[优化] 更新认证机制，使用 OPENFLARE_TOKEN 替代 Bearer Token

openflare_server/middleware/auth.go

@@ -1,49 +1,35 @@
 package middleware
 
 import (
-	"github.com/gin-contrib/sessions"
 	"github.com/gin-gonic/gin"
 	"net/http"
 	"openflare/common"
 	"openflare/model"
 )
 
+const OpenFlareTokenHeader = "OPENFLARE_TOKEN"
+
 func authHelper(c *gin.Context, minRole int) {
-	session := sessions.Default(c)
-	username := session.Get("username")
-	role := session.Get("role")
-	id := session.Get("id")
-	status := session.Get("status")
-	authByToken := false
-	if username == nil {
-		// Check token
-		token := c.Request.Header.Get("Authorization")
-		if token == "" {
-			c.JSON(http.StatusUnauthorized, gin.H{
-				"success": false,
-				"message": "无权进行此操作，未登录或 token 无效",
-			})
-			c.Abort()
-			return
-		}
-		user := model.ValidateUserToken(token)
-		if user != nil && user.Username != "" {
-			// Token is valid
-			username = user.Username
-			role = user.Role
-			id = user.Id
-			status = user.Status
-		} else {
-			c.JSON(http.StatusOK, gin.H{
-				"success": false,
-				"message": "无权进行此操作，token 无效",
-			})
-			c.Abort()
-			return
-		}
-		authByToken = true
+	token := c.GetHeader(OpenFlareTokenHeader)
+	if token == "" {
+		c.JSON(http.StatusUnauthorized, gin.H{
+			"success": false,
+			"message": "无权进行此操作，未登录或 token 无效",
+		})
+		c.Abort()
+		return
 	}
-	if status.(int) == common.UserStatusDisabled {
+
+	user := model.ValidateUserToken(token)
+	if user == nil || user.Username == "" {
+		c.JSON(http.StatusUnauthorized, gin.H{
+			"success": false,
+			"message": "无权进行此操作，token 无效",
+		})
+		c.Abort()
+		return
+	}
+	if user.Status == common.UserStatusDisabled {
 		c.JSON(http.StatusOK, gin.H{
 			"success": false,
 			"message": "用户已被封禁",
@@ -51,7 +37,7 @@ func authHelper(c *gin.Context, minRole int) {
 		c.Abort()
 		return
 	}
-	if role.(int) < minRole {
+	if user.Role < minRole {
 		c.JSON(http.StatusOK, gin.H{
 			"success": false,
 			"message": "无权进行此操作，权限不足",
@@ -59,10 +45,10 @@ func authHelper(c *gin.Context, minRole int) {
 		c.Abort()
 		return
 	}
-	c.Set("username", username)
-	c.Set("role", role)
-	c.Set("id", id)
-	c.Set("authByToken", authByToken)
+	c.Set("username", user.Username)
+	c.Set("role", user.Role)
+	c.Set("id", user.Id)
+	c.Set("authByToken", true)
 	c.Next()
 }
 
@@ -84,34 +70,16 @@ func RootAuth() func(c *gin.Context) {
 	}
 }
 
-// NoTokenAuth You should always use this after normal auth middlewares.
+// NoTokenAuth is kept as a compatibility no-op because admin APIs now always use OPENFLARE_TOKEN.
 func NoTokenAuth() func(c *gin.Context) {
 	return func(c *gin.Context) {
-		authByToken := c.GetBool("authByToken")
-		if authByToken {
-			c.JSON(http.StatusOK, gin.H{
-				"success": false,
-				"message": "本接口不支持使用 token 进行验证",
-			})
-			c.Abort()
-			return
-		}
 		c.Next()
 	}
 }
 
-// TokenOnlyAuth You should always use this after normal auth middlewares.
+// TokenOnlyAuth is kept as a compatibility no-op because admin APIs now always use OPENFLARE_TOKEN.
 func TokenOnlyAuth() func(c *gin.Context) {
 	return func(c *gin.Context) {
-		authByToken := c.GetBool("authByToken")
-		if !authByToken {
-			c.JSON(http.StatusOK, gin.H{
-				"success": false,
-				"message": "本接口仅支持使用 token 进行验证",
-			})
-			c.Abort()
-			return
-		}
 		c.Next()
 	}
 }

openflare_server/middleware/cors.go

@@ -11,7 +11,7 @@ import (
 func CORS() gin.HandlerFunc {
 	config := cors.DefaultConfig()
 	config.AllowCredentials = true
-	config.AllowHeaders = []string{"Origin", "Content-Length", "Content-Type", "Authorization", "X-Agent-Token", "Accept"}
+	config.AllowHeaders = []string{"Origin", "Content-Length", "Content-Type", "Authorization", "OPENFLARE_TOKEN", "X-Agent-Token", "Accept"}
 	config.AllowOriginFunc = func(origin string) bool {
 		serverAddr := strings.TrimRight(common.ServerAddress, "/")
 		if serverAddr == "" {