Laravel Sentinel — 路由保护中间件调查

// 传统做法(TelescopeServiceProvider 等)
Gate::before(function ($user) {
    return $user->isAdmin() ? true : null;
});

composer require laravel/sentinel

// src/Drivers/Laravel.php
public function authorize(Request $request): bool
{
    if (! $this->app()->environment('local')) {
        return true; // 非 local 一律放行
    }

    // 通过隧道服务访问时给出警告
    if ($this->isPrivateIp($request->ip())
        && ! $request->isFromTrustedProxy()
        && Str::endsWith($request->host(), ['.sharedwithexpose.com', '.ngrok-free.app', '.ngrok.io'])) {
        throw new RuntimeException(
            'Unable to access "..." using "local" environment, ...'
        );
    }

    // Docker 本地环境放行
    if ($this->isRunningOnDockerLocally($request)) {
        return true;
    }

    // 检查是否经反向代理访问
    return $this->authorizeAccessingViaReverseProxies($request);
}

// src/Drivers/Driver.php
protected function isRunningOnDockerLocally(Request $request): bool
{
    return $request->server->get('REMOTE_ADDR') === '127.0.0.1'
        && file_exists(base_path('.dockerenv'));
}

use Laravel\Sentinel\Http\Middleware\SentinelMiddleware;

Route::middleware(SentinelMiddleware::class)->group(function () {
    Route::get('/telescope', function () { /* ... */ });
    Route::get('/horizon', function () { /* ... */ });
    Route::get('/pulse', function () { /* ... */ });
});

Route::middleware([SentinelMiddleware::class . ':custom-driver'])->group(function () {
    // 使用自定义驱动做授权
});

// src/Http/Middleware/SentinelMiddleware.php
public function handle(Request $request, Closure $next, ?string $driver = null)
{
    abort_unless(Sentinel::driverOrFallback($driver)->authorize($request), 401);

    return $next($request);
}

use Laravel\Sentinel\Sentinel;
use Laravel\Sentinel\Drivers\Driver;
use Illuminate\Http\Request;

Sentinel::extend('admin-only', function ($app) {
    return new class extends Driver {
        public function authorize(Request $request): bool
        {
            // 只允许已认证且拥有 admin 角色的用户
            $user = $request->user();

            return $user !== null && $user->hasRole('admin');
        }
    };
});

public function authorize(Request $request): bool
{
    // 生产环境只允许来自私有 IP 的请求
    if ($this->app()->environment('production')) {
        return $this->isPrivateIp($request->ip());
    }

    // 本地只允许 Docker 或直接访问
    return $this->isRunningOnDockerLocally($request)
        || $this->authorizeAccessingViaReverseProxies($request);
}

// src/SentinelManager.php
class SentinelManager extends Manager
{
    protected function createLaravelDriver()
    {
        return new Laravel(fn () => $this->getContainer());
    }

    public function getDefaultDriver()
    {
        return 'laravel';
    }

    public function driverOrFallback(?string $driver)
    {
        return rescue(
            fn () => $this->driver($driver),
            value(fn () => $this->driver()),
            false  // 不记录日志
        );
    }
}

// src/SentinelServiceProvider.php
public function register(): void
{
    $this->app->scoped(SentinelManager::class, fn ($app) => new SentinelManager($app));
}