爪子的个人博客

// 连接数据库
function db(): PDO {
    static $pdo = null;
    if ($pdo === null) {
        $pdo = new PDO(
            "mysql:host=127.0.0.1;dbname=learnphp;charset=utf8mb4",
            "root", "password"
        );
    }
    return $pdo;
}

// 预处理语句防 SQL 注入
$stmt = db()->prepare("SELECT * FROM messages WHERE name LIKE ?");
$stmt->execute(["%$search%"]);
$messages = $stmt->fetchAll();

// 统一 JSON 响应
function jsonOut(int $code, string $message, $data = null, int $http = 200): void {
    http_response_code($http);
    echo json_encode([
        "code" => $code,
        "message" => $message,
        "data" => $data
    ]);
    exit;
}

// 获取 JSON 请求体
function inputJson(): array {
    return json_decode(file_get_contents("php://input"), true) ?? [];
}

function handleCORS(): void {
    header("Access-Control-Allow-Origin: *");
    header("Access-Control-Allow-Methods: GET, POST, DELETE, OPTIONS");
    header("Access-Control-Allow-Headers: Content-Type, Authorization");
    
    if ($_SERVER["REQUEST_METHOD"] === "OPTIONS") {
        http_response_code(204);
        exit;
    }
}

function requireAuth(): array {
    $header = $_SERVER["HTTP_AUTHORIZATION"] ?? "";
    if (!preg_match("/^Bearer\s+(.+)$/", $header, $m)) {
        jsonOut(1, "未登录", null, 401);
    }
    $token = $m[1];
    
    $stmt = db()->prepare(
        "SELECT id, username FROM users WHERE token = ? AND token_expires_at > NOW()"
    );
    $stmt->execute([$token]);
    $user = $stmt->fetch();
    if (!$user) {
        jsonOut(2, "token 无效或过期", null, 401);
    }
    return $user;
}

$hash = password_hash($password, PASSWORD_DEFAULT);  // 注册时
password_verify($password, $user["password_hash"]);   // 登录时验证

// 路由表（前端控制器）
$routes = [
    "messages" => [
        "GET"    => [$controller, "index"],
        "POST"   => [$controller, "store"],
        "DELETE" => [$controller, "destroy"],
    ],
];
($routes[$path][$method])();  // 分发

$messageModel = new Message(db());
$controller = new MessageController($messageModel);

$user = User::create([
    'username' => $validated['username'],
    'password' => $validated['password'],  // Model 自动哈希
]);
$token = $user->createToken('api')->plainTextToken;

if (!Auth::attempt($credentials)) {
    return ['message' => '用户名或密码错误'];
}
$token = $request->user()->createToken('api')->plainTextToken;

$request->user()->currentAccessToken()->delete();

$request->user()->tokens()->delete();

Route::middleware('auth:sanctum')->group(function () {
    Route::post('/messages', [MessageController::class, 'store']);
});

$request->user()->id

public function messages()
{
    return $this->hasMany(Message::class);
}

public function user()
{
    return $this->belongsTo(User::class);
}

// 不用预加载（N+1 问题）
$messages = Message::all();
foreach ($messages as $message) {
    $message->user;  // 每条留言都查一次用户
}

// 用预加载（只查 2 次）
$messages = Message::with('user')->get();

$validated['user_id'] = $request->user()->id;
$message = Message::create($validated);

public function handle(Request $request, Closure $next): Response
{
    $id = $request->query('id');
    $message = Message::find($id);
    
    if (!$message) {
        return response()->json(['code' => 404, 'msg' => '留言不存在'], 404);
    }
    
    if ($message->user_id !== $request->user()->id) {
        return response()->json(['code' => 403, 'msg' => '无权删除'], 403);
    }
    
    return $next($request);
}

// bootstrap/app.php
->withMiddleware(function (Middleware $middleware): void {
    $middleware->alias([
        'check-message-owner' => CheckMessageOwner::class,
    ]);
})

Route::delete('/messages', [MessageController::class, 'destroy'])
    ->middleware('check-message-owner');

public function toArray(Request $request): array
{
    return [
        'id' => $this->id,
        'username' => $this->username,
        // 只返回需要的字段，隐藏 email_verified_at、updated_at 等
    ];
}

public function toArray(Request $request): array
{
    return [
        'id' => $this->id,
        'name' => $this->name,
        'content' => $this->content,
        'created_at' => $this->created_at,
        'user' => new UserResource($this->user),  // 嵌套
    ];
}

return new MessageResource($message);

return MessageResource::collection($messages);

$messages = Message::latest()->with('user')->paginate($perPage);

return MessageResource::collection($messages)
    ->additional([
        'code' => 0,
        'msg' => 'ok',
    ]);

public function authorize(): bool
{
    return true;  // 允许请求
}

public function rules(): array
{
    return [
        'name' => 'required|max:20',
        'email' => 'nullable|email',
        'content' => 'required',
    ];
}

public function store(StoreMessageRequest $request)
{
    $validated = $request->validated();  // 获取已验证数据
    $validated['user_id'] = $request->user()->id;
    $message = Message::create($validated);
    // ...
}

// bootstrap/app.php
->withExceptions(function (Exceptions $exceptions): void {
    // ...
})

use Illuminate\Validation\ValidationException;

$exceptions->render(function (ValidationException $e, Request $request) {
    if ($request->is('api/*')) {
        return response()->json([
            'code' => 422,
            'msg' => $e->getMessage(),
            'errors' => $e->errors(),
        ], 422);
    }
});

use Illuminate\Auth\AuthenticationException;

$exceptions->render(function (AuthenticationException $e, Request $request) {
    if ($request->is('api/*')) {
        return response()->json([
            'code' => 401,
            'msg' => '无权限访问',
        ], 401);
    }
});

class User extends Authenticatable
{
    use HasFactory, Notifiable;
    // 缺少 HasApiTokens
}

use Laravel\Sanctum\HasApiTokens;

class User extends Authenticatable
{
    use HasApiTokens, HasFactory, Notifiable;
}

public function register(UserRequest $request)
{
    $user = User::create($validated);
    $token = $user->createToken('api-token')->plainTextToken;
    
    return response()->json([
        'code' => 0,
        'msg' => '注册成功',
        'data' => [
            'user' => new UserResource($user),
            'token' => $token,
        ],
    ]);
}

public function logout(Request $request)
{
    $request->user()->currentAccessToken()->delete();
    
    return response()->json([
        'code' => 0,
        'msg' => '登出成功',
    ]);
}

public function store(TaskRequest $request)
{
    // 验证通过后，通过 $request->validated() 获取验证后的数据
    $task = $request->user()->tasks()->create($request->validated());
    
    return response()->json([
        'code' => 0,
        'msg' => '创建成功',
        'data' => new TaskResource($task),
    ]);
}

class TaskResource extends JsonResource
{
    public function toArray($request): array
    {
        return [
            'id' => $this->id,
            'title' => $this->title,
            'description' => $this->description,
            'completed' => (bool) $this->completed,  // 强制转换布尔值
            'created_at' => $this->created_at->toIso8601String(),  // 统一时间格式
        ];
    }
}

return response()->json([
    'code' => 0,
    'msg' => '创建成功',
    'data' => new TaskResource($task),
]);

$tasks = auth()->user()->tasks()->paginate(5);

return TaskResource::collection($tasks)
    ->additional([
        'code' => 0,
        'msg' => '获取任务列表成功',
    ]);

// User.php
public function tasks()
{
    return $this->hasMany(Task::class);
}

// Task.php
public function user()
{
    return $this->belongsTo(User::class);
}

public function store(TaskRequest $request)
{
    $task = $request->user()->tasks()->create($request->validated());
    
    return response()->json([
        'code' => 0,
        'msg' => '创建成功',
        'data' => new TaskResource($task),
    ]);
}

public function index(Request $request)
{
    $perPage = $request->query('per_page', 5);
    $tasks = Task::where('user_id', $request->user()->id)
        ->latest()
        ->paginate($perPage);
    
    return TaskResource::collection($tasks)
        ->additional(['code' => 0, 'msg' => '获取任务列表成功']);
}

$tasks = $request->user()->tasks()->latest()->paginate($perPage);

use Laravel\Sanctum\HasApiTokens;

class User extends Authenticatable
{
    use HasApiTokens, HasFactory, Notifiable;
}

$tasks = Task::where('user_id', $request->user()->id)->paginate(5);

Task::where('user_id', 'like', $request->user()->id)

Task::where('user_id', $request->user()->id)

public function destroy(Request $request, string $id)
{
    $task = Task::find($id);
    
    // 先检查是否存在
    if (!$task) {
        return response()->json(['code' => 404, 'msg' => '任务不存在'], 404);
    }
    
    // 再检查权限
    if ($task->user_id != $request->user()->id) {
        return response()->json(['code' => 403, 'msg' => '无权操作'], 403);
    }
    
    $task->delete();
    
    return response()->json(['code' => 0, 'msg' => '删除成功']);
}