Routing & Middleware

Annotation di atas method controller ({Namespace}\{Module}\Controller, wajib di-discover lewat glob app/Modules/*/Controller.php):

/**
 * @routeGroup("/user")
 * @middleware("SessionAuth")
 */
class Controller extends BaseController
{
    /**
     * @routeGet("/")
     * @routePost("/")   // bisa lebih dari satu method-annotation per action
     */
    public function indexAction() { ... }
}

• @route(["GET","POST"], "/path") — bentuk umum
• @route{METHOD}("/path") — shorthand (@routeGet, @routePost, @routePut, @routePatch, @routeDelete, dst — nama method HTTP apa saja setelah "route")
• @middleware("Nama", ...args) — bisa lebih dari satu per class/method (semuanya diterapkan, bukan cuma yang pertama)
• Resolusi nama middleware: exact FQCN → App\Middleware\{Nama} → App\Middlewares\{Nama} → Core\Middleware\{Nama} (middleware bawaan package ini). App-level custom middleware dengan nama sama selalu menang.
• Middleware global didaftarkan di app/config/config.php → 'middlewares' (array nama class, dieksekusi di semua route).

Katalog middleware bawaan

Middleware	Fungsi	Config
Csrf	Tolak POST/PUT/PATCH/DELETE tanpa token CSRF valid (form field atau header X-CSRF-TOKEN)	—
RateLimit	Batasi request per IP per action, counter di dataCache	args: (maxAttempts=60, decayMinutes=1)
Cors	Jawab preflight OPTIONS, tambah header Access-Control-Allow-*	app/config/cors.php: allowedOrigins, allowedMethods, allowedHeaders, allowCredentials, maxAge
TrustProxy	Terjemahkan X-Forwarded-* ke REMOTE_ADDR/HTTPS — hanya kalau peer ada di whitelist CIDR	app/config/trustproxy.php: proxies (array CIDR/IP)
SessionAuth	Guard session-based login, redirect ke halaman login / 401 JSON	app/config/auth.php: modelClass, loginUrl
IamAuth	Guard token Ed25519 IAM server internal (Core\Iam\Sdk)	app/config/iam.php: publicKey, baseUrl, appId
CasdoorAuth	Guard JWT Casdoor (aurora-sso) via JWKS	app/config/casdoor.php: issuer, audience, jwksUrl, algorithms, cacheTtl
OAuth2Auth	Guard JWT generik OAuth2/OIDC (multi-provider: Keycloak/Auth0/Google/dst) via JWKS + OIDC discovery	app/config/oauth2.php: default, providers.{key}.{issuer,clientId,audience,algorithms,cacheTtl,jwksUri?} — args: (provider = null)

Kernel::boot() sudah otomatis memanggil TrustProxy::beforeExecute() sekali di awal (lihat Getting started), jadi REMOTE_ADDR/HTTPS sudah benar untuk middleware/controller lain begitu request masuk — tidak perlu didaftarkan lagi di 'middlewares' global. Baris registrasi di bawah cuma relevan untuk app yang sengaja mau menjalankannya ulang di titik lain (harmless, jadi no-op kalau REMOTE_ADDR sudah bukan alamat proxy lagi):

'middlewares' => [
    \Core\Middleware\TrustProxy::class,
    \Core\Middleware\RateLimit::class,
],