api/src/Topxia/Api/ApiAuth.php

这里只显示每个文件的开头 60 行。登录后可以解锁完整代码。

微信扫码关注公众号，代码整理好后第一时间通知你。

<?php

namespace Topxia\Api;

use Biz\Role\Util\PermissionBuilder;
use Biz\User\CurrentUser;
use Topxia\Service\Common\ServiceKernel;
use Symfony\Component\HttpFoundation\Request;

class ApiAuth
{
    private $whilelist;

    public function __construct($whilelist)
    {
        $this->whilelist = $whilelist;
    }

    public function auth(Request $request)
    {
        $token = $request->headers->get('X-Auth-Token');

        if (empty($token)) {
            // 兼容老的协议，即将去除
            $token = $request->headers->get('Auth-Token', '');
        }

        $method = strtolower($request->headers->get('X-Auth-Method'));

        if ($method == 'keysign') {
            $this->setCurrentUser(array(
                'id' => 0,
                'nickname' => '游客',
                'currentIp' => $request->getClientIp(),
                'roles' => array(),
            ));

            $decoded = $this->decodeKeysign($token);
            $this->onlineSample($request, $token, 0);
        } else {
            $whilelist = isset($this->whilelist[$request->getMethod()]) ? $this->whilelist[$request->getMethod()] : array();

            $path = rtrim($request->getPathInfo(), '/');

            $inWhiteList = 0;

            foreach ($whilelist as $pattern) {
                if (preg_match($pattern, $path)) {
                    $inWhiteList = 1;
                    break;
                }
            }

            if (!$inWhiteList && empty($token)) {
                throw new \RuntimeException('API Token不存在！', 4);
            }

            $token = $this->getUserService()->getToken('mobile_login', $token);

            if (!$inWhiteList && empty($token['userId'])) {