授权判断

backend/components/v1/authorizationFilter.php

@@ -6,7 +6,8 @@ use Yii;
 use yii\base\ActionFilter;
 use yii\helpers\StringHelper;
 use app\models\v1\rbacuser\ShopRbacUser;
-use yii\web\HttpException;
+use yii\web\ForbiddenHttpException;
+use yii\web\UnauthorizedHttpException;
 class authorizationFilter extends ActionFilter
 {
     public $optional;
@@ -16,21 +17,24 @@ class authorizationFilter extends ActionFilter
         if ($this->isOptional($action)) {
             return true;
         }
-        $userGuid = Yii::$app->user->identity->GUID;
-        $url = Yii::$app->request->pathInfo;
-        $shopRbacUser = ShopRbacUser::find()
-        ->from('shop_rbac_user sru')
-        ->select('sru.GUID')
-        ->leftJoin('shop_rbac_role_user srru', 'srru.USER_ID = sru.GUID')
-        ->leftJoin('shop_rbac_role_access srra', 'srra.ROLE_ID = srru.ROLE_ID')
-        ->leftJoin('shop_rbac_node srn', 'srn.ID = srra.NODE_ID')
-        ->where(['srn.NAME' => $url])
-        ->andWhere(['sru.GUID' => $userGuid])
-        ->all();
-        if (!empty($shopRbacUser)) {
-            return true;
+        if (isset(Yii::$app->user->identity->GUID)) {
+            $userGuid = Yii::$app->user->identity->GUID;
+            $url = Yii::$app->request->pathInfo;
+            $shopRbacUser = ShopRbacUser::find()
+            ->from('shop_rbac_user sru')
+            ->select('sru.GUID')
+            ->leftJoin('shop_rbac_role_user srru', 'srru.USER_ID = sru.GUID')
+            ->leftJoin('shop_rbac_role_access srra', 'srra.ROLE_ID = srru.ROLE_ID')
+            ->leftJoin('shop_rbac_node srn', 'srn.ID = srra.NODE_ID')
+            ->where(['srn.NAME' => $url])
+            ->andWhere(['sru.GUID' => $userGuid])
+            ->all();
+            if (!empty($shopRbacUser)) {
+                return true;
+            }
+            throw new ForbiddenHttpException('没有权限访问此接口');
         }
-        throw new HttpException('403','没有权限访问此接口');
+        throw new UnauthorizedHttpException();
     }
     /**
      * Checks, whether authentication is optional for the given action.