feat: MC Report System - MySQL + Express + Vanilla JS SPA

backend/middleware/auth.js

@@ -0,0 +1,37 @@
+const jwt = require('jsonwebtoken');
+const { getConfig } = require('../db');
+
+function getSecret() {
+  try {
+    const cfg = getConfig();
+    return cfg?.jwt_secret || process.env.JWT_SECRET || 'mc-dev-secret';
+  } catch { return process.env.JWT_SECRET || 'mc-dev-secret'; }
+}
+
+function generateToken(user) {
+  return jwt.sign({ id: user.id, username: user.username, role: user.role, game_name: user.game_name, game_uid: user.game_uid, email: user.email }, getSecret(), { expiresIn: '72h' });
+}
+
+function verifyToken(token) { return jwt.verify(token, getSecret()); }
+
+function authenticate(req, res, next) {
+  const h = req.headers.authorization;
+  if (!h || !h.startsWith('Bearer ')) return res.status(401).json({ error: '请先登录' });
+  try { req.user = verifyToken(h.split(' ')[1]); next(); } catch { return res.status(401).json({ error: '登录已过期' }); }
+}
+
+function requireRole(...roles) {
+  return (req, res, next) => {
+    if (!req.user) return res.status(401).json({ error: '请先登录' });
+    if (!roles.includes(req.user.role)) return res.status(403).json({ error: '权限不足' });
+    next();
+  };
+}
+
+function optionalAuth(req, res, next) {
+  const h = req.headers.authorization;
+  if (h && h.startsWith('Bearer ')) { try { req.user = verifyToken(h.split(' ')[1]); } catch {} }
+  next();
+}
+
+module.exports = { generateToken, verifyToken, authenticate, requireRole, optionalAuth };