feat: 完善鉴权

server/api/records.get.ts

@@ -1,7 +1,6 @@
 // server/api/records.get.ts - 用户问答记录接口，供 Nuxt Dashboard 表格展示
-import { getQuery, setResponseStatus } from "h3";
+import { getQuery } from "h3";
 
-import { getAuthSession } from "~~/server/utils/auth";
 import { createApiLogger } from "~~/server/utils/logging";
 import { getQaRecords } from "~~/server/utils/runtimeState";
 
@@ -9,27 +8,13 @@ import { getQaRecords } from "~~/server/utils/runtimeState";
  * 用户问答记录接口（分页，最新在前）
  *
  * 安全边界：
- * - 必须携带有效 session cookie（登录用户）
+ * - 必须携带有效 session cookie（由 api-auth middleware 统一鉴权）
  * - 只返回当前登录用户自己的记录，用 userId 严格隔离
  * - 不包含 OpenAI 响应体、API Key 或内部错误
  */
 export default defineEventHandler(async (event) => {
   const logger = createApiLogger(event, "api.records");
 
-  const session = await getAuthSession(event);
-  if (!session) {
-    setResponseStatus(event, 401);
-    logger.warn("unauthorized");
-    return {
-      success: false,
-      message: "未登录",
-      records: [],
-      page: 1,
-      size: 10,
-      total: 0
-    };
-  }
-
   const query = getQuery(event);
   const rawPage = Number.parseInt(query.page?.toString() || "1", 10);
   const rawSize = Number.parseInt(query.size?.toString() || "10", 10);
@@ -38,7 +23,7 @@ export default defineEventHandler(async (event) => {
     : 10;
   const page = Number.isFinite(rawPage) ? Math.max(rawPage, 1) : 1;
 
-  const { records, total } = await getQaRecords(session.user.id, {
+  const { records, total } = await getQaRecords(event.context.auth!.user.id, {
     page,
     size
   });