From bfe359d5a2cbc395b3bb2c98eb07d3fc86222641 Mon Sep 17 00:00:00 2001
From: sky121113 <sky121113@gmail.com>
Date: Fri, 17 Apr 2026 16:14:17 +0800
Subject: [PATCH] =?UTF-8?q?[FIX]=20=E7=A7=BB=E9=99=A4=20B014=20API=20?=
 =?UTF-8?q?=E7=9A=84=E5=BC=B7=E5=88=B6=E5=BA=A6=E4=BA=BA=E5=93=A1=E8=AA=8D?=
 =?UTF-8?q?=E8=AD=89=EF=BC=8C=E7=B0=A1=E5=8C=96=E6=A9=9F=E5=8F=B0=E6=8E=A5?=
 =?UTF-8?q?=E5=85=A5=E6=B5=81=E7=A8=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1. 修正 routes/api.php：移除 machine/setting/B014 的 auth:sanctum middleware。
2. 修正 MachineController.php：移除 getSettings 方法中的 RBAC 權限檢查邏輯，改為僅需驗證機台序號即可獲取設定。
---
 .../Api/V1/App/MachineController.php          | 24 ++-----------------
 routes/api.php                                |  4 ++--
 2 files changed, 4 insertions(+), 24 deletions(-)

diff --git a/app/Http/Controllers/Api/V1/App/MachineController.php b/app/Http/Controllers/Api/V1/App/MachineController.php
index 3d30a30..dc08833 100644
--- a/app/Http/Controllers/Api/V1/App/MachineController.php
+++ b/app/Http/Controllers/Api/V1/App/MachineController.php
@@ -577,13 +577,12 @@ class MachineController extends Controller
     }
 
     /**
-     * B014: Download Machine Settings & Config (Synchronous, Requires User Auth)
+     * B014: Download Machine Settings & Config (Synchronous)
      * 用於機台引導階段，同步金流、發票與機台專屬 API Token。
      */
     public function getSettings(Request $request)
     {
         $serialNo = $request->input('machine');
-        $user = $request->user();
 
         // 1. 查找機台 (忽略全局範圍以進行認領)
         $machine = Machine::withoutGlobalScopes()
@@ -599,26 +598,7 @@ class MachineController extends Controller
             ], 404);
         }
 
-        // 2. 權限加強驗證 (RBAC)
-        $isAuthorized = false;
-        if ($user->isSystemAdmin()) {
-            $isAuthorized = true;
-        } elseif ($machine->company_id === $user->company_id) {
-            // 公司管理員或已授權員工才能存取
-            if ($user->is_admin || $user->machines()->where('machine_id', $machine->id)->exists()) {
-                $isAuthorized = true;
-            }
-        }
-
-        if (!$isAuthorized) {
-            return response()->json([
-                'success' => false,
-                'code' => 403,
-                'message' => 'Forbidden: You do not have permission to configure this machine'
-            ], 403);
-        }
-
-        // 3. 獲取關聯設定
+        // 2. 獲取關聯設定 (依據使用者要求，跳過權限校驗，只要有序號即可獲取)
         $paymentSettings = $machine->paymentConfig->settings ?? [];
         $companySettings = $machine->company->settings ?? [];
 
diff --git a/routes/api.php b/routes/api.php
index ab5ee0b..1b26747 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -52,8 +52,8 @@ Route::prefix('v1')->middleware(['throttle:api'])->group(function () {
     Route::prefix('app')->group(function () {
         Route::post('admin/login/B000', [\App\Http\Controllers\Api\V1\App\MachineAuthController::class, 'loginB000'])->middleware('throttle:30,1');
         
-        // 機台啟動引導與參數下載 (需人員登入 Token)
-        Route::middleware('auth:sanctum')->get('machine/setting/B014', [App\Http\Controllers\Api\V1\App\MachineController::class, 'getSettings']);
+        // 機台啟動引導與參數下載 (已改為公開存取，僅需機台序號)
+        Route::get('machine/setting/B014', [App\Http\Controllers\Api\V1\App\MachineController::class, 'getSettings']);
     });
 
     Route::prefix('app')->middleware(['iot.auth', 'throttle:100,1'])->group(function () {