CodeIgniter 4 应用程序中的敏感数据安全：认证过滤器与访问控制

// app/Filters/AuthGuard.php
<?php

namespace App\Filters;

use CodeIgniter\Filters\FilterInterface;
use CodeIgniter\HTTP\RequestInterface;
use CodeIgniter\HTTP\ResponseInterface;

class AuthGuard implements FilterInterface
{
    /**
     * 在控制器执行之前检查用户是否已登录。
     * 如果未登录，则重定向到登录页面。
     *
     * @param RequestInterface $request
     * @param array|null       $arguments
     * @return ResponseInterface|void
     */
    public function before(RequestInterface $request, $arguments = null)
    {
        // 检查会话中是否存在 'isLoggedIn' 标志
        if (!session()->get('isLoggedIn')) {
            // 用户未登录，重定向到登录页面
            return redirect()->to('/login');
        }
        // 如果已登录，继续执行请求
    }

    /**
     * 在控制器执行之后执行，通常用于日志记录或修改响应。
     * 对于认证过滤器，此方法通常留空。
     *
     * @param RequestInterface  $request
     * @param ResponseInterface $response
     * @param array|null        $arguments
     * @return void
     */
    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
    {
        // 此处通常无需操作
    }
}

// app/Controllers/LoginController.php (示例片段)
<?php

namespace App\Controllers;

use CodeIgniter\Controller;
use App\Models\EmployeeModel; // 假设有一个员工模型

class LoginController extends Controller
{
    protected $session;

    public function __construct()
    {
        $this->session = \Config\Services::session();
    }

    public function authenticate()
    {
        // ... 用户凭据验证逻辑 ...
        $employeeModel = new EmployeeModel();
        $employee = $employeeModel->where('email', $this->request->getPost('email'))
                                  ->first();

        if ($employee && password_verify($this->request->getPost('password'), $employee->password_hash)) {
            // 认证成功，设置会话数据
            $session_data = [
                'id' => $employee->id,
                'name' => $employee->name,
                'email' => $employee->email,
                'isLoggedIn' => true, // 关键标志
                'level' => $employee->level, // 可用于更细粒度的授权
            ];

            $this->session->set($session_data);
            return redirect()->to('/dashboard'); // 重定向到仪表盘
        } else {
            // 认证失败
            return redirect()->back()->withInput()->with('error', '无效的邮箱或密码。');
        }
    }
}

// app/Config/Filters.php
<?php

namespace Config;

use CodeIgniter\Config\BaseConfig;
use CodeIgniter\Filters\CSRF;
use CodeIgniter\Filters\DebugToolbar;
use CodeIgniter\Filters\Honeypot;
use CodeIgniter\Filters\InvalidChars;
use CodeIgniter\Filters\SecureHeaders;

class Filters extends BaseConfig
{
    // ... 其他配置 ...

    /**
     * List of alias to control filters.
     *
     * @var array<string, array<string, array<string, string>>>
     */
    public array $aliases = [
        'csrf'          => CSRF::class,
        'toolbar'       => DebugToolbar::class,
        'honeypot'      => Honeypot::class,
        'invalidchars'  => InvalidChars::class,
        'secureheaders' => SecureHeaders::class,
        'authGuard'     => \App\Filters\AuthGuard::class, // 添加您的认证过滤器别名
    ];

    // ... 其他配置 ...
}

// app/Config/Routes.php
<?php

use CodeIgniter\Router\RouteCollection;

/**
 * @var RouteCollection $routes
 */
$routes->get('/', 'Home::index');
$routes->get('/login', 'LoginController::index');
$routes->post('/login/authenticate', 'LoginController::authenticate');
$routes->get('/logout', 'LoginController::logout');

// 保护所有客户相关路由
$routes->group('/', ['filter' => 'authGuard'], function ($routes) {
    $routes->get('dashboard', 'Dashboard::index');
    $routes->get('list_customer', 'Customer::listCustomer');
    $routes->get('customer/(:num)', 'Customer::viewCustomer/$1');
    // ... 更多需要登录才能访问的路由 ...
});

// app/Config/Routes.php
$routes->get('/list_customer', 'Customer::listCustomer', ['filter' => 'authGuard']);

class Customer extends BaseController
{
    public function listCustomer()
    {
       $customer_model = new CustomerModel();
       $data['all_customer'] = $customer_model->findAll(); // <-- 这将显示所有客户数据。非常敏感的数据！
       return view('list_customer', $data);
    }
}