check role

src/PdAuth/Middleware/Authenticate.php

@@ -74,22 +74,22 @@ class Authenticate
         }
 
         //权限检测
-        $path = $request->path();
-        $privileges = config('pdauth.roles_privileges');
-        $user = $request->user();
-        $match = [];
-        foreach ($user['roles'] as $role) {
-            if (array_key_exists($role, $privileges)) {
-                //如果设置了 * ,则跳过权限检测
-                if (is_string($privileges[$role]) && $privileges[$role] == '*') {
-                    return $next($request);
-                }
-                if (!is_array($privileges[$role])) {
-                    throw new \Exception('pdauth 配置错误！');
-                }
-                $match = array_merge($match, $privileges[$role]);
-            }
-        }
+//        $path = $request->path();
+//        $privileges = config('pdauth.roles_privileges');
+//        $user = $request->user();
+//        $match = [];
+//        foreach ($user['roles'] as $role) {
+//            if (array_key_exists($role, $privileges)) {
+//                //如果设置了 * ,则跳过权限检测
+//                if (is_string($privileges[$role]) && $privileges[$role] == '*') {
+//                    return $next($request);
+//                }
+//                if (!is_array($privileges[$role])) {
+//                    throw new \Exception('pdauth 配置错误！');
+//                }
+//                $match = array_merge($match, $privileges[$role]);
+//            }
+//        }
 
         if (in_array($path, $match)) {
             return $next($request);

src/PdAuth/Middleware/CheckRole.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace PdAuth\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+
+class CheckRole
+{
+
+    public function handle(Request $request, Closure $next)
+    {
+        $uses = $request->route()[1]['uses'];
+        list($controller, $action) = explode('@', $uses);
+        $roles = $controller::Privileges;
+
+        if (empty($roles) || empty($roles[$action])) {
+            api_abort(403, '未定义权限');
+        }
+
+        $user = $request->user();
+
+        if (!$user->hasRoles($roles[$action])) {
+            api_abort(403, '无权访问');
+        }
+
+        return $next($request);
+    }
+
+}