v1接口基本权限验证

jianminglok · May 23, 2017 · b7199bf · b7199bf
1 parent 7245808
commit b7199bf
Show file tree

Hide file tree

Showing 2 changed files with 57 additions and 8 deletions.
diff --git a/database/seeds/PermissionSeeder.php b/database/seeds/PermissionSeeder.php
@@ -133,5 +133,47 @@ protected function createOwnerPerm()
             'display_name' => '登录',
             'description' => '用户登录权限',
         ]);
+
+        Permission::create([
+            'name' => 'password-update',
+            'display_name' => '修改用户密码',
+            'description' => '用户修改密码权限',
+        ]);
+
+        Permission::create([
+            'name' => 'user-update',
+            'display_name' => '修改用户资料',
+            'description' => '用户修改资料权限',
+        ]);
+
+        Permission::create([
+            'name' => 'user-view',
+            'display_name' => '查看用户资料',
+            'description' => '用户查看资料权限',
+        ]);
+
+        Permission::create([
+            'name' => 'user-follow',
+            'display_name' => '关注用户',
+            'description' => '用户关注权限',
+        ]);
+
+        Permission::create([
+            'name' => 'storage-create',
+            'display_name' => '上传附件',
+            'description' => '用户上传附件权限',
+        ]);
+
+        Permission::create([
+            'name' => 'feedback',
+            'display_name' => '意见反馈',
+            'description' => '用户意见反馈权限',
+        ]);
+
+        Permission::create([
+            'name' => 'conversations',
+            'display_name' => '系统会话',
+            'description' => '用户获取系统会话权限',
+        ]);
     }
 }
diff --git a/routes/api_v1.php b/routes/api_v1.php
@@ -46,20 +46,25 @@
     Route::patch('/', 'UserController@profile')
         ->middleware(Middleware\ChangeUserAvatar::class)
         ->middleware(Middleware\ChangeUserCover::class)
-        ->middleware(Middleware\ChangeUsername::class);
+        ->middleware(Middleware\ChangeUsername::class)
+        ->middleware('role-permissions:user-update,你没有修改资料的权限');
     // 修改用户密码
     Route::patch('/password', 'UserController@resetPassword') // 设置控制器
-        ->middleware(Middleware\VerifyPassword::class); // 验证用户密码是否正确
+        ->middleware(Middleware\VerifyPassword::class) // 验证用户密码是否正确
+        ->middleware('role-permissions:password-update,你没有修改用户密码的权限');
     // 获取用户信息
-    Route::post('/', 'UserController@get');
+    Route::post('/', 'UserController@get')
+        ->middleware('role-permissions:user-view,你没有查看用户信息的权限');
 
     // 关注操作相关
     Route::post('/follow', 'FollowController@doFollow')
         ->middleware(Middleware\CheckUserExsistedByUserId::class)
-        ->middleware(Middleware\CheckIsFollow::class);
+        ->middleware(Middleware\CheckIsFollow::class)
+        ->middleware('role-permissions:user-follow,你没有关注用户的权限');
     Route::delete('/unFollow', 'FollowController@doUnFollow')
         ->middleware(Middleware\CheckUserExsistedByUserId::class)
-        ->middleware(Middleware\CheckIsFollowing::class);
+        ->middleware(Middleware\CheckIsFollowing::class)
+        ->middleware('role-permissions:user-follow,你没有关注用户的权限');
 
     //查看指定用户关注状态
     Route::get('/followstatus', 'FollowController@getFollowStatus');
@@ -105,7 +110,7 @@
     // local storage api.
     Route::post('/task/{storage_task_id}', 'StorageController@upload')
         ->name('storage/upload');
-});
+})->middleware('role-permissions:storage-create,你没有上传附件的权限');
 
 //系统及配置相关
 Route::group([
@@ -114,9 +119,11 @@
 ], function () {
     //意见反馈
     Route::post('/feedback', 'SystemController@createFeedback')
-    ->middleware(Middleware\CheckFeedbackContentExisted::class);
+    ->middleware(Middleware\CheckFeedbackContentExisted::class)
+    ->middleware('role-permissions:feedback,你没有意见反馈的权限');
     //获取系统会话列表
-    Route::get('/conversations', 'SystemController@getConversations');
+    Route::get('/conversations', 'SystemController@getConversations')
+    ->middleware('role-permissions:conversations,你没有获取系统会话的权限');
 });
 //获取扩展包安装状态
 Route::get('/system/component/status', 'SystemController@getComponentStatus');