OneBot: Leantime 改造版源码（BOM/Univer 表格/AI 接管/品牌替换等）

app/Core/Middleware/VerifyCsrfToken.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace Leantime\Core\Middleware;
+
+use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier;
+
+/**
+ * Verifies CSRF tokens on state-changing requests.
+ *
+ * Extends Laravel's built-in CSRF middleware. The token is read from
+ * the session and checked against the `_token` POST field or the
+ * `X-CSRF-TOKEN` header (used by HTMX via hx-headers on the body tag).
+ *
+ * Routes that use their own authentication (API keys, webhooks, cron)
+ * are excluded since they don't rely on browser sessions.
+ */
+class VerifyCsrfToken extends BaseVerifier
+{
+    /**
+     * Routes excluded from CSRF verification.
+     *
+     * API endpoints use API-key / Sanctum auth, not session cookies.
+     * Cron and webhook endpoints are server-to-server calls.
+     *
+     * @var array<int, string>
+     */
+    protected $except = [
+        'api/*',
+        'cron/*',
+        'webhook/*',
+        'install',
+        'install/*',
+    ];
+}