terrylee/star-cloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] 移除 B014 API 的強制度人員認證，簡化機台接入流程

Browse Source 
1. 修正 routes/api.php：移除 machine/setting/B014 的 auth:sanctum middleware。
2. 修正 MachineController.php：移除 getSettings 方法中的 RBAC 權限檢查邏輯，改為僅需驗證機台序號即可獲取設定。
This commit is contained in:
sky121113 2026-04-17 16:14:17 +08:00
parent bf43a33df3
commit bfe359d5a2
2 changed files with 4 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
app/Http/Controllers/Api/V1/App/MachineController.php
View File

@ -577,13 +577,12 @@ class MachineController extends Controller
}
/**
* B014: Download Machine Settings & Config (Synchronous, Requires User Auth)
* B014: Download Machine Settings & Config (Synchronous)
* 用於機台引導階段，同步金流、發票與機台專屬 API Token。
*/
public function getSettings(Request $request)
{
$serialNo = $request->input('machine');
$user = $request->user();
// 1. 查找機台 (忽略全局範圍以進行認領)
$machine = Machine::withoutGlobalScopes()
@ -599,26 +598,7 @@ class MachineController extends Controller
], 404);
}
// 2. 權限加強驗證 (RBAC)
$isAuthorized = false;
if ($user->isSystemAdmin()) {
$isAuthorized = true;
} elseif ($machine->company_id === $user->company_id) {
// 公司管理員或已授權員工才能存取
if ($user->is_admin || $user->machines()->where('machine_id', $machine->id)->exists()) {
$isAuthorized = true;
}
}
if (!$isAuthorized) {
return response()->json([
'success' => false,
'code' => 403,
'message' => 'Forbidden: You do not have permission to configure this machine'
], 403);
}
// 3. 獲取關聯設定
// 2. 獲取關聯設定 (依據使用者要求，跳過權限校驗，只要有序號即可獲取)
$paymentSettings = $machine->paymentConfig->settings ?? [];
$companySettings = $machine->company->settings ?? [];

4
routes/api.php
View File

@ -52,8 +52,8 @@ Route::prefix('v1')->middleware(['throttle:api'])->group(function () {
Route::prefix('app')->group(function () {
Route::post('admin/login/B000', [\App\Http\Controllers\Api\V1\App\MachineAuthController::class, 'loginB000'])->middleware('throttle:30,1');
// 機台啟動引導與參數下載 (需人員登入 Token)
Route::middleware('auth:sanctum')->get('machine/setting/B014', [App\Http\Controllers\Api\V1\App\MachineController::class, 'getSettings']);
// 機台啟動引導與參數下載 (已改為公開存取，僅需機台序號)
Route::get('machine/setting/B014', [App\Http\Controllers\Api\V1\App\MachineController::class, 'getSettings']);
});
Route::prefix('app')->middleware(['iot.auth', 'throttle:100,1'])->group(function () {