备份：修复前完整项目快照 2026-04-19

backend/middleware/auth.js

@@ -0,0 +1,81 @@
+const jwt = require('jsonwebtoken');
+const { hashPassword, verifyPassword, verifyToken } = require('../utils/auth');
+
+const JWT_SECRET = process.env.JWT_SECRET || 'your-jwt-secret-change-in-production';
+
+const generateToken = (user) => {
+  const payload = {
+    id: user.id,
+    username: user.username,
+    role: user.role
+  };
+  
+  return jwt.sign(payload, JWT_SECRET, { expiresIn: '24h' });
+};
+
+const authenticate = (req, res, next) => {
+  const token = req.headers.authorization?.replace('Bearer ', '');
+  
+  if (!token) {
+    return res.status(401).json({ success: false, message: '未提供认证令牌' });
+  }
+  
+  const decoded = verifyToken(token);
+  
+  if (!decoded) {
+    return res.status(401).json({ success: false, message: '无效的认证令牌' });
+  }
+  
+  req.user = decoded;
+  next();
+};
+
+const optionalAuth = (req, res, next) => {
+  const token = req.headers.authorization?.replace('Bearer ', '');
+  
+  if (!token) {
+    req.user = null;
+    next();
+    return;
+  }
+  
+  const decoded = verifyToken(token);
+  
+  if (!decoded) {
+    req.user = null;
+    next();
+    return;
+  }
+  
+  req.user = decoded;
+  next();
+};
+
+const requireRole = (roles) => {
+  return (req, res, next) => {
+    if (!req.user) {
+      return res.status(401).json({ success: false, message: '未授权' });
+    }
+    
+    if (!roles.includes(req.user.role)) {
+      return res.status(403).json({ success: false, message: '权限不足' });
+    }
+    
+    next();
+  };
+};
+
+const requireAdmin = (req, res, next) => {
+  return requireRole(['admin'])(req, res, next);
+};
+
+module.exports = {
+  authenticate,
+  optionalAuth,
+  requireRole,
+  requireAdmin,
+  generateToken,
+  verifyToken,
+  hashPassword,
+  verifyPassword
+};