15 lines
423 B
JavaScript
15 lines
423 B
JavaScript
|
/**
|
|||
|
|
* API 鉴权中间件 · BC-集成-005
|
|||
|
|
* 检查请求头 X-API-Key 是否匹配
|
|||
|
|
* 只保护 POST 写入接口，GET 查询不需要鉴权
|
|||
|
|
*/
|
|||
|
|
function apiAuth(req, res, next) {
|
|||
|
|
var apiKey = req.headers["x-api-key"];
|
|||
|
|
if (!apiKey || apiKey !== process.env.API_SECRET_KEY) {
|
|||
|
|
console.log("❌ 鉴权失败：", req.ip);
|
|||
|
|
return res.status(401).json({ error: "Unauthorized" });
|
|||
|
|
}
|
|||
|
|
next();
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
module.exports = apiAuth;
|