Laravelのカスタムミドルウェア作成と活用法：認証以外の横断処理を安全に差し込む

php artisan make:middleware EnsureApiKey

// app/Http/Middleware/EnsureApiKey.php
namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class EnsureApiKey
{
    public function handle(Request $request, Closure $next): Response
    {
        // ここでチェックして通す/止める
        return $next($request);
    }
}

// app/Http/Middleware/EnsureApiKey.php（例）
namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class EnsureApiKey
{
    public function handle(Request $request, Closure $next): Response
    {
        $provided = $request->header('X-API-KEY');               // エラー条件①：ヘッダ未設定でnull
        $expected = config('app.internal_api_key');              // エラー条件②：設定未投入でnull

        if (!$expected) {
            // 設定ミスは運用事故なので 500 に寄せて気づけるようにする
            return response()->json([
                'message' => 'Server misconfigured: API key not set.'
            ], 500);
        }

        if (!$provided || !hash_equals($expected, $provided)) {  // エラー条件③：不一致
            return response()->json([
                'message' => 'Unauthorized.'
            ], 401);
        }

        return $next($request);
    }
}

// routes/api.php（例）
use Illuminate\Support\Facades\Route;

Route::middleware(['ensure.api.key'])->group(function () {
    Route::get('/internal/health', fn () => ['ok' => true]);
    Route::post('/internal/sync', fn () => ['queued' => true]);
});

// handle の第3引数以降に引数を受けられる例
public function handle(Request $request, Closure $next, string $role): Response
{
    $user = $request->user();                 // エラー条件①：未ログインだとnull
    if (!$user) {
        return redirect()->route('login');    // もしくは 401
    }

    if ($user->role !== $role) {              // エラー条件②：権限不足
        abort(403);
    }

    return $next($request);
}

public function handle(Request $request, Closure $next): Response
{
    $start = microtime(true);

    $response = $next($request);

    $elapsedMs = (microtime(true) - $start) * 1000;

    $response->headers->set('X-Request-Id', (string) $request->header('X-Request-Id', uniqid()));
    $response->headers->set('X-Elapsed-Ms', (string) (int) $elapsedMs);

    logger()->info('request.done', [
        'path' => $request->path(),
        'elapsed_ms' => (int) $elapsedMs,
    ]);

    return $response;
}