http/middleware/LoginMiddleware.php

@@ -0,0 +1,106 @@
+<?php
+// +----------------------------------------------------------------------
+// | likeadmin快速开发前后端分离管理后台（PHP版）
+// +----------------------------------------------------------------------
+// | 欢迎阅读学习系统程序代码，建议反馈是我们前进的动力
+// | 开源版本可自由商用，可去除界面版权logo
+// | gitee下载：https://gitee.com/likeshop_gitee/likeadmin
+// | github下载：https://github.com/likeshop-github/likeadmin
+// | 访问官网：https://www.likeadmin.cn
+// | likeadmin团队 版权所有 拥有最终解释权
+// +----------------------------------------------------------------------
+// | author: likeadminTeam
+// +----------------------------------------------------------------------
+
+declare (strict_types=1);
+
+namespace app\adminapi\http\middleware;
+
+use app\adminapi\logic\LoginLogic;
+use app\common\cache\AdminTokenCache;
+use app\adminapi\service\AdminTokenService;
+use app\common\service\JsonService;
+use think\facade\Config;
+
+/**
+ * 登录中间件
+ * Class LoginMiddleware
+ * @package app\adminapi\http\middleware
+ */
+class LoginMiddleware
+{
+    /**
+     * @notes 登录验证
+     * @param $request
+     * @param \Closure $next
+     * @return mixed|\think\response\Json
+     * @author 令狐冲
+     * @date 2021/7/1 17:33
+     */
+    public function handle($request, \Closure $next)
+    {
+        $token = $request->header('token');
+        //判断接口是否免登录
+        $isNotNeedLogin = $request->controllerObject->isNotNeedLogin();
+
+        //不直接判断$isNotNeedLogin结果，使不需要登录的接口通过，为了兼容某些接口可以登录或不登录访问
+        if (empty($token) && !$isNotNeedLogin) {
+            //没有token并且该地址需要登录才能访问
+            return JsonService::fail('请求参数缺token', [], 0, 0);
+        }
+
+        $adminInfo = (new AdminTokenCache())->getAdminInfo($token);
+        if (empty($adminInfo) && !$isNotNeedLogin) {
+            //token过期无效并且该地址需要登录才能访问
+            return JsonService::fail('登录超时，请重新登录', [], -1);
+        }
+
+        //token临近过期，自动续期
+        if ($adminInfo) {
+            //获取临近过期自动续期时长
+            $beExpireDuration = Config::get('project.admin_token.be_expire_duration');
+            //token续期
+            if (time() > ($adminInfo['expire_time'] - $beExpireDuration)) {
+                $result = AdminTokenService::overtimeToken($token);
+                //续期失败（数据表被删除导致）
+                if (empty($result)) {
+                    return JsonService::fail('登录过期', [], -1);
+                }
+            }
+        }
+
+        //给request赋值，用于控制器
+        $request->adminInfo = $adminInfo;
+        $request->adminId = $adminInfo['admin_id'] ?? 0;
+
+        // 非 root 须绑定企微：免登录接口不拦截（如 getConfig），避免 init 死循环
+        if (!empty($adminInfo) && LoginLogic::adminMustBindWorkWechat($adminInfo) && !$isNotNeedLogin) {
+            if (!self::isWorkWechatBindExemptAction($request)) {
+                return JsonService::fail(
+                    '请先绑定企业微信后再使用系统',
+                    [],
+                    LoginLogic::CODE_NEED_BIND_WORK_WECHAT,
+                    0
+                );
+            }
+        }
+
+        return $next($request);
+    }
+
+    private static function isWorkWechatBindExemptAction($request): bool
+    {
+        if (LoginLogic::isWorkWechatBindExemptActionName((string) $request->action())) {
+            return true;
+        }
+        // 与 AuthMiddleware 一致：未绑企微时仍允许打开面诊进度所需只读列表
+        if ((int) $request->param('progress_board', 0) === 1 && strtolower((string) $request->action()) === 'lists') {
+            $c = strtolower((string) $request->controller());
+
+            return in_array($c, ['auth.admin', 'doctor.appointment'], true);
+        }
+
+        return false;
+    }
+
+}