init

.gitattributes

@@ -0,0 +1,3 @@
+/dist export-ignore
+/.git export-ignore
+/.github export-ignore

.idea/.gitignore

@@ -0,0 +1,8 @@
+# 默认忽略的文件
+/shelf/
+/workspace.xml
+# 基于编辑器的 HTTP 客户端请求
+/httpRequests/
+# Datasource local storage ignored files
+/dataSources/
+/dataSources.local.xml

README.md

@@ -0,0 +1,122 @@
+# Dcat Employee Auth
+
+使用业务系统的 `employees` 表登录 dcat-admin，使用手机号和密码登录，并继续使用 dcat-admin 自带的角色与权限表。
+
+## 环境要求
+
+- PHP 8.1+
+- Laravel 9-12
+- dcat-admin 2.x
+- `employees` 表至少包含：
+  - `id`
+  - `employee_no`
+  - `email`
+  - `phone`
+  - `password`
+  - `name`
+  - `avatar`
+  - `status`
+  - `remember_token`
+
+## 安装
+
+```bash
+composer require returnee/dcat-employee-auth:^1.0
+php artisan vendor:publish --tag=dcat-employee-auth-config
+php artisan optimize:clear
+```
+
+如果扩展包位于项目本地目录：
+
+```json
+{
+    "repositories": [
+        {
+            "type": "path",
+            "url": "dcat-admin-extensions/dcat-employee-auth",
+            "options": {
+                "symlink": true
+            }
+        }
+    ]
+}
+```
+
+然后安装：
+
+```bash
+composer require returnee/dcat-employee-auth:^1.0
+```
+
+## 使用 ZIP 包安装
+
+将 `returnee-dcat-employee-auth-1.0.0.zip` 放入项目的 `packages` 目录，并配置：
+
+```json
+{
+    "repositories": [
+        {
+            "type": "artifact",
+            "url": "packages"
+        }
+    ]
+}
+```
+
+然后执行：
+
+```bash
+composer require returnee/dcat-employee-auth:^1.0
+```
+
+## 配置
+
+发布后的配置文件为 `config/dcat-employee-auth.php`。
+
+默认使用手机号登录：
+
+```php
+'login_columns' => [
+    'phone',
+],
+```
+
+只有 `status = 1` 的员工允许登录。
+
+## 授予后台管理员角色
+
+员工登录前，需要将员工ID关联到 dcat-admin 的角色表。可以执行：
+
+```bash
+php artisan dcat-employee-auth:grant-administrator E001
+```
+
+参数支持员工ID或手机号。
+
+扩展使用 dcat-admin 原有的 `admin_role_users` 表保存员工角色，`user_id` 对应 `employees.id`。
+
+## 自定义员工模型
+
+如需添加业务关系或修改访问器，可以继承扩展模型：
+
+```php
+namespace App\Models;
+
+use Returnee\DcatEmployeeAuth\Models\EmployeeAdministrator;
+
+class AdminEmployee extends EmployeeAdministrator
+{
+}
+```
+
+然后修改配置：
+
+```php
+'model' => App\Models\AdminEmployee::class,
+```
+
+## 禁用扩展
+
+```dotenv
+DCAT_EMPLOYEE_AUTH_ENABLED=false
+```

composer.json

@@ -0,0 +1,31 @@
+{
+    "name": "returnee/dcat-employee-auth",
+    "description": "Use an employees table as the authentication source for Dcat Admin.",
+    "type": "library",
+    "license": "MIT",
+    "authors": [
+        {
+            "name": "Returnee Team",
+            "email": "dev@returnee.com"
+        }
+    ],
+    "require": {
+        "php": ">=8.1",
+        "e282486518/dcat-admin": "2.*",
+        "laravel/framework": "^9.0|^10.0|^11.0|^12.0"
+    },
+    "autoload": {
+        "psr-4": {
+            "Returnee\\DcatEmployeeAuth\\": "src/"
+        }
+    },
+    "extra": {
+        "laravel": {
+            "providers": [
+                "Returnee\\DcatEmployeeAuth\\EmployeeAuthServiceProvider"
+            ]
+        }
+    },
+    "minimum-stability": "stable",
+    "prefer-stable": true
+}

config/dcat-employee-auth.php

@@ -0,0 +1,43 @@
+<?php
+
+use Returnee\DcatEmployeeAuth\Models\EmployeeAdministrator;
+
+return [
+    // 是否启用员工后台认证扩展。
+    'enabled' => env('DCAT_EMPLOYEE_AUTH_ENABLED', true),
+
+    // Dcat Admin 使用的认证守卫和用户提供者名称。
+    'guard' => env('DCAT_EMPLOYEE_AUTH_GUARD', 'admin'),
+    'provider' => env('DCAT_EMPLOYEE_AUTH_PROVIDER', 'admin'),
+
+    // 员工管理员模型、数据库连接及员工数据表。
+    'model' => EmployeeAdministrator::class,
+    'connection' => env('DCAT_EMPLOYEE_AUTH_CONNECTION'),
+    'table' => env('DCAT_EMPLOYEE_AUTH_TABLE', 'employees'),
+
+    // 登录表单字段、中文标签及允许用于登录的数据库字段。
+    'login_input' => 'account',
+    'login_label' => '手机号',
+    'login_columns' => [
+        'phone',
+    ],
+
+    // 项目员工表字段与扩展内部字段的映射关系。
+    'fields' => [
+        'employee_no' => 'employee_no',
+        'name' => 'name',
+        'avatar' => 'avatar',
+        'password' => 'password',
+        'status' => 'status',
+        'last_login_at' => 'last_login_at',
+        'last_login_ip' => 'last_login_ip',
+    ],
+
+    // 有效员工状态值；状态不匹配的员工无法登录。
+    'active_value' => 1,
+
+    // 登录页和密码输入限制。
+    'remember' => true,
+    'password_min_length' => 6,
+    'password_max_length' => 64,
+];

resources/views/login.blade.php

@@ -0,0 +1,144 @@
+<style>
+    .login-box {
+        margin-top: -10rem;
+        padding: 5px;
+    }
+    .login-card-body {
+        padding: 1.5rem 1.8rem 1.6rem;
+    }
+    .card, .card-body {
+        border-radius: .25rem
+    }
+    .login-btn {
+        padding-left: 2rem!important;
+        padding-right: 1.5rem!important;
+    }
+    .content {
+        overflow-x: hidden;
+    }
+    .form-group .control-label {
+        text-align: left;
+    }
+</style>
+
+@php
+    // 登录字段名称和显示标签均可由扩展配置覆盖。
+    $loginInput = config('dcat-employee-auth.login_input', 'account');
+    $loginLabel = config('dcat-employee-auth.login_label', '手机号');
+@endphp
+
+<div class="login-page bg-40">
+    <div class="login-box">
+        <div class="login-logo mb-2">
+            {{ config('admin.name') }}
+        </div>
+        <div class="card">
+            <div class="card-body login-card-body shadow-100">
+                <p class="login-box-msg mt-1 mb-1">{{ __('admin.welcome_back') }}</p>
+
+                <form id="login-form" method="POST" action="{{ admin_url('auth/login') }}">
+                    <input type="hidden" name="_token" value="{{ csrf_token() }}"/>
+
+                    <fieldset class="form-label-group form-group position-relative has-icon-left">
+                        <input
+                            id="{{ $loginInput }}"
+                            type="text"
+                            class="form-control {{ $errors->has($loginInput) ? 'is-invalid' : '' }}"
+                            name="{{ $loginInput }}"
+                            placeholder="{{ $loginLabel }}"
+                            value="{{ old($loginInput) }}"
+                            required
+                            autofocus
+                        >
+
+                        <div class="form-control-position">
+                            <i class="feather icon-user"></i>
+                        </div>
+
+                        <label for="{{ $loginInput }}">{{ $loginLabel }}</label>
+
+                        <div class="help-block with-errors"></div>
+                        @if($errors->has($loginInput))
+                            <span class="invalid-feedback text-danger" role="alert">
+                                @foreach($errors->get($loginInput) as $message)
+                                    <span class="control-label">
+                                        <i class="feather icon-x-circle"></i> {{ $message }}
+                                    </span><br>
+                                @endforeach
+                            </span>
+                        @endif
+                    </fieldset>
+
+                    <fieldset class="form-label-group form-group position-relative has-icon-left">
+                        <input
+                            minlength="{{ config('dcat-employee-auth.password_min_length', 6) }}"
+                            maxlength="{{ config('dcat-employee-auth.password_max_length', 64) }}"
+                            id="password"
+                            type="password"
+                            class="form-control {{ $errors->has('password') ? 'is-invalid' : '' }}"
+                            name="password"
+                            placeholder="{{ trans('admin.password') }}"
+                            required
+                            autocomplete="current-password"
+                        >
+
+                        <div class="form-control-position">
+                            <i class="feather icon-lock"></i>
+                        </div>
+                        <label for="password">{{ trans('admin.password') }}</label>
+
+                        <div class="help-block with-errors"></div>
+                        @if($errors->has('password'))
+                            <span class="invalid-feedback text-danger" role="alert">
+                                @foreach($errors->get('password') as $message)
+                                    <span class="control-label">
+                                        <i class="feather icon-x-circle"></i> {{ $message }}
+                                    </span><br>
+                                @endforeach
+                            </span>
+                        @endif
+                    </fieldset>
+
+                    <div class="form-group d-flex justify-content-between align-items-center">
+                        <div class="text-left">
+                            @if(config('admin.auth.remember'))
+                                <fieldset class="checkbox">
+                                    <div class="vs-checkbox-con vs-checkbox-primary">
+                                        <input
+                                            id="remember"
+                                            name="remember"
+                                            value="1"
+                                            type="checkbox"
+                                            {{ old('remember') ? 'checked' : '' }}
+                                        >
+                                        <span class="vs-checkbox">
+                                            <span class="vs-checkbox--check">
+                                                <i class="vs-icon feather icon-check"></i>
+                                            </span>
+                                        </span>
+                                        <span>{{ trans('admin.remember_me') }}</span>
+                                    </div>
+                                </fieldset>
+                            @endif
+                        </div>
+                    </div>
+
+                    <button type="submit" class="btn btn-primary float-right login-btn">
+                        {{ __('admin.login') }}
+                        &nbsp;
+                        <i class="feather icon-arrow-right"></i>
+                    </button>
+                </form>
+            </div>
+        </div>
+    </div>
+</div>
+
+<script>
+Dcat.ready(function () {
+    // 使用 Dcat 自带表单验证与 AJAX 登录处理。
+    $('#login-form').form({
+        validate: true,
+    });
+});
+</script>

src/Auth/EmployeeUserProvider.php

@@ -0,0 +1,71 @@
+<?php
+
+namespace Returnee\DcatEmployeeAuth\Auth;
+
+use Illuminate\Auth\EloquentUserProvider;
+use Illuminate\Contracts\Hashing\Hasher as HasherContract;
+
+/**
+ * 员工账号 Eloquent 用户提供者。
+ *
+ * 根据配置的登录字段查找员工，并自动过滤禁用或离职账号。
+ */
+class EmployeeUserProvider extends EloquentUserProvider
+{
+    public function __construct(
+        HasherContract $hasher,
+        string $model,
+        private readonly array $employeeConfig
+    ) {
+        parent::__construct($hasher, $model);
+    }
+
+    /**
+     * 根据登录凭证查询员工。
+     *
+     * 默认只允许使用手机号登录，也可通过 login_columns 配置其他字段。
+     */
+    public function retrieveByCredentials(#[\SensitiveParameter] array $credentials)
+    {
+        $input = $this->employeeConfig['login_input'] ?? 'account';
+        $account = $credentials[$input] ?? null;
+
+        if ($account === null || $account === '') {
+            return null;
+        }
+
+        $columns = array_values(array_filter(
+            $this->employeeConfig['login_columns'] ?? ['phone']
+        ));
+
+        if ($columns === []) {
+            return null;
+        }
+
+        return $this->newModelQuery()
+            ->where(function ($query) use ($account, $columns) {
+                // 多个登录字段之间使用 OR，例如手机号或邮箱。
+                foreach ($columns as $index => $column) {
+                    $method = $index === 0 ? 'where' : 'orWhere';
+                    $query->{$method}($column, $account);
+                }
+            })
+            ->first();
+    }
+
+    protected function newModelQuery($model = null)
+    {
+        $query = parent::newModelQuery($model);
+        $statusColumn = $this->employeeConfig['fields']['status'] ?? null;
+
+        if ($statusColumn) {
+            // 所有认证查询统一限制为有效员工，避免已禁用账号继续登录。
+            $query->where(
+                $statusColumn,
+                $this->employeeConfig['active_value'] ?? 1
+            );
+        }
+
+        return $query;
+    }
+}

src/Console/GrantAdministratorCommand.php

@@ -0,0 +1,58 @@
+<?php
+
+namespace Returnee\DcatEmployeeAuth\Console;
+
+use Dcat\Admin\Models\Role;
+use Illuminate\Console\Command;
+
+/**
+ * 为指定员工授予 Dcat Admin 超级管理员角色。
+ */
+class GrantAdministratorCommand extends Command
+{
+    protected $signature = 'dcat-employee-auth:grant-administrator
+                            {account : 员工ID或登录账号}';
+
+    protected $description = '为员工授予 Dcat Admin 超级管理员角色';
+
+    /**
+     * 根据员工 ID 或配置的登录字段查找员工并绑定 administrator 角色。
+     */
+    public function handle(): int
+    {
+        $model = config('dcat-employee-auth.model');
+        $account = $this->argument('account');
+        $columns = config('dcat-employee-auth.login_columns', []);
+
+        $employee = $model::query()
+            ->where(function ($query) use ($account, $columns) {
+                // 员工主键和所有可登录字段都可以作为命令参数。
+                $query->whereKey($account);
+
+                foreach ($columns as $column) {
+                    $query->orWhere($column, $account);
+                }
+            })
+            ->first();
+
+        if (! $employee) {
+            $this->error('未找到对应员工。');
+
+            return self::FAILURE;
+        }
+
+        $role = Role::query()->where('slug', Role::ADMINISTRATOR)->first();
+
+        if (! $role) {
+            $this->error('未找到 administrator 角色，请先安装 Dcat Admin 数据表。');
+
+            return self::FAILURE;
+        }
+
+        $employee->roles()->syncWithoutDetaching([$role->getKey()]);
+
+        $this->info("已为员工 {$employee->getKey()} 授予超级管理员角色。");
+
+        return self::SUCCESS;
+    }
+}

src/EmployeeAuthServiceProvider.php

@@ -0,0 +1,94 @@
+<?php
+
+namespace Returnee\DcatEmployeeAuth;
+
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\ServiceProvider;
+use Returnee\DcatEmployeeAuth\Auth\EmployeeUserProvider;
+use Returnee\DcatEmployeeAuth\Console\GrantAdministratorCommand;
+use Returnee\DcatEmployeeAuth\Http\Controllers\AuthController;
+
+/**
+ * 员工后台认证扩展服务提供者。
+ *
+ * 负责将 employees 表接入 Laravel Auth 与 Dcat Admin，并注册扩展配置、
+ * 登录视图和超级管理员授权命令。
+ */
+class EmployeeAuthServiceProvider extends ServiceProvider
+{
+    /**
+     * 合并扩展配置并替换 Dcat Admin 的认证实现。
+     */
+    public function register(): void
+    {
+        $this->mergeConfigFrom(
+            __DIR__.'/../config/dcat-employee-auth.php',
+            'dcat-employee-auth'
+        );
+
+        if (! config('dcat-employee-auth.enabled', true)) {
+            return;
+        }
+
+        $this->registerUserProvider();
+        $this->configureAuthentication();
+    }
+
+    /**
+     * 发布配置、加载视图并注册 Artisan 命令。
+     */
+    public function boot(): void
+    {
+        $this->publishes([
+            __DIR__.'/../config/dcat-employee-auth.php' => config_path('dcat-employee-auth.php'),
+        ], 'dcat-employee-auth-config');
+
+        $this->loadViewsFrom(__DIR__.'/../resources/views', 'dcat-employee-auth');
+
+        if ($this->app->runningInConsole()) {
+            $this->commands([
+                GrantAdministratorCommand::class,
+            ]);
+        }
+    }
+
+    private function registerUserProvider(): void
+    {
+        // 注册自定义用户提供者，让 Laravel 从员工表中查找登录账号。
+        Auth::provider('dcat_employee', function ($app, array $config) {
+            return new EmployeeUserProvider(
+                $app['hash'],
+                $config['model'],
+                config('dcat-employee-auth')
+            );
+        });
+    }
+
+    private function configureAuthentication(): void
+    {
+        $guard = config('dcat-employee-auth.guard', 'admin');
+        $provider = config('dcat-employee-auth.provider', 'admin');
+        $model = config('dcat-employee-auth.model');
+
+        $guardConfig = [
+            'driver' => 'session',
+            'provider' => $provider,
+        ];
+        $providerConfig = [
+            'driver' => 'dcat_employee',
+            'model' => $model,
+        ];
+
+        // 同时覆盖 Dcat 和 Laravel 的认证配置，保证中间件与 Admin::user() 使用同一员工模型。
+        config([
+            'admin.auth.controller' => AuthController::class,
+            'admin.auth.guard' => $guard,
+            "admin.auth.guards.{$guard}" => $guardConfig,
+            "admin.auth.providers.{$provider}" => $providerConfig,
+            'admin.auth.remember' => config('dcat-employee-auth.remember', true),
+            'admin.database.users_model' => $model,
+            "auth.guards.{$guard}" => $guardConfig,
+            "auth.providers.{$provider}" => $providerConfig,
+        ]);
+    }
+}

src/Http/Controllers/AuthController.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace Returnee\DcatEmployeeAuth\Http\Controllers;
+
+use Dcat\Admin\Http\Controllers\AuthController as BaseAuthController;
+use Illuminate\Http\Request;
+
+/**
+ * 员工后台登录控制器。
+ *
+ * 复用 Dcat 登录流程，仅替换登录视图、账号字段并记录最后登录信息。
+ */
+class AuthController extends BaseAuthController
+{
+    /** @var string 员工登录页面视图 */
+    protected $view = 'dcat-employee-auth::login';
+
+    /**
+     * 返回登录表单使用的账号字段名。
+     */
+    protected function username()
+    {
+        return config('dcat-employee-auth.login_input', 'account');
+    }
+
+    protected function sendLoginResponse(Request $request)
+    {
+        // 登录成功后先记录时间和 IP，再交由 Dcat 生成标准响应。
+        $this->updateLoginInformation($request);
+
+        return parent::sendLoginResponse($request);
+    }
+
+    private function updateLoginInformation(Request $request): void
+    {
+        $user = $this->guard()->user();
+
+        if (! $user) {
+            return;
+        }
+
+        $values = [];
+        $lastLoginAt = config('dcat-employee-auth.fields.last_login_at');
+        $lastLoginIp = config('dcat-employee-auth.fields.last_login_ip');
+
+        if ($lastLoginAt) {
+            $values[$lastLoginAt] = now();
+        }
+
+        if ($lastLoginIp) {
+            $values[$lastLoginIp] = $request->ip();
+        }
+
+        if ($values !== []) {
+            // 直接更新数据库，并同步刷新当前内存模型中的字段值。
+            $user->newQuery()->whereKey($user->getKey())->update($values);
+            $user->forceFill($values);
+        }
+    }
+}

src/Models/EmployeeAdministrator.php

@@ -0,0 +1,123 @@
+<?php
+
+namespace Returnee\DcatEmployeeAuth\Models;
+
+use Dcat\Admin\Models\Administrator;
+use Dcat\Admin\Support\Helper;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Facades\URL;
+
+/**
+ * Dcat Admin 员工管理员模型。
+ *
+ * 复用 Dcat Administrator 的角色和权限能力，但将认证数据源切换到 employees 表。
+ */
+class EmployeeAdministrator extends Administrator
+{
+    /**
+     * 设置员工模型使用的数据库连接和数据表。
+     */
+    protected function init()
+    {
+        $connection = config('dcat-employee-auth.connection')
+            ?: config('admin.database.connection')
+            ?: config('database.default');
+
+        $this->setConnection($connection);
+        $this->setTable(config('dcat-employee-auth.table', 'employees'));
+    }
+
+    public function getUsernameAttribute($value): mixed
+    {
+        // Dcat 内部使用 username，此处映射为员工工号。
+        $column = config('dcat-employee-auth.fields.employee_no', 'employee_no');
+
+        return $this->attributes[$column] ?? $value;
+    }
+
+    public function getNameAttribute($value): mixed
+    {
+        // 将 Dcat 展示名称映射到员工姓名字段。
+        $column = config('dcat-employee-auth.fields.name', 'name');
+
+        return $this->attributes[$column] ?? $value;
+    }
+
+    public function getAuthPasswordName(): string
+    {
+        // 支持项目自定义员工密码字段名。
+        return config('dcat-employee-auth.fields.password', 'password');
+    }
+
+    /**
+     * 获取员工头像地址，不存在时使用 Dcat 默认头像。
+     */
+    public function getAvatar()
+    {
+        $column = config('dcat-employee-auth.fields.avatar', 'avatar');
+        $avatar = $this->getAttribute($column);
+
+        if ($avatar) {
+            if (! URL::isValidUrl($avatar)) {
+                $avatar = Storage::disk(config('admin.upload.disk'))->url($avatar);
+            }
+
+            return $avatar;
+        }
+
+        return admin_asset(config('admin.default_avatar') ?: '@admin/images/default-avatar.jpg');
+    }
+
+    /**
+     * 判断当前员工是否可以看到指定菜单。
+     *
+     * 超级管理员始终可见；普通角色的父菜单只有在至少一个子菜单可访问时才显示，
+     * 避免出现没有任何可用功能的空目录。
+     */
+    public function canSeeMenu($menu): bool
+    {
+        if ($this->isAdministrator()) {
+            return true;
+        }
+
+        $children = Helper::array(data_get($menu, 'children', []));
+
+        if (! $children) {
+            return true;
+        }
+
+        foreach ($children as $child) {
+            if ($this->canAccessMenuItem($child) && $this->canSeeMenu($child)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private function canAccessMenuItem($menu): bool
+    {
+        // 菜单可以直接绑定角色，也可以通过权限节点间接授权。
+        $roles = collect(Helper::array(data_get($menu, 'roles', [])))
+            ->pluck('slug')
+            ->filter()
+            ->all();
+        $permissions = collect(Helper::array(data_get($menu, 'permissions', [])))
+            ->flatMap(fn ($permission) => [
+                data_get($permission, 'id'),
+                data_get($permission, 'slug'),
+            ])
+            ->filter()
+            ->all();
+        $permissionIds = Helper::array(data_get($menu, 'permission_id', []));
+
+        if (! $roles && ! $permissions && ! $permissionIds) {
+            // 未配置权限约束的菜单按 Dcat 默认行为允许显示。
+            return true;
+        }
+
+        return $this->visible($roles)
+            || collect(array_merge($permissions, $permissionIds))
+                ->contains(fn ($permission) => $this->can($permission));
+    }
+}