中间件添加对渠道对应app_id是否正确的判断

src/Middleware/CompanyAuth.php

@@ -27,6 +27,14 @@ class CompanyAuth
             $diff = time() - $timestamp;
             if ($diff < SysConsts::ONE_MINUTE_SECONDS * 60) {
                 $config = $service->findCompanyAuthConfig($params['app_id']);
+
+                // 检查channel_id所属appid
+                $channel_ids = $service->findCompanyChannelIds($config->company_id);    // 获取该公司下的所有渠道ID
+                $request_channel_id = $request->get('channel_id', '');
+                if ($request_channel_id && !in_array($request_channel_id, $channel_ids)) {
+                    return response()->error('CHANNEL_AUTH_INVALID');
+                }
+
                 if (isset($params['sign']) && strcasecmp(CommonHelper::sign($params, $config->app_secret), $params['sign']) == 0) {
                     $this->setGlobalConfig($config);
                     return $next($request);

src/Services/Config/ConfigService.php

@@ -43,4 +43,9 @@ class ConfigService
         }
         return explode(';', $ips);
     }
+
+    public function findCompanyChannelIds($company_id) {
+        $channel_user_ids = DB::connection('mysql')->table('channel_users')->where('company_id', $company_id)->pluck('id')->all();
+        return DB::connection('mysql')->table('distribution_channels')->whereIn('channel_user_id', $channel_user_ids)->pluck('id')->all();
+    }
 }