[优化] Phase2

openflare_server/middleware/relay-auth.go

@@ -0,0 +1,34 @@
+package middleware
+
+import (
+	"github.com/gin-gonic/gin"
+	"net/http"
+	"openflare/service"
+)
+
+// RelayAuth authenticates Relay requests using the shared agent token,
+// and verifies the node is a tunnel_relay type.
+func RelayAuth() func(c *gin.Context) {
+	return func(c *gin.Context) {
+		token := c.GetHeader("X-Agent-Token")
+		node, err := service.AuthenticateAgentToken(token)
+		if err != nil {
+			c.JSON(http.StatusUnauthorized, gin.H{
+				"success": false,
+				"message": "无权进行此操作，Agent Token 无效",
+			})
+			c.Abort()
+			return
+		}
+		if node.NodeType != "tunnel_relay" {
+			c.JSON(http.StatusForbidden, gin.H{
+				"success": false,
+				"message": "此节点不是 TunnelRelay 类型",
+			})
+			c.Abort()
+			return
+		}
+		c.Set("relay_node", node)
+		c.Next()
+	}
+}

openflare_server/middleware/tunnel-auth.go

@@ -0,0 +1,25 @@
+package middleware
+
+import (
+	"github.com/gin-gonic/gin"
+	"net/http"
+	"openflare/service"
+)
+
+// TunnelAuth authenticates OpenFlared client requests using X-Tunnel-Token.
+func TunnelAuth() func(c *gin.Context) {
+	return func(c *gin.Context) {
+		token := c.GetHeader("X-Tunnel-Token")
+		tunnel, err := service.AuthenticateTunnelToken(token)
+		if err != nil {
+			c.JSON(http.StatusUnauthorized, gin.H{
+				"success": false,
+				"message": "无权进行此操作，Tunnel Token 无效",
+			})
+			c.Abort()
+			return
+		}
+		c.Set("tunnel", tunnel)
+		c.Next()
+	}
+}