Laravel 권한 기능에 대한 보안 전략: 권한 남용 및 우회를 방지하는 방법

public function update(Request $request, $id)
{
    $user = User::find($id);

    if (!$user->hasPermission('edit_user')) {
        abort(403, '你没有权限修改用户信息。');
    }

    // 判断该用户是否需要审批
    if ($user->needApproval()) {
        // 如果需要审批，则需要审批人进行审核通过后才能修改用户
        $approver = $user->approver;

        if (!$approver->hasPermission('approve_user')) {
            abort(403, '你没有权限审批用户信息修改请求。');
        }

        $user->name = $request->name;
        $user->email = $request->email;
        $user->save();

        return redirect()->route('users.show', $user->id)->with('success', '用户信息修改成功！');
    }

    // 如果不需要审批，则直接修改用户
    $user->name = $request->name;
    $user->email = $request->email;
    $user->save();

    return redirect()->route('users.show', $user->id)->with('success', '用户信息修改成功！');
}

protected $middlewareGroups = [
    'web' => [
        AppHttpMiddlewareEncryptCookies::class,
        IlluminateCookieMiddlewareAddQueuedCookiesToResponse::class,
        IlluminateSessionMiddlewareStartSession::class,
        // 加入ThrottleRequests中间件
        IlluminateRoutingMiddlewareThrottleRequests::class,
        IlluminateContractsAuthMiddlewareAuthenticate::class,
        IlluminateRoutingMiddlewareSubstituteBindings::class,
    ],

    'api' => [
        'throttle:60,1',
        'auth:api',
    ],
];

class MyModel extends Model
{
    // 只查询被授权的数据
    public function scopeAuthorized($query)
    {
        // 获取当前用户的权限数组
        $permissions = auth()->user()->permissions->pluck('name')->toArray();

        // 过滤只保留当前用户有权限的数据
        return $query->whereIn('permission', $permissions);
    }
}

public function __construct()
{
    $this->middleware('auth');
}