Api.php 9.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330
  1. <?php
  2. namespace app\common\controller;
  3. use app\common\library\Auth;
  4. use think\Config;
  5. use think\exception\HttpResponseException;
  6. use think\exception\ValidateException;
  7. use think\Hook;
  8. use think\Lang;
  9. use think\Loader;
  10. use think\Request;
  11. use think\Response;
  12. use think\Route;
  13. use think\Validate;
  14. /**
  15. * API控制器基类
  16. */
  17. class Api
  18. {
  19. /**
  20. * @var Request Request 实例
  21. */
  22. protected $request;
  23. /**
  24. * @var bool 验证失败是否抛出异常
  25. */
  26. protected $failException = false;
  27. /**
  28. * @var bool 是否批量验证
  29. */
  30. protected $batchValidate = false;
  31. /**
  32. * @var array 前置操作方法列表
  33. */
  34. protected $beforeActionList = [];
  35. /**
  36. * 无需登录的方法,同时也就不需要鉴权了
  37. * @var array
  38. */
  39. protected $noNeedLogin = [];
  40. /**
  41. * 无需鉴权的方法,但需要登录
  42. * @var array
  43. */
  44. protected $noNeedRight = [];
  45. /**
  46. * 权限Auth
  47. * @var Auth
  48. */
  49. protected $auth = null;
  50. /**
  51. * 默认响应输出类型,支持json/xml
  52. * @var string
  53. */
  54. protected $responseType = 'json';
  55. /**
  56. * 构造方法
  57. * @access public
  58. * @param Request $request Request 对象
  59. */
  60. public function __construct(Request $request = null)
  61. {
  62. $this->request = is_null($request) ? Request::instance() : $request;
  63. // 控制器初始化
  64. $this->_initialize();
  65. // 前置操作方法
  66. if ($this->beforeActionList) {
  67. foreach ($this->beforeActionList as $method => $options) {
  68. is_numeric($method) ?
  69. $this->beforeAction($options) :
  70. $this->beforeAction($method, $options);
  71. }
  72. }
  73. }
  74. /**
  75. * 初始化操作
  76. * @access protected
  77. */
  78. protected function _initialize()
  79. {
  80. //跨域请求检测
  81. check_cors_request();
  82. // 检测IP是否允许
  83. check_ip_allowed();
  84. //移除HTML标签
  85. $this->request->filter('trim,strip_tags,htmlspecialchars');
  86. $this->auth = Auth::instance();
  87. $modulename = $this->request->module();
  88. $controllername = Loader::parseName($this->request->controller());
  89. $actionname = strtolower($this->request->action());
  90. // token
  91. $token = $this->request->server('HTTP_TOKEN', $this->request->request('token', \think\Cookie::get('token')));
  92. $path = str_replace('.', '/', $controllername) . '/' . $actionname;
  93. // 设置当前请求的URI
  94. $this->auth->setRequestUri($path);
  95. // 检测是否需要验证登录
  96. if (!$this->auth->match($this->noNeedLogin)) {
  97. //初始化
  98. $this->auth->init($token);
  99. //检测是否登录
  100. if (!$this->auth->isLogin()) {
  101. $this->error(__('Please login first'), null, 401);
  102. }
  103. // 判断是否需要验证权限
  104. if (!$this->auth->match($this->noNeedRight)) {
  105. // 判断控制器和方法判断是否有对应权限
  106. if (!$this->auth->check($path)) {
  107. $this->error(__('You have no permission'), null, 403);
  108. }
  109. }
  110. } else {
  111. // 如果有传递token才验证是否登录状态
  112. if ($token) {
  113. $this->auth->init($token);
  114. }
  115. }
  116. $upload = \app\common\model\Config::upload();
  117. // 上传信息配置后
  118. Hook::listen("upload_config_init", $upload);
  119. Config::set('upload', array_merge(Config::get('upload'), $upload));
  120. // 加载当前控制器语言包
  121. $this->loadlang($controllername);
  122. }
  123. /**
  124. * 加载语言文件
  125. * @param string $name
  126. */
  127. protected function loadlang($name)
  128. {
  129. $name = Loader::parseName($name);
  130. $name = preg_match("/^([a-zA-Z0-9_\.\/]+)\$/i", $name) ? $name : 'index';
  131. $lang = $this->request->langset();
  132. $lang = preg_match("/^([a-zA-Z\-_]{2,10})\$/i", $lang) ? $lang : 'zh-cn';
  133. Lang::load(APP_PATH . $this->request->module() . '/lang/' . $lang . '/' . str_replace('.', '/', $name) . '.php');
  134. }
  135. /**
  136. * 操作成功返回的数据
  137. * @param string $msg 提示信息
  138. * @param mixed $data 要返回的数据
  139. * @param int $code 错误码,默认为1
  140. * @param string $type 输出类型
  141. * @param array $header 发送的 Header 信息
  142. */
  143. protected function success($msg = '', $data = null, $code = 1, $type = null, array $header = [])
  144. {
  145. $this->result($msg, $data, $code, $type, $header);
  146. }
  147. /**
  148. * 操作失败返回的数据
  149. * @param string $msg 提示信息
  150. * @param mixed $data 要返回的数据
  151. * @param int $code 错误码,默认为0
  152. * @param string $type 输出类型
  153. * @param array $header 发送的 Header 信息
  154. */
  155. protected function error($msg = '', $data = null, $code = 0, $type = null, array $header = [])
  156. {
  157. $this->result($msg, $data, $code, $type, $header);
  158. }
  159. /**
  160. * 返回封装后的 API 数据到客户端
  161. * @access protected
  162. * @param mixed $msg 提示信息
  163. * @param mixed $data 要返回的数据
  164. * @param int $code 错误码,默认为0
  165. * @param string $type 输出类型,支持json/xml/jsonp
  166. * @param array $header 发送的 Header 信息
  167. * @return void
  168. * @throws HttpResponseException
  169. */
  170. protected function result($msg, $data = null, $code = 0, $type = null, array $header = [])
  171. {
  172. $result = [
  173. 'code' => $code,
  174. 'msg' => $msg,
  175. 'time' => Request::instance()->server('REQUEST_TIME'),
  176. 'data' => $data,
  177. ];
  178. // 如果未设置类型则自动判断
  179. $type = $type ? $type : ($this->request->param(config('var_jsonp_handler')) ? 'jsonp' : $this->responseType);
  180. if (isset($header['statuscode'])) {
  181. $code = $header['statuscode'];
  182. unset($header['statuscode']);
  183. } else {
  184. //未设置状态码,根据code值判断
  185. $code = $code >= 1000 || $code < 200 ? 200 : $code;
  186. }
  187. $response = Response::create($result, $type, $code)->header($header);
  188. throw new HttpResponseException($response);
  189. }
  190. /**
  191. * 前置操作
  192. * @access protected
  193. * @param string $method 前置操作方法名
  194. * @param array $options 调用参数 ['only'=>[...]] 或者 ['except'=>[...]]
  195. * @return void
  196. */
  197. protected function beforeAction($method, $options = [])
  198. {
  199. if (isset($options['only'])) {
  200. if (is_string($options['only'])) {
  201. $options['only'] = explode(',', $options['only']);
  202. }
  203. if (!in_array($this->request->action(), $options['only'])) {
  204. return;
  205. }
  206. } elseif (isset($options['except'])) {
  207. if (is_string($options['except'])) {
  208. $options['except'] = explode(',', $options['except']);
  209. }
  210. if (in_array($this->request->action(), $options['except'])) {
  211. return;
  212. }
  213. }
  214. call_user_func([$this, $method]);
  215. }
  216. /**
  217. * 设置验证失败后是否抛出异常
  218. * @access protected
  219. * @param bool $fail 是否抛出异常
  220. * @return $this
  221. */
  222. protected function validateFailException($fail = true)
  223. {
  224. $this->failException = $fail;
  225. return $this;
  226. }
  227. /**
  228. * 验证数据
  229. * @access protected
  230. * @param array $data 数据
  231. * @param string|array $validate 验证器名或者验证规则数组
  232. * @param array $message 提示信息
  233. * @param bool $batch 是否批量验证
  234. * @param mixed $callback 回调方法(闭包)
  235. * @return array|string|true
  236. * @throws ValidateException
  237. */
  238. protected function validate($data, $validate, $message = [], $batch = false, $callback = null)
  239. {
  240. if (is_array($validate)) {
  241. $v = Loader::validate();
  242. $v->rule($validate);
  243. } else {
  244. // 支持场景
  245. if (strpos($validate, '.')) {
  246. list($validate, $scene) = explode('.', $validate);
  247. }
  248. $v = Loader::validate($validate);
  249. !empty($scene) && $v->scene($scene);
  250. }
  251. // 批量验证
  252. if ($batch || $this->batchValidate) {
  253. $v->batch(true);
  254. }
  255. // 设置错误信息
  256. if (is_array($message)) {
  257. $v->message($message);
  258. }
  259. // 使用回调验证
  260. if ($callback && is_callable($callback)) {
  261. call_user_func_array($callback, [$v, &$data]);
  262. }
  263. if (!$v->check($data)) {
  264. if ($this->failException) {
  265. throw new ValidateException($v->getError());
  266. }
  267. return $v->getError();
  268. }
  269. return true;
  270. }
  271. /**
  272. * 刷新Token
  273. */
  274. protected function token()
  275. {
  276. $token = $this->request->param('__token__');
  277. //验证Token
  278. if (!Validate::make()->check(['__token__' => $token], ['__token__' => 'require|token'])) {
  279. $this->error(__('Token verification error'), ['__token__' => $this->request->token()]);
  280. }
  281. //刷新Token
  282. $this->request->token();
  283. }
  284. }