im/plugin/admin/app/middleware/AccessControl.php

<?php

namespace plugin\admin\app\middleware;

use plugin\admin\api\Auth;
use ReflectionException;
use support\exception\BusinessException;
use Webman\Http\Request;
use Webman\Http\Response;
use Webman\MiddlewareInterface;

class AccessControl implements MiddlewareInterface
{
    /**
     * @param Request $request
     * @param callable $handler
     * @return Response
     * @throws ReflectionException|BusinessException
     */
    public function process(Request $request, callable $handler): Response
    {
        $controller = $request->controller;
        $action = $request->action;
        $request->controller_name = get_controller_name();
        $request->action_name = get_action_name();

        $code = 0;
        $msg = '';
        if (!Auth::canAccess($controller, $action, $code, $msg)) {
            if ($request->expectsJson()) {
                $response = json(['code' => $code, 'msg' => $msg, 'data' => []]);
            } else {
                if ($code === 401) {
                    $response = response('<script>    if (self !== top) {        parent.location = "'.admin_path().'";    }</script>',401);
                    //$response = response('',301, ['Location'=> admin_path().'/index/index']);
                } else {
                    $request->app = '';
                    $request->plugin = 'admin';
                    $response = view('common/403')->withStatus(403);
                }
            }
            return $response;
        }
        return $handler($request);
    }
}