wip

app/admin/middleware/Auth.php

@@ -6,6 +6,28 @@ use think\facade\Session;
 
 class Auth
 {
+    /**
+     * 无需 admin 角色即可访问的路由名称（方法名小写）
+     */
+    protected $publicActions = [];
+
+    /**
+     * 需要 admin 角色才能访问的路由名称（方法名小写）
+     */
+    protected $adminActions = [
+        'deleteoperator',
+        'deletecompany',
+        'addcompany',
+        'addoperator',
+        'getallusers',
+        'addaccount',
+        'updateaccountstatus',
+        'deleteaccount',
+        'getexportdata',
+        'deleteticket',
+        'batchupdate',
+    ];
+
     public function handle($request, \Closure $next)
     {
         if (!Session::has('user_info')) {
@@ -13,9 +35,18 @@ class Auth
         }
 
         $user = Session::get('user_info');
+        $role = $user['role'] ?? 'user';
 
         $request->login_user_id = $user['id'] ?? null;
-        $request->login_role    = $user['role'] ?? null;
+        $request->login_role    = $role;
+
+        // 获取当前请求的路由方法名
+        $action = strtolower($request->action());
+
+        // admin 专用接口
+        if (in_array($action, $this->adminActions) && $role !== 'admin') {
+            return json(['code' => 403, 'msg' => '权限不足，仅管理员可执行此操作']);
+        }
 
         return $next($request);
     }