wip

app/admin/controller/CompanyAndOperators.php

@@ -13,9 +13,7 @@ class CompanyAndOperators extends BaseController
      */
     public function getAllOperators(TicketService $ticketService)
     {
-
         $result = $ticketService->getAllOperators();
-
         return json(['code' => 200, 'msg' => '查询成功', 'data' => $result]);
     }
 

app/admin/middleware/Auth.php

@@ -6,6 +6,28 @@ use think\facade\Session;
 
 class Auth
 {
+    /**
+     * 无需 admin 角色即可访问的路由名称（方法名小写）
+     */
+    protected $publicActions = [];
+
+    /**
+     * 需要 admin 角色才能访问的路由名称（方法名小写）
+     */
+    protected $adminActions = [
+        'deleteoperator',
+        'deletecompany',
+        'addcompany',
+        'addoperator',
+        'getallusers',
+        'addaccount',
+        'updateaccountstatus',
+        'deleteaccount',
+        'getexportdata',
+        'deleteticket',
+        'batchupdate',
+    ];
+
     public function handle($request, \Closure $next)
     {
         if (!Session::has('user_info')) {
@@ -13,9 +35,18 @@ class Auth
         }
 
         $user = Session::get('user_info');
+        $role = $user['role'] ?? 'user';
 
         $request->login_user_id = $user['id'] ?? null;
-        $request->login_role    = $user['role'] ?? null;
+        $request->login_role    = $role;
+
+        // 获取当前请求的路由方法名
+        $action = strtolower($request->action());
+
+        // admin 专用接口
+        if (in_array($action, $this->adminActions) && $role !== 'admin') {
+            return json(['code' => 403, 'msg' => '权限不足，仅管理员可执行此操作']);
+        }
 
         return $next($request);
     }

app/admin/route/app.php

@@ -2,6 +2,7 @@
 
 use think\facade\Route;
 use app\admin\middleware\Auth;
+use app\middleware\CheckLogin;
 
 Route::group(function () {
     Route::get('ticketsfind', 'Ticket/ticketsFind');
@@ -11,7 +12,6 @@ Route::group(function () {
     Route::put('tickets/batch-update', 'Ticket/batchUpdate');
     Route::get('getticketdashboardstats', 'Ticket/getTicketDashboardStats');
 
-
     Route::get('getUserStaffList', 'CompanyAndOperators/getStaffList');
     Route::get('operators', 'CompanyAndOperators/getAllOperators');
     Route::get('getOperatorList', 'CompanyAndOperators/TestgetAllOperators');
@@ -26,4 +26,4 @@ Route::group(function () {
     Route::delete('deleteAccount/:id', 'AccountManagement/deleteAccount');
 
     Route::post('getExportData', 'Utill/getExportData');
-})->middleware(Auth::class);
+})->middleware([CheckLogin::class, Auth::class]);