67 lines
2.2 KiB
TypeScript
67 lines
2.2 KiB
TypeScript
import { NextResponse, type NextRequest } from "next/server";
|
|
import { SESSION_COOKIE_NAME, getAuthRuntimeConfig, safeNextPath } from "@/lib/auth/config";
|
|
import { hasAdminAccess } from "@/lib/auth/permissions";
|
|
import { parseSessionCookieValue, readChunkedCookieValue } from "@/lib/auth/session";
|
|
|
|
export async function middleware(request: NextRequest) {
|
|
const config = getAuthRuntimeConfig();
|
|
if (!config.required) return NextResponse.next();
|
|
|
|
const pathname = request.nextUrl.pathname;
|
|
if (config.configured && config.sessionSecret) {
|
|
const session = await parseSessionCookieValue(
|
|
readChunkedCookieValue(SESSION_COOKIE_NAME, (name) => request.cookies.get(name)?.value),
|
|
config.sessionSecret
|
|
);
|
|
if (session) {
|
|
if (isAdminPath(pathname) && !hasAdminAccess(session.user)) {
|
|
if (pathname.startsWith("/api/")) {
|
|
return NextResponse.json({ error: "需要管理员权限。" }, { status: 403 });
|
|
}
|
|
return NextResponse.redirect(new URL("/create", request.url));
|
|
}
|
|
return NextResponse.next();
|
|
}
|
|
}
|
|
|
|
if (pathname.startsWith("/api/")) {
|
|
return NextResponse.json({
|
|
error: config.configured ? "请先登录。" : "认证配置不完整。"
|
|
}, { status: config.configured ? 401 : 503 });
|
|
}
|
|
|
|
const loginUrl = new URL("/auth/login", request.url);
|
|
loginUrl.searchParams.set("next", safeNextPath(`${pathname}${request.nextUrl.search}`));
|
|
if (!config.configured) loginUrl.searchParams.set("error", "auth_not_configured");
|
|
return NextResponse.redirect(loginUrl);
|
|
}
|
|
|
|
export const config = {
|
|
matcher: [
|
|
"/",
|
|
"/create/:path*",
|
|
"/assets/:path*",
|
|
"/logs/:path*",
|
|
"/settings/:path*",
|
|
"/accounts/:path*",
|
|
"/image-edit/:path*",
|
|
"/uploads/:path*",
|
|
"/generated-results/:path*",
|
|
"/api/assets/:path*",
|
|
"/api/generations/:path*",
|
|
"/api/logs/:path*",
|
|
"/api/prompt/:path*",
|
|
"/api/settings/:path*",
|
|
"/api/admin/:path*"
|
|
]
|
|
};
|
|
|
|
function isAdminPath(pathname: string): boolean {
|
|
return pathname.startsWith("/logs") ||
|
|
pathname.startsWith("/settings") ||
|
|
pathname.startsWith("/accounts") ||
|
|
pathname.startsWith("/api/logs") ||
|
|
pathname.startsWith("/api/settings") ||
|
|
pathname.startsWith("/api/admin");
|
|
}
|