Codeigniter3获取员工数据权限不足问题求助

问题背景 #

已通过EmployeeController成功获取Access Token，但调用/api/services/app/HR201EmployeesV2/GetAll接口时返回错误：

"Required permissions are not granted. At least one of these permissions must be granted: HR201 employees"

需求是将员工数据展示在employee_list.php视图中。

排查与解决步骤 #

1. 确认用户权限集合 #

先调用已实现的checkUserPermissions方法，访问http://你的域名/index.php/EmployeeController/checkUserPermissions，查看返回的权限列表是否包含HR201 employees。如果没有，需在后端权限管理系统给当前用户分配该权限。

2. 新增权限前置检查逻辑 #

在调用员工接口前先验证权限，避免无效请求；同时区分401（Token无效）和403（权限不足）的错误处理逻辑。

3. 优化认证后的跳转逻辑 #

认证成功后直接跳转到员工列表页面，提升用户体验。

修改后的EmployeeController.php代码 #

<?php
defined('BASEPATH') OR exit('No direct script access allowed');

class EmployeeController extends CI_Controller {

    public function __construct() {
        parent::__construct();
        $this->load->library('session');
    }

    public function authenticate() {
        $url = 'http://172.16.0.177:5101/api/TokenAuth/Authenticate';

        $data = json_encode(array(
            'userNameOrEmailAddress' => 'myusernamehere',
            'password' => 'mypasswordhere',
            'twoFactorVerificationCode' => '',
            'rememberClient' => true,
            'twoFactorRememberClientToken' => '',
            'singleSignIn' => true,
            'returnUrl' => '',
            'captchaResponse' => ''
        ));

        $curl = curl_init($url);
        curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($curl, CURLOPT_HTTPHEADER, array(
            'Content-Type: application/json',
            'Accept: application/json',
        ));
        curl_setopt($curl, CURLOPT_POST, true);
        curl_setopt($curl, CURLOPT_POSTFIELDS, $data);

        $response = curl_exec($curl);
        if (curl_errno($curl)) {
            echo 'cURL Error: ' . curl_error($curl);
            curl_close($curl);
            return;
        }
        curl_close($curl);

        $result = json_decode($response, true);

        if (isset($result['result']['accessToken'])) {
            $this->session->set_userdata('access_token', $result['result']['accessToken']);
            // 认证成功后跳转至员工列表页面
            redirect('EmployeeController/fetchEmployees');
        } else {
            echo "Authentication failed. Response: " . print_r($result, true);
        }
    }

    private function ensureAuthenticated() {
        if (!$this->session->userdata('access_token')) {
            $this->authenticate();
            exit; // 阻止后续代码执行
        }
    }

    // 检查是否拥有指定权限
    private function hasPermission($permissionName) {
        $accessToken = $this->session->userdata('access_token');
        $url = 'http://172.16.0.177:5101/api/services/app/Permission/GetAllPermissions';

        $curl = curl_init($url);
        curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($curl, CURLOPT_HTTPHEADER, array(
            'Content-Type: application/json',
            'Authorization: Bearer ' . $accessToken,
        ));

        $response = curl_exec($curl);
        if (curl_errno($curl)) {
            log_message('error', 'Permission check cURL error: ' . curl_error($curl));
            curl_close($curl);
            return false;
        }

        $httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
        curl_close($curl);

        if ($httpCode != 200) {
            log_message('error', 'Permission check failed with code: ' . $httpCode);
            return false;
        }

        $data = json_decode($response, true);
        if (!isset($data['result'])) {
            return false;
        }

        // 遍历权限列表检查是否包含目标权限
        foreach ($data['result'] as $permission) {
            if ($permission['name'] == $permissionName) {
                return true;
            }
        }
        return false;
    }

    public function fetchEmployees() {
        $this->ensureAuthenticated();
        $accessToken = $this->session->userdata('access_token');

        // 前置检查权限
        if (!$this->hasPermission('HR201 employees')) {
            echo '权限不足，请联系管理员分配"HR201 employees"权限';
            log_message('error', 'User lacks required permission: HR201 employees');
            return;
        }

        $url = 'http://172.16.0.177:5101/api/services/app/HR201EmployeesV2/GetAll';

        $curl = curl_init($url);
        curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($curl, CURLOPT_HTTPHEADER, array(
            'Content-Type: application/json',
            'Authorization: Bearer ' . $accessToken,
        ));

        $response = curl_exec($curl);
        if (curl_errno($curl)) {
            echo 'cURL Error: ' . curl_error($curl);
            curl_close($curl);
            return;
        }

        $httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
        curl_close($curl);

        $data = json_decode($response, true);

        if ($httpCode == 200 && isset($data['result'])) {
            $this->load->view('employee_list', ['employees' => $data['result']]);
        } else {
            switch ($httpCode) {
                case 401:
                    // Token无效，清除session并重新认证
                    $this->session->unset_userdata('access_token');
                    $this->authenticate();
                    break;
                case 403:
                    echo '权限不足，请联系管理员分配"HR201 employees"权限';
                    log_message('error', 'API returned 403: Insufficient permissions');
                    break;
                default:
                    log_message('error', 'Failed to fetch employees. Code: ' . $httpCode . ', Response: ' . print_r($data, true));
                    echo '获取员工数据失败，错误码：' . $httpCode;
            }
        }
    }

    public function checkUserPermissions() {
        $this->ensureAuthenticated();
        $accessToken = $this->session->userdata('access_token');
        $url = 'http://172.16.0.177:5101/api/services/app/Permission/GetAllPermissions';

        $curl = curl_init($url);
        curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($curl, CURLOPT_HTTPHEADER, array(
            'Content-Type: application/json',
            'Authorization: Bearer ' . $accessToken,
        ));

        $response = curl_exec($curl);
        if (curl_errno($curl)) {
            echo 'cURL Error: ' . curl_error($curl);
            curl_close($curl);
            return;
        }

        $httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
        curl_close($curl);

        $data = json_decode($response, true);

        if ($httpCode == 200 && isset($data['result'])) {
            echo "<pre>User Permissions:\n" . print_r($data['result'], true) . "</pre>";
        } else {
            if ($httpCode == 401) {
                $this->authenticate();
            } else {
                echo 'Failed to fetch user permissions. Response: ' . json_encode($data);
            }
        }
    }
    
}

内容的提问来源于stack exchange，提问作者Jonald Penpillo