初始化

缺陷：主题配色需要优化整体的同风格

app/Http/Middleware/ApiAuthMiddleware.php

@@ -0,0 +1,68 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Enum\ErrorEnum;
+use App\Service\common\JWTService;
+use App\Service\PermissionService;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * 登录态 + 接口级权限
+ *
+ * 原来鉴权只发生在 BaseService 的构造函数里，任何不经过 BaseService 的方法就是裸奔的；
+ * 而 autoRouteRegister 会把继承来的方法也注册成路由，等于白送一批未受保护的入口。
+ * 这里把校验前移到中间件，路由一进来就拦，BaseService 里那层保留做兜底。
+ */
+class ApiAuthMiddleware
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $path = $this->normalizePath($request->path());
+        if (in_array($path, (array) config('nl.api.white_list', []), true)) {
+            return $next($request);
+        }
+
+        try {
+            $userInfo = JWTService::getInstance()->getToken()->getUserInfo();
+        } catch (\Throwable $e) {
+            return $this->deny($e->getMessage() ?: '请先登录', ErrorEnum::NOT_AUTH);
+        }
+        if (empty($userInfo['id'])) {
+            return $this->deny('请先登录', ErrorEnum::NOT_AUTH);
+        }
+
+        $roleId = (int) ($userInfo['role_id'] ?? 0);
+        if (!PermissionService::getInstance()->allows($roleId, $path)) {
+            return $this->deny('没有该操作的权限，请联系管理员', ErrorEnum::NOT_PERMISSION);
+        }
+
+        // 后续无需再解 token 的地方可以直接取
+        $request->attributes->set('nl_user', $userInfo);
+        return $next($request);
+    }
+
+    private function normalizePath(string $path): string
+    {
+        $path = trim($path, '/');
+        if (str_starts_with($path, 'api/')) {
+            $path = substr($path, 4);
+        }
+        return trim($path, '/');
+    }
+
+    /**
+     * HTTP 恒 200、业务码表达失败，与前端 request.ts 拦截器的约定一致
+     */
+    private function deny(string $message, ErrorEnum $code): Response
+    {
+        return response()->json([
+            'code' => $code->value,
+            'message' => $message,
+            'result' => [],
+            'type' => 'error',
+        ]);
+    }
+}

app/Http/Middleware/ApiOpLogMiddleware.php

@@ -145,6 +145,8 @@ class ApiOpLogMiddleware
         $maskKeys = [
             'password', 'old_password', 'new_password', 'confirm_password',
             'access_key', 'secret_key', 'api_key', 'token',
+            // 小程序登录凭证与商户密钥同样不能落进日志表
+            'code', 'phone_code', 'session_key', 'app_secret', 'mch_key', 'mch_private_key',
         ];
         foreach ($maskKeys as $k) {
             if (array_key_exists($k, $all) && $all[$k] !== '' && $all[$k] !== null) {

app/Http/Middleware/WxAuthMiddleware.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Enum\ErrorEnum;
+use App\Service\wx\WxTokenService;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * 小程序登录态
+ *
+ * 老项目的 AuthMiddleware 是先 $next($request) 跑完控制器、再检查 token，
+ * 而且只判空不验签——等于没有鉴权。这里在进控制器之前就拦。
+ */
+class WxAuthMiddleware
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $user = WxTokenService::getInstance()->resolveUser($request->bearerToken());
+        if (empty($user)) {
+            return response()->json([
+                'code' => ErrorEnum::NOT_AUTH->value,
+                'message' => '请先登录',
+                'result' => [],
+                'type' => 'error',
+            ]);
+        }
+        if ((int) ($user['status'] ?? 0) === 1) {
+            return response()->json([
+                'code' => ErrorEnum::NOT_AUTH->value,
+                'message' => '账号已被停用，请联系客服',
+                'result' => [],
+                'type' => 'error',
+            ]);
+        }
+        $request->attributes->set('wx_user', $user);
+        return $next($request);
+    }
+}