77 lines
3.0 KiB
PHP
77 lines
3.0 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use App\Services\Auth\SupplierPortalAccess;
|
|
use App\Utilities\SidebarPermissions;
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
|
|
class EnsureLimitedDingTalkPageAccess
|
|
{
|
|
public function handle(Request $request, Closure $next): mixed
|
|
{
|
|
$user = $request->user();
|
|
$route = $request->route();
|
|
if (! $user || ! SidebarPermissions::hasLimitedDingTalkAccess($user)) {
|
|
return $next($request);
|
|
}
|
|
|
|
if (SupplierPortalAccess::isSupplierUser($user)) {
|
|
if ($route?->named('logout', 'business.supplier-portal.home')) {
|
|
return $next($request);
|
|
}
|
|
if ($route?->named('dashboard') && $route->hasParameter('company_id')) {
|
|
return redirect()->route('business.supplier-portal.home', [
|
|
'company_id' => $route->parameter('company_id'),
|
|
]);
|
|
}
|
|
if ($route?->named('business.pages.show')
|
|
&& $route->parameter('section') === 'supplier-reconciliation'
|
|
&& $route->parameter('page') === 'supplier-data') {
|
|
return $next($request);
|
|
}
|
|
foreach ($route?->gatherMiddleware() ?? [] as $middleware) {
|
|
if (is_string($middleware) && str_starts_with($middleware, 'business.page:')
|
|
&& str_replace(',', '/', substr($middleware, strlen('business.page:'))) === SupplierPortalAccess::PAGE_KEY) {
|
|
return $next($request);
|
|
}
|
|
}
|
|
|
|
abort(403, '当前账号没有该页面权限。');
|
|
}
|
|
|
|
if (! $route?->hasParameter('company_id')) {
|
|
return $next($request);
|
|
}
|
|
|
|
// Keep the application entrance, sign-out and existing self-profile checks.
|
|
if ($route->named('dashboard', 'logout', 'profile.edit', 'profile.update')) {
|
|
return $next($request);
|
|
}
|
|
|
|
$allowed = SidebarPermissions::allowedKeys($user);
|
|
$key = $route->parameter('section').'/'.$route->parameter('page');
|
|
if (in_array($key, $allowed, true)) {
|
|
return $next($request);
|
|
}
|
|
|
|
// The section and quote group are navigation containers for the three pages.
|
|
if ($route->named('business.pages.show') && $route->parameter('section') === 'courier-payables'
|
|
&& in_array($route->parameter('page'), [null, 'courier-quote'], true)) {
|
|
return $next($request);
|
|
}
|
|
|
|
// Dedicated detail, file and action routes declare their owning business page.
|
|
foreach ($route->gatherMiddleware() as $middleware) {
|
|
if (is_string($middleware) && str_starts_with($middleware, 'business.page:')
|
|
&& in_array(str_replace(',', '/', substr($middleware, strlen('business.page:'))), $allowed, true)) {
|
|
return $next($request);
|
|
}
|
|
}
|
|
|
|
// Also deny legacy exports/previews that do not declare a page permission.
|
|
abort(403, '当前账号没有该页面权限。');
|
|
}
|
|
}
|