From 39234a0f4d6094e60ad49d7ed2cff94243fd4fb7 Mon Sep 17 00:00:00 2001
From: li <ljf@com>
Date: Sat, 14 Mar 2026 17:58:26 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20custom=20Authenticate=20middleware=20ret?=
 =?UTF-8?q?urns=20null=20redirectTo=20=E2=80=94=20prevents=20Route[login]?=
 =?UTF-8?q?=20not=20defined=20500?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/app/Http/Middleware/Authenticate.php | 18 ++++++++++++++++++
 backend/bootstrap/app.php                    |  5 +++--
 2 files changed, 21 insertions(+), 2 deletions(-)
 create mode 100644 backend/app/Http/Middleware/Authenticate.php

diff --git a/backend/app/Http/Middleware/Authenticate.php b/backend/app/Http/Middleware/Authenticate.php
new file mode 100644
index 0000000..fce1f24
--- /dev/null
+++ b/backend/app/Http/Middleware/Authenticate.php
@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Auth\Middleware\Authenticate as Middleware;
+use Illuminate\Http\Request;
+
+class Authenticate extends Middleware
+{
+    /**
+     * API-only project — never redirect, always return null so Laravel
+     * responds with a 401 JSON response instead of looking for a "login" route.
+     */
+    protected function redirectTo(Request $request): ?string
+    {
+        return null;
+    }
+}
diff --git a/backend/bootstrap/app.php b/backend/bootstrap/app.php
index 30d5b54..97de047 100644
--- a/backend/bootstrap/app.php
+++ b/backend/bootstrap/app.php
@@ -14,9 +14,10 @@ return Application::configure(basePath: dirname(__DIR__))
     )
     ->withMiddleware(function (Middleware $middleware): void {
         $middleware->alias([
-            'store' => \App\Http\Middleware\StoreIsolation::class,
+            'auth'       => \App\Http\Middleware\Authenticate::class,
+            'store'      => \App\Http\Middleware\StoreIsolation::class,
             'permission' => \App\Http\Middleware\CheckPermission::class,
-            'oplog' => \App\Http\Middleware\OperationLog::class,
+            'oplog'      => \App\Http\Middleware\OperationLog::class,
         ]);
 
         // Removed statefulApi() — app uses Bearer token auth, not cookie SPA auth