OneBot: Leantime 改造版源码（BOM/Univer 表格/AI 接管/品牌替换等）

app/Core/Auth/Permissions/CheckPermissions.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace Leantime\Core\Auth\Permissions;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Enforces #[RequiresPermission] for native Laravel-routed controllers (Blueprints, the
+ * relocated image/upload controllers, etc.) — the controllers that do NOT go through
+ * Frontcontroller. Applied to all domain/plugin routes by {@see \Leantime\Core\Routing\RouteLoader}.
+ *
+ * Reads the attribute off the matched route's controller@method via the shared
+ * {@see PermissionEnforcer} (injected, not resolved through the app() helper), so the
+ * attribute remains the single source of truth — no per-route `can:` duplication. A method
+ * without the attribute is a no-op.
+ */
+class CheckPermissions
+{
+    public function __construct(private PermissionEnforcer $enforcer) {}
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        $route = $request->route();
+
+        if ($route instanceof \Illuminate\Routing\Route) {
+            $controller = $route->getControllerClass();
+            $method = $route->getActionMethod();
+
+            // Skip closure routes (no controller) and invokable/closure actions where the
+            // "method" resolves to the class name itself.
+            if (is_string($controller) && $controller !== '' && is_string($method) && $method !== $controller) {
+                $this->enforcer->enforce($controller, $method, $request->all());
+            }
+        }
+
+        return $next($request);
+    }
+}