File manager - Edit - /home/webapp69.cm.in.th/u69319090028/Shop/app/Middleware/AdminMiddleware.php
Back
<?php /** * AdminMiddleware * Full admin authentication + role check + permission resolution into session context */ require_once __DIR__ . '/../Helpers/Auth.php'; require_once __DIR__ . '/../Helpers/Session.php'; require_once __DIR__ . '/../Helpers/Url.php'; require_once __DIR__ . '/../Models/AdminPermission.php'; require_once __DIR__ . '/../Services/AdminPermissionService.php'; class AdminMiddleware { private static array $adminRoles = [ 'admin', 'operation_admin', 'finance_admin', 'support_admin' ]; public function handle(): void { // 1. Authentication check if (!Auth::check()) { Session::setFlash('danger', 'กรุณาเข้าสู่ระบบก่อนเข้าใช้งาน Admin Portal'); Url::redirect('/login'); } $user = Auth::user(); if (!$user) { Session::setFlash('danger', 'เซสชันหมดอายุ กรุณาเข้าสู่ระบบใหม่'); Url::redirect('/login'); } // 2. Admin role check $roles = Auth::roles(); $isAdmin = false; foreach ($roles as $role) { if (in_array($role, self::$adminRoles, true)) { $isAdmin = true; break; } } if (!$isAdmin) { Session::setFlash('danger', 'คุณไม่มีสิทธิ์เข้าถึง Admin Portal'); Url::redirect('/'); } // 3. Resolve and cache permissions into session $adminId = Auth::id(); if (empty($_SESSION['admin_permissions']) || ($_SESSION['admin_permissions_for'] ?? null) !== $adminId) { $permService = new AdminPermissionService(); $_SESSION['admin_permissions'] = $permService->getEffectivePermissions($adminId); $_SESSION['admin_permissions_for'] = $adminId; } // 4. Inject Super Admin flag for view-level conditionals $_SESSION['is_super_admin'] = !empty($user['is_super_admin']); } /** * Static helper for in-controller permission checks * Aborts with 403 if denied */ public static function requirePermission(string $permissionKey): void { $permissions = $_SESSION['admin_permissions'] ?? []; if (!in_array($permissionKey, $permissions, true)) { http_response_code(403); // Simple 403 response without leaking internals echo '<!DOCTYPE html><html><head><title>403 Forbidden</title></head><body>'; echo '<h2>403 - ไม่มีสิทธิ์ดำเนินการนี้</h2>'; echo '<p>คุณไม่มี Permission: <strong>' . htmlspecialchars($permissionKey) . '</strong></p>'; echo '<a href="/CARGOO/admin">กลับหน้า Admin Dashboard</a></body></html>'; exit; } } /** * Static helper: check permission without aborting (for conditional view rendering) */ public static function can(string $permissionKey): bool { $permissions = $_SESSION['admin_permissions'] ?? []; return in_array($permissionKey, $permissions, true); } /** * Check if current admin is Super Admin */ public static function isSuperAdmin(): bool { return !empty($_SESSION['is_super_admin']); } }
| ver. 1.4 |
Github
|
.
| PHP 7.4.33 | Generation time: 0.23 |
proxy
|
phpinfo
|
Settings