48 lines
1.8 KiB
PHP
48 lines
1.8 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use App\Utilities\SidebarPermissions;
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
|
|
class EnsureLimitedDingTalkPageAccess
|
|
{
|
|
public function handle(Request $request, Closure $next): mixed
|
|
{
|
|
$user = $request->user();
|
|
$route = $request->route();
|
|
if (! $user || ! $route?->hasParameter('company_id') || ! SidebarPermissions::hasLimitedDingTalkAccess($user)) {
|
|
return $next($request);
|
|
}
|
|
|
|
// Keep the application entrance, sign-out and existing self-profile checks.
|
|
if ($route->named('dashboard', 'logout', 'profile.edit', 'profile.update')) {
|
|
return $next($request);
|
|
}
|
|
|
|
$allowed = SidebarPermissions::allowedKeys($user);
|
|
$key = $route->parameter('section').'/'.$route->parameter('page');
|
|
if (in_array($key, $allowed, true)) {
|
|
return $next($request);
|
|
}
|
|
|
|
// The section and quote group are navigation containers for the three pages.
|
|
if ($route->named('business.pages.show') && $route->parameter('section') === 'courier-payables'
|
|
&& in_array($route->parameter('page'), [null, 'courier-quote'], true)) {
|
|
return $next($request);
|
|
}
|
|
|
|
// Dedicated detail, file and action routes declare their owning business page.
|
|
foreach ($route->gatherMiddleware() as $middleware) {
|
|
if (is_string($middleware) && str_starts_with($middleware, 'business.page:')
|
|
&& in_array(str_replace(',', '/', substr($middleware, strlen('business.page:'))), $allowed, true)) {
|
|
return $next($request);
|
|
}
|
|
}
|
|
|
|
// Also deny legacy exports/previews that do not declare a page permission.
|
|
abort(403, '当前账号没有该页面权限。');
|
|
}
|
|
}
|