liche/market/hooks/ApiAuthHook.php

<?php

class ApiAuthHook
{
    // CI instance
    private $CI;
    // 需要加入钩子函数保护的路由
    private $route;
    private $auth;//验证身份，不需要验访问权限
    private $route_un;//不需要验证token

    public function __construct()
    {
        $this->CI = &get_instance();
        // 保护路由为 /api/* 或者 /Api/*
        $this->route = '/^api/i';
        $this->auth = ',api/auth';
        $this->route_un = ['api/captcha', 'api/login', 'api/login/code', 'api/login/forget', 'api/upload'];
    }

    /**
     * 钩子主函数
     */
    public function index()
    {
        $this->CI->load->helper('url');
        // $route 正则匹配是否符合 /api/* 或者 /Api/*
        $uri_string = uri_string();
        if (preg_match($this->route, $uri_string)) {
            if (!in_array($uri_string, $this->route_un)) {
                // 获取整个 request headers
                $headers = $this->CI->input->request_headers();
                // headers 中是否存在 Authorization
                if ($this->tokenIsExist($headers)) {
                    $userId = $this->validateToken($headers['Authorization']);
                    $this->set_session($userId);
                } else {
                    $this->httpBadResponse(
                        'The request lacks the authorization token'
                    );
                }
            }
        }
    }

    private function set_session($userId)
    {
        $_SESSION['userId'] = intval($userId);
        $this->CI->load->model('market/Market_sys_admin_model');
        $re_admin = $this->CI->Market_sys_admin_model->get(['userId' => $userId, 'status' => 0]);
        if ($re_admin) {
            $_SESSION = $re_admin;
        }
        $route = uri_string();
        if (strstr(',' . $route, $this->auth)) {
            return;
        }
        $request = $this->CI->input->method();
        $authorityAry = explode('/', $route); //api/system/user/
        $authority_set = '';
        if ($request == 'post') {
            $authority_set = 'save';
        } else if ($request == 'put') {
            $authority_set = 'update';
        } else if ($request == 'delete') {
            $authority_set = 'remove';
        } else if (strstr($route, '/page')) {//列表搜索权限
            $authority_set = 'list';
        }
        $menuIds = '';
        if ($re_admin['roleId']) {//查找角色
            $this->CI->load->model('market/Market_sys_role_model');
            $re_role = $this->CI->Market_sys_role_model->get(['roleId' => $re_admin['roleId'], 'status' => 0]);
            if ($re_role) {
                $_SESSION['roleCode'] = $re_role['roleCode'];//角色标识
                $menuIds = $re_role['menuIds'];
                if ($re_role['roleCode'] == 'brand') {//品牌角色
                    $_SESSION['brandName'] = $re_role['roleName'];
                }
            }
        }
        if ($authority_set) {
            $show = true;
            $authority = $authorityAry[1] . ':' . $authorityAry[2] . ':' . $authority_set;//system:user:save
            if ($menuIds) {
                if (strstr($route, '/roleMenu')) {//角色分配权限
                    $authority = 'system:role:' . $authority_set;
                } else if (strstr($route, '/dictionaryData')) {//字典项权限
                    $authority = 'system:dictionary:' . $authority_set;
                } else if (strstr($route, '/institution/organizationUser')) {//机构用户权限
                    $authority = 'institution:organization:' . $authority_set;
                } else if (strstr($route, '/institution/teamUser')) {//团队用户权限
                    $authority = 'institution:team:' . $authority_set;
                } else if (strstr($route, '/sylive/groupsUser')) {//分组用户权限
                    $authority = 'sylive:groups:' . $authority_set;
                }
                $this->CI->load->model('market/Market_sys_menu_model');
                $re_menu = $this->CI->Market_sys_menu_model->get(["menuId in({$menuIds})" => null, 'status' => 0
                    , 'authority' => $authority]);
                if ($re_menu) {
                    $show = false;
                    if ($re_menu['title'] == '登录日志' || $re_menu['title'] == '操作日志') {
                    } else {
                        $_SESSION['operation_description'] = $re_menu['title'];//操作功能
                        $re_menu2 = $this->CI->Market_sys_menu_model->get(["menuId" => $re_menu['parentId'], 'status' => 0]);
                        $_SESSION['operation_module'] = $re_menu2['title'] ? $re_menu2['title'] : $re_menu['title'];//操作模块
                    }
                }
            }
            $show && $this->return_json('没有访问权限', 403);
        }
    }

    public function return_json($message = '', $code = 1)
    {
        header('Content-Type:application/json; charset=utf-8');
        echo json_encode(['code' => $code, 'message' => $message], JSON_UNESCAPED_UNICODE);
        exit();
    }

    /**
     * 判断 headers 中是否含有 Authorization 字段
     *
     * @param type $headers
     * @return type boolean
     */
    public function tokenIsExist($headers = array())
    {
        return (
            array_key_exists('Authorization', $headers) &&
            !empty($headers['Authorization'])
        );
    }

    /**
     * Authorization 中是否有 json web token 值
     *
     * @param type $headers
     * @return type
     */
    public function jwtIsExist($headers)
    {
        list($jwt) = sscanf($headers['Authorization'], 'market.com %s');
        return $jwt;
    }

    /**
     * 校验 json web token 的合法性
     *
     * @param type $jwt
     * @return boolean
     */
    public function validateToken($jwt)
    {
        if ($jwt) {
            try {
                $token = Authorization::validateToken($jwt);
                return $token;
            } catch (Exception $ex) {
                $this->httpUnauthorizedResponse($ex->getMessage());
            }
        } else {
            $this->httpBadResponse(
                'the token is unauthorized'
            );
        }
    }

    /**
     * http code 400 response
     *
     * @param type $msg
     */
    public function httpBadResponse($msg = NULL)
    {
        set_status_header(400, $msg);
        exit(1);
    }

    /**
     * http code 401 response
     *
     * @param type $msg
     */
    public function httpUnauthorizedResponse($msg = NULL)
    {
        set_status_header(401, $msg);
        exit(1);
    }

}