Laravel Sentinel — 路由保護 Middleware 調查

// 傳統做法（TelescopeServiceProvider 等）
Gate::before(function ($user) {
    return $user->isAdmin() ? true : null;
});

composer require laravel/sentinel

// src/Drivers/Laravel.php
public function authorize(Request $request): bool
{
    if (! $this->app()->environment('local')) {
        return true; // local 以外一律允許
    }

    // 對透過 tunnel 服務的存取警告
    if ($this->isPrivateIp($request->ip())
        && ! $request->isFromTrustedProxy()
        && Str::endsWith($request->host(), ['.sharedwithexpose.com', '.ngrok-free.app', '.ngrok.io'])) {
        throw new RuntimeException(
            'Unable to access "..." using "local" environment, ...'
        );
    }

    // Docker 本機環境允許
    if ($this->isRunningOnDockerLocally($request)) {
        return true;
    }

    // 檢查透過反向代理的存取
    return $this->authorizeAccessingViaReverseProxies($request);
}

// src/Drivers/Driver.php
protected function isRunningOnDockerLocally(Request $request): bool
{
    return $request->server->get('REMOTE_ADDR') === '127.0.0.1'
        && file_exists(base_path('.dockerenv'));
}

use Laravel\Sentinel\Http\Middleware\SentinelMiddleware;

Route::middleware(SentinelMiddleware::class)->group(function () {
    Route::get('/telescope', function () { /* ... */ });
    Route::get('/horizon', function () { /* ... */ });
    Route::get('/pulse', function () { /* ... */ });
});

Route::middleware([SentinelMiddleware::class . ':custom-driver'])->group(function () {
    // 由自訂 driver 進行授權
});

// src/Http/Middleware/SentinelMiddleware.php
public function handle(Request $request, Closure $next, ?string $driver = null)
{
    abort_unless(Sentinel::driverOrFallback($driver)->authorize($request), 401);

    return $next($request);
}

use Laravel\Sentinel\Sentinel;
use Laravel\Sentinel\Drivers\Driver;
use Illuminate\Http\Request;

Sentinel::extend('admin-only', function ($app) {
    return new class extends Driver {
        public function authorize(Request $request): bool
        {
            // 只允許已認證且擁有 admin 角色的使用者
            $user = $request->user();

            return $user !== null && $user->hasRole('admin');
        }
    };
});

public function authorize(Request $request): bool
{
    // 正式環境僅允許私人 IP
    if ($this->app()->environment('production')) {
        return $this->isPrivateIp($request->ip());
    }

    // 本機僅允許 Docker 或直接存取
    return $this->isRunningOnDockerLocally($request)
        || $this->authorizeAccessingViaReverseProxies($request);
}

// src/SentinelManager.php
class SentinelManager extends Manager
{
    protected function createLaravelDriver()
    {
        return new Laravel(fn () => $this->getContainer());
    }

    public function getDefaultDriver()
    {
        return 'laravel';
    }

    public function driverOrFallback(?string $driver)
    {
        return rescue(
            fn () => $this->driver($driver),
            value(fn () => $this->driver()),
            false  // 不記錄到 log
        );
    }
}

// src/SentinelServiceProvider.php
public function register(): void
{
    $this->app->scoped(SentinelManager::class, fn ($app) => new SentinelManager($app));
}