Laravel多角色路由授权异常：仅最后一个auth中间件组生效求助

需求与问题背景 #

开发支持「user」和「kurir」两个角色的登录程序，当前路由配置如下：

Route::group(['middleware' => 'auth:api','web'], function(){
    Route::get('user', 'Api\AuthController@user');
    Route::get('kurir', 'Api\AuthController@kurir');
    Route::get('droppoint', 'Api\DroppointController@index');
    Route::get('droppoint/{id}', 'Api\DroppointController@show');
    Route::post('droppoint', 'Api\DroppointController@store');
    Route::put('droppoint/{id}', 'Api\DroppointController@update');
    Route::delete('droppoint/{id}', 'Api\DroppointController@destroy');
});

Route::group(['middleware' => 'auth:kurirs-api','web'], function(){
    Route::get('user', 'Api\AuthController@user');
    Route::get('kurir', 'Api\AuthController@kurir');
    Route::get('droppoint', 'Api\DroppointController@index');
    Route::get('droppoint/{id}', 'Api\DroppointController@show');
    Route::post('droppoint', 'Api\DroppointController@store');
    Route::put('droppoint/{id}', 'Api\DroppointController@update');
    Route::delete('droppoint/{id}', 'Api\DroppointController@destroy');
});

当前问题：只有最后一个使用auth:kurirs-api中间件的路由组能正常授权，访问第一个auth:api路由组时提示未认证；调换两组顺序后则只有auth:api组生效，需要实现两个中间件组均能正常授权。

核心问题分析 #

1. 路由URI冲突：Laravel路由按定义顺序匹配，相同URI的路由只会触发第一个匹配到的规则，后续同URI路由会被忽略。
2. 中间件数组写法错误：原代码中['middleware' => 'auth:api','web']的写法不符合Laravel规范，web未被正确加入中间件列表，正确写法应为['middleware' => ['auth:api', 'web']]。

解决方案 #

方案1：使用多守卫认证中间件（推荐） #

将两个路由组合并，通过auth:api,kurirs-api指定多个认证守卫，Laravel会依次尝试每个守卫，只要其中一个认证通过即可访问路由：

Route::group(['middleware' => ['web', 'auth:api,kurirs-api']], function(){
    Route::get('user', 'Api\AuthController@user');
    Route::get('kurir', 'Api\AuthController@kurir');
    // 使用resource路由简化CRUD定义
    Route::resource('droppoint', 'Api\DroppointController');
});

方案2：为角色设置差异化路由前缀 #

如果需要区分角色的路由路径，可给不同角色的路由添加专属前缀，避免URI冲突：

// User角色专属路由
Route::group(['middleware' => ['web', 'auth:api'], 'prefix' => 'user'], function(){
    Route::get('profile', 'Api\AuthController@user');
    Route::resource('droppoint', 'Api\DroppointController');
});

// Kurir角色专属路由
Route::group(['middleware' => ['web', 'auth:kurirs-api'], 'prefix' => 'kurir'], function(){
    Route::get('profile', 'Api\AuthController@kurir');
    Route::resource('droppoint', 'Api\DroppointController');
});

方案3：自定义中间件实现灵活认证 #

若需要更复杂的角色认证逻辑，可自定义中间件手动处理多守卫认证：

1. 创建自定义中间件：

php artisan make:middleware AuthenticateAnyRole

2. 修改中间件逻辑（app/Http/Middleware/AuthenticateAnyRole.php）：

<?php

namespace App\Http\Middleware;

use Illuminate\Auth\Middleware\Authenticate as Middleware;

class AuthenticateAnyRole extends Middleware
{
    protected function authenticate($request, array $guards)
    {
        // 遍历所有守卫，只要有一个认证通过即生效
        foreach ($guards as $guard) {
            if ($this->auth->guard($guard)->check()) {
                $this->auth->shouldUse($guard);
                return;
            }
        }

        $this->unauthenticated($request, $guards);
    }
}

3. 在app/Http/Kernel.php中注册中间件：

protected $routeMiddleware = [
    // 其他中间件...
    'auth.any' => \App\Http\Middleware\AuthenticateAnyRole::class,
];

4. 使用自定义中间件：

Route::group(['middleware' => ['web', 'auth.any:api,kurirs-api']], function(){
    Route::get('user', 'Api\AuthController@user');
    Route::get('kurir', 'Api\AuthController@kurir');
    Route::resource('droppoint', 'Api\DroppointController');
});

内容的提问来源于stack exchange，提问作者Jumbo Mambo