Laravel自定义中间件？中间件如何编写注册？

php artisan make:middleware CheckUserRole

app/Http/Middleware

CheckUserRole.php

handle

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class CheckUserRole
{
    /**
     * 处理传入的请求。
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
     * @return \Symfony\Component\HttpFoundation\Response
     */
    public function handle(Request $request, Closure $next): Response
    {
        // 在请求到达控制器之前，你可以在这里执行一些逻辑
        // 比如，检查用户角色
        if (! $request->user() || ! $request->user()->hasRole('admin')) {
            // 如果条件不满足，可以重定向或者返回错误
            return redirect('home')->with('error', '您没有管理员权限。');
        }

        // 如果一切正常，继续处理请求，传递给下一个中间件或控制器
        return $next($request);
    }
}

handle

$request

$next

return $next($request);

Authenticate

LogRequests

Authenticate

CheckUserRole

LogRequest

Authenticate

CheckUserRole

Kernel.php

// 考虑一个简单的限流中间件，它需要一个计数器
// 为了可测试性，我们可以通过构造函数注入缓存实例
class RateLimitRequests
{
    protected $cache;

    public function __construct(\Illuminate\Contracts\Cache\Repository $cache)
    {
        $this->cache = $cache;
    }

    public function handle(Request $request, Closure $next, $maxAttempts = 60, $decayMinutes = 1)
    {
        $key = $request->ip(); // 或者用户ID

        if ($this->cache->has($key)) {
            $attempts = $this->cache->get($key);
            if ($attempts >= $maxAttempts) {
                // 返回一个429 Too Many Requests响应
                return response('Too Many Requests.', 429)
                       ->header('Retry-After', now()->addMinutes($decayMinutes)->timestamp);
            }
            $this->cache->increment($key);
        } else {
            $this->cache->put($key, 1, now()->addMinutes($decayMinutes));
        }

        return $next($request);
    }
}

app/Http/Kernel.php

$middleware

// app/Http/Kernel.php
protected $middleware = [
    \App\Http\Middleware\TrustProxies::class,
    \Illuminate\Http\Middleware\HandleCors::class, // 比如处理CORS
    \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
    \App\Http\Middleware\SomeGlobalLogger::class, // 你的全局日志中间件
    // ...
];

app/Http/Kernel.php

$middlewareAliases

// app/Http/Kernel.php
protected $middlewareAliases = [
    'auth' => \App\Http\Middleware\Authenticate::class,
    'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
    'role' => \App\Http\Middleware\CheckUserRole::class, // 自定义角色检查中间件
    // ...
];

routes/web.php

routes/api.php

// 针对单个路由
Route::get('/profile', [UserProfileController::class, 'show'])->middleware('auth');

// 针对路由组
Route::middleware(['auth', 'role:admin'])->prefix('admin')->group(function () {
    Route::get('/dashboard', [AdminController::class, 'index']);
    Route::get('/users', [AdminController::class, 'users']);
});

// 甚至可以链式调用
Route::get('/settings', [SettingsController::class, 'index'])
     ->middleware('auth')
     ->middleware('throttle:60,1'); // 结合限流中间件

role:admin

CheckUserRole

handle

admin

web

api

web

api

// app/Http/Kernel.php
protected $middlewareGroups = [
    'web' => [
        \App\Http\Middleware\EncryptCookies::class,
        // ...
        \App\Http\Middleware\EnsureUserHasProfile::class, // 比如，确保用户有完整资料
    ],

    'api' => [
        // ...
    ],

    'management' => [ // 创建一个名为 'management' 的中间件组
        'auth:api', // 使用api认证
        'role:manager', // 确保是经理角色
        \App\Http\Middleware\LogManagementActions::class, // 记录管理操作
    ],
];

Route::group(['middleware' => ['management']], function () {
    Route::post('/manage/products', [ProductManagementController::class, 'store']);
    Route::put('/manage/products/{id}', [ProductManagementController::class, 'update']);
});

management