CodeIgniter 4 应用中的敏感数据保护与认证策略

<?php

namespace App\Controllers;

use App\Models\EmployeeModel; // 假设有一个员工模型用于验证
use CodeIgniter\Controller;

class LoginController extends Controller
{
    protected $session;

    public function __construct()
    {
        $this->session = \Config\Services::session();
    }

    public function authenticate()
    {
        // 实际应用中，这里会有用户凭据验证逻辑
        // 假设验证成功，获取到员工信息 $employee
        $employeeModel = new EmployeeModel();
        $employee = $employeeModel->find(1); // 示例：获取ID为1的员工

        if ($employee) {
            $session_data = [
                'id' => $employee->id,
                'name' => $employee->name,
                'email' => $employee->email,
                'isLoggedIn' => true, // 标记用户已登录
                'level' => $employee->level, // 用户权限级别
            ];

            $this->session->set($session_data); // 存储会话数据
            return redirect()->to('/dashboard'); // 重定向到仪表盘
        } else {
            // 登录失败处理
            return redirect()->back()->with('error', 'Invalid credentials.');
        }
    }

    public function logout()
    {
        $this->session->destroy(); // 销毁会话
        return redirect()->to('/login');
    }
}

<?php

namespace App\Filters;

use CodeIgniter\Filters\FilterInterface;
use CodeIgniter\HTTP\RequestInterface;
use CodeIgniter\HTTP\ResponseInterface;

class AuthGuard implements FilterInterface
{
    /**
     * 在请求到达控制器之前执行
     *
     * @param RequestInterface $request
     * @param array|null       $arguments
     *
     * @return ResponseInterface|void
     */
    public function before(RequestInterface $request, $arguments = null)
    {
        // 检查会话中是否存在 'isLoggedIn' 标志
        if (!session()->get('isLoggedIn')) {
            // 如果未登录，重定向到登录页面
            return redirect()->to('/login');
        }
        // 如果已登录，则继续处理请求
    }

    /**
     * 在控制器执行后、响应发送之前执行
     *
     * @param RequestInterface  $request
     * @param ResponseInterface $response
     * @param array|null        $arguments
     *
     * @return void
     */
    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
    {
        // 通常，认证守卫的after方法不需要做额外处理
    }
}

<?php

// ... 其他路由定义

// 保护单个路由
$routes->add('/list_customer', 'Customer::list_customer', ['filter' => 'authGuard']);

// 保护一组路由
$routes->group('/', ['filter' => 'authGuard'], function ($routes) {
    $routes->add('dashboard', 'Dashboard::index');
    $routes->add('edit_profile', 'User::editProfile');
    // 更多受保护的路由...
});

// ...

<?php

namespace App\Controllers;

use App\Models\CustomerModel;
use CodeIgniter\Controller;

class Customer extends Controller
{
    public function list_customer()
    {
       $customer_model = new CustomerModel();
       // 假设已登录用户被允许查看所有客户数据
       $data['all_customer'] = $customer_model->findAll(); // 这将显示所有客户数据
       return view('list_customer', $data);
    }
}

<?php

namespace Config;

use CodeIgniter\Config\BaseConfig;
use CodeIgniter\Filters\CSRF;
use CodeIgniter\Filters\DebugToolbar;
use CodeIgniter\Filters\Honeypot;
use CodeIgniter\Filters\InvalidChars;
use CodeIgniter\Filters\SecureHeaders;

class Filters extends BaseConfig
{
    /**
     * Configures aliases for Filter classes to
     * make them easier to apply to routes.
     *
     * @var array
     */
    public $aliases = [
        'csrf'          => CSRF::class,
        'toolbar'       => DebugToolbar::class,
        'honeypot'      => Honeypot::class,
        'invalidchars'  => InvalidChars::class,
        'secureheaders' => SecureHeaders::class,
        'authGuard'     => \App\Filters\AuthGuard::class, // 添加您的AuthGuard
    ];

    /**
     * List of filter aliases that are always
     * applied before and after every request.
     *
     * @var array
     */
    public $globals = [
        'before' => [
            // 'honeypot',
            // 'csrf',
            // 'invalidchars',
        ],
        'after' => [
            'toolbar',
            // 'honeypot',
            // 'secureheaders',
        ],
    ];

    /**
     * List of filter aliases that works on a
     * particular HTTP method (GET, POST, etc.).
     *
     * Example:
     * 'post' => ['csrf', 'throttle']
     *
     * @var array
     */
    public $methods = [];

    /**
     * List of filter aliases that should run on any
     * specific callback function.
     *
     * @var array
     */
    public $filters = [];
}

<?php

// app/Config/Routes.php

// ...

// 保护单个路由
$routes->add('/list_customer', 'Customer::list_customer', ['filter' => 'authGuard']);

// 保护一组路由
$routes->group('/', ['filter' => 'authGuard'], function ($routes) {
    $routes->add('dashboard', 'Dashboard::index');
    $routes->add('edit_profile', 'User::editProfile');
});

// ...