chatroom/bootstrap/app.php

<?php

use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;
use Illuminate\Http\Request;
use Illuminate\Session\TokenMismatchException;
use Symfony\Component\HttpKernel\Exception\HttpExceptionInterface;

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        commands: __DIR__.'/../routes/console.php',
        channels: __DIR__.'/../routes/channels.php',
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware) {
        $trustedProxies = array_values(array_filter(array_map(
            static fn (string $proxy): string => trim($proxy),
            explode(',', (string) env('TRUSTED_PROXIES', '127.0.0.1,::1'))
        )));

        // 强制解析并信任 CDN (如 Cloudflare) 透传的真实 IP (最高优先级)
        $middleware->prepend(\App\Http\Middleware\CloudflareProxies::class);

        // 仅信任显式配置的反向代理 / CDN 节点，避免外部客户端伪造转发头污染 request()->ip()。
        // 生产环境需要把实际代理 IP / CIDR 写入 TRUSTED_PROXIES。
        $middleware->trustProxies(at: empty($trustedProxies) ? null : $trustedProxies);

        $middleware->alias([
            'chat.auth' => \App\Http\Middleware\ChatAuthenticate::class,
            'chat.level' => \App\Http\Middleware\LevelRequired::class,
            'chat.site_owner' => \App\Http\Middleware\SiteOwnerRequired::class,
            'chat.has_position' => \App\Http\Middleware\HasActivePosition::class,
        ]);

        // 这一步是为了防止用户访问需要登录的页面时，默认被跳到原版 Laravel 未定义的 login 路由报错
        $middleware->redirectGuestsTo('/');
    })
    ->withExceptions(function (Exceptions $exceptions): void {
        $isChatAjaxRequest = static function (Request $request): bool {
            return $request->expectsJson() && $request->is(
                'room/*/send',
                'room/*/heartbeat',
                'room/*/leave',
                'room/*/announcement',
                'gift/*',
                'command/*',
                'chatbot/*',
                'shop/*'
            );
        };

        // 聊天室 AJAX 接口：CSRF token 过期（419）时，返回 JSON 提示而非重定向
        // 防止浏览器收到 302 后以 GET 方式重请求只允许 POST 的路由，产生 405 错误
        $exceptions->render(function (TokenMismatchException $e, Request $request) use ($isChatAjaxRequest) {
            if ($isChatAjaxRequest($request)) {
                return response()->json([
                    'status' => 'error',
                    'message' => '页面已过期，请刷新后重试。',
                ], 419);
            }
        });

        // Laravel 在某些环境下会先把 TokenMismatchException 包装成 419 HttpException，
        // 这里补一层兜底，确保聊天接口始终返回稳定的 JSON，而不是默认 HTML 错误页。
        $exceptions->render(function (HttpExceptionInterface $e, Request $request) use ($isChatAjaxRequest) {
            if ($e->getStatusCode() === 419 && $isChatAjaxRequest($request)) {
                return response()->json([
                    'status' => 'error',
                    'message' => '页面已过期，请刷新后重试。',
                ], 419);
            }
        });
    })->create();