controller; $action = $request->action; $allowAnonymous = AnnotationHelper::getMethodAnnotation($controllerClass, $action, AllowAnonymous::class); if ($allowAnonymous && !$allowAnonymous->requirePermission) { return $handler($request); } try { $userId = (new JwtToken())->id(); if (empty($userId)) { throw new UnauthorizedHttpException(); } } catch (\Exception $e) { // 检查是否为SSE请求 if (SseHelper::isSseRequest($request)) { return SseHelper::sendSseErrorViaConnection($request, $e->getMessage()); } return Json::fail($e->getMessage(), [], 401); } // 使用CurrentUser进行权限验证 $currentUser = Container::make(CurrentUser::class); // 顶级管理员直接跳过权限验证 if ($currentUser->isSuperAdmin()) { return $handler($request); } try { //权限验证 $permissions = $this->resolvePermissions($controllerClass, $action); $this->validatePermissions($currentUser, $permissions); } catch (\Exception $e) { // 检查是否为SSE请求 if (SseHelper::isSseRequest($request)) { return SseHelper::sendSseErrorViaConnection($request, $e->getMessage()); } throw $e; } return $handler($request); } /** * 解析类/方法级的 Permission 注解 * * @return array 合并后的权限注解列表 */ private function resolvePermissions(string $controllerClass, string $action): array { $permissions = []; // a. 类级别注解（作用于整个控制器） $classAnnotation = AnnotationHelper::getClassAnnotation($controllerClass, Permission::class); if ($classAnnotation) { $permissions[] = $classAnnotation; } // b. 方法级别注解（覆盖/补充类级别规则） $methodAnnotation = AnnotationHelper::getMethodAnnotation($controllerClass, $action, Permission::class); if ($methodAnnotation) { $permissions[] = $methodAnnotation; } return $permissions; } /** * 校验用户权限是否符合注解规则 * * @throws \core\exception\handler\ForbiddenHttpException */ private function validatePermissions(CurrentUser $currentUser, array $permissions): void { foreach ($permissions as $permission) { $this->handleSinglePermission($currentUser, $permission); } } /** * 处理 Permission 注解的权限校验逻辑 * * @param CurrentUser $currentUser 当前用户 * @param Permission $permission 权限注解 * * @throws \core\exception\handler\ForbiddenHttpException */ private function handleSinglePermission( CurrentUser $currentUser, Permission $permission ): void { // 权限码数组 $codes = $permission->getCodes(); // 操作类型 $operation = $permission->getOperation(); // 使用CurrentUser的checkPermission方法进行权限验证 $currentUser->checkPermission($codes, $operation); } }