Laravel 多角色多分区登录认证的优化实践

public function store(LoginRequest $request)
{
    $credentials = $request->validate([
        'email' => ['required', 'email'],
        'password' => ['required'],
    ]);

    // 为每个分区和角色组合进行认证尝试
    if (Auth::attempt(['email' => $request->email, 'password' => $request->password, 'is_admin' => 1, 'section_id' => 1])) {
        $request->session()->regenerate();
        return redirect()->intended('dashboard/section1/admin');
    } elseif (Auth::attempt(['email' => $request->email, 'password' => $request->password, 'is_admin' => 0, 'section_id' => 1])) {
        return redirect()->intended('dashboard/section1/user');
    }
    // ... 更多 elseif 条件 ...
    elseif (Auth::attempt(['email' => $request->email, 'password' => $request->password, 'is_admin' => 0, 'section_id' => 3])) {
        return redirect()->intended('dashboard/section3/user');
    } else {
        return back()->withErrors([
            'email' => 'The provided credentials do not match our records.',
        ]);
    }
}

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use App\Http\Requests\LoginRequest; // 假设您有自定义的登录请求验证

class AuthenticatedSessionController extends Controller
{
    /**
     * 显示登录表单。
     */
    public function create()
    {
        return view('auth.login');
    }

    /**
     * 处理传入的认证请求。
     */
    public function store(LoginRequest $request)
    {
        // 验证用户提供的凭据
        $credentials = $request->validate([
            'email' => ['required', 'email'],
            'password' => ['required'],
        ]);

        // 尝试认证用户，不带额外的角色或分区条件
        if (Auth::attempt($credentials)) {
            // 认证成功，重新生成会话ID以防止会话固定攻击
            $request->session()->regenerate();

            // 获取当前认证用户
            $user = Auth::user();

            // 根据用户的 section_id 和 is_admin 属性动态构建重定向URL
            // 假设 section_id 存储在用户模型中，is_admin 是一个布尔值
            $roleSegment = $user->is_admin ? 'admin' : 'user';
            $redirectPath = 'dashboard/section' . $user->section_id . '/' . $roleSegment;

            // 重定向到动态生成的路径，或用户之前尝试访问的路径
            return redirect()->intended($redirectPath);
        }

        // 认证失败，返回上一页并附带错误信息
        return back()->withErrors([
            'email' => '提供的凭据与我们的记录不匹配。',
        ])->onlyInput('email'); // 仅保留 email 输入，避免密码回显
    }
}

use App\Http\Controllers\Auth\AuthenticatedSessionController;
use Illuminate\Support\Facades\Route;

Route::get('/login', [AuthenticatedSessionController::class, 'create'])
    ->middleware('guest')
    ->name('login');

Route::post('/login', [AuthenticatedSessionController::class, 'store'])
    ->middleware('guest')
    ->name('login.user'); // 可以考虑更通用的名称，如 'login.attempt'

// app/Models/User.php
class User extends Authenticatable
{
    // ...
    protected $casts = [
        'email_verified_at' => 'datetime',
        'password' => 'hashed',
        'is_admin' => 'boolean', // 确保 is_admin 被正确转换为布尔值
    ];

    // ...
}

// app/Http/Middleware/CheckUserRoleAndSection.php
namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Symfony\Component\HttpFoundation\Response;

class CheckUserRoleAndSection
{
    public function handle(Request $request, Closure $next, $sectionId, $role)
    {
        if (!Auth::check()) {
            return redirect()->route('login');
        }

        $user = Auth::user();
        $isAdmin = ($role === 'admin');

        if ($user->section_id == $sectionId && $user->is_admin == $isAdmin) {
            return $next($request);
        }

        abort(403, 'Unauthorized access.');
    }
}

// app/Http/Kernel.php 中注册中间件
protected $routeMiddleware = [
    // ...
    'check.role.section' => \App\Http\Middleware\CheckUserRoleAndSection::class,
];

// web.php 路由示例
Route::middleware(['auth', 'check.role.section:1,admin'])->group(function () {
    Route::get('dashboard/section1/admin', function () {
        return 'Welcome, Section 1 Admin!';
    });
});

Route::middleware(['auth', 'check.role.section:1,user'])->group(function () {
    Route::get('dashboard/section1/user', function () {
        return 'Welcome, Section 1 User!';
    });
});