feat: 第一阶段基础框架搭建

后端 (Laravel 10 + Sanctum): - RBAC 四层权限系统 (users→roles→permissions→menus) - 门店隔离中间件 (BelongsToStore Trait + StoreIsolation Middleware) - 操作日志中间件 (自动记录写操作) - 权限检查中间件 (CheckPermission) - 16张数据库表迁移 (系统基础+RBAC+字典+配置) - 11个 Eloquent Model - Auth API (登录/登出/用户信息) - 系统设置模块 CRUD (门店/部门/职务/用户/角色/菜单/权限/字典/日志) - 45条 RESTful API 路由 - InitSeeder 初始数据 (超管/角色/76权限/31菜单) 前端 (Vue 3 + Element Plus + Vite): - Axios 请求封装 + Token 注入 - Pinia 状态管理 (user + permission store) - 动态路由 (服务端菜单→前端路由自动生成) - 后台布局 (侧边栏+顶栏+主内容区) - 登录页 + 仪表盘首页 - 系统设置 7 个 CRUD 页面技术方案文档 (7卷): - 技术总览/数据库设计/API规范/RBAC设计/模块详设/小程序设计/部署方案
2026-03-13 19:52:09 +08:00
commit 11c177a432
144 changed files with 25209 additions and 0 deletions
@@ -0,0 +1,88 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Models\User;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+
+class AuthController extends Controller
+{
+    /**
+     * 登录
+     */
+    public function login(Request $request): JsonResponse
+    {
+        $request->validate([
+            'username' => 'required|string',
+            'password' => 'required|string',
+        ]);
+
+        $user = User::withoutGlobalScope('store')
+            ->where('username', $request->username)
+            ->first();
+
+        if (!$user || !Hash::check($request->password, $user->password)) {
+            return $this->error('用户名或密码错误', 40100, 401);
+        }
+
+        if ($user->status->value !== 1) {
+            return $this->error('账号已被禁用或待审核', 40101, 403);
+        }
+
+        // 清除旧 token
+        $user->tokens()->delete();
+
+        $token = $user->createToken('admin')->plainTextToken;
+
+        $user->update(['last_login_at' => now()]);
+
+        return $this->success([
+            'token' => $token,
+            'user' => [
+                'id' => $user->id,
+                'username' => $user->username,
+                'name' => $user->name,
+                'avatar' => $user->avatar,
+                'store_id' => $user->store_id,
+                'is_super' => $user->is_super,
+            ],
+        ]);
+    }
+
+    /**
+     * 退出登录
+     */
+    public function logout(Request $request): JsonResponse
+    {
+        $request->user()->currentAccessToken()->delete();
+        return $this->success(null, '退出成功');
+    }
+
+    /**
+     * 获取当前用户信息
+     */
+    public function me(Request $request): JsonResponse
+    {
+        $user = $request->user();
+        $user->load(['department', 'position', 'roles']);
+
+        return $this->success([
+            'id' => $user->id,
+            'username' => $user->username,
+            'name' => $user->name,
+            'phone' => $user->phone,
+            'email' => $user->email,
+            'avatar' => $user->avatar,
+            'store_id' => $user->store_id,
+            'is_super' => $user->is_super,
+            'department' => $user->department?->name,
+            'position' => $user->position?->name,
+            'roles' => $user->roles->pluck('name'),
+            'permissions' => $user->getAllPermissionCodes(),
+            'menus' => $user->getMenuTree(),
+        ]);
+    }
+}
@@ -0,0 +1,80 @@
+<?php
+
+namespace App\Http\Controllers\Admin\System;
+
+use App\Http\Controllers\Controller;
+use App\Models\Department;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class DepartmentController extends Controller
+{
+    /**
+     * 部门树
+     */
+    public function index(): JsonResponse
+    {
+        $departments = Department::orderBy('sort')->get()->toArray();
+        $tree = $this->buildTree($departments);
+        return $this->success($tree);
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'parent_id' => 'integer',
+            'name' => 'required|string|max:50',
+            'sort' => 'integer',
+            'status' => 'in:0,1',
+        ]);
+
+        $data['store_id'] = $data['store_id'] ?? auth()->user()->store_id;
+        $department = Department::create($data);
+        return $this->success($department, '创建成功');
+    }
+
+    public function update(Request $request, Department $department): JsonResponse
+    {
+        $data = $request->validate([
+            'parent_id' => 'integer',
+            'name' => 'string|max:50',
+            'sort' => 'integer',
+            'status' => 'in:0,1',
+        ]);
+
+        // 不能设自己为上级
+        if (isset($data['parent_id']) && $data['parent_id'] == $department->id) {
+            return $this->error('不能设置自身为上级部门');
+        }
+
+        $department->update($data);
+        return $this->success($department, '更新成功');
+    }
+
+    public function destroy(Department $department): JsonResponse
+    {
+        if ($department->children()->exists()) {
+            return $this->error('该部门下还有子部门，无法删除');
+        }
+        if ($department->users()->exists()) {
+            return $this->error('该部门下还有员工，无法删除');
+        }
+        $department->delete();
+        return $this->success(null, '删除成功');
+    }
+
+    private function buildTree(array $items, int $parentId = 0): array
+    {
+        $tree = [];
+        foreach ($items as $item) {
+            if ($item['parent_id'] == $parentId) {
+                $children = $this->buildTree($items, $item['id']);
+                if ($children) {
+                    $item['children'] = $children;
+                }
+                $tree[] = $item;
+            }
+        }
+        return $tree;
+    }
+}
@@ -0,0 +1,91 @@
+<?php
+
+namespace App\Http\Controllers\Admin\System;
+
+use App\Http\Controllers\Controller;
+use App\Models\Dictionary;
+use App\Models\DictionaryItem;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class DictionaryController extends Controller
+{
+    public function index(): JsonResponse
+    {
+        $dictionaries = Dictionary::withCount('items')->orderByDesc('id')->get();
+        return $this->success($dictionaries);
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'name' => 'required|string|max:50',
+            'code' => 'required|string|max:50|unique:dictionaries,code',
+            'description' => 'nullable|string|max:255',
+        ]);
+
+        $dict = Dictionary::create($data);
+        return $this->success($dict, '创建成功');
+    }
+
+    /**
+     * 字典项列表
+     */
+    public function items(Dictionary $dictionary): JsonResponse
+    {
+        return $this->success($dictionary->items);
+    }
+
+    /**
+     * 新建字典项
+     */
+    public function storeItem(Request $request, Dictionary $dictionary): JsonResponse
+    {
+        $data = $request->validate([
+            'label' => 'required|string|max:100',
+            'value' => 'required|string|max:100',
+            'sort' => 'integer',
+            'status' => 'in:0,1',
+        ]);
+
+        $data['dictionary_id'] = $dictionary->id;
+        $item = DictionaryItem::create($data);
+        return $this->success($item, '创建成功');
+    }
+
+    /**
+     * 更新字典项
+     */
+    public function updateItem(Request $request, DictionaryItem $item): JsonResponse
+    {
+        $data = $request->validate([
+            'label' => 'string|max:100',
+            'value' => 'string|max:100',
+            'sort' => 'integer',
+            'status' => 'in:0,1',
+        ]);
+
+        $item->update($data);
+        return $this->success($item, '更新成功');
+    }
+
+    /**
+     * 删除字典项
+     */
+    public function destroyItem(DictionaryItem $item): JsonResponse
+    {
+        $item->delete();
+        return $this->success(null, '删除成功');
+    }
+
+    public function destroy(Dictionary $dictionary): JsonResponse
+    {
+        if ($dictionary->is_system) {
+            return $this->error('系统字典不可删除');
+        }
+
+        $dictionary->items()->delete();
+        $dictionary->delete();
+        return $this->success(null, '删除成功');
+    }
+}
@@ -0,0 +1,71 @@
+<?php
+
+namespace App\Http\Controllers\Admin\System;
+
+use App\Http\Controllers\Controller;
+use App\Models\Menu;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class MenuController extends Controller
+{
+    /**
+     * 菜单树
+     */
+    public function index(): JsonResponse
+    {
+        return $this->success(Menu::tree());
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'parent_id' => 'integer',
+            'name' => 'required|string|max:50',
+            'path' => 'nullable|string|max:255',
+            'component' => 'nullable|string|max:255',
+            'icon' => 'nullable|string|max:50',
+            'permission_code' => 'nullable|string|max:100',
+            'type' => 'required|in:1,2,3',
+            'visible' => 'in:0,1',
+            'sort' => 'integer',
+            'status' => 'in:0,1',
+        ]);
+
+        $menu = Menu::create($data);
+        return $this->success($menu, '创建成功');
+    }
+
+    public function update(Request $request, Menu $menu): JsonResponse
+    {
+        $data = $request->validate([
+            'parent_id' => 'integer',
+            'name' => 'string|max:50',
+            'path' => 'nullable|string|max:255',
+            'component' => 'nullable|string|max:255',
+            'icon' => 'nullable|string|max:50',
+            'permission_code' => 'nullable|string|max:100',
+            'type' => 'in:1,2,3',
+            'visible' => 'in:0,1',
+            'sort' => 'integer',
+            'status' => 'in:0,1',
+        ]);
+
+        if (isset($data['parent_id']) && $data['parent_id'] == $menu->id) {
+            return $this->error('不能设置自身为上级菜单');
+        }
+
+        $menu->update($data);
+        return $this->success($menu, '更新成功');
+    }
+
+    public function destroy(Menu $menu): JsonResponse
+    {
+        if ($menu->children()->exists()) {
+            return $this->error('该菜单下还有子菜单，无法删除');
+        }
+
+        $menu->delete();
+        return $this->success(null, '删除成功');
+    }
+}
@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Http\Controllers\Admin\System;
+
+use App\Http\Controllers\Controller;
+use App\Models\OperationLog;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class OperationLogController extends Controller
+{
+    public function index(Request $request): JsonResponse
+    {
+        $query = OperationLog::query();
+
+        $user = auth()->user();
+        if (!$user->is_super) {
+            $query->where('store_id', $user->store_id);
+        }
+
+        if ($request->keyword) {
+            $query->where(function ($q) use ($request) {
+                $q->where('user_name', 'like', "%{$request->keyword}%")
+                  ->orWhere('target', 'like', "%{$request->keyword}%");
+            });
+        }
+        if ($request->module) {
+            $query->where('module', $request->module);
+        }
+        if ($request->start_date && $request->end_date) {
+            $query->whereBetween('created_at', [$request->start_date, $request->end_date . ' 23:59:59']);
+        }
+
+        $logs = $query->orderByDesc('created_at')
+            ->paginate($request->input('page_size', 20));
+
+        return $this->paginate($logs);
+    }
+}
@@ -0,0 +1,62 @@
+<?php
+
+namespace App\Http\Controllers\Admin\System;
+
+use App\Http\Controllers\Controller;
+use App\Models\Permission;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class PermissionController extends Controller
+{
+    /**
+     * 权限树
+     */
+    public function index(): JsonResponse
+    {
+        return $this->success(Permission::tree());
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'parent_id' => 'integer',
+            'name' => 'required|string|max:50',
+            'code' => 'required|string|max:100|unique:permissions,code',
+            'module' => 'nullable|string|max:50',
+            'type' => 'required|in:1,2,3',
+            'description' => 'nullable|string|max:255',
+            'sort' => 'integer',
+        ]);
+
+        $permission = Permission::create($data);
+        return $this->success($permission, '创建成功');
+    }
+
+    public function update(Request $request, Permission $permission): JsonResponse
+    {
+        $data = $request->validate([
+            'parent_id' => 'integer',
+            'name' => 'string|max:50',
+            'code' => 'string|max:100|unique:permissions,code,' . $permission->id,
+            'module' => 'nullable|string|max:50',
+            'type' => 'in:1,2,3',
+            'description' => 'nullable|string|max:255',
+            'sort' => 'integer',
+        ]);
+
+        $permission->update($data);
+        return $this->success($permission, '更新成功');
+    }
+
+    public function destroy(Permission $permission): JsonResponse
+    {
+        if ($permission->children()->exists()) {
+            return $this->error('该权限下有子权限，无法删除');
+        }
+
+        $permission->roles()->detach();
+        $permission->delete();
+        return $this->success(null, '删除成功');
+    }
+}
@@ -0,0 +1,48 @@
+<?php
+
+namespace App\Http\Controllers\Admin\System;
+
+use App\Http\Controllers\Controller;
+use App\Models\Position;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class PositionController extends Controller
+{
+    public function index(Request $request): JsonResponse
+    {
+        $positions = Position::orderBy('sort')
+            ->paginate($request->input('page_size', 50));
+
+        return $this->paginate($positions);
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'name' => 'required|string|max:50',
+            'sort' => 'integer',
+        ]);
+
+        $data['store_id'] = auth()->user()->store_id;
+        $position = Position::create($data);
+        return $this->success($position, '创建成功');
+    }
+
+    public function update(Request $request, Position $position): JsonResponse
+    {
+        $data = $request->validate([
+            'name' => 'string|max:50',
+            'sort' => 'integer',
+        ]);
+
+        $position->update($data);
+        return $this->success($position, '更新成功');
+    }
+
+    public function destroy(Position $position): JsonResponse
+    {
+        $position->delete();
+        return $this->success(null, '删除成功');
+    }
+}
@@ -0,0 +1,98 @@
+<?php
+
+namespace App\Http\Controllers\Admin\System;
+
+use App\Http\Controllers\Controller;
+use App\Models\Role;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class RoleController extends Controller
+{
+    public function index(Request $request): JsonResponse
+    {
+        $query = Role::withCount('users');
+
+        if ($request->keyword) {
+            $query->where('name', 'like', "%{$request->keyword}%");
+        }
+
+        // 门店角色 + 全局角色
+        $user = auth()->user();
+        if (!$user->is_super) {
+            $query->where(function ($q) use ($user) {
+                $q->where('store_id', $user->store_id)
+                  ->orWhereNull('store_id');
+            });
+        }
+
+        $roles = $query->orderByDesc('id')
+            ->paginate($request->input('page_size', 20));
+
+        return $this->paginate($roles);
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'name' => 'required|string|max:50',
+            'code' => 'required|string|max:50|unique:roles,code',
+            'description' => 'nullable|string|max:255',
+        ]);
+
+        $user = auth()->user();
+        $data['store_id'] = $user->is_super ? null : $user->store_id;
+
+        $role = Role::create($data);
+        return $this->success($role, '创建成功');
+    }
+
+    public function show(Role $role): JsonResponse
+    {
+        $role->load('permissions');
+        return $this->success($role);
+    }
+
+    public function update(Request $request, Role $role): JsonResponse
+    {
+        if ($role->is_system) {
+            return $this->error('系统内置角色不可编辑');
+        }
+
+        $data = $request->validate([
+            'name' => 'string|max:50',
+            'description' => 'nullable|string|max:255',
+        ]);
+
+        $role->update($data);
+        return $this->success($role, '更新成功');
+    }
+
+    /**
+     * 分配权限
+     */
+    public function assignPermissions(Request $request, Role $role): JsonResponse
+    {
+        $request->validate([
+            'permission_ids' => 'required|array',
+            'permission_ids.*' => 'exists:permissions,id',
+        ]);
+
+        $role->permissions()->sync($request->permission_ids);
+        return $this->success(null, '权限分配成功');
+    }
+
+    public function destroy(Role $role): JsonResponse
+    {
+        if ($role->is_system) {
+            return $this->error('系统内置角色不可删除');
+        }
+        if ($role->users()->exists()) {
+            return $this->error('该角色下还有用户，无法删除');
+        }
+
+        $role->permissions()->detach();
+        $role->delete();
+        return $this->success(null, '删除成功');
+    }
+}
@@ -0,0 +1,73 @@
+<?php
+
+namespace App\Http\Controllers\Admin\System;
+
+use App\Http\Controllers\Controller;
+use App\Models\Store;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class StoreController extends Controller
+{
+    public function index(Request $request): JsonResponse
+    {
+        $query = Store::with('region');
+
+        if ($request->keyword) {
+            $query->where('name', 'like', "%{$request->keyword}%");
+        }
+        if ($request->has('status')) {
+            $query->where('status', $request->status);
+        }
+
+        $stores = $query->orderByDesc('id')
+            ->paginate($request->input('page_size', 20));
+
+        return $this->paginate($stores);
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'region_id' => 'required|exists:regions,id',
+            'name' => 'required|string|max:100',
+            'code' => 'nullable|string|max:20|unique:stores,code',
+            'address' => 'nullable|string|max:255',
+            'phone' => 'nullable|string|max:20',
+            'status' => 'in:0,1',
+        ]);
+
+        $store = Store::create($data);
+        return $this->success($store, '创建成功');
+    }
+
+    public function show(Store $store): JsonResponse
+    {
+        $store->load('region');
+        return $this->success($store);
+    }
+
+    public function update(Request $request, Store $store): JsonResponse
+    {
+        $data = $request->validate([
+            'region_id' => 'exists:regions,id',
+            'name' => 'string|max:100',
+            'code' => 'nullable|string|max:20|unique:stores,code,' . $store->id,
+            'address' => 'nullable|string|max:255',
+            'phone' => 'nullable|string|max:20',
+            'status' => 'in:0,1',
+        ]);
+
+        $store->update($data);
+        return $this->success($store, '更新成功');
+    }
+
+    public function destroy(Store $store): JsonResponse
+    {
+        if ($store->users()->exists()) {
+            return $this->error('该门店下还有员工，无法删除');
+        }
+        $store->delete();
+        return $this->success(null, '删除成功');
+    }
+}
@@ -0,0 +1,123 @@
+<?php
+
+namespace App\Http\Controllers\Admin\System;
+
+use App\Http\Controllers\Controller;
+use App\Models\User;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+
+class UserController extends Controller
+{
+    public function index(Request $request): JsonResponse
+    {
+        $query = User::with(['department', 'position', 'roles']);
+
+        if ($request->keyword) {
+            $query->where(function ($q) use ($request) {
+                $q->where('name', 'like', "%{$request->keyword}%")
+                  ->orWhere('phone', 'like', "%{$request->keyword}%")
+                  ->orWhere('username', 'like', "%{$request->keyword}%");
+            });
+        }
+        if ($request->department_id) {
+            $query->where('department_id', $request->department_id);
+        }
+        if ($request->has('status')) {
+            $query->where('status', $request->status);
+        }
+
+        $users = $query->orderByDesc('id')
+            ->paginate($request->input('page_size', 20));
+
+        return $this->paginate($users);
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'username' => 'required|string|max:50|unique:users,username',
+            'password' => 'required|string|min:6',
+            'name' => 'required|string|max:50',
+            'phone' => 'nullable|string|max:20',
+            'email' => 'nullable|email|max:100',
+            'department_id' => 'nullable|exists:departments,id',
+            'position_id' => 'nullable|exists:positions,id',
+            'status' => 'in:0,1,2',
+            'role_ids' => 'array',
+            'role_ids.*' => 'exists:roles,id',
+        ]);
+
+        $roleIds = $data['role_ids'] ?? [];
+        unset($data['role_ids']);
+
+        $data['store_id'] = auth()->user()->store_id;
+        $user = User::create($data);
+
+        if ($roleIds) {
+            $user->roles()->sync($roleIds);
+        }
+
+        return $this->success($user->load('roles'), '创建成功');
+    }
+
+    public function show(User $user): JsonResponse
+    {
+        $user->load(['department', 'position', 'roles']);
+        return $this->success($user);
+    }
+
+    public function update(Request $request, User $user): JsonResponse
+    {
+        $data = $request->validate([
+            'name' => 'string|max:50',
+            'phone' => 'nullable|string|max:20',
+            'email' => 'nullable|email|max:100',
+            'department_id' => 'nullable|exists:departments,id',
+            'position_id' => 'nullable|exists:positions,id',
+            'role_ids' => 'array',
+            'role_ids.*' => 'exists:roles,id',
+        ]);
+
+        $roleIds = $data['role_ids'] ?? null;
+        unset($data['role_ids']);
+
+        $user->update($data);
+
+        if ($roleIds !== null) {
+            $user->roles()->sync($roleIds);
+        }
+
+        return $this->success($user->load('roles'), '更新成功');
+    }
+
+    /**
+     * 更新状态
+     */
+    public function updateStatus(Request $request, User $user): JsonResponse
+    {
+        $request->validate(['status' => 'required|in:0,1,2']);
+        $user->update(['status' => $request->status]);
+        return $this->success(null, '状态更新成功');
+    }
+
+    /**
+     * 重置密码
+     */
+    public function resetPassword(Request $request, User $user): JsonResponse
+    {
+        $request->validate(['password' => 'required|string|min:6']);
+        $user->update(['password' => $request->password]);
+        return $this->success(null, '密码重置成功');
+    }
+
+    public function destroy(User $user): JsonResponse
+    {
+        if ($user->is_super) {
+            return $this->error('超级管理员不可删除');
+        }
+        $user->delete();
+        return $this->success(null, '删除成功');
+    }
+}
@@ -0,0 +1,47 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use Illuminate\Http\JsonResponse;
+
+abstract class Controller
+{
+    /**
+     * 成功响应
+     */
+    protected function success($data = null, string $message = 'success'): JsonResponse
+    {
+        return response()->json([
+            'code' => 0,
+            'message' => $message,
+            'data' => $data,
+        ]);
+    }
+
+    /**
+     * 分页响应
+     */
+    protected function paginate($paginator): JsonResponse
+    {
+        return response()->json([
+            'code' => 0,
+            'data' => [
+                'list' => $paginator->items(),
+                'total' => $paginator->total(),
+                'page' => $paginator->currentPage(),
+                'page_size' => $paginator->perPage(),
+            ],
+        ]);
+    }
+
+    /**
+     * 错误响应
+     */
+    protected function error(string $message, int $code = 40001, int $httpCode = 400): JsonResponse
+    {
+        return response()->json([
+            'code' => $code,
+            'message' => $message,
+        ], $httpCode);
+    }
+}
@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+
+/**
+ * 权限检查中间件
+ * 用法：Route::middleware('permission:crm.lead.create')
+ */
+class CheckPermission
+{
+    public function handle(Request $request, Closure $next, string ...$permissions)
+    {
+        $user = $request->user();
+
+        if (!$user) {
+            return response()->json(['code' => 40100, 'message' => '未认证'], 401);
+        }
+
+        // 超级管理员直接放行
+        if ($user->is_super) {
+            return $next($request);
+        }
+
+        // 检查权限
+        foreach ($permissions as $permission) {
+            if (!$user->hasPermission($permission)) {
+                return response()->json([
+                    'code' => 40300,
+                    'message' => '权限不足：' . $permission,
+                ], 403);
+            }
+        }
+
+        return $next($request);
+    }
+}
@@ -0,0 +1,86 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use App\Models\OperationLog as OperationLogModel;
+
+/**
+ * 操作日志中间件
+ * 自动记录写操作（POST/PUT/PATCH/DELETE）
+ */
+class OperationLog
+{
+    /**
+     * 不记录的路由
+     */
+    private array $except = [
+        'api/v1/auth/login',
+        'api/v1/auth/me',
+    ];
+
+    public function handle(Request $request, Closure $next)
+    {
+        $response = $next($request);
+
+        // 仅记录写操作
+        if (!in_array($request->method(), ['POST', 'PUT', 'PATCH', 'DELETE'])) {
+            return $response;
+        }
+
+        // 排除白名单
+        foreach ($this->except as $pattern) {
+            if ($request->is($pattern)) {
+                return $response;
+            }
+        }
+
+        $user = $request->user();
+        if (!$user) {
+            return $response;
+        }
+
+        try {
+            // 从 URL 推断模块和操作
+            $path = $request->path();
+            $module = $this->parseModule($path);
+            $action = $this->parseAction($request->method());
+
+            OperationLogModel::create([
+                'store_id' => $user->store_id,
+                'user_id' => $user->id,
+                'user_name' => $user->name,
+                'module' => $module,
+                'action' => $action,
+                'target' => $path,
+                'ip' => $request->ip(),
+                'method' => $request->method(),
+                'url' => $request->fullUrl(),
+                'created_at' => now(),
+            ]);
+        } catch (\Throwable $e) {
+            // 日志记录失败不影响业务
+            \Log::warning('操作日志记录失败: ' . $e->getMessage());
+        }
+
+        return $response;
+    }
+
+    private function parseModule(string $path): string
+    {
+        // api/v1/system/users → system
+        $segments = explode('/', $path);
+        return $segments[2] ?? 'unknown';
+    }
+
+    private function parseAction(string $method): string
+    {
+        return match ($method) {
+            'POST' => 'create',
+            'PUT', 'PATCH' => 'update',
+            'DELETE' => 'delete',
+            default => $method,
+        };
+    }
+}
@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+
+/**
+ * 门店隔离中间件
+ * 验证并设置当前用户的门店上下文
+ */
+class StoreIsolation
+{
+    public function handle(Request $request, Closure $next)
+    {
+        $user = $request->user();
+
+        if (!$user) {
+            return response()->json(['code' => 40100, 'message' => '未认证'], 401);
+        }
+
+        // 超级管理员可通过 Header 切换门店
+        if ($user->is_super && $request->header('X-Store-Id')) {
+            $storeId = (int) $request->header('X-Store-Id');
+            // 验证门店存在
+            if (!\App\Models\Store::where('id', $storeId)->exists()) {
+                return response()->json(['code' => 40400, 'message' => '门店不存在'], 404);
+            }
+        }
+
+        return $next($request);
+    }
+}