feat: 完善鉴权

server/utils/api-auth-rules.ts

@@ -0,0 +1,46 @@
+// server/utils/api-auth-rules.ts - API 鉴权路由规则表：声明公开路由，其余默认需要登录
+
+type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS";
+
+type ApiRouteRule = {
+  path: string | RegExp;
+  method?: HttpMethod | HttpMethod[];
+};
+
+/**
+ * 公开 API 路由规则表
+ *
+ * 新增接口默认需要登录，无需任何改动；
+ * 只有明确需要公开访问的路由才加到这里。
+ */
+export const publicApiRoutes: ApiRouteRule[] = [
+  // Better Auth 自己的登录、注册、退出、get-session 等接口必须放行
+  { path: "/api/auth/**" },
+  // 服务健康检查，供部署平台和 Docker healthcheck 使用，不含敏感信息
+  { method: "GET", path: "/api/health" },
+  // OCS 油猴脚本跨域无法携带 cookie，搜索接口有自己的双通道鉴权（session 或 apiToken）
+  { path: "/api/search" }
+];
+
+/** 路径匹配：支持精确匹配、`/**` 前缀通配和 RegExp */
+function matchPath(rulePath: string | RegExp, pathname: string): boolean {
+  if (rulePath instanceof RegExp) return rulePath.test(pathname);
+  if (rulePath.endsWith("/**")) {
+    const prefix = rulePath.slice(0, -3);
+    return pathname === prefix || pathname.startsWith(`${prefix}/`);
+  }
+  return pathname === rulePath;
+}
+
+/** 判断当前请求是否命中公开路由规则 */
+export function isPublicApiRoute(pathname: string, method: string): boolean {
+  return publicApiRoutes.some((rule) => {
+    const methods = Array.isArray(rule.method)
+      ? rule.method
+      : rule.method
+        ? [rule.method]
+        : null;
+    const methodMatched = !methods || methods.includes(method as HttpMethod);
+    return methodMatched && matchPath(rule.path, pathname);
+  });
+}